GET IN TOUCH:
LATEST FROM MY BLOG
DORA's four key metrics quietly became five in 2024, and one of them moved out of the category everyone still puts it in. A practical guide to what changed, why recovery time is now a throughput measure, how to compute each metric from your own Git and deployment data, and the ways these numbers break the moment they become someone's performance target.
Four algorithms, one race condition, and the header everyone gets wrong. What RFC 6585 actually says about 429, and why X-RateLimit-* is not the standard you think it is.
Idempotency is not a header you add. It is a property your storage layer either has or doesn't. What RFC 9110 actually says, how Stripe's model works, and the race condition that breaks most implementations.
Keycloak is Apache 2.0 with no paid tier. authentik is open core — MIT plus a proprietary enterprise directory. That licensing difference matters more than any feature table, and SCIM coverage is not equal either.
Kubernetes now enforces policy in-process: ValidatingAdmissionPolicy went stable in 1.30, MutatingAdmissionPolicy in 1.36. So the real question is no longer OPA or Kyverno — it's what you still need a controller for.
Installing Falco takes ten minutes. Making it useful takes months. A practical guide to runtime security that survives contact with production — rule maturity, tuning out noise, and what to actually alert on.
"We encrypted everything" does not take a system out of PCI DSS scope, and tokenization does not take you out of GDPR. A practical guide to what each one actually buys you — and where teams get it wrong.
Your prompt is fine. Your agent still loses the plot. Context engineering treats the context window as a finite budget — here's what goes in it, why bigger windows don't fix it, and the three techniques that do.
A 70B model needs 140 GB of VRAM at full precision — until you quantize it. A practical guide to GGUF, K-quants, Q4 vs Q8, what quality you actually lose, and exactly how much VRAM you need.
"SQL vs NoSQL" is the wrong first question. A practical 2026 guide to database types, what relational really means, ACID vs BASE, and a decision framework to choose by your access patterns — not by hype.
An MCP server is how you give an AI agent real capabilities — safely. A practical 2026 guide: what the protocol actually is, how to build a server, what breaks in production, and the security rules you cannot skip.
Domain-Driven Design is not a folder structure or a bag of patterns. It's a way to align software with the business. A practical 2026 guide: strategic vs tactical DDD, bounded contexts, aggregates, when it's worth it, and how to start — no jargon.
Neither a monolith nor microservices is 'modern' or 'legacy'. Each trades one kind of complexity for another. An honest 2026 guide: the real trade-offs, where each wins, the anti-patterns, and a decision framework — no dogma.
A backup is a copy of your data. Disaster recovery is getting the whole service running again — infra, network, DNS and all. Confusing the two is a multi-hour outage waiting to happen. RTO vs RPO, the four DR strategies, and why an untested plan is the real failure.
An SBOM is an inventory, not a defense. Generating one would not have stopped Log4Shell. What would: continuous CVE correlation, signed provenance, and VEX to kill the noise. A practical supply-chain security guide for 2026.
