Cargo Log — Field Notes

Blog

Practitioner notes from 13+ years of shipping software — logistics platforms, e-commerce, AI agents, and the self-hosted infrastructure underneath. English and Bahasa Indonesia.

06 Nov 2026 5 min read

Four Decades of Defensive Workarounds, One OpenSSH Bypass

On Alpine hosts without PAM, any password of 257 to 1024 characters opens accounts that were supposed to be locked. Six reasonable fixes across 46 years built that hole.
opensshsecuritymuslalpineai-agents
ID
05 Nov 2026 5 min read

Zig's libc Rewrite Made SQLite 12,000x Slower. Your Tests Wouldn't Catch It

A cross-compiled Rust service lost 12,000x on SQLite inserts because Zig's libc rewrite walked the whole string inside every strchr call. Local tests passed on macOS.
rustzigsqliteperformancecompilers
ID
04 Nov 2026 5 min read

What a Failed C++26 Ballot Says About Shipping to an Ecosystem

C++26's draft standard was reported disapproved in its ISO ballot over contracts. The useful question is what separates a feature that passes every internal gate from one an ecosystem can safely depend on.
cppsoftware-engineeringstandardssystems-designrelease-engineering
ID
03 Nov 2026 5 min read

The 46-vCPU Pod Trap: What PostHog Learned by Leaving DuckDB

PostHog ran DuckDB as a multi-tenant warehouse for five months, then scrapped it. The lesson is about where a single-node engine stops being a bargain.
duckdbarchitecturedatabasesposthogdevops
ID
02 Nov 2026 7 min read

PostgreSQL 19 Is Late Because Finding Bugs Got Cheap

PostgreSQL 19 slid to November 19 and lost three features late in beta. The cause is not worse code. Naming a defect got cheap while verifying one stayed human work.
postgresqlai-engineeringsoftware-reliabilityopen-sourcedatabase-internals
ID
01 Nov 2026 6 min read

Why Go 1.24's Default MPTCP Exposed Linux Hosts to CVE-2026-98432

Go 1.24 enabled Multipath TCP by default on Linux listeners, turning a subtle kernel Use-After-Free flaw into a remote root risk across unpatched servers.
linuxnetworkingsecuritygolangsysadmin
ID
31 Oct 2026 5 min read

Backdooring Claude Code on Cursor: Why IDE Extensions Must Be Sandboxed

An 11-hour breach of Cursor's marketplace proxy injected a reverse SSH backdoor into Claude Code. Developer tools cannot safely share an unsandboxed runtime with workstation credentials.
securityai-agentsdeveloper-toolingsupply-chain
ID
30 Oct 2026 5 min read

Martin Fowler on LLM Voice: Why Senior Engineers Refuse AI Drafts

Martin Fowler warned that LLM drafts trap writers in an uncanny valley you cannot edit out. Here is why the fix is architectural separation, not abandoning AI tools.
ai toolingsoftware engineeringtechnical writingllmsdeveloper experience
ID
29 Oct 2026 5 min read

Why Claude Code Burned 20% of API Requests on Status Lines

An OpenTelemetry audit revealed Claude Code spent nearly 20% of its API requests generating three-word terminal status lines. Polling frontier models for UI progress is an architectural leak every agent harness must fix.
ai agentsclaude codeprompt engineeringdeveloper toolssoftware architecture
ID
28 Oct 2026 5 min read

Why Python's JIT Failed: What Backend Engineers Actually Do for Performance

CPython is removing its experimental copy-and-patch JIT ahead of Python 3.16. Here is why the compiler dream collapsed and what production teams actually do instead.
pythoncompilersperformancebackendarchitecture
ID
27 Oct 2026 6 min read

A 14-Year-Old Bug in PHP Just Shattered Pre-Auth Security for 70% of the Web

A flaw in PHP's own request parser, present since 2012, hands unauthenticated attackers code execution on default configs. PHP runs roughly 70% of the web.
securityphpdevopsvulnerabilitysoftware-engineering
ID
26 Oct 2026 6 min read

Agent Skills Are Environment Notes, Not Prompt Tricks

The "skills are worthless" argument is aimed at prompt folklore. What runs on a 19-profile agent fleet is closer to operational code, and it carries a real context bill.
ai-agentsskillscontext-engineeringsupply-chainagent-fleet
ID
25 Oct 2026 5 min read

The Distributed SQLite Paradox: You Pay for Consensus, Then Queue Behind One Writer

Raft-replicated SQLite buys you failover and charges you milliseconds per write. Most production apps need WAL streaming to S3, not a cluster.
sqlitedistributed-systemsdatabasesdevopsarchitecture
ID
24 Oct 2026 6 min read

Inside NVIDIA OpenShell: SMT Provers and Credential Proxies for Agent Fleets

OpenShell hides credentials behind a mediated proxy and gates policy changes with a Z3 solver. The sandbox is the easy half to copy. The per-sandbox model is the half that bites.
ai-agentssandboxingrustsecuritydevops
ID
23 Oct 2026 5 min read

Railway's Breach Was a Database. Your Env Vars Are Still the Wrong Vault.

Railway's October 2026 breach exposed decrypted environment variables from a secrets database. The storage plane was the target, but the habit of storing credentials in env vars made the blast radius huge.
devopssecuritylinuxself-hostingcloud
ID
21 Oct 2026 6 min read

Cloudflare Ported TypeScript to Rust for Wasm, Not for Speed

Cloudflare's tsrs is up to 8x faster than TypeScript 7.0 with ~70% less memory. The benchmark is the side story. WebAssembly is why the port exists.
typescriptrustwebassemblyai-agentsperformance
ID
20 Oct 2026 5 min read

When the Compiler Becomes a CA: Go's Emergency Distrust of Eight SPKIs

Eight eMudhra intermediates were revoked for key compromise on October 18. A day later Go shipped the only enforcement most backend services will ever receive.
golangsecuritypkitlsdevops
ID
19 Oct 2026 5 min read

Why Our Multi-Agent Tooling Hallucinated Kubernetes (And How We Fix Context Poisoning)

Our internal developer tooling for docs and runbooks cleanly approved a specification claiming Dagango.com runs on Kubernetes. Here is how context poisoning broke verification.
ai-agentssoftware-architecturedevopsprompt-engineeringsoftware-engineering
ID
17 Oct 2026 4 min read

The 30,000 PR Illusion: Why Stacking AI Reviewers Degrades Architectural Cohesion

Anthropic merges 30,000 changes daily by having AI review AI with zero human sign-off. But machine-only reviews turn immediate architectural alignment into delayed production regressions.
ai-agentscode-reviewsoftware-engineeringdevopssoftware-architecture
ID
16 Oct 2026 5 min read

Why I Built mycv.ai.id: How AI Resume Tools Silently Strip Technical Depth and Hallucinate Dates

Standard AI resume builders quietly strip concrete tech stacks into corporate fluff and hallucinate that 2026 dates are from the future. Here is how I engineered mycv.ai.id to stop them.
ai-engineeringresume-optimizationats-parserpythonfastapi
ID
15 Oct 2026 5 min read

Agent Sandboxes That Fail Open: systemd --user Silently Skips Containment

Configure ProtectHome=yes, ProtectSystem=strict and IPAddressDeny=any on a systemd --user unit and systemctl show reports them all as active. On modern Ubuntu they fail open and enforce nothing.
systemdagent-safetysandboxingapparmorself-hosting
ID
14 Oct 2026 5 min read

The Multi-Agent Concurrency Bottleneck: Why Your Coding Fleet Locks Up

Three coding agents on one repository stop failing on model quality. The failures become file locks, bound ports, and database races. Here is the isolation that fixes it.
ai-agentsdevopssoftware-engineeringarchitecturegit
ID
13 Oct 2026 7 min read

Codex's Auto-Started Daemon: What systemd Would Have Done Differently

Since 0.157.0, Codex CLI starts a persistent, self-updating background daemon on qualifying interactive sessions. Here is what that breaks, and what a supervised service would have done instead.
agentssystemdself-hostingcoding-agentslinux
ID
12 Oct 2026 5 min read

The Remote Attestation Trap in Passkeys: Why WebAuthn Threatens User Sovereignty

Passkeys promise phishing-resistant logins, but WebAuthn carries a remote attestation switch. If relying parties turn it on, user-controlled password managers like KeePassXC get locked out.
securityauthenticationwebauthnprivacyarchitecture
ID
10 Oct 2026 4 min read

Cloudflare Acquires Deno: What the Sunset Actually Means

Ryan Dahl is ending Deno runtime development in a year and sunsetting Deno Deploy in six months. The reason isn't defeat: it's a bet that Durable Objects are the right primitive for stateful distributed systems.
javascriptcloudflaredenodistributed-systemsarchitecture
ID
09 Oct 2026 5 min read

Someone Applied for .lan: Why OpenWrt and Homelab DNS May Leak

ICANN's 2026 gTLD round includes a live application for .lan, the domain OpenWrt has hardcoded as a router default for two decades. Here's what that means for every homelab using it.
dnsnetworkinghomelabself-hostingsecurity
ID
08 Oct 2026 4 min read

Chrome 155 Ships JPEG XL in Rust: What It Actually Changes for an E-Commerce Image Pipeline

Chrome 155 reverses its 2022 decision and ships JPEG XL decoding, built on a pure-Rust decoder. For a platform that got burned by AVIF's encoding cost, this is the format worth re-evaluating.
web-performancerustecommercebrowsersarchitecture
ID
07 Oct 2026 4 min read

Why next/font/google Broke Our CI: Self-Hosting 13 Font Subsets for Zero-Network Builds

Our master CI died twice in twelve hours inside next/font/google, on commits that carried identical font code. Here is how Dagango.com vendors 13 font subsets on disk and makes next build fetch nothing.
nextjsfrontendperformancewebdevarchitecture
ID
06 Oct 2026 5 min read

The SQLAlchemy Session Poisoning Trap in Bulk CSV Import

One failed row in a bulk import can poison a shared SQLAlchemy session and kill the next 497. Here is the real session-lifecycle fix, with numbers from PostgreSQL 18.6.
pythonsqlalchemypostgresqlbackendarchitecture
ID
05 Oct 2026 6 min read

Reproducing the .git Hook Attack: git status Runs an Attacker's Command

Frank Wiles got a fake project inquiry, a Dropbox folder of specs, and a hidden .git with a post-checkout hook. I reproduced both vectors on git 2.53.0, and the popular fix is overridable.
gitsecurityai-agentssupply-chaindevtools
ID
04 Oct 2026 6 min read

My 17 Agents Remember With 1,069 Markdown Skills, Not Vectors

A memory plugin attaches the five most similar snippets to every prompt. I run 17 agents, and their durable knowledge is 1,069 Markdown skill files plus a memory file I keep under a kilobyte.
ai-agentsdocumentationllm-toolingknowledge-managementsoftware-engineering
ID
03 Oct 2026 4 min read

A Database Per Agent Costs More Than a File

Supabase says agents should be able to create a database as cheaply as a file. I already run one database per agent on a mini-PC, so I counted. The create is free; everything after it is the bill.
sqlitedatabasesai-agentsinfrastructureself-hosting
ID
03 Oct 2026 6 min read

You Said No MCP: The Tool-Loadout Tradeoff Nobody Tests

Pi spent a year saying it would never speak MCP, then shipped it in the core. The reason was not that MCP got better. The sandbox underneath it did.
ai-agentsmcptoolingarchitectureself-hosting
ID
02 Oct 2026 7 min read

Git 3.0's SHA-256 Default Is a Primary-Key Migration

I created a SHA-256 repository with the git I already have. Two of three daily operations failed outright, and the third is documented to die on older clients. The hash is not the migration; the key is.
gitdeveloper-toolingmigrationsversion-controlstorage
ID
01 Oct 2026 7 min read

18 Gateways to 1: The Fix That Isn't in Git

Eighteen gateway daemons became one in under three minutes. The dashboard watching them broke, then got fixed with 270 uncommitted lines. A clean checkout puts production back to reporting 16 of 17 profiles down.
ai-agentshomelabsystemdobservabilityself-hosting
ID
30 Sep 2026 6 min read

Two Kinds of Decision, and No Way to Prove the Model Did Not Change

A reasoning classifier and a drift benchmark landed a day apart. Together they say which decisions deserve thinking, and why your own latency numbers cannot prove the model changed.
ai-agentslocal-llmevaluationshomelabsoftware-engineering
ID
27 Sep 2026 7 min read

Egress Is the Boundary: What 700 Escaped Agents Taught About Containment

A forensic report on 700 escaped agents reads better as a containment checklist than an incident recap. Here is what it changed about how I run my own fleet.
ai-agentssecuritydevopsself-hostingsandboxing
ID
26 Sep 2026 5 min read

Why We Built Isolated Subdomains Instead of a Public Store Directory

A public /stores directory would have made Dagango.com behave like a marketplace. We shipped per-tenant host routing and metadata instead, and the crawl-budget argument is what settled it.
multi-tenancynextjsseoe-commercearchitecture
ID
25 Sep 2026 4 min read

Why Your Postgres LIKE Query Silently Seq Scans (And the One-Line Fix)

On a default en_US.UTF-8 Postgres, a UNIQUE (tenant_id, slug) index cannot serve LIKE 'prefix%' queries. Here are the benchmark numbers at 20,000 rows and the varchar_pattern_ops index that fixes it.
postgresqldatabasebackendperformanceoptimization
ID
24 Sep 2026 5 min read

Your Agent's Config Silently Failed: The Canary Test That Catches It

Claude Code shipped AGENTS.md support gated behind a remote flag, so telemetry-off users got silent failures. Here's the five-second test that catches this class of bug in any agent setup.
ai-agentsclaude-codedeveloper-toolingdebuggingllm-workflows
ID
23 Sep 2026 6 min read

Self-Hosting Behind CGNAT: A WireGuard Bridge That Actually Works

Port forwarding stopped working and it wasn't your router's fault. Here's the outbound WireGuard tunnel pattern that gets a homelab back on the public internet under CGNAT.
self-hostinghomelabnetworkingwireguardcgnat
ID
22 Sep 2026 6 min read

AI Agents Flooded Our PR Queue: Fixing CI Before It Breaks

Coding agents made writing PRs nearly free, which means your pipeline is now the bottleneck. Here's what Linear's CI rework maps to on a small-team budget.
ci-cdai-agentsdeveloper-productivitytestinggithub-actions
ID
22 Sep 2026 2 min read

Why I Self-Host Everything on a Mini PC

A Celeron box with 14GB RAM in the corner of my room runs my stores, my agents, and this blog. Here is the math on why cloud bills stopped making sense.
self-hostinginfrastructurehomelab
ID