Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How Do I Prove a Network Problem Isn't on Our Side? (2026)
Every cross-team incident reaches the same deadlock: two sides with dashboards that disagree and no shared evidence. The packets settle it. Here is what actually counts as proof on Linux, how to show which side closed the connection first, and how to capture what a third-party endpoint really sent back.
How to Let an AI Agent Fix Something in Production Safely (2026)
A fix and an incident are the same syscalls, so the question is not whether the agent is trustworthy but what it can reach, what you can undo, and what you can prove afterward. What Replit's own documentation changed after an agent deleted a production database during a code freeze, why an instruction is not a control, and how to keep a record of an agent's changes that the agent did not write.
How to Check if a Linux Box Is Cryptomining in 2026: A kworker With a Socket Is Not a kworker
A kworker pegging a core is usually a firmware interrupt storm, but a kworker moving bytes to a mining pool is a renamed userspace process. Detect cryptojacking on Linux in 2026 by reading the name in the kernel at send time, after prctl(PR_SET_NAME) edited what ps and top show.