Sign in

Vincent Bernat

@vincent.bernat.ch
508 followers 219 following 174 posts

Network engineer at AS12322. Debian and free software developer. Like to work on projects with C, Python, or Go. He/him. vincent.bernat.ch

PostsRepliesMedia
Reposted by Vincent Bernat
Miguel de Icaza @migueldeicaza.bsky.social · 24/09/2026
From twitter bad_pote
511730
Vincent Bernat @vincent.bernat.ch · 20/09/2026
Bot-free self-hosted analytics with GoatCounter on NixOS: vincent.bernat.ch/en/blog/2026.... With an alternative JavaScript client, a fallback to CSS, an overdoing local proxy, and a lot of NixOS, including Litestream to backup an SQLite database!
vincent.bernat.ch
Bot-free self-hosted analytics with GoatCounter on NixOS
AI scrapers inflated my visitor count tenfold. I now count a visit only after a user interaction, buffer hits on each web server, and back up the...
011
Vincent Bernat @vincent.bernat.ch · 12/09/2026
Quality of life in Thunderbird with this patch to avoid drag&drop folders by accident: github.com/vincentberna.... Thanks to Nix, it's no issue to apply such a patch.
github.com
homemanager-configuration/patches/thunderbird-folder-drag.patch at main · vincentbernat/homemanager-configuration
home-manager configuration for use with Debian Sid - vincentbernat/homemanager-configuration
002
Vincent Bernat @vincent.bernat.ch · 07/09/2026
Sidenotes with CSS anchor positioning: vincent.bernat.ch/en/blog/2026.... A short post about positioning notes in the margin (and not at the end of the document) and a digression on how to spend far more time than needed on this issue.
vincent.bernat.ch
Sidenotes with CSS anchor positioning
Sidenotes positioned in the margin with CSS anchor positioning, without JavaScript. On narrow viewports and older browsers, they fall back below...
020
Vincent Bernat @vincent.bernat.ch · 04/09/2026
I tried uploading my latest video on Youtube. It seems that I have to be "verified" to be able to add a link to the text version or to add a second language track. I also immediately got a claim about the audio soundtrack, while its recording is CC-PDM-1.0. So, I've just deleted the video.
120
Vincent Bernat @vincent.bernat.ch · 01/09/2026
It's difficult to build very high performance tools in Go. For example, BART would benefit for an helper over net/netip: github.com/golang/go/is.... Unfortunately, the maintainers consistently reject these APIs but Go don't really offer any safe workaround. You can't extend, you can't fork.
github.com
proposal: net/netip: add Prefix.ContainsIPv4Unchecked and Prefix.ContainsIPv6Unchecked for hot-path lookups · Issue #81236 · golang/go
Proposal Details Author Karl Gaissmaier Abstract I propose adding two exported, fully inlinable methods to netip.Prefix: ContainsIPv4Unchecked(Addr) bool ContainsIPv6Unchecked(Addr) bool. These met...
011
Vincent Bernat @vincent.bernat.ch · 29/08/2026
Minor update for Akvorado, your beloved flow collector. Among them, a few small fixes, the ability to zoom out, or the support for DB-IP. github.com/akvorado/akv...
github.com
Release v2026.8.1 · akvorado/akvorado
💥 console: console.homepage-graph-filter now uses the console filter language instead of SQL 🩹 console: fix completion for DstNetName and the other network attributes 🩹 console: accept again an emp...
051
Vincent Bernat @vincent.bernat.ch · 24/08/2026
An interactive introduction to the spanning tree protocol: vincent.bernat.ch/en/blog/2026.... While the spanning tree protocol is quite old, it is still sometimes useful. This article explores it with interactive demonstrations running a real daemon (MSTPD) compiled to WebAssembly with Emscripten.
vincent.bernat.ch
An interactive introduction to the spanning tree protocol
Root election, port roles, proposals and agreements, topology changes: explore RSTP through simulations powered by MSTPD compiled to WebAssembly.
293
Vincent Bernat @vincent.bernat.ch · 23/08/2026
Wow, FVWM is coming to Wayland! codeberg.org/thomasadam/cow!
codeberg.org
cow
Compositor on Wayland -- a stacking window manager using river as the compositor. CoW aims to behave like fvwm and mwm from X11.
133
Vincent Bernat @vincent.bernat.ch · 15/08/2026
nixpkgs multiverse, now faster and leaner! fzakaria.com/2026/08/14/n... With the previous iteration released last week, if you pin a lot of packages, you pull many versions of nixpkgs and evaluate them. Not anymore! You can fetch directly from the cache! Look at the other articles from the blog too
fzakaria.com
nixpkgs-multiverse: fast mode
“The fastest evaluation is the one that never happens.” – Sun Tzu, The Art of Evaluation
130
Vincent Bernat @vincent.bernat.ch · 13/08/2026
In Debian, CDBS has been deprecated and removed. It didn't get much love, but for a very long time, it made packaging easier by making implicit good decisions, a bit like the "recent" dh command sequencer (2008).
010
Vincent Bernat @vincent.bernat.ch · 12/08/2026
New release of Akvorado, a IPFIX/sFlow collector with a builtin web interface for visualization. We are switching to CalVer for versioning. The GeoIP/networks database migrates from the orchestrator to the outlet. It is now possible to export enriched flows to Kafka. github.com/akvorado/akv...
github.com
Release v2026.8.0 · akvorado/akvorado
Akvorado does not use the networks ClickHouse dictionary anymore. It is not removed on upgrade: it still holds a copy of the GeoIP databases in ClickHouse memory. Drop it on each cluster member onc...
040
Reposted by Vincent Bernat
viveksb007.bsky.social @viveksb007.bsky.social · 06/08/2026
came across a neat post to understand IP lookup using trie and other optimizations on top of it. thanks @vincent.bernat.ch vincent.bernat.ch/en/blog/2017...
vincent.bernat.ch
IPv4 route lookup on Linux
Linux uses an LPC-trie for looking up routes. It provides good performance with low memory use even with millions of routes.
022
Vincent Bernat @vincent.bernat.ch · 26/07/2026
I was about to write an article comparing semicolons in English with BGP confederations in networking: both of them are taught in class but shouldn't be used outside. Unfortunately, it seems the discourse around semicolons is more nuanced.
120
Reposted by Vincent Bernat
Ky @ky.fyi · 15/07/2026
for fellow freaks who want to render sheet music by writing plain text inside of markdown inside of Astro, well, I made something for you! astro-lilypond converts text to SVG and works in markdown or with a <LilyPond> component. zero client-side JS. 🎶 docs and install: lilypond.ky.fyi
lilypond.ky.fyi
Astro LilyPond
Render LilyPond music notation to images with Astro.
2028257
Vincent Bernat @vincent.bernat.ch · 18/07/2026
I've asked IEEE the authorization to reproduce one diagram from IEEE 802.1Q (through standards.ieee.org/ipr/copyrigh...). Do they answer "fast"?
standards.ieee.org
IEEE Standards Permission For Use Form
Submit requests for permission for use of IEEE copyrighted material published by IEEE Standards Association.
000
Vincent Bernat @vincent.bernat.ch · 17/07/2026
I had this article about contributing to RRDtool in draft for more than 10 years! I just published it "as is:" vincent.bernat.ch/en/blog/2013... The goal was to encourage people around me to contribute to open source. Unfortunately, the patch took a bit of time to be accepted.
vincent.bernat.ch
Contributing to open source: a new feature for RRDtool
Note (2026-07) This article was not completed and stayed as a draft for more than 10 years. As I think it is still useful today, even incomplete,...
050
Vincent Bernat @vincent.bernat.ch · 14/07/2026
Just published Akvorado 2.4.1, your friendly IPFIX/NetFlow/sFlow collector: github.com/akvorado/akv....
github.com
Release v2.4.1 · akvorado/akvorado
🩹 outlet: fix decoding of destination MAC address for sFlow 🩹 console: avoid clipped labels in Sankey graphs 🩹 console: fix empty widgets when toggling dark mode 🌱 outlet: improve BMP RIB performan...
030
Vincent Bernat @vincent.bernat.ch · 14/07/2026
In Firefox, one tab for Outlook Web and one tab for Teams already eats 2.1GB of RAM. The next one is Zulip with only 150MB (which I think is OK).
120
Reposted by Vincent Bernat
Charity Majors @charity.wtf · 21/06/2026
ah yes...I should also post about OUR book. the 2nd edition of "Observability Engineering" is now available for download.. and you can download it for free on the honeycomb site. this was supposed to be an update, and ended up being a total rewrite (& then some). 😅 www.honeycomb.io/blog/the-sec...
honeycomb.io
The Second Edition of Observability Engineering Is Here
IT’S HERE it’s here it’s here it’s here!!!! The second edition of Observability Engineering is available for download, and since Honeycomb is the sponsor, you can now download it from our website (th...
711125
Reposted by Vincent Bernat
Sam Rose @samwho.dev · 18/06/2026
I've made a Kubernetes that runs in the browser, and today we're open sourcing it. The hope here is to make super interactive and visual web content about Kubernetes much easier to write, and we have a whole bunch planned this year. Repo: github.com/ngrok/webern... Demo: webernetes-demo.ngrok.app
1317436
Reposted by Vincent Bernat
Cynthia Dunlop @cynthiadunlop.bsky.social · 16/06/2026
(Some) writers appreciate LLM writing assistance but readers hate it. Survey says… writethatblog.substack.com/p/dev-reacti... If readers suspect AI, they not only stop reading, but also downvote/avoid the author.
how readers react to AI assisted blogs
25516
Vincent Bernat @vincent.bernat.ch · 16/06/2026
Building a Soviet Nail Factory: how KPIs killed efficiency. A story that I often tell. It is now old enough to not upset my former colleagues. vincent.bernat.ch/en/blog/2026...
vincent.bernat.ch
Building a Soviet Nail Factory: how KPIs killed efficiency
How an obsession with KPIs at Orange led people to game them, slowing service delivery to a crawl. A cautionary tale about Goodhart's law.
063
Vincent Bernat @vincent.bernat.ch · 12/06/2026
TIL: `export -f` in bash can export a function to a subshell
052
Reposted by Vincent Bernat
Charity Majors @charity.wtf · 06/06/2026
yes!! thank you for noticing!! :D i have been going to TOWN lately generating sticker art and slogans and learning graphic design fundamentals. maybe i will write about that today, hm. this is one of my favorite themes.. it feels very.. scandinavian? i will mail you some if you give me an address!
scandinavian cranky tech stickers theme
2101
Vincent Bernat @vincent.bernat.ch · 10/06/2026
Blogging with an LLM assistant: vincent.bernat.ch/en/blog/2026... (grammar, copyediting, translation). This specific post is *not* modified by an LLM.
vincent.bernat.ch
Blogging with an LLM assistant
As a non-native English writer, I rely on LLMs for grammar, copyediting, and translation, despite hating AI slop.
050
Reposted by Vincent Bernat
Charity Majors @charity.wtf · 03/06/2026
i wrote a post about the growing divide between AI skeptics and AI enthusiasts. wins and costs are both real, but too often fall on different groups of people. when you're only experiencing half the story, it's too easy to write each other off. charitydotwtf.substack.com/p/ai-enthusi...
charitydotwtf.substack.com
AI enthusiasts are in a race against time, AI skeptics are in a race against entropy
Both sides are grappling with a real existential threat, and both sides feel like they are screaming into the void. Here's how to close the gap and get everyone pulling in the same direction.
109434
Vincent Bernat @vincent.bernat.ch · 05/06/2026
This MT7915 card seems supported by Linux and features two radios and could advertise 16 SSIDs. Anyone knows if they work well? asiarf.com/product/wifi...
asiarf.com
WiFi 6 11ax DBDC 1800Mbps Mini PCIe Module AW7915-NPD
AW7915-NPD is a WiFi 6 11ax 2T2R 1800Mbps mini PCIe Module powered by MediaTek MT7915DAN with FCC CE certificated.
110
Vincent Bernat @vincent.bernat.ch · 27/05/2026
New release of Akvorado (direct from the train to Montpellier): github.com/akvorado/akv.... There is a new bidirectional option for Sankey graphs. Also, some improvements on handling the RIB. The next version is likely to ship an architecture change to pave the way to more flexible flow enrichment.
github.com
Release v2.4.0 · akvorado/akvorado
💥 build: require x86-64-v3 baseline for binary shipped with each release (supported by most CPU after 2014, no change for the Docker image) ✨ console: add a "bidirectional" option for sankey graphs...
050
Reposted by Vincent Bernat
Kevin Powell @kevinpowell.co · 21/05/2026
More and more people I deeply respect and have learned a lot from over the years feel like they are speaking into a void, to the point where they are losing motivation to continue making content, which got me to write my first post on my site in over a year... www.kevinpowell.co/article/tell...
3030078
Vincent Bernat @vincent.bernat.ch · 24/05/2026
Scaling Akvorado BMP RIB with sharding. Making an efficient RIB to store 10M+ routes is challenging. While writing this article, I discovered additional optimizations. That's one reason to blog! vincent.bernat.ch/en/blog/2026...
vincent.bernat.ch
Scaling Akvorado BMP RIB with sharding
How Akvorado's BMP component scales to tens of millions of routes thanks to RIB sharding and lock-free reads.
042
Vincent Bernat @vincent.bernat.ch · 17/05/2026
I didn't notice until recently, but Epiphany, the GNOME browser, is quite on par with Safari. Same rendering engine, same JS engine, almost the same UI. It's convenient to test "Safari" on Linux.
031
Vincent Bernat @vincent.bernat.ch · 16/05/2026
Don't upgrade Docker Engine to 29.5.0 if you are using Akvorado. It breaks the conntrack handling. See here for some details: github.com/akvorado/akv... 😭
github.com
Conntrack issue with Docker 29.5.0 (not receiving new flows) · Issue #2431 · akvorado/akvorado
Disclaimer I have read and understood the disclaimer. I am a new user. Akvorado version 2.3.0 Bug description After updating to Docker 29.5.0 from 29.4.3, all new flows stopped being processed by A...
001
Vincent Bernat @vincent.bernat.ch · 15/05/2026
Another 0-day in Linux, discovered by someone reading the commit log of the master branch. This one is more difficult to workaround as it does not rely on any module. It does not allow to read arbitrary files, "just" files read by a suid binary. github.com/0xdeadbeefne...
github.com
GitHub - 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn
051
Vincent Bernat @vincent.bernat.ch · 15/05/2026
Just published lldpd 1.0.22, which contains some security fixes, notably CVE-2026-46433. It is evaluated to 6.5/10. I think this is a bit high, as in most cases, ASan is not enabled and you can't reliably crash the process. github.com/lldpd/lldpd/...
github.com
Heap OOB Read in VLAN Decapsulation memmove
## Summary `lldpd_decode()` in `src/daemon/lldpd.c` strips 802.1Q VLAN tags from received Ethernet frames by calling `memmove()` to shift the frame payload 4 bytes left. The third argument (byte...
011
Reposted by Vincent Bernat
Jeff Geerling @jeffgeerling.com · 12/05/2026
Bambu Lab 3D printers: never again. They're breaking the open source social contract (for the nth time...), and I'm past hoping they'll amend their ways. www.youtube.com/watch?v=eb48...
youtube.com
Bambu Lab 3D printers: Never again
YouTube video by Jeff Geerling
1118340
Reposted by Vincent Bernat
isabel @isabelroses.com · 08/05/2026
At a time of 2 local privilege escalation vulnerabilities I find a good time to finally get my blog post on nixos and its relation with secrets out. I would summarise it with the following words: PLEASE DO NOT PUT SECRETS IN THE NIX STORE. IT IS WORLD-READABLE. isabelroses.com/blog/nixos-a...
isabelroses.com
NixOS and Secrets
My takes and experinces with secrets management on NixOS
68819
Reposted by Vincent Bernat
StepBroBD @stepbrobd.com · 08/05/2026
terranix is actually really enjoyable to use, you basically get the entirety of hcl but in nix, and everything boils down to a config.tf.json for diffing and applying
011
Reposted by Vincent Bernat
Laurent Cheylus @lcheylus.bsky.social · 08/05/2026
Swissing a Table: moving step by step from a simple hash table to a "swiss table", the design behind Go’s new map implementation - Article by Phil Pearl @philpearl.bsky.social #Programming #Golang philpearl.github.io/post/swissin...
philpearl.github.io
Swissing a table · Phil Pearl's Blog
Moving step by step from a simple hash table to a “swiss table” — the design behind Go’s new map implementation.
052
Vincent Bernat @vincent.bernat.ch · 08/05/2026
Instead of blacklisting unused kernel modules, we can just disable kernel module loading after boot is complete with sysctl -w kernel.modules_disabled=1. At least on most servers. Example with NixOS: github.com/vincentberna...
github.com
common: lock kernel modules after boot · vincentbernat/nixops-take1@ed752cb
031
Vincent Bernat @vincent.bernat.ch · 08/05/2026
Four Column ASCII. This explains the ASCII table uses 2 bits for modifiers including CTRL and SHIFT. This makes keyboards easier to implement without electronic logic. garbagecollected.org/2017/01/31/f...
garbagecollected.org
Four Column ASCII
032
Vincent Bernat @vincent.bernat.ch · 08/05/2026
Nginx 1.30 ships a new "add_header_inherit" that could solve a longtime pain point when handling headers. Unfortunately, it does not allow one to override an existing header with a new value (it's append only). One day, I should migrate to Caddy. nginx.org/en/docs/http...
nginx.org
Module ngx_http_headers_module
110
Vincent Bernat @vincent.bernat.ch · 06/05/2026
For unknown reasons, I spent some time adding an XSLT stylesheet to the ATOM feed of my blog while I know this technology is being removed from Chromium and Firefox. 🤷‍♂️ There are some sharp edges around it (notably whitespace handling). vincent.bernat.ch/en/blog/atom...
vincent.bernat.ch
010
Vincent Bernat @vincent.bernat.ch · 06/05/2026
This tool looks well designed and polished: well-specified interface, minimalist, and a use case with NixOS read-only images. I keep it in the back of my mind. ruuda.nl/2026/deptool
ruuda.nl
Building the deployment tool I wish I had
Deptool is a new declarative configuration deployment tool that I built for myself. In this post I describe the design, and I explain what problems it solves.
100
Vincent Bernat @vincent.bernat.ch · 04/05/2026
The IPv8 draft has been updated twice and its author is debating it on the NANOG mailing list. I noticed that too late and there are too many messages to read. My opinion: still crazy. datatracker.ietf.org/doc/draft-th...
datatracker.ietf.org
Internet Protocol Version 8 (IPv8)
Internet Protocol Version 8 (IPv8) is a managed network protocol suite that transforms how networks of every scale -- from home networks to the global internet -- are operated, secured, and monitored....
022
Vincent Bernat @vincent.bernat.ch · 04/05/2026
I am not able to upload anything to Launchpad PPA since 4 days ago. I get either timeout or connection refused. Yet, status.canonical.com does not say there is an outage.
status.canonical.com
Welcome to Canonical and Ubuntu Status! View active incident progress, historical component status, and subscribe to email and RSS notifications for components and incidents on the move.
000
Vincent Bernat @vincent.bernat.ch · 27/04/2026
From Milliseconds to 26 Nanoseconds: How a $20 eBay SFP Module Beat My Entire NTP Setup. It's a special SFP multicasting PTP frames to the network! austinsnerdythings.com/2026/04/26/p...
austinsnerdythings.com
From Milliseconds to 26 Nanoseconds: How a $20 eBay SFP Module Beat My Entire NTP Setup - Austin's Nerdy Things
Welcome to Austin’s Nerdy Things, where we spend years chasing nanoseconds that nobody asked us to chase. Five years ago, I started this blog by building a microsecond-accurate NTP server with a Raspb...
042
Vincent Bernat @vincent.bernat.ch · 26/04/2026
Amazing post on how to optimize measuring durations on Linux.
020
Reposted by Vincent Bernat
Ky @ky.fyi · 24/04/2026
I wrote about why I quit my job, and how weird and tiring tech feels these days.
ky.fyi
Do I belong in tech anymore?
On quitting, the spread of AI, and the loss of an ideal.
1281791545
Reposted by Vincent Bernat
Golang Articles, News, Packages @golangch.bsky.social · 24/04/2026
Log analytics in a single binary. No dependencies. Lynx Flow query language #golang github.com/lynxbase/ly...
github.com
GitHub - lynxbase/lynxdb: A lightweight schema-on-read analytics in a single binary
A lightweight schema-on-read analytics in a single binary - lynxbase/lynxdb
041