Uncategorized

  • A stampede lock, and what the losers should do

    An expensive cached value expires under load and every concurrent request misses simultaneously, so forty workers run the same four-second query at once. What the losers do is…

  • A Symfony service that is lazy, and when that matters

    A service injected into a controller is constructed on every request that hits it, including the requests that never call it — and for an expensive constructor that…

  • An idempotency key, and where the response is stored

    A client that times out and retries has sent the same request twice, and the server cannot tell whether the first one succeeded. Storing the response rather than…

  • nginx and the resolver that stapling needs

    OCSP stapling saves the client a round trip to the certificate authority, and the configuration is completely inert without one extra line that nothing warns about. nginx needs…

  • MariaDB 10.5 and the InnoDB that is no longer XtraDB

    10.5 in June replaced XtraDB with upstream InnoDB, which is a change to the storage engine that most upgrade notes describe as an implementation detail. Removed variables in…

  • Timeouts bound one request; only a cap bounds concurrency

    Setting a thirty-second timeout feels responsible and does nothing about the number of workers waiting simultaneously, which is what actually takes a site down. Dropping the timeout from…

  • Lazy loading arrived in the browser

    One attribute replaces an IntersectionObserver and a library — and applying it to everything makes the Largest Contentful Paint worse rather than better.

  • RESP3, and the client library that has to agree

    6.0 introduced a new protocol with typed replies, and the client opts in with HELLO 3 — so the server supporting it changes nothing until the library does.…

  • Redis 6 and the shared password that was everywhere

    One password, six services, and FLUSHALL available to all of them. 6.0 landed in April with users — and the keyspace pattern is where the isolation actually is.

  • Redis 6 ACLs, and the user per service

    Redis had one password and no users, so every service that could read the cache could also flush it — and the credential was the same string in…