iiinova — where your digital self keeps evolving

Self-hosted HTTP tunnels with SSH and nginx: vincent.bernat.ch/en/blog/2026.... That's like ngrok or Cloudflare Quick Tunnels, but self-hosted and you only need SSH.

vincent.bernat.ch

Self-hosted HTTP tunnels with SSH and nginx

No extra software to install: OpenSSH remote forwarding and nginx's secure_link module give you a shareable HTTPS URL with an expiring token.

020

Reposted by Vincent Bernat

Miguel de Icaza @migueldeicaza.bsky.social · 24/09/2026

From twitter bad_pote

511830

Vincent Bernat @vincent.bernat.ch · 20/09/2026

Bot-free self-hosted analytics with GoatCounter on NixOS: vincent.bernat.ch/en/blog/2026.... With an alternative JavaScript client, a fallback to CSS, an overdoing local proxy, and a lot of NixOS, including Litestream to backup an SQLite database!

vincent.bernat.ch

Bot-free self-hosted analytics with GoatCounter on NixOS

AI scrapers inflated my visitor count tenfold. I now count a visit only after a user interaction, buffer hits on each web server, and back up the...

011

Vincent Bernat @vincent.bernat.ch · 07/09/2026

Sidenotes with CSS anchor positioning: vincent.bernat.ch/en/blog/2026.... A short post about positioning notes in the margin (and not at the end of the document) and a digression on how to spend far more time than needed on this issue.

vincent.bernat.ch

Sidenotes with CSS anchor positioning

Sidenotes positioned in the margin with CSS anchor positioning, without JavaScript. On narrow viewports and older browsers, they fall back below...

020

Vincent Bernat @vincent.bernat.ch · 04/09/2026

I am self-publishing videos on my website using HLS (check https:// vincent.bernat.ch/en/blog/2018-self-hosted-videos). But, I made a video with two sound tracks and browsers don't support audio track selection without JavaScript. Maybe I'll switch to VideoJS 10 once it is not in beta anymore.

vincent.bernat.ch

Self-hosted videos with HLS

Putting videos on YouTube is a convenient solution, but not a privacy-friendly one. Using HLS, it's possible to self-host videos while being...

031

Vincent Bernat @vincent.bernat.ch · 04/09/2026

I tried uploading my latest video on Youtube. It seems that I have to be "verified" to be able to add a link to the text version or to add a second language track. I also immediately got a claim about the audio soundtrack, while its recording is CC-PDM-1.0. So, I've just deleted the video.

120

Vincent Bernat @vincent.bernat.ch · 01/09/2026

It's difficult to build very high performance tools in Go. For example, BART would benefit for an helper over net/netip: github.com/golang/go/is.... Unfortunately, the maintainers consistently reject these APIs but Go don't really offer any safe workaround. You can't extend, you can't fork.

github.com

proposal: net/netip: add Prefix.ContainsIPv4Unchecked and Prefix.ContainsIPv6Unchecked for hot-path lookups · Issue #81236 · golang/go

Proposal Details Author Karl Gaissmaier Abstract I propose adding two exported, fully inlinable methods to netip.Prefix: ContainsIPv4Unchecked(Addr) bool ContainsIPv6Unchecked(Addr) bool. These met...

011

Vincent Bernat @vincent.bernat.ch · 24/08/2026

An interactive introduction to the spanning tree protocol: vincent.bernat.ch/en/blog/2026.... While the spanning tree protocol is quite old, it is still sometimes useful. This article explores it with interactive demonstrations running a real daemon (MSTPD) compiled to WebAssembly with Emscripten.

vincent.bernat.ch

An interactive introduction to the spanning tree protocol

Root election, port roles, proposals and agreements, topology changes: explore RSTP through simulations powered by MSTPD compiled to WebAssembly.

293

Vincent Bernat @vincent.bernat.ch · 15/08/2026

nixpkgs multiverse, now faster and leaner! fzakaria.com/2026/08/14/n... With the previous iteration released last week, if you pin a lot of packages, you pull many versions of nixpkgs and evaluate them. Not anymore! You can fetch directly from the cache! Look at the other articles from the blog too

fzakaria.com

nixpkgs-multiverse: fast mode

“The fastest evaluation is the one that never happens.” – Sun Tzu, The Art of Evaluation

130

Vincent Bernat @vincent.bernat.ch · 13/08/2026

In Debian, CDBS has been deprecated and removed. It didn't get much love, but for a very long time, it made packaging easier by making implicit good decisions, a bit like the "recent" dh command sequencer (2008).

010

Vincent Bernat @vincent.bernat.ch · 12/08/2026

New release of Akvorado, a IPFIX/sFlow collector with a builtin web interface for visualization. We are switching to CalVer for versioning. The GeoIP/networks database migrates from the orchestrator to the outlet. It is now possible to export enriched flows to Kafka. github.com/akvorado/akv...

github.com

Release v2026.8.0 · akvorado/akvorado

Akvorado does not use the networks ClickHouse dictionary anymore. It is not removed on upgrade: it still holds a copy of the GeoIP databases in ClickHouse memory. Drop it on each cluster member onc...

040

Reposted by Vincent Bernat

viveksb007.bsky.social @viveksb007.bsky.social · 06/08/2026

came across a neat post to understand IP lookup using trie and other optimizations on top of it. thanks @vincent.bernat.ch vincent.bernat.ch/en/blog/2017...

vincent.bernat.ch

IPv4 route lookup on Linux

Linux uses an LPC-trie for looking up routes. It provides good performance with low memory use even with millions of routes.

022

Vincent Bernat @vincent.bernat.ch · 26/07/2026

I was about to write an article comparing semicolons in English with BGP confederations in networking: both of them are taught in class but shouldn't be used outside. Unfortunately, it seems the discourse around semicolons is more nuanced.

120

Reposted by Vincent Bernat

Ky @ky.fyi · 15/07/2026

for fellow freaks who want to render sheet music by writing plain text inside of markdown inside of Astro, well, I made something for you! astro-lilypond converts text to SVG and works in markdown or with a <LilyPond> component. zero client-side JS. 🎶 docs and install: lilypond.ky.fyi

lilypond.ky.fyi

Astro LilyPond

Render LilyPond music notation to images with Astro.

2028257

Vincent Bernat @vincent.bernat.ch · 18/07/2026

I've asked IEEE the authorization to reproduce one diagram from IEEE 802.1Q (through standards.ieee.org/ipr/copyrigh...). Do they answer "fast"?

standards.ieee.org

IEEE Standards Permission For Use Form

Submit requests for permission for use of IEEE copyrighted material published by IEEE Standards Association.

000

Vincent Bernat @vincent.bernat.ch · 17/07/2026

I had this article about contributing to RRDtool in draft for more than 10 years! I just published it "as is:" vincent.bernat.ch/en/blog/2013... The goal was to encourage people around me to contribute to open source. Unfortunately, the patch took a bit of time to be accepted.

vincent.bernat.ch

Contributing to open source: a new feature for RRDtool

Note (2026-07) This article was not completed and stayed as a draft for more than 10 years. As I think it is still useful today, even incomplete,...

050

Vincent Bernat @vincent.bernat.ch · 14/07/2026

In Firefox, one tab for Outlook Web and one tab for Teams already eats 2.1GB of RAM. The next one is Zulip with only 150MB (which I think is OK).

120

Reposted by Vincent Bernat

Charity Majors @charity.wtf · 21/06/2026

ah yes...I should also post about OUR book. the 2nd edition of "Observability Engineering" is now available for download.. and you can download it for free on the honeycomb site. this was supposed to be an update, and ended up being a total rewrite (& then some). 😅 www.honeycomb.io/blog/the-sec...

honeycomb.io

The Second Edition of Observability Engineering Is Here

IT’S HERE it’s here it’s here it’s here!!!! The second edition of Observability Engineering is available for download, and since Honeycomb is the sponsor, you can now download it from our website (th...

711125

Reposted by Vincent Bernat

Sam Rose @samwho.dev · 18/06/2026

I've made a Kubernetes that runs in the browser, and today we're open sourcing it. The hope here is to make super interactive and visual web content about Kubernetes much easier to write, and we have a whole bunch planned this year. Repo: github.com/ngrok/webern... Demo: webernetes-demo.ngrok.app

1317436

Vincent Bernat @vincent.bernat.ch · 16/06/2026

Interesting stats. It could start people on blogging if they don't have anyone that could help. The difficulty would be to do the second (or third) post without an LLM.

100

Vincent Bernat @vincent.bernat.ch · 16/06/2026

I think they prefer a grammar-"perfect-yet-authentic" over this. A few years back, people would correct your English in comments (kindly, but this means they notice and they were bothered enough to remove some "authenticity").

000

Reposted by Vincent Bernat

Cynthia Dunlop @cynthiadunlop.bsky.social · 16/06/2026

(Some) writers appreciate LLM writing assistance but readers hate it. Survey says… writethatblog.substack.com/p/dev-reacti... If readers suspect AI, they not only stop reading, but also downvote/avoid the author.

25516

Vincent Bernat @vincent.bernat.ch · 16/06/2026

Building a Soviet Nail Factory: how KPIs killed efficiency. A story that I often tell. It is now old enough to not upset my former colleagues. vincent.bernat.ch/en/blog/2026...

vincent.bernat.ch

Building a Soviet Nail Factory: how KPIs killed efficiency

How an obsession with KPIs at Orange led people to game them, slowing service delivery to a crawl. A cautionary tale about Goodhart's law.

063

Vincent Bernat @vincent.bernat.ch · 16/06/2026

Thanks! I think asking an LLM to fix my English helped me learn to be better.

000

Vincent Bernat @vincent.bernat.ch · 12/06/2026

TIL: `export -f` in bash can export a function to a subshell

052

Reposted by Vincent Bernat

Charity Majors @charity.wtf · 06/06/2026

yes!! thank you for noticing!! :D i have been going to TOWN lately generating sticker art and slogans and learning graphic design fundamentals. maybe i will write about that today, hm. this is one of my favorite themes.. it feels very.. scandinavian? i will mail you some if you give me an address!

2101

Vincent Bernat @vincent.bernat.ch · 10/06/2026

Blogging with an LLM assistant: vincent.bernat.ch/en/blog/2026... (grammar, copyediting, translation). This specific post is *not* modified by an LLM.

vincent.bernat.ch

Blogging with an LLM assistant

As a non-native English writer, I rely on LLMs for grammar, copyediting, and translation, despite hating AI slop.

050

Vincent Bernat @vincent.bernat.ch · 05/06/2026

Is there a story behind the illustrations? I like them a lot but they are not credited. Did you create them yourself?

120

Reposted by Vincent Bernat

Charity Majors @charity.wtf · 03/06/2026

i wrote a post about the growing divide between AI skeptics and AI enthusiasts. wins and costs are both real, but too often fall on different groups of people. when you're only experiencing half the story, it's too easy to write each other off. charitydotwtf.substack.com/p/ai-enthusi...

charitydotwtf.substack.com

AI enthusiasts are in a race against time, AI skeptics are in a race against entropy

Both sides are grappling with a real existential threat, and both sides feel like they are screaming into the void. Here's how to close the gap and get everyone pulling in the same direction.

109434

Vincent Bernat @vincent.bernat.ch · 05/06/2026

This MT7915 card seems supported by Linux and features two radios and could advertise 16 SSIDs. Anyone knows if they work well? asiarf.com/product/wifi...

asiarf.com

WiFi 6 11ax DBDC 1800Mbps Mini PCIe Module AW7915-NPD

AW7915-NPD is a WiFi 6 11ax 2T2R 1800Mbps mini PCIe Module powered by MediaTek MT7915DAN with FCC CE certificated.

110

Vincent Bernat @vincent.bernat.ch · 27/05/2026

New release of Akvorado (direct from the train to Montpellier): github.com/akvorado/akv.... There is a new bidirectional option for Sankey graphs. Also, some improvements on handling the RIB. The next version is likely to ship an architecture change to pave the way to more flexible flow enrichment.

github.com

Release v2.4.0 · akvorado/akvorado

💥 build: require x86-64-v3 baseline for binary shipped with each release (supported by most CPU after 2014, no change for the Docker image) ✨ console: add a "bidirectional" option for sankey graphs...

050

Reposted by Vincent Bernat

Kevin Powell @kevinpowell.co · 21/05/2026

More and more people I deeply respect and have learned a lot from over the years feel like they are speaking into a void, to the point where they are losing motivation to continue making content, which got me to write my first post on my site in over a year... www.kevinpowell.co/article/tell...

3030078

Vincent Bernat @vincent.bernat.ch · 24/05/2026

Scaling Akvorado BMP RIB with sharding. Making an efficient RIB to store 10M+ routes is challenging. While writing this article, I discovered additional optimizations. That's one reason to blog! vincent.bernat.ch/en/blog/2026...

vincent.bernat.ch

Scaling Akvorado BMP RIB with sharding

How Akvorado's BMP component scales to tens of millions of routes thanks to RIB sharding and lock-free reads.

042

Vincent Bernat @vincent.bernat.ch · 17/05/2026

I didn't notice until recently, but Epiphany, the GNOME browser, is quite on par with Safari. Same rendering engine, same JS engine, almost the same UI. It's convenient to test "Safari" on Linux.

031

Vincent Bernat @vincent.bernat.ch · 16/05/2026

Yes, this was to help someone else. I would like to switch to Caddy as nginx feels too antiquated, but ENOTIME.

010

Vincent Bernat @vincent.bernat.ch · 15/05/2026

Another 0-day in Linux, discovered by someone reading the commit log of the master branch. This one is more difficult to workaround as it does not rely on any module. It does not allow to read arbitrary files, "just" files read by a suid binary. github.com/0xdeadbeefne...

github.com

GitHub - 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

051

Vincent Bernat @vincent.bernat.ch · 15/05/2026

Just published lldpd 1.0.22, which contains some security fixes, notably CVE-2026-46433. It is evaluated to 6.5/10. I think this is a bit high, as in most cases, ASan is not enabled and you can't reliably crash the process. github.com/lldpd/lldpd/...

github.com

Heap OOB Read in VLAN Decapsulation memmove

## Summary `lldpd_decode()` in `src/daemon/lldpd.c` strips 802.1Q VLAN tags from received Ethernet frames by calling `memmove()` to shift the frame payload 4 bytes left. The third argument (byte...

011

Reposted by Vincent Bernat

Jeff Geerling @jeffgeerling.com · 12/05/2026

Bambu Lab 3D printers: never again. They're breaking the open source social contract (for the nth time...), and I'm past hoping they'll amend their ways. www.youtube.com/watch?v=eb48...

youtube.com

Bambu Lab 3D printers: Never again

YouTube video by Jeff Geerling

1118340

Reposted by Vincent Bernat

isabel @isabelroses.com · 08/05/2026

At a time of 2 local privilege escalation vulnerabilities I find a good time to finally get my blog post on nixos and its relation with secrets out. I would summarise it with the following words: PLEASE DO NOT PUT SECRETS IN THE NIX STORE. IT IS WORLD-READABLE. isabelroses.com/blog/nixos-a...

isabelroses.com

NixOS and Secrets

My takes and experinces with secrets management on NixOS

68819

Reposted by Vincent Bernat

StepBroBD @stepbrobd.com · 08/05/2026

terranix is actually really enjoyable to use, you basically get the entirety of hcl but in nix, and everything boils down to a config.tf.json for diffing and applying

011

Reposted by Vincent Bernat

Laurent Cheylus @lcheylus.bsky.social · 08/05/2026

Swissing a Table: moving step by step from a simple hash table to a "swiss table", the design behind Go’s new map implementation - Article by Phil Pearl @philpearl.bsky.social #Programming #Golang philpearl.github.io/post/swissin...

philpearl.github.io

Swissing a table · Phil Pearl's Blog

Moving step by step from a simple hash table to a “swiss table” — the design behind Go’s new map implementation.

052

Vincent Bernat @vincent.bernat.ch · 08/05/2026

Instead of blacklisting unused kernel modules, we can just disable kernel module loading after boot is complete with sysctl -w kernel.modules_disabled=1. At least on most servers. Example with NixOS: github.com/vincentberna...

github.com

common: lock kernel modules after boot · vincentbernat/nixops-take1@ed752cb

031

Vincent Bernat @vincent.bernat.ch · 08/05/2026

Four Column ASCII. This explains the ASCII table uses 2 bits for modifiers including CTRL and SHIFT. This makes keyboards easier to implement without electronic logic. garbagecollected.org/2017/01/31/f...

garbagecollected.org

Four Column ASCII

032