Reposted by Vincent BernatMiguel de Icaza @migueldeicaza.bsky.social · 24/09/2026From twitter bad_pote 511730
Vincent Bernat @vincent.bernat.ch · 20/09/2026Bot-free self-hosted analytics with GoatCounter on NixOS: vincent.bernat.ch/en/blog/2026.... With an alternative JavaScript client, a fallback to CSS, an overdoing local proxy, and a lot of NixOS, including Litestream to backup an SQLite database!vincent.bernat.chBot-free self-hosted analytics with GoatCounter on NixOSAI scrapers inflated my visitor count tenfold. I now count a visit only after a user interaction, buffer hits on each web server, and back up the... 011
Vincent Bernat @vincent.bernat.ch · 12/09/2026Quality of life in Thunderbird with this patch to avoid drag&drop folders by accident: github.com/vincentberna.... Thanks to Nix, it's no issue to apply such a patch.github.comhomemanager-configuration/patches/thunderbird-folder-drag.patch at main · vincentbernat/homemanager-configurationhome-manager configuration for use with Debian Sid - vincentbernat/homemanager-configuration 002
Vincent Bernat @vincent.bernat.ch · 07/09/2026Sidenotes with CSS anchor positioning: vincent.bernat.ch/en/blog/2026.... A short post about positioning notes in the margin (and not at the end of the document) and a digression on how to spend far more time than needed on this issue.vincent.bernat.chSidenotes with CSS anchor positioningSidenotes positioned in the margin with CSS anchor positioning, without JavaScript. On narrow viewports and older browsers, they fall back below... 020
Vincent Bernat @vincent.bernat.ch · 04/09/2026I tried uploading my latest video on Youtube. It seems that I have to be "verified" to be able to add a link to the text version or to add a second language track. I also immediately got a claim about the audio soundtrack, while its recording is CC-PDM-1.0. So, I've just deleted the video. 120
Vincent Bernat @vincent.bernat.ch · 01/09/2026It's difficult to build very high performance tools in Go. For example, BART would benefit for an helper over net/netip: github.com/golang/go/is.... Unfortunately, the maintainers consistently reject these APIs but Go don't really offer any safe workaround. You can't extend, you can't fork.github.comproposal: net/netip: add Prefix.ContainsIPv4Unchecked and Prefix.ContainsIPv6Unchecked for hot-path lookups · Issue #81236 · golang/goProposal Details Author Karl Gaissmaier Abstract I propose adding two exported, fully inlinable methods to netip.Prefix: ContainsIPv4Unchecked(Addr) bool ContainsIPv6Unchecked(Addr) bool. These met... 011
Vincent Bernat @vincent.bernat.ch · 29/08/2026Minor update for Akvorado, your beloved flow collector. Among them, a few small fixes, the ability to zoom out, or the support for DB-IP. github.com/akvorado/akv...github.comRelease v2026.8.1 · akvorado/akvorado💥 console: console.homepage-graph-filter now uses the console filter language instead of SQL 🩹 console: fix completion for DstNetName and the other network attributes 🩹 console: accept again an emp... 051
Vincent Bernat @vincent.bernat.ch · 24/08/2026An interactive introduction to the spanning tree protocol: vincent.bernat.ch/en/blog/2026.... While the spanning tree protocol is quite old, it is still sometimes useful. This article explores it with interactive demonstrations running a real daemon (MSTPD) compiled to WebAssembly with Emscripten.vincent.bernat.chAn interactive introduction to the spanning tree protocolRoot election, port roles, proposals and agreements, topology changes: explore RSTP through simulations powered by MSTPD compiled to WebAssembly. 293
Vincent Bernat @vincent.bernat.ch · 23/08/2026Wow, FVWM is coming to Wayland! codeberg.org/thomasadam/cow!codeberg.orgcowCompositor on Wayland -- a stacking window manager using river as the compositor. CoW aims to behave like fvwm and mwm from X11. 133
Vincent Bernat @vincent.bernat.ch · 15/08/2026nixpkgs multiverse, now faster and leaner! fzakaria.com/2026/08/14/n... With the previous iteration released last week, if you pin a lot of packages, you pull many versions of nixpkgs and evaluate them. Not anymore! You can fetch directly from the cache! Look at the other articles from the blog toofzakaria.comnixpkgs-multiverse: fast mode“The fastest evaluation is the one that never happens.” – Sun Tzu, The Art of Evaluation 130
Vincent Bernat @vincent.bernat.ch · 13/08/2026In Debian, CDBS has been deprecated and removed. It didn't get much love, but for a very long time, it made packaging easier by making implicit good decisions, a bit like the "recent" dh command sequencer (2008). 010
Vincent Bernat @vincent.bernat.ch · 12/08/2026New release of Akvorado, a IPFIX/sFlow collector with a builtin web interface for visualization. We are switching to CalVer for versioning. The GeoIP/networks database migrates from the orchestrator to the outlet. It is now possible to export enriched flows to Kafka. github.com/akvorado/akv...github.comRelease v2026.8.0 · akvorado/akvoradoAkvorado does not use the networks ClickHouse dictionary anymore. It is not removed on upgrade: it still holds a copy of the GeoIP databases in ClickHouse memory. Drop it on each cluster member onc... 040
Reposted by Vincent Bernatviveksb007.bsky.social @viveksb007.bsky.social · 06/08/2026came across a neat post to understand IP lookup using trie and other optimizations on top of it. thanks @vincent.bernat.ch vincent.bernat.ch/en/blog/2017...vincent.bernat.chIPv4 route lookup on LinuxLinux uses an LPC-trie for looking up routes. It provides good performance with low memory use even with millions of routes. 022
Vincent Bernat @vincent.bernat.ch · 26/07/2026I was about to write an article comparing semicolons in English with BGP confederations in networking: both of them are taught in class but shouldn't be used outside. Unfortunately, it seems the discourse around semicolons is more nuanced. 120
Reposted by Vincent BernatKy @ky.fyi · 15/07/2026for fellow freaks who want to render sheet music by writing plain text inside of markdown inside of Astro, well, I made something for you! astro-lilypond converts text to SVG and works in markdown or with a <LilyPond> component. zero client-side JS. 🎶 docs and install: lilypond.ky.fyililypond.ky.fyiAstro LilyPondRender LilyPond music notation to images with Astro. 2028257
Vincent Bernat @vincent.bernat.ch · 18/07/2026I've asked IEEE the authorization to reproduce one diagram from IEEE 802.1Q (through standards.ieee.org/ipr/copyrigh...). Do they answer "fast"?standards.ieee.orgIEEE Standards Permission For Use FormSubmit requests for permission for use of IEEE copyrighted material published by IEEE Standards Association. 000
Vincent Bernat @vincent.bernat.ch · 17/07/2026I had this article about contributing to RRDtool in draft for more than 10 years! I just published it "as is:" vincent.bernat.ch/en/blog/2013... The goal was to encourage people around me to contribute to open source. Unfortunately, the patch took a bit of time to be accepted.vincent.bernat.chContributing to open source: a new feature for RRDtoolNote (2026-07) This article was not completed and stayed as a draft for more than 10 years. As I think it is still useful today, even incomplete,... 050
Vincent Bernat @vincent.bernat.ch · 14/07/2026Just published Akvorado 2.4.1, your friendly IPFIX/NetFlow/sFlow collector: github.com/akvorado/akv....github.comRelease v2.4.1 · akvorado/akvorado🩹 outlet: fix decoding of destination MAC address for sFlow 🩹 console: avoid clipped labels in Sankey graphs 🩹 console: fix empty widgets when toggling dark mode 🌱 outlet: improve BMP RIB performan... 030
Vincent Bernat @vincent.bernat.ch · 14/07/2026In Firefox, one tab for Outlook Web and one tab for Teams already eats 2.1GB of RAM. The next one is Zulip with only 150MB (which I think is OK). 120
Reposted by Vincent BernatCharity Majors @charity.wtf · 21/06/2026ah yes...I should also post about OUR book. the 2nd edition of "Observability Engineering" is now available for download.. and you can download it for free on the honeycomb site. this was supposed to be an update, and ended up being a total rewrite (& then some). 😅 www.honeycomb.io/blog/the-sec...honeycomb.ioThe Second Edition of Observability Engineering Is HereIT’S HERE it’s here it’s here it’s here!!!! The second edition of Observability Engineering is available for download, and since Honeycomb is the sponsor, you can now download it from our website (th... 711125
Reposted by Vincent BernatSam Rose @samwho.dev · 18/06/2026I've made a Kubernetes that runs in the browser, and today we're open sourcing it. The hope here is to make super interactive and visual web content about Kubernetes much easier to write, and we have a whole bunch planned this year. Repo: github.com/ngrok/webern... Demo: webernetes-demo.ngrok.app 1317436
Reposted by Vincent BernatCynthia Dunlop @cynthiadunlop.bsky.social · 16/06/2026(Some) writers appreciate LLM writing assistance but readers hate it. Survey says… writethatblog.substack.com/p/dev-reacti... If readers suspect AI, they not only stop reading, but also downvote/avoid the author. 25516
Vincent Bernat @vincent.bernat.ch · 16/06/2026Building a Soviet Nail Factory: how KPIs killed efficiency. A story that I often tell. It is now old enough to not upset my former colleagues. vincent.bernat.ch/en/blog/2026...vincent.bernat.chBuilding a Soviet Nail Factory: how KPIs killed efficiencyHow an obsession with KPIs at Orange led people to game them, slowing service delivery to a crawl. A cautionary tale about Goodhart's law. 063
Vincent Bernat @vincent.bernat.ch · 12/06/2026TIL: `export -f` in bash can export a function to a subshell 052
Reposted by Vincent BernatCharity Majors @charity.wtf · 06/06/2026yes!! thank you for noticing!! :D i have been going to TOWN lately generating sticker art and slogans and learning graphic design fundamentals. maybe i will write about that today, hm. this is one of my favorite themes.. it feels very.. scandinavian? i will mail you some if you give me an address! 2101
Vincent Bernat @vincent.bernat.ch · 10/06/2026Blogging with an LLM assistant: vincent.bernat.ch/en/blog/2026... (grammar, copyediting, translation). This specific post is *not* modified by an LLM.vincent.bernat.chBlogging with an LLM assistantAs a non-native English writer, I rely on LLMs for grammar, copyediting, and translation, despite hating AI slop. 050
Reposted by Vincent BernatCharity Majors @charity.wtf · 03/06/2026i wrote a post about the growing divide between AI skeptics and AI enthusiasts. wins and costs are both real, but too often fall on different groups of people. when you're only experiencing half the story, it's too easy to write each other off. charitydotwtf.substack.com/p/ai-enthusi...charitydotwtf.substack.comAI enthusiasts are in a race against time, AI skeptics are in a race against entropyBoth sides are grappling with a real existential threat, and both sides feel like they are screaming into the void. Here's how to close the gap and get everyone pulling in the same direction. 109434
Vincent Bernat @vincent.bernat.ch · 05/06/2026This MT7915 card seems supported by Linux and features two radios and could advertise 16 SSIDs. Anyone knows if they work well? asiarf.com/product/wifi...asiarf.comWiFi 6 11ax DBDC 1800Mbps Mini PCIe Module AW7915-NPDAW7915-NPD is a WiFi 6 11ax 2T2R 1800Mbps mini PCIe Module powered by MediaTek MT7915DAN with FCC CE certificated. 110
Vincent Bernat @vincent.bernat.ch · 27/05/2026New release of Akvorado (direct from the train to Montpellier): github.com/akvorado/akv.... There is a new bidirectional option for Sankey graphs. Also, some improvements on handling the RIB. The next version is likely to ship an architecture change to pave the way to more flexible flow enrichment.github.comRelease v2.4.0 · akvorado/akvorado💥 build: require x86-64-v3 baseline for binary shipped with each release (supported by most CPU after 2014, no change for the Docker image) ✨ console: add a "bidirectional" option for sankey graphs... 050
Reposted by Vincent BernatKevin Powell @kevinpowell.co · 21/05/2026More and more people I deeply respect and have learned a lot from over the years feel like they are speaking into a void, to the point where they are losing motivation to continue making content, which got me to write my first post on my site in over a year... www.kevinpowell.co/article/tell... 3030078
Vincent Bernat @vincent.bernat.ch · 24/05/2026Scaling Akvorado BMP RIB with sharding. Making an efficient RIB to store 10M+ routes is challenging. While writing this article, I discovered additional optimizations. That's one reason to blog! vincent.bernat.ch/en/blog/2026...vincent.bernat.chScaling Akvorado BMP RIB with shardingHow Akvorado's BMP component scales to tens of millions of routes thanks to RIB sharding and lock-free reads. 042
Vincent Bernat @vincent.bernat.ch · 17/05/2026I didn't notice until recently, but Epiphany, the GNOME browser, is quite on par with Safari. Same rendering engine, same JS engine, almost the same UI. It's convenient to test "Safari" on Linux. 031
Vincent Bernat @vincent.bernat.ch · 16/05/2026Don't upgrade Docker Engine to 29.5.0 if you are using Akvorado. It breaks the conntrack handling. See here for some details: github.com/akvorado/akv... 😭github.comConntrack issue with Docker 29.5.0 (not receiving new flows) · Issue #2431 · akvorado/akvoradoDisclaimer I have read and understood the disclaimer. I am a new user. Akvorado version 2.3.0 Bug description After updating to Docker 29.5.0 from 29.4.3, all new flows stopped being processed by A... 001
Vincent Bernat @vincent.bernat.ch · 15/05/2026Another 0-day in Linux, discovered by someone reading the commit log of the master branch. This one is more difficult to workaround as it does not rely on any module. It does not allow to read arbitrary files, "just" files read by a suid binary. github.com/0xdeadbeefne...github.comGitHub - 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn 051
Vincent Bernat @vincent.bernat.ch · 15/05/2026Just published lldpd 1.0.22, which contains some security fixes, notably CVE-2026-46433. It is evaluated to 6.5/10. I think this is a bit high, as in most cases, ASan is not enabled and you can't reliably crash the process. github.com/lldpd/lldpd/...github.comHeap OOB Read in VLAN Decapsulation memmove## Summary `lldpd_decode()` in `src/daemon/lldpd.c` strips 802.1Q VLAN tags from received Ethernet frames by calling `memmove()` to shift the frame payload 4 bytes left. The third argument (byte... 011
Reposted by Vincent BernatJeff Geerling @jeffgeerling.com · 12/05/2026Bambu Lab 3D printers: never again. They're breaking the open source social contract (for the nth time...), and I'm past hoping they'll amend their ways. www.youtube.com/watch?v=eb48...youtube.comBambu Lab 3D printers: Never againYouTube video by Jeff Geerling 1118340
Reposted by Vincent Bernatisabel @isabelroses.com · 08/05/2026At a time of 2 local privilege escalation vulnerabilities I find a good time to finally get my blog post on nixos and its relation with secrets out. I would summarise it with the following words: PLEASE DO NOT PUT SECRETS IN THE NIX STORE. IT IS WORLD-READABLE. isabelroses.com/blog/nixos-a...isabelroses.comNixOS and SecretsMy takes and experinces with secrets management on NixOS 68819
Reposted by Vincent BernatStepBroBD @stepbrobd.com · 08/05/2026terranix is actually really enjoyable to use, you basically get the entirety of hcl but in nix, and everything boils down to a config.tf.json for diffing and applying 011
Reposted by Vincent BernatLaurent Cheylus @lcheylus.bsky.social · 08/05/2026Swissing a Table: moving step by step from a simple hash table to a "swiss table", the design behind Go’s new map implementation - Article by Phil Pearl @philpearl.bsky.social #Programming #Golang philpearl.github.io/post/swissin...philpearl.github.ioSwissing a table · Phil Pearl's BlogMoving step by step from a simple hash table to a “swiss table” — the design behind Go’s new map implementation. 052
Vincent Bernat @vincent.bernat.ch · 08/05/2026Instead of blacklisting unused kernel modules, we can just disable kernel module loading after boot is complete with sysctl -w kernel.modules_disabled=1. At least on most servers. Example with NixOS: github.com/vincentberna...github.comcommon: lock kernel modules after boot · vincentbernat/nixops-take1@ed752cb 031
Vincent Bernat @vincent.bernat.ch · 08/05/2026Four Column ASCII. This explains the ASCII table uses 2 bits for modifiers including CTRL and SHIFT. This makes keyboards easier to implement without electronic logic. garbagecollected.org/2017/01/31/f...garbagecollected.orgFour Column ASCII 032
Vincent Bernat @vincent.bernat.ch · 08/05/2026Nginx 1.30 ships a new "add_header_inherit" that could solve a longtime pain point when handling headers. Unfortunately, it does not allow one to override an existing header with a new value (it's append only). One day, I should migrate to Caddy. nginx.org/en/docs/http...nginx.orgModule ngx_http_headers_module 110
Vincent Bernat @vincent.bernat.ch · 06/05/2026For unknown reasons, I spent some time adding an XSLT stylesheet to the ATOM feed of my blog while I know this technology is being removed from Chromium and Firefox. 🤷♂️ There are some sharp edges around it (notably whitespace handling). vincent.bernat.ch/en/blog/atom...vincent.bernat.ch 010
Vincent Bernat @vincent.bernat.ch · 06/05/2026This tool looks well designed and polished: well-specified interface, minimalist, and a use case with NixOS read-only images. I keep it in the back of my mind. ruuda.nl/2026/deptoolruuda.nlBuilding the deployment tool I wish I hadDeptool is a new declarative configuration deployment tool that I built for myself. In this post I describe the design, and I explain what problems it solves. 100
Vincent Bernat @vincent.bernat.ch · 04/05/2026The IPv8 draft has been updated twice and its author is debating it on the NANOG mailing list. I noticed that too late and there are too many messages to read. My opinion: still crazy. datatracker.ietf.org/doc/draft-th...datatracker.ietf.orgInternet Protocol Version 8 (IPv8)Internet Protocol Version 8 (IPv8) is a managed network protocol suite that transforms how networks of every scale -- from home networks to the global internet -- are operated, secured, and monitored.... 022
Vincent Bernat @vincent.bernat.ch · 04/05/2026I am not able to upload anything to Launchpad PPA since 4 days ago. I get either timeout or connection refused. Yet, status.canonical.com does not say there is an outage.status.canonical.comWelcome to Canonical and Ubuntu Status! View active incident progress, historical component status, and subscribe to email and RSS notifications for components and incidents on the move. 000
Vincent Bernat @vincent.bernat.ch · 27/04/2026From Milliseconds to 26 Nanoseconds: How a $20 eBay SFP Module Beat My Entire NTP Setup. It's a special SFP multicasting PTP frames to the network! austinsnerdythings.com/2026/04/26/p...austinsnerdythings.comFrom Milliseconds to 26 Nanoseconds: How a $20 eBay SFP Module Beat My Entire NTP Setup - Austin's Nerdy ThingsWelcome to Austin’s Nerdy Things, where we spend years chasing nanoseconds that nobody asked us to chase. Five years ago, I started this blog by building a microsecond-accurate NTP server with a Raspb... 042
Vincent Bernat @vincent.bernat.ch · 26/04/2026Amazing post on how to optimize measuring durations on Linux. 020
Reposted by Vincent BernatKy @ky.fyi · 24/04/2026I wrote about why I quit my job, and how weird and tiring tech feels these days.ky.fyiDo I belong in tech anymore?On quitting, the spread of AI, and the loss of an ideal. 1281791545
Reposted by Vincent BernatGolang Articles, News, Packages @golangch.bsky.social · 24/04/2026Log analytics in a single binary. No dependencies. Lynx Flow query language #golang github.com/lynxbase/ly...github.comGitHub - lynxbase/lynxdb: A lightweight schema-on-read analytics in a single binaryA lightweight schema-on-read analytics in a single binary - lynxbase/lynxdb 041