Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF54linux54yeet51AI agents24observability17networking9security8claude-code7HTTP4production4sandboxing4tracing4uprobes4API debugging3bcc3bpftrace3containers3exectop3incident-response3kubernetes3omarchy3supply chain3tcpdump3TLS3troubleshooting3audit2auditd2BSON2capabilities2ci2codex2databases2debugging2egress2execsnoop2hyprland2MongoDB2mysql2oom2performance2permissions2postgres2processes2quickshell2runtime-debugging2ssh2TCP2802.111agent-security1agentic network operations1ai-sre1bar-widget1benchmarks1biolatency1bpf-verifier1bubblewrap1build-performance1cgroups1Cilium1CO-RE1confidential-computing1context-switches1cpu-accounting1cryptojacking1devops1DNS1docker1exfiltration1hardening1integration-testing1kprobes1kworker1landlock1latency1local-llm1logging1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1openssl1opentelemetry1packet-capture1plugin1postinstall1prepared statements1privilege1proc-filesystem1process-attribution1process-masquerading1proctop1profiling1query-shapes1Redis1refusal1RESP1rf1root-cause-analysis1runqlat1schedstat1seccomp1slowlog1SQLite1stratum1sudo1syscall1systemd1tcp-retransmits1terminal-bench1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1yeetkit1+121 more

All eBPF54 linux54 yeet51 AI agents24 observability17 networking9 security8 claude-code7 HTTP4 production4 sandboxing4 tracing4 uprobes4 API debugging3 bcc3 bpftrace3 containers3 exectop3 incident-response3 kubernetes3 omarchy3 supply chain3 tcpdump3 TLS3 troubleshooting3 audit2 auditd2 BSON2 capabilities2 ci2 codex2 databases2 debugging2 egress2 execsnoop2 hyprland2 MongoDB2 mysql2 oom2 performance2 permissions2 postgres2 processes2 quickshell2 runtime-debugging2 ssh2 TCP2 802.111 agent-security1 agentic network operations1 ai-sre1 bar-widget1 benchmarks1 biolatency1 bpf-verifier1 bubblewrap1 build-performance1 cgroups1 Cilium1 CO-RE1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 devops1 DNS1 docker1 exfiltration1 hardening1 integration-testing1 kprobes1 kworker1 landlock1 latency1 local-llm1 logging1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 openssl1 opentelemetry1 packet-capture1 plugin1 postinstall1 prepared statements1 privilege1 proc-filesystem1 process-attribution1 process-masquerading1 proctop1 profiling1 query-shapes1 Redis1 refusal1 RESP1 rf1 root-cause-analysis1 runqlat1 schedstat1 seccomp1 slowlog1 SQLite1 stratum1 sudo1 syscall1 systemd1 tcp-retransmits1 terminal-bench1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1 yeetkit1

October 13, 2026

Which Process Is Talking to Which Host? (Linux 2026)

ss shows you sockets that exist right now and tcpdump shows you packets with no process attached. To answer which process is talking to which host, you need the connection caught at the moment it is dialed, in the context of the process that dialed it. Here is how to do that on Linux, and when a bpftrace one-liner is the better call.

networkingeBPFegressobservabilitylinuxyeet

September 4, 2026

Can an AI Coding Agent Exfiltrate My Source Code? What a Domain Allowlist Decides, and What It Doesn't (2026)

A domain allowlist decides whether a connection may open, not what goes through it, and the proxy in front of your agent does not read TLS by default. Here are the six ways to control agent egress on Linux in 2026, what each one covers, and how to see every host your agent dialed with claudefeed.

AI agentsexfiltrationegresseBPFsecuritylinuxyeet