
Post-Quantum TLS Migration: Stop Paying the 150ms Retry Tax
Post-quantum TLS migration checklist: X25519MLKEM768 cut Cloudflare's handshake retries from 52% to 3.7%. How to check, enable, and verify on your own origin.

Post-quantum TLS migration checklist: X25519MLKEM768 cut Cloudflare's handshake retries from 52% to 3.7%. How to check, enable, and verify on your own origin.

Javascript proxy reactive state in under a kilobyte: an 80-line get/set trap that tracks reads, batches writes, and quietly breaks on one property name.

Here is how to migrate to a new CMS with zero downtime: a cookie-routed proxy Worker, staged 1%-100% rollout, and a 28,000 RPS DDoS absorbed mid-migration.

Rust dyn Trait vs generics: how to switch, and the 16-byte fat-pointer cost dyn Trait pays on every call — the cost generics compile away.

AI agent CMS write access breaks caches fast. The layered invalidation pattern that let one CMS absorb 5,000 RPS spikes and a 28,000 RPS DDoS without a hiccup.

How to reduce Rust struct memory footprint: the 5 layout changes that shrank a real cache entry from 953 to 420 bytes, and what each one costs.

SVG to MP4 in the browser needs no server: paste a URL and 30MB of ffmpeg.wasm renders every frame in your tab. The one catch that trips people up.

Use Postgres for everything and four of the five swaps hold. The queue is the one that death-spirals: 383,000 dead tuples and 300ms locks at 800 jobs/sec.

Remove Cloudflare beacon.min.js for good: the disable toggle hides behind adding your site to Web Analytics first, and no-transform is the stronger lever.

The Datasette SQL injection patched in 1.0a38 and 0.65.3 leaks private tables via unescaped filter columns. The check, upgrade, and why execute-sql is no fix.

Make your site agent-readable in four layers — readable, discoverable, callable, payable. Three are build-time files; only /mcp needs a Worker.

Ads for AI agents are live. TIME serves crawlers a 42 KB markdown site with sponsored blocks; humans and Googlebot get 1.2 MB of HTML. I measured all of it.

React Server Components in 2026: the mental model that finally clicks, the use client boundary rules, and when NOT to use them — with the Web Vitals payoff.

Streaming HTML out of order without JavaScript: how Declarative Partial Updates and Declarative Shadow DOM reorder content natively in Chrome 148.

FastAPI 0.138.0 ships app.frontend() — a native way to serve React, Vue, and Svelte SPA builds. How it works, real use cases, and what it still can't do.