Four nginx defaults that quietly cost you
Soft 404s, add_header inheritance, ten-year cache headers on unversioned files, and a gzip_types line that is commented out in the shipped config. All four were live on this very domain.
Bitware Labs/Notebook
The Notebook
Working notes, written while the work is still fresh. Mostly infrastructure, security and long-running AI — the unglamorous middle of the job, which is where the interesting parts live.
All entries
§ 6 filed
Sending mail from PHP-FPM when AppArmor says no
The contact form on this site does not call mail(). It speaks SMTP to loopback by hand, because the php-fpm AppArmor profile will not exec sendmail — and that turned out to be the better design.
Why bwmem sleeps: consolidation in long-running agents
An agent that only appends is an agent that eventually drowns. Consolidation is the part everyone skips, and it is the part that decides whether the thing still works in month six.
A WireGuard mesh you can actually reason about
Ten peers, one address plan, no overlay control plane. What we run, what we deliberately left out, and the two mistakes that cost us an afternoon each.
Ranking fourteen polymers from what you can actually observe
Why Plastic Fantastic scores candidates instead of walking a decision tree, how the evidence is weighted, and why it will name PVC without ever asking you to set it on fire.
Why WordPress is not permitted on our machines
Not snobbery. A hosting policy is a security boundary, and the plugin model puts the boundary in the wrong place — on the other side of code we did not write and cannot audit.