Dated, with the numbers
Writing
Notes on building and running a lot of software with very few people. Mostly Go, running your own infrastructure, and what actually happens when you put agents to work on a production estate.
-
Your analytics tool is counting bots as people
Bot filtering in analytics products is a user-agent blocklist, so it only catches bots that admit what they are. Here are three ways to identify the ones that don't, why your analytics vendor structurally can't do the best of them, and the Cloudflare rule that stops them at the edge.
analyticsprivacycloudflareobservability
-
Replacing SigNoz with VictoriaMetrics on a 4 GiB budget
Our observability stack had a bigger memory budget than every application it was watching, and was still silently dropping data. Here's what we replaced it with, the exact collector wiring, and what it cost us.
observabilityopentelemetryinfrastructure
-
Your authorisation layer is correct and your query still leaks
A permission check answers "may this user do this". It doesn't answer "to which rows". In multi-tenant software the second question is the one that leaks data, and it fails in a way that passes every test you've written.
gosecuritymulti-tenancypostgres
-
SMR drives, ZFS and 92% full, and why compression won't save you
A ZFS mirror pool on shingled drives stalled under build load. The instinct is to reach for compression or a bigger cache, and both are useless here, because the stall was never bandwidth-bound. Measured at single-digit MB/s while completely wedged. Here's how to tell seek starvation from a throughput problem, and why the fix is moving the workload rather than tuning the pool.
zfsstorageinfrastructureperformance
-
How I run 19 agent sessions at once
A coding-agent session is worth treating as a long-lived named worker rather than a process you start per task. Nineteen of mine run permanently on one headless machine, reset in place with /clear and re-pointed with a slash command. Here's the addressing scheme, what forces a real restart, and the two places it falls over.
agentstoolingprocess
-
The third consent state nobody builds
Consent banners give you two states and the law has three. Here's a cookieless measurement mode for visitors who haven't decided yet, why Article 5(3) isn't engaged by it, and how to prove your own tracking works when you cannot see it from your own network.
privacyanalyticsgdprgo
-
Vibe coding is not binary
The vibe-versus-serious split measured how much code you type, and that has stopped being a useful signal. Across 37 active days and 77,720 agent actions, 12% authored code and 68% ran commands and read output. The line that still means something is not typing volume - it is who owns verification and who owns the consequences.
agentsprocesstooling
-
Handing the easy tickets to a free local model cost 1.65x more
I built a harness to grind the mechanical backlog tail on a local Ollama model and measured what it actually saved. Across three real tickets the local-model path cost 1.65x the Claude tokens of just doing the work, and every output needed fixing before it could merge.
agentstoolingprocessgo
-
Dogfooding is a brilliant bug-finder and a terrible product manager
Every tool here is used to run the place, including the one reviewing this draft. That catches a class of defect nothing else does. It also produces a convincing-looking roadmap built entirely from the preferences of the least representative user available.
productprocesskythene
-
A library-centric Go monorepo, and the one rule that makes it work
38 shared libraries across 75 modules and a dozen production apps, run by one person. The thing that makes it survivable isn't the tooling - it's a rule about where a fix is allowed to go, and a worked example of paying it.
gomonorepoarchitecture
-
Why your OpenTelemetry build broke, and how to check the whole set
OpenTelemetry ships as several modules with different version numbers that are all one release. Go has no idea. Here is how to tell which versions belong together, why it breaks, and a check you can run in CI today.
goopentelemetrydependencies