Blog

fork COW RSS vs spawn: Python Multiprocessing Lab

Hands-on fork COW vs multiprocessing spawn lab: PSS/Private_Dirty after fork and page dirtying, plus spawn start latency. Real numbers on the lab box.

1 Oct 20266 min read

orjson vs json in Python: How Much Faster Is orjson?

Hands-on Python json vs orjson vs msgpack lab: encode/decode MB/s on records, nested, and unicode payloads. Real p50 numbers measured on localhost box.

1 Oct 20267 min read

nice / ionice Lab: CPU Nice 19 Slowdown and Idle-Class Disk

Hands-on nice/ionice lab: victim nice19 under 6 hogs ~5.7× slower (p95 ~7.4s); ionice idle O_DIRECT read ~6.1× under writers. Real numbers, no Docker.

1 Oct 20266 min read

TCP_QUICKACK Lab: Delayed ACK, Set-Once, and the Reassert Trap

Hands-on TCP_QUICKACK lab: default QA=1 on loopback; WWR set-once ~18 µs; reassert QA=1 under Nagle p95 ~48 ms, OutSegs ~13×. Real numbers, no Docker.

1 Oct 20267 min read

mmap vs read (+ O_DIRECT): Localhost Sequential Scan Lab

Hands-on mmap vs buffered read lab: 256 MiB p50 11.5 vs 5.4 GB/s; O_DIRECT ~0.9 GB/s warm-cache bypass. Fake endpoint-only GB/s disclosed. No Docker.

30 Sept 20265 min read

HTTP Keep-Alive vs Connection: close: Localhost Numbers and a Simulated-RTT Trap

30 Sept 20267 min read

Clozure AI Business OS Review: Pricing, Claims, and Fit

30 Sept 202610 min read

Nginx limit_req Rate-Limit Lab: Burst, nodelay, and the return Pitfall

Hands-on nginx 1.26 limit_req on localhost: 5r/s burst=10 nodelay yields 11/200 OK then 429s; return bypasses limiting; paced 5r/s stays green. Real numbers, no Docker.

30 Sept 20267 min read

Lily in CI: Trying Fuzz-Based Backdoor Detection on a Real Repo

Hands-on Lily (ASE 2026) on an owned C toy: rosa/lily 0.6.0 pin, directed catch of a localhost-bind trigger, clean refactor with zero flags, discovery miss, and CI cost math.

30 Sept 20268 min read

SBOM Signing in CI: How to Sign and Attest With Cosign

One CI shape: build an image by digest, Syft SBOM, Cosign sign + SBOM attest, verify success, and prove wrong-key/unsigned failure — the operational follow-on to after-xz.

29 Sept 20269 min read

Supply Chain Security Checklist for Small Teams After xz

Turn the xz-utils backdoor lesson into action: tarball vs git diffs, SBOM, Sigstore Cosign, SLSA provenance, and a solo/small-team release gate you can run this week.

29 Sept 202610 min read

OpenTelemetry Collector + Prometheus + Grafana: A First Stack That Actually Diagnoses

A first OTel Collector, Prometheus, and Grafana lab: OTLP in, Prometheus scrape out, and a break-one-signal drill with measured PromQL.

29 Sept 202610 min read