MOTD, Console Tips, and Rod's Tales.https://rodhat.com/https://rodhat.com/motd/2026-08-24-wireguard-six-years-kernel/https://rodhat.com/motd/2026-08-24-wireguard-six-years-kernel/WireGuard landed in Linux 5.6 in April 2020. Six years later, it's in every major OS, every cloud provider's toolbox, and the cryptography audit held. The 4,000-line kernel module that was supposed to be too opinionated turned out to be the right kind of opinionated.Mon, 24 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-24-seccomp-bpf-syscall-filter/https://rodhat.com/tips/2026-08-24-seccomp-bpf-syscall-filter/seccomp-BPF loads a classic BPF filter into the kernel that runs on every syscall your process makes. Give it a whitelist, everything else gets EPERM or SIGKILL. Here's how the filter model works, how libseccomp makes it tolerable, and how to audit what a real binary actually needs.Mon, 24 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-23-iptables-nftables-done/https://rodhat.com/motd/2026-08-23-iptables-nftables-done/Debian 13 Trixie completed the transition — iptables the binary now calls the nftables backend across every major Linux distro. The legacy xt_* kernel path still exists, but it's not the default and it's on the removal list. Twelve years after nftables landed, the ecosystem caught up.Sun, 23 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-23-the-pool-was-full-of-dead-connections/https://rodhat.com/tales/2026-08-23-the-pool-was-full-of-dead-connections/An intermittent burst of broken-pipe database errors had been logged as "flaky" for two months before anyone looked closely enough to notice they were always the first query on a connection. The connection pool was handing out corpses.Sun, 23 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-23-cgroups-v2-without-systemd/https://rodhat.com/tips/2026-08-23-cgroups-v2-without-systemd/Linux cgroups v2 exposes memory, CPU, and I/O limits through a plain filesystem interface under /sys/fs/cgroup/. No systemd, no container runtime — write to files, read the results. Here's the real workflow for memory.max, cpu.max, freezer, and io.max.Sun, 23 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-22-openzfs-3-raidz-expand-dedup/https://rodhat.com/motd/2026-08-22-openzfs-3-raidz-expand-dedup/OpenZFS 3.0 landed with RAIDZ expansion, a ground-up rewrite of the dedup engine, and block cloning. Three features that have been "coming soon" for most of the past decade are now in a release build. Worth looking at.Sat, 22 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-22-ftrace-kernel-function-tracer/https://rodhat.com/tips/2026-08-22-ftrace-kernel-function-tracer/ftrace is Linux's built-in kernel function tracer, accessible directly via /sys/kernel/debug/tracing/. No compiler, no LLVM, no kernel headers — write to files, read call graphs. Here's the workflow for function tracing, call-graph timing, IRQ latency, and isolated trace instances.Sat, 22 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-21-sudo-rs-production-ready/https://rodhat.com/motd/2026-08-21-sudo-rs-production-ready/sudo-rs is production-ready for most deployments. A setuid-root binary sitting at uid 0, accumulating privilege-escalation CVEs for four decades, is exactly the right target for a memory-safe rewrite. This one is hard to argue with.Fri, 21 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-21-trap-signal-handling/https://rodhat.com/tips/2026-08-21-trap-signal-handling/The shell trap builtin intercepts signals and the EXIT pseudo-signal to run cleanup code regardless of how a script dies. Most scripts skip it entirely. Here is how to use it correctly, including the subshell gotchas and the ERR trap edge cases that bite people.Fri, 21 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-20-getrandom-vdso/https://rodhat.com/motd/2026-08-20-getrandom-vdso/Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.Thu, 20 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-20-the-oom-killer-was-doing-its-job/https://rodhat.com/tales/2026-08-20-the-oom-killer-was-doing-its-job/A slow memory leak ran undetected for five weeks because the kernel's out-of-memory killer, executing its heuristic correctly, kept choosing the monitoring agent over the leaking service. The pager never fired. The monitoring gaps were there in the data the whole time.Thu, 20 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-20-smaps-pss-memory-accounting/https://rodhat.com/tips/2026-08-20-smaps-pss-memory-accounting/RSS from ps aux double-counts shared pages and makes every process look more expensive than it is. PSS from /proc/PID/smaps_rollup gives you actual per-process memory ownership. Here is how to read it.Thu, 20 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-19-python-without-the-gil/https://rodhat.com/motd/2026-08-19-python-without-the-gil/Python's free-threaded build has been shipping for two release cycles now. The GIL is optional, increasingly the default build on major distros, and the ecosystem is discovering that "thread-safe" was a comment in a docstring, not a guarantee.Wed, 19 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-19-ss-tcp-internals/https://rodhat.com/tips/2026-08-19-ss-tcp-internals/Everyone knows ss -tulnp. Almost nobody uses ss -i, which surfaces congestion window size, RTT, retransmit counts, and send/receive buffer fill — directly from the kernel, no tool required.Wed, 19 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-18-openssh-10-drops-the-fossils/https://rodhat.com/motd/2026-08-18-openssh-10-drops-the-fossils/OpenSSH 10.0 removes DSA keys, CBC cipher modes, and SHA-1 HMAC completely. Not deprecated with a warning. Removed. If your network gear or embedded systems are still negotiating any of these, your next maintenance window just got scheduled for you.Tue, 18 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-18-nohup-disown-setsid-terminal-detachment/https://rodhat.com/tips/2026-08-18-nohup-disown-setsid-terminal-detachment/Three tools for keeping a process alive after you close the terminal. They do not do the same thing. Here is the kernel-level difference, and when each one applies.Tue, 18 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-17-go-127-ships-pgo-and-iterators-settle/https://rodhat.com/motd/2026-08-17-go-127-ships-pgo-and-iterators-settle/Go 1.27 lands today. Profile-guided optimization is showing 12-18% gains on real HTTP workloads with zero code changes. The iter package is now threaded through the entire standard library. Rod has updated some priors. Not all of them.Mon, 17 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-17-the-number-1024-was-not-a-coincidence/https://rodhat.com/tales/2026-08-17-the-number-1024-was-not-a-coincidence/A file descriptor limit from 2003 survived three infrastructure migrations and one complete platform rewrite because nobody ever questioned a number that had always been there. It bit us at 2am on a Tuesday.Mon, 17 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-17-ip-netns-network-namespaces/https://rodhat.com/tips/2026-08-17-ip-netns-network-namespaces/Network namespaces give a process its own routing table, its own interfaces, and its own firewall rules — in milliseconds. Docker creates them. Kubernetes creates them. You can too, from ip, without touching a container runtime.Mon, 17 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-16-linux-72-ships-ai-cleaned-the-basement/https://rodhat.com/motd/2026-08-16-linux-72-ships-ai-cleaned-the-basement/Linux 7.2 stable lands today with cache-aware scheduling, MGLRU gains that doubled MongoDB throughput in benchmarks, and a pile of driver removals nobody asked for — except the LLMs, who wouldn't stop filing bugs about them.Sun, 16 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-16-the-pipeline-that-succeeded-in-silence/https://rodhat.com/tales/2026-08-16-the-pipeline-that-succeeded-in-silence/A deployment that broke production ran undetected for forty minutes because the notification step was written to never fail, and the monitoring alert that should have fired went to the same broken endpoint.Sun, 16 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-16-bpftrace-one-liners/https://rodhat.com/tips/2026-08-16-bpftrace-one-liners/dtrace showed up on Solaris in 2004, shipped in FreeBSD 7 in 2008, and Linux users spent the next decade pretending strace was sufficient. bpftrace is the real answer — dynamic kernel tracing, histograms, stack walks, zero overhead when idle.Sun, 16 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-15-freebsd-base-system-gpl-free/https://rodhat.com/motd/2026-08-15-freebsd-base-system-gpl-free/FreeBSD replaced dialog with bsddialog and declared its base system GPL-free. Then someone looked at the kernel. Thirty years of license hygiene, and it ends with "oops, still some in there."Sat, 15 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-15-the-postrotate-that-fired-into-the-void/https://rodhat.com/tales/2026-08-15-the-postrotate-that-fired-into-the-void/Three months of production logs, all gone. logrotate ran clean on schedule every week. The daemon was healthy and writing the whole time. The postrotate signal was firing correctly — just to a PID that had been dead since deployment day.Sat, 15 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-15-taskset-numactl-cpu-pinning/https://rodhat.com/tips/2026-08-15-taskset-numactl-cpu-pinning/The Linux scheduler moves processes between cores. Sometimes that churn is the bottleneck — cold cache lines, NUMA cross-node fetches, latency spikes with no obvious cause. taskset and numactl are blunt instruments that work.Sat, 15 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-14-post-quantum-key-exchange-is-already-here/https://rodhat.com/motd/2026-08-14-post-quantum-key-exchange-is-already-here/NIST finalized ML-KEM two years ago. OpenSSH shipped the hybrid key exchange into default KEX negotiation and most connections quietly upgraded. The certificate half of the post-quantum transition is not going to be that clean.Fri, 14 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-14-perf-stat-record/https://rodhat.com/tips/2026-08-14-perf-stat-record/perf stat hands you hardware performance counters — cycles, cache misses, branch mispredictions — in seconds. perf record samples call stacks at full speed. Both are already installed and beat any SaaS APM for understanding CPU-bound problems.Fri, 14 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-13-encrypted-dns-not-what-you-think/https://rodhat.com/motd/2026-08-13-encrypted-dns-not-what-you-think/DNS-over-HTTPS is a correct answer to a real problem — cleartext DNS has been leaking every hostname you visit since 1983. The way browsers deployed it, pointing users to Cloudflare and Google by default without explanation, is a different story. The encryption is real. The 'privacy' framing is doing a lot of work.Thu, 13 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-13-the-storage-was-fine-we-were-swapping/https://rodhat.com/tales/2026-08-13-the-storage-was-fine-we-were-swapping/Three weeks, two engineers, one open storage vendor ticket, and roughly forty collective hours chasing read latency on a ZFS pool. The pool was fine the whole time. There was a swapfile nobody remembered adding seven months earlier.Thu, 13 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-13-strace-not-a-firehose/https://rodhat.com/tips/2026-08-13-strace-not-a-firehose/Most people open strace, get buried in output, and close the terminal. Four flags fix that — -c counts, -e filters, -P follows a single path, -T times each call. Here is how strace is actually supposed to work.Thu, 13 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-12-posix-2024-make/https://rodhat.com/motd/2026-08-12-posix-2024-make/POSIX.1-2024 updated the make utility specification for the first time since the early 90s. The .PHONY target — which every make implementation has shipped for three decades without being in the spec — is now actually standard. The standardization story is a better parable about how POSIX works than anything the standards body would tell you itself.Wed, 12 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-12-nsenter-linux-namespaces/https://rodhat.com/tips/2026-08-12-nsenter-linux-namespaces/Containers are six kernel namespaces and nothing else. nsenter gets you inside from the host without docker exec, without touching the image, and without whatever tooling the vendor decided to ship.Wed, 12 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-11-rust-linux-kernel-not-failing/https://rodhat.com/motd/2026-08-11-rust-linux-kernel-not-failing/When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.Tue, 11 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-11-socat-swiss-army-socket/https://rodhat.com/tips/2026-08-11-socat-swiss-army-socket/netcat forwards a port. socat forwards a port, wraps it in TLS, splices it to a Unix socket, proxies serial-over-TCP, and lets you inject raw bytes mid-stream. You already have it installed. Here is how to actually use it.Tue, 11 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-10-git-sha256-finally-moving/https://rodhat.com/motd/2026-08-10-git-sha256-finally-moving/Six years after the object-format flag landed in 2.29, SHA-256 repos are actually getting real hosting support. The design they ended up with — capability advertisement plus translation proxies — is genuinely clever. I hate that it took this long and I respect how they did it.Mon, 10 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-10-python-free-threaded-stable/https://rodhat.com/motd/2026-08-10-python-free-threaded-stable/Free-threaded CPython is stable in 3.14. After thirty years, import threading will do what you thought it did. RodHat on why the right fix took this long, who actually benefits, and why the Python you probably care about is either unaffected or slower.Mon, 10 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-10-valkey-redis-fork-survived/https://rodhat.com/motd/2026-08-10-valkey-redis-fork-survived/In March 2024, Redis relicensed and AWS/Google forked it as Valkey under the Linux Foundation. I gave it 18 months before it turned into a governance zombie. Valkey 2.0 is shipping and I was wrong.Mon, 10 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-10-the-config-change-that-went-everywhere-at-once/https://rodhat.com/tales/2026-08-10-the-config-change-that-went-everywhere-at-once/A one-line config change, reviewed, tested, and correct in every environment we tried it in. It went to all six regions in the same rollout because config isn't code, and config doesn't need a staged rollout. It does now.Mon, 10 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-10-dig-trace-dns-debugging/https://rodhat.com/tips/2026-08-10-dig-trace-dns-debugging/"It's a DNS problem" is where debugging stops. +trace walks the delegation from the root yourself, +norecurse asks a resolver what it has cached without letting it go fetch, and together they tell you whether the bad answer is the zone, the resolver, or the client.Mon, 10 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-09-alpine-musl-not-glibc/https://rodhat.com/motd/2026-08-09-alpine-musl-not-glibc/Alpine Linux is the most-pulled base image on Docker Hub. It ships musl libc, not glibc. Those are not interchangeable. RodHat on the quiet ABI divide that bites engineers every week and explains why half the "mysterious container crash" tickets exist.Sun, 09 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-09-pledge-unveil-10-years/https://rodhat.com/motd/2026-08-09-pledge-unveil-10-years/OpenBSD's pledge(2) landed in 5.9 in 2016. Ten years later, Linux has Landlock (good) and seccomp-bpf (powerful and painful) and still nothing that lets a process sandbox itself in a single readable line. RodHat on why API simplicity is a security property.Sun, 09 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-09-systemd-run0-sudo-replacement/https://rodhat.com/motd/2026-08-09-systemd-run0-sudo-replacement/run0 has been in systemd 256+ for over two years now and distros are starting to actually ship it. The scope creep argument is real. The security critique of sudo is also real. Holding both is annoying.Sun, 09 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-09-flock-cron-overlap/https://rodhat.com/tips/2026-08-09-flock-cron-overlap/A job that usually takes four minutes on a five-minute schedule will eventually take six, and then you have two copies racing. flock fixes it in one line — and the pidfile you were about to write instead is broken in ways flock isn't.Sun, 09 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-08-ebpf-unprivileged-lockdown/https://rodhat.com/motd/2026-08-08-ebpf-unprivileged-lockdown/The Linux kernel project is landing a config change that makes kernel.unprivileged_bpf_disabled permanent by default. RodHat on why unprivileged BPF was always an attack surface in a trenchcoat, and why your bpftrace workflow is fine.Sat, 08 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-08-the-alert-that-fired-for-eight-months/https://rodhat.com/tales/2026-08-08-the-alert-that-fired-for-eight-months/A rule that pages nightly and gets acknowledged nightly isn't monitoring, it's a ritual. We had trained an entire team to dismiss a specific alert without reading it, and then it started telling us about something new.Sat, 08 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-08-policy-routing-ip-rule/https://rodhat.com/tips/2026-08-08-policy-routing-ip-rule/The routing table picks a route by destination. When you have two upstreams, replies to traffic that arrived on the second one leave via the first, get dropped by the upstream's anti-spoofing, and vanish. ip rule and a second routing table fix it properly.Sat, 08 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-07-paying-per-log-line-during-an-outage/https://rodhat.com/motd/2026-08-07-paying-per-log-line-during-an-outage/Ingest-based pricing creates an incentive that fires exactly backwards: the incident that generates the most telemetry is the one that costs the most to observe. Teams respond by sampling, and then wonder why the postmortem has a gap in the middle.Fri, 07 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-07-zfs-boot-environments-bectl/https://rodhat.com/tips/2026-08-07-zfs-boot-environments-bectl/A ZFS boot environment is a bootable clone of your root dataset. Make one before every upgrade and a wrecked kernel becomes a reboot, not a recovery-media evening. The bectl walk, and the loader trick that saves you when the new one won't boot.Fri, 07 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-06-freebsd-ktrace-jail-privilege-regression/https://rodhat.com/motd/2026-08-06-freebsd-ktrace-jail-privilege-regression/FreeBSD-SA-26:53.ktrace is a regression in how ktrace is gated inside jails. No dramatic exploit, just an isolation boundary that quietly stopped meaning what you thought it meant.Thu, 06 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-06-observability-was-down-do-it-with-your-hands/https://rodhat.com/tales/2026-08-06-observability-was-down-do-it-with-your-hands/A junior engineer froze during a production fire because the SaaS dashboard that watches production was part of the fire. RodHat on the tools that were on every Unix box before the kid was born, the racket that sold competence back to us as a monthly invoice, and why the fire isn't out.Thu, 06 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-06-pf-tables-anchors-self-updating-firewall/https://rodhat.com/tips/2026-08-06-pf-tables-anchors-self-updating-firewall/pf tables and anchors turn a static ruleset into a firewall that bans its own attackers and updates without a reload. Real pfctl commands, real persistence, real expiry — not a cron job that greps auth.log like it's 2004.Thu, 06 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-06-read-a-wedged-process-without-a-dashboard/https://rodhat.com/tips/2026-08-06-read-a-wedged-process-without-a-dashboard/A process is hung and the graphs won't say why. Here's the /proc, ps, strace, and dmesg walk that finds a stuck worker in about ninety seconds — no agent, no vendor, no login.Thu, 06 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-05-lts-forever-is-over/https://rodhat.com/motd/2026-08-05-lts-forever-is-over/Linux kernel long-term support dropped from six years to two, and the reason given was honest: almost nobody was testing the old branches. Stability was never a property of the version number. It was a property of somebody doing the work.Wed, 05 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-05-restart-loop-evidence/https://rodhat.com/tips/2026-08-05-restart-loop-evidence/Automatic restarts keep services available, but an aggressive restart loop can erase the timing, logs, cores, and state needed to understand why a process failed. Preserve evidence before recovery becomes amnesia.Wed, 05 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-04-your-backup-is-one-account-lockout-away/https://rodhat.com/motd/2026-08-04-your-backup-is-one-account-lockout-away/Three copies, two media, one offsite — and all three sitting under a single cloud identity that a fraud algorithm can disable at 4am with no appeal path. The rule was written when a copy meant a physical object somebody had to come and take.Tue, 04 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-04-health-check-wrong-service/https://rodhat.com/tales/2026-08-04-health-check-wrong-service/A service can answer HTTP 200 while its queue is wedged, its database writes are failing, and every useful request is dying. RodHat on health checks that prove process existence instead of service capability.Tue, 04 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-04-tcpdump-ring-buffer/https://rodhat.com/tips/2026-08-04-tcpdump-ring-buffer/Intermittent network failures do not happen while you are watching. Use tcpdump's rotating capture files, size limits, and post-trigger preservation to keep the packets that existed before the pager fired.Tue, 04 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-03-freebsd-14-5-branch-week/https://rodhat.com/motd/2026-08-03-freebsd-14-5-branch-week/FreeBSD 14.5 branches on August 7 and BETA1 starts the same day. RodHat explains why the useful part of a minor release is the short window when boring hardware reports can still change it.Mon, 03 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-03-staging-shared-the-production-database/https://rodhat.com/tales/2026-08-03-staging-shared-the-production-database/Separate servers, separate config, separate deploy pipeline, a big banner saying STAGING. And a database connection string that pointed, through two layers of indirection, at production. We found out during a load test.Mon, 03 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-03-pipeline-exit-status/https://rodhat.com/tips/2026-08-03-pipeline-exit-status/A failed producer can disappear behind a successful consumer. RodHat explains pipeline exit status, pipefail, PIPESTATUS, and how to stop backup scripts from lying.Mon, 03 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-02-who-trains-the-seniors/https://rodhat.com/motd/2026-08-02-who-trains-the-seniors/Every argument about AI and junior developers is about this quarter's headcount. The interesting question is a decade out: seniority is produced by doing unglamorous work under supervision, and that's exactly the work being automated first.Sun, 02 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-02-ephemeral-port-exhaustion/https://rodhat.com/tips/2026-08-02-ephemeral-port-exhaustion/A client making thousands of short-lived outbound connections exhausts the ephemeral range, and every tuple sits in TIME_WAIT for a minute afterwards. Here's how to confirm it in one command and the three fixes, ranked by how much you'll regret them.Sun, 02 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-01-ai-slop-in-the-diff/https://rodhat.com/motd/2026-08-01-ai-slop-in-the-diff/AI coding tools now generate a meaningful percentage of commits at shops that have adopted them. RodHat on what happens to institutional knowledge when the author of the diff has never been paged.Sat, 01 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-01-io-uring-structural-cve/https://rodhat.com/motd/2026-08-01-io-uring-structural-cve/Another batch of privilege-escalation bugs in io_uring dropped this week. RodHat explains why the design keeps generating the same vuln class, and what to actually do about it in your container environments.Sat, 01 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-08-01-openssh-drops-legacy/https://rodhat.com/motd/2026-08-01-openssh-drops-legacy/The OpenSSH project continues ripping out legacy cryptography — DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.Sat, 01 Aug 2026 00:00:00 GMThttps://rodhat.com/tales/2026-08-01-the-retry-storm/https://rodhat.com/tales/2026-08-01-the-retry-storm/One backend got slow for ninety seconds. Every client retried, in lockstep, three times, with no jitter. The retries were larger than the original traffic, the backend never recovered, and every fix we tried made it worse until we did the thing nobody wanted to do.Sat, 01 Aug 2026 00:00:00 GMThttps://rodhat.com/tips/2026-08-01-awk-associative-arrays/https://rodhat.com/tips/2026-08-01-awk-associative-arrays/Most people's awk stops at print $7. Associative arrays, END blocks and a two-line accumulator turn it into the right tool for ninety percent of the log questions people currently write a script for — and it runs on a box with nothing installed.Sat, 01 Aug 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-31-memory-safe-mandate/https://rodhat.com/motd/2026-07-31-memory-safe-mandate/Federal agencies are now demanding memory-safety roadmaps from software vendors. RodHat runs through what the mandate gets right, what it gets delusional, and what happens when bureaucrats discover that C is load-bearing.Fri, 31 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-31-vendor-killed-the-cli/https://rodhat.com/motd/2026-07-31-vendor-killed-the-cli/A DevOps tooling vendor is sunsetting their CLI in favor of a "streamlined cloud dashboard experience." RodHat has opinions, and a survival guide.Fri, 31 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-31-zfs-send-recv-replication/https://rodhat.com/tips/2026-07-31-zfs-send-recv-replication/An incremental zfs send moves exactly the blocks that changed, verified end to end, with no file-tree walk at all. The full replication pipeline is one command, and the resume token turns a failed 3TB transfer from a restart into a continuation.Fri, 31 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-30-database-vendor-pricing-change/https://rodhat.com/motd/2026-07-30-database-vendor-pricing-change/Another usage-based pricing overhaul from a managed database vendor, filed under simplification. RodHat translates.Thu, 30 Jul 2026 00:00:00 GMThttps://rodhat.com/tales/2026-07-30-the-temporary-nfs-mount/https://rodhat.com/tales/2026-07-30-the-temporary-nfs-mount/Somebody stood it up in an afternoon to unblock a launch. It had no monitoring, no owner, no backup, and no entry in any diagram. It survived two datacentre moves, a company acquisition, and every engineer who knew it existed.Thu, 30 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-30-rsync-flags-that-matter/https://rodhat.com/tips/2026-07-30-rsync-flags-that-matter/-a doesn't preserve what you think it preserves. --inplace and --partial solve opposite problems and combining them wrong loses data. And --link-dest turns rsync into a deduplicating snapshot system in one flag.Thu, 30 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-29-package-registry-typosquat-wave/https://rodhat.com/motd/2026-07-29-package-registry-typosquat-wave/The same typosquatting attack pattern, the same registry, the same 'we should really fix this' thread. RodHat's seen this loop enough times to name it.Wed, 29 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-29-openssl-s-client-tls-debugging/https://rodhat.com/tips/2026-07-29-openssl-s-client-tls-debugging/"Certificate verify failed" is four different bugs wearing one error message. s_client shows you the chain the server actually sent, in order, with the verify result per link — which is how you find the missing intermediate in about twenty seconds.Wed, 29 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-28-serverless-cold-start-regression/https://rodhat.com/motd/2026-07-28-serverless-cold-start-regression/Cold starts crept back up on a major FaaS platform this week. No announcement, no postmortem. RodHat noticed because he still checks.Tue, 28 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-28-ionice-cgroup-io-latency/https://rodhat.com/tips/2026-07-28-ionice-cgroup-io-latency/nice does nothing for I/O. ionice only works on one scheduler that most systems no longer use. cgroup v2 io.latency and io.max are the two knobs that actually work, and they work on the thing you already have.Tue, 28 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-27-cve-scoring-inflation/https://rodhat.com/motd/2026-07-27-cve-scoring-inflation/CVSS score inflation has gotten bad enough that a 9.8 barely raises RodHat's eyebrow anymore. That's the actual crisis.Mon, 27 Jul 2026 00:00:00 GMThttps://rodhat.com/tales/2026-07-27-the-cron-job-that-ran-twice/https://rodhat.com/tales/2026-07-27-the-cron-job-that-ran-twice/No errors. No alerts. The reconciliation report matched every single day. And a few hundred customers were being double-charged, because the job that generated the charges and the job that verified them were the same code with the same bug.Mon, 27 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-27-bpftrace-io-latency/https://rodhat.com/tips/2026-07-27-bpftrace-io-latency/iostat gives you an average, and averages hide the tail that's actually hurting you. A four-line bpftrace program prints a log2 histogram of block I/O latency per device, live, on a production box, with no agent and no restart.Mon, 27 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-26-passkeys-and-the-recovery-hole/https://rodhat.com/motd/2026-07-26-passkeys-and-the-recovery-hole/The cryptography is right, the phishing resistance is real, and I've stopped arguing about it. What hasn't been solved is what happens when the device is gone — and every deployed answer to that reintroduces the thing passkeys replaced.Sun, 26 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-26-shell-one-liners-worth-screenshotting/https://rodhat.com/tips/2026-07-26-shell-one-liners-worth-screenshotting/Real, still-in-daily-use shell one-liners for finding what's eating memory, what's holding a port, and what changed in a config file — no clickbait filler.Sun, 26 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-25-ai-coding-assistant-outage/https://rodhat.com/motd/2026-07-25-ai-coding-assistant-outage/A major AI coding assistant had a multi-hour outage this week. RodHat has seen this movie before, just with a different lead actor.Sat, 25 Jul 2026 00:00:00 GMThttps://rodhat.com/tales/2026-07-25-the-ttl-nobody-lowered/https://rodhat.com/tales/2026-07-25-the-ttl-nobody-lowered/Six weeks of planning, a rehearsed cutover, and a maintenance window we finished forty minutes early. Then a fifth of our traffic kept arriving at a datacentre we'd already started decommissioning, for a full day, and there was nothing whatsoever we could do about it.Sat, 25 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-25-supervision-without-systemd/https://rodhat.com/tips/2026-07-25-supervision-without-systemd/You don't need a service manager with a DNS resolver in it to restart a daemon that died. daemontools, runit and s6 do supervision trees, log rotation and clean shutdown in a handful of files — and the design idea underneath them is worth stealing even if you never install one.Sat, 25 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-24-certificate-lifetimes-are-collapsing/https://rodhat.com/motd/2026-07-24-certificate-lifetimes-are-collapsing/The CA/Browser Forum voted to phase TLS certificate validity down to under seven weeks by 2029. If your renewal runbook has a human in it, the schedule just became your problem — and that's the actual point of the change.Fri, 24 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-24-xargs-null-terminated/https://rodhat.com/tips/2026-07-24-xargs-null-terminated/Whitespace, newlines and quotes in filenames turn the standard find-pipe-xargs idiom into something that deletes the wrong files. -print0 and -0 fix it, find -exec + fixes it better, and there's one case where only one of them works.Fri, 24 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-23-egress-fees-were-always-a-lock-in-tax/https://rodhat.com/motd/2026-07-23-egress-fees-were-always-a-lock-in-tax/Charging nothing to put data in and a fortune to take it out is not a cost recovery model, it's a switching cost. Regulators worked that out, the fees started falling, and the interesting part is what got built to replace them.Thu, 23 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-23-zfs-jails-poor-mans-containers/https://rodhat.com/tips/2026-07-23-zfs-jails-poor-mans-containers/A real walkthrough of FreeBSD jails on ZFS datasets as a lighter, more honest isolation model than a container runtime for a lot of workloads.Thu, 23 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-22-one-maintainer-load-bearing/https://rodhat.com/motd/2026-07-22-one-maintainer-load-bearing/Not the direct ones — the transitive ones. The libraries nobody chose, that nothing in your organisation has a name attached to, that a single unpaid person has been carrying since before your company existed.Wed, 22 Jul 2026 00:00:00 GMThttps://rodhat.com/tales/2026-07-22-the-microservice-that-should-have-been-a-function/https://rodhat.com/tales/2026-07-22-the-microservice-that-should-have-been-a-function/An architecture rant, grounded in a real bad design RodHat watched calcify for a year and a half before anyone had the standing to kill it.Wed, 22 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-22-ssh-multiplexing-controlmaster/https://rodhat.com/tips/2026-07-22-ssh-multiplexing-controlmaster/ControlMaster reuses one TCP connection and one authentication for every subsequent session to the same host. Combine it with ProxyJump and a Match block and the difference between a 900ms hop and a 20ms one is four lines of config you write once.Wed, 22 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-21-rust-in-the-kernel-was-never-the-hard-part/https://rodhat.com/motd/2026-07-21-rust-in-the-kernel-was-never-the-hard-part/The compiler works. The bindings work. The drivers work. What nearly stalled the whole effort was thirty years of maintainer culture meeting a rule about who has to maintain what — and that's a governance problem no language solves.Tue, 21 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-21-zfs-arc-is-not-a-leak/https://rodhat.com/tips/2026-07-21-zfs-arc-is-not-a-leak/The ARC is designed to consume all the memory you aren't using and give it back under pressure. But it does give it back slowly, and there are two real cases where you should cap it. Here's how to tell which situation you're actually in.Tue, 21 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-20-your-build-depends-on-someone-elses-free-tier/https://rodhat.com/motd/2026-07-20-your-build-depends-on-someone-elses-free-tier/Registry rate limits turn CI into a coin flip, and the fix — a pull-through cache — has existed the entire time. Anonymous pulls from shared CI egress IPs were always going to hit a ceiling. That was predictable in 2020.Mon, 20 Jul 2026 00:00:00 GMThttps://rodhat.com/tales/2026-07-20-the-backup-restored-perfectly/https://rodhat.com/tales/2026-07-20-the-backup-restored-perfectly/We tested our backups. Monthly, documented, signed off. The restore ran clean, the checksums matched, the database came up on the first try. And the data in it was eleven days old, because for eleven days the job had been backing up a directory nobody was writing to any more.Mon, 20 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-20-dtrace-syscall-latency/https://rodhat.com/tips/2026-07-20-dtrace-syscall-latency/A real dtrace/bpftrace one-liner for finding the syscall responsible for tail latency, plus why strace -T won't get you there.Mon, 20 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-19-xz-two-years-on/https://rodhat.com/motd/2026-07-19-xz-two-years-on/Two years on, the thing that nearly shipped a compromised sshd into every distro on earth wasn't a code flaw. It was a burned-out maintainer, a patient stranger, and a pressure campaign. Almost every mitigation since has been aimed at the wrong layer.Sun, 19 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-19-full-disk-no-files/https://rodhat.com/tips/2026-07-19-full-disk-no-files/df reports 100%, du walks the whole tree and finds nothing. The space is in a file somebody deleted while a process still had it open — the inode lives until the last fd closes. lsof +L1 finds it in one command.Sun, 19 Jul 2026 00:00:00 GMThttps://rodhat.com/motd/2026-07-18-the-sso-tax/https://rodhat.com/motd/2026-07-18-the-sso-tax/Single sign-on sits behind the enterprise tier at a suspicious number of vendors, at a markup that has nothing to do with what it costs to implement. It's not a feature. It's the control you need to offboard someone the day you fire them.Sat, 18 Jul 2026 00:00:00 GMThttps://rodhat.com/tales/2026-07-18-the-friday-deploy-that-ate-a-weekend/https://rodhat.com/tales/2026-07-18-the-friday-deploy-that-ate-a-weekend/A sysadmin war story about a Friday-afternoon deploy, a silent DNS TTL assumption, and the two-day outage it caused. RodHat owns every part of it.Sat, 18 Jul 2026 00:00:00 GMThttps://rodhat.com/tips/2026-07-18-what-is-actually-listening/https://rodhat.com/tips/2026-07-18-what-is-actually-listening/netstat -an tells you a socket is open. It does not tell you which process opened it, which user owns it, or whether the accept queue is already overflowing. ss and sockstat do, and they take the same three seconds.Sat, 18 Jul 2026 00:00:00 GMT