posts
- All four drives at once, and why that was the good news
Every HDD on the storage box vanished at once — a quadruple drive death, it looked like. It was two mundane faults stacked together, and the data was fine.
- Native Image Grew to 734 MB
Five things the benchmark taught me that the documentation didn't mention.
- 2492, 2495, 2508
Three frameworks, byte-identical DAOs, and the benchmark that collapsed to a rounding error.
- Eight Connections, Zero Available
Two reactive frameworks hit the same 60 rps wall. The pool said all 8 connections were busy. Postgres said they were idle.
- It wasn't CGNAT. It was a one-digit typo.
The typo was found early, fixed, and dismissed as irrelevant — then I killed the poller that would have disproved my CGNAT diagnosis.
- Transmission is a remote-code-execution box by default
Transmission runs a script of the RPC caller's choosing when a torrent finishes. Seccomp can't block that exec; a systemd sandbox can make it worthless.
- AllowedIPs is not access control
A per-friend WireGuard kit scoped each peer with AllowedIPs, which is a route on the friend's own device. The real scope is a forward-chain drop on the router.
- The iPhone camera wanted to Google my private key
Adding WireGuard to a MikroTik: the hairpin test that fails for no reason, and the iPhone Camera app offering to web-search a private key.
- The router had been running fine, which was the problem
A read-only audit of a hAP ac3 that had run fine for years: a 6.x bootloader, plaintext services on, NTP off, and admin reachable from anywhere.
- 16,700 Classes Before Your First Request
Quarkus JVM OOMs at 256 MB while Micronaut and Spring Boot fit. Not heap. Not a leak. It's 86 MB of metaspace that never shrinks.