https://sangtd.net/tags/tech/Recent content in Tech on Sang's BlogHugo -- gohugo.ioenSun, 19 Jul 2026 00:00:00 +0700https://sangtd.net/the-on-call-rotation-is-a-social-contract-not-a-schedule/Sun, 19 Jul 2026 00:00:00 +0700https://sangtd.net/the-on-call-rotation-is-a-social-contract-not-a-schedule/An on-call rotation is the only place where engineering decisions are tested against real-world consequences at three in the morning. Code review tests assumptions. Automated tests verify behavior. Staging environments simulate load. But on-call is the exam — the moment when a design choice made six months ago wakes someone up, demands an answer, and refuses to wait until morning. Everything else is preparation. This is why the way an organization structures its on-call rotation reveals more about its engineering values than any mission statement ever will.https://sangtd.net/from-property-to-permission/Sun, 05 Jul 2026 00:00:00 +0700https://sangtd.net/from-property-to-permission/The Constitution of the United States, Article I, Section 8, Clause 8, grants Congress the power “to promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.” The phrase “limited Times” was not an afterthought. It was the central bargain. The government grants a temporary monopoly — fourteen years, renewable once for a total of twenty-eight — and in exchange, the work enters the public domain for everyone to build upon.https://sangtd.net/standards-are-infrastructure-not-merchandise/Sun, 21 Jun 2026 00:00:00 +0700https://sangtd.net/standards-are-infrastructure-not-merchandise/On June 17, 2026, the Society of Motion Picture and Television Engineers made an announcement that should not have been news. SMPTE, the 110-year-old organization that defines the technical standards behind everything from film reel dimensions to digital cinema projection, declared that its entire catalog of more than eight hundred standards documents would now be freely available to anyone, anywhere, without a paywall. The announcement was treated as a significant event.https://sangtd.net/tokenmaxxing-and-the-price-of-a-token/Sun, 14 Jun 2026 00:00:00 +0700https://sangtd.net/tokenmaxxing-and-the-price-of-a-token/The term “tokenmaxxing” entered the tech vocabulary sometime in 2025, born from a peculiar practice: companies publishing leaderboards of how many AI tokens each employee consumed, tying performance reviews to token burn, and sometimes spending more on API calls than on salaries. The reaction was predictable. The tech press called it Tulip Mania. Executives defended it as necessary to force adoption. Engineers called it the stupidest metric ever devised. Both sides had evidence for their position, and neither was entirely wrong.https://sangtd.net/lack-of-self-reliance-on-ai-models-is-a-disaster/Sat, 13 Jun 2026 00:00:00 +0700https://sangtd.net/lack-of-self-reliance-on-ai-models-is-a-disaster/On 10 June 2026, Anthropic released Fable 5, their most powerful model yet. Three days later, the Trump administration imposed export controls, forcing Anthropic to stop providing Fable 5 and Mythos 5 to users worldwide. This marked the first instance in history where the United States restricted the export of a commercially deployed AI model — not chips or hardware, but software. The government cited a security breach that could threaten national security.https://sangtd.net/the-database-convergence-is-already-here/Sun, 07 Jun 2026 00:00:00 +0700https://sangtd.net/the-database-convergence-is-already-here/For about a decade, the standard narrative about databases has been fragmentation. The relational monolith cracked. NoSQL shattered the consensus. Now there are hundreds of specialised engines, each optimised for one shape of data, and the era of one database to rule them all is over. This narrative felt true because it was true, roughly from 2010 to 2018. But the real story of the past five years is the opposite: databases are converging, and the convergence is happening so fast that the question of which engine to use is becoming less interesting than the question of who is going to run it.https://sangtd.net/go-rust-and-zig/Sat, 06 Jun 2026 00:00:00 +0700https://sangtd.net/go-rust-and-zig/For most of computing history, the debate about programming languages was really a debate about one thing: who is responsible for making sure the program does not break. At one extreme was C, which trusted the programmer completely and gave them absolute control over the machine. At the other extreme was Java, which trusted the programmer not at all and wrapped every operation in a runtime that mediated every memory allocation, every thread, and every type cast.https://sangtd.net/search-engines-are-broken/Sat, 23 May 2026 00:00:00 +0700https://sangtd.net/search-engines-are-broken/Search used to be simple. You typed words into a box, and a machine gave you a list of pages that contained those words, ranked by how many other pages linked to them. You clicked a result, left the search engine, and read what someone else had written. The search engine was a map. The web was the territory. That arrangement is gone. Google does not want to send you to a website anymore.https://sangtd.net/database-ha-without-kubernetes/Sun, 17 May 2026 00:00:00 +0700https://sangtd.net/database-ha-without-kubernetes/A production database must survive failures. The server crashes, the network partition occurs, the datacenter loses power. When Kubernetes is in the stack, the answer is an operator — the StatefulSet restarts the pod, the PersistentVolumeClaim re-attaches the volume, the service routes traffic to the new instance. The database is treated as cattle, and the operator translates infrastructure failures into pod lifecycle events. But not every environment runs Kubernetes. On bare metal, on virtual machines in a private datacenter, on a three-node cluster behind a jump server, the tools are different and the abstractions are thinner.https://sangtd.net/iroh-less-net-work-for-networks/Sat, 16 May 2026 00:00:00 +0700https://sangtd.net/iroh-less-net-work-for-networks/It is surprisingly difficult to connect two devices directly over the internet. NAT boxes on home routers block inbound connections. Firewalls drop unfamiliar protocols. Dynamic IP addresses can change without warning. Personal devices do not have domain names. The internet was designed for clients to talk to servers with known addresses, not for peers to find each other across hostile middleboxes. Workarounds such as STUN, TURN and UPnP, as well as port forwarding, have made this possible, but it has never been simple.https://sangtd.net/site-to-site-vpn-connecting-infrastructure-across-boundaries/Sun, 10 May 2026 00:00:00 +0700https://sangtd.net/site-to-site-vpn-connecting-infrastructure-across-boundaries/Two networks need to communicate. One sits behind a NAT gateway in a cloud VPC, the other behind a firewall in a colocation facility. There is no direct fiber between them. The internet is the only path, and the traffic must be encrypted because it crosses untrusted infrastructure. A site-to-site VPN is the standard answer: an encrypted tunnel between two gateways that makes the two networks behave as one. The scenario repeats across every infrastructure team.https://sangtd.net/from-vpn-to-zero-trust-the-perimeter-is-no-longer-real/Sat, 09 May 2026 00:00:00 +0700https://sangtd.net/from-vpn-to-zero-trust-the-perimeter-is-no-longer-real/An engineer connects to the corporate VPN from a coffee shop. The VPN client authenticates, the tunnel comes up, and the laptop receives an IP address from the internal subnet. From that moment, the laptop can reach any server on the corporate network — the ERP system, the CI/CD pipeline, the production database, the internal wiki, the monitoring dashboard, the Git repository, the entire internal attack surface. The VPN tunnel is encrypted, so the link between the coffee shop and the corporate gateway is secure.https://sangtd.net/cloud-providers-the-lock-in-curve/Sun, 03 May 2026 00:00:00 +0700https://sangtd.net/cloud-providers-the-lock-in-curve/Managed services reduce operational burden. A managed database eliminates backup and replication management. Object storage eliminates disk capacity management. Serverless functions eliminate scaling management. The cloud provider handles the infrastructure, and the team focuses on business logic. The result is agility, scalability, and efficiency. Then the first large bill arrives. The breakdown shows charges for data transfer between services, API requests, storage IOPS, provisioned capacity that is not being used. Estimating next month’s bill is impossible because the pricing model is too complex.https://sangtd.net/anonymous-networks-from-vpn-to-tor-to-freenet/Sat, 02 May 2026 00:00:00 +0700https://sangtd.net/anonymous-networks-from-vpn-to-tor-to-freenet/The internet is not private. Each time you visit a website, your IP address is logged. Your internet provider can see every domain you connect to. The websites themselves can see your approximate location. Advertising networks compile behavioural profiles of your browsing across sites. Governments and corporations perform deep packet inspection on backbone traffic. The default state of being online is to be watched. You can either accept this or push back.https://sangtd.net/dns-is-the-phonebook-of-the-internet/Sat, 25 Apr 2026 00:00:00 +0700https://sangtd.net/dns-is-the-phonebook-of-the-internet/Every time you open a website, your computer asks a question you never see. It translates the domain name you typed into the IP address of the server that hosts the page. The Domain Name System handles this translation, and it does so through a hierarchy: your computer checks its cache first, then contacts a resolver — typically run by your internet provider — which queries the root servers, the top-level domain servers and finally the authoritative name servers for the specific domain.https://sangtd.net/ai-models-are-compression-engines-and-memory-is-the-workaround/Sun, 19 Apr 2026 00:00:00 +0700https://sangtd.net/ai-models-are-compression-engines-and-memory-is-the-workaround/Ask an AI model about the history of the Roman Empire and it will give you a lecture spanning centuries. Ask it about quantum mechanics and it will walk you through wave functions and Bell inequalities. But ask it what you told it yesterday about your project, and it stares back blankly. It knows everything and remembers nothing. This is not a bug. It is the direct consequence of what these models actually are: compression engines.https://sangtd.net/dns-records-for-email-reputation-takes-time/Sun, 12 Apr 2026 00:00:00 +0700https://sangtd.net/dns-records-for-email-reputation-takes-time/A mail server is configured. Postfix is set up, TLS is enabled, user accounts are created. A test email is sent to a Gmail account. It arrives in spam. The logs show everything is fine. The email was sent, the connection was successful. SPF, DKIM, and DMARC records are added to DNS. A day passes. Another test email is sent. Still spam. The headers show “SPF: pass,” “DKIM: pass,” “DMARC: pass.https://sangtd.net/replication-and-sharding-consistency-at-scale/Sun, 05 Apr 2026 00:00:00 +0700https://sangtd.net/replication-and-sharding-consistency-at-scale/A database cannot handle the load. Queries are slow, writes are blocking, connections are timing out. Replication offers a solution: create read replicas, route read traffic to them, and suddenly there is 10x the read capacity. The implementation works—for a while. Then a user updates their profile, but when they refresh the page, the old data is still there. They refresh again, and now it is updated. The read replica is lagging behind the primary.https://sangtd.net/privacy-is-not-security/Sat, 04 Apr 2026 00:00:00 +0700https://sangtd.net/privacy-is-not-security/There is a mistake that privacy-focused communities make so consistently that it has become almost invisible. It is the assumption that a product marketed as privacy-respecting is also more secure. This assumption is not just wrong. It is dangerous. Privacy and security are different properties, they require different organisational capabilities, and they frequently conflict in ways that leave users worse off than if they had never switched at all. The distinction is not subtle once you state it plainly.https://sangtd.net/linux-and-the-linux-foundation-open-source-that-shaped-the-world/Sat, 28 Mar 2026 00:00:00 +0700https://sangtd.net/linux-and-the-linux-foundation-open-source-that-shaped-the-world/In 1991, Linus Torvalds posted to the comp.os.minix newsgroup that he was writing a free operating system — not a big project, just a hobby. He said it would never be “professional” like GNU. Thirty-five years later, the Linux kernel runs on 100% of the top 500 supercomputers, on the majority of smartphones through Android, on every major cloud provider’s servers, and on billions of embedded devices from routers to Teslas.https://sangtd.net/building-infrastructure-from-bare-metal/Sun, 15 Mar 2026 00:00:00 +0700https://sangtd.net/building-infrastructure-from-bare-metal/A rack of servers arrives. Four nodes, each with two CPUs, 128GB of RAM, four network ports, and four hard drives. The task is to turn them into a private cloud: virtual machines for databases, Kubernetes nodes, storage, monitoring, and development environments. There is no cloud provider to abstract the hardware, no API to provision resources, no managed service to handle the network. Everything must be built from scratch, one layer at a time, and each layer constrains the layers above it.https://sangtd.net/elk-logs-tell-stories-not-facts/Sun, 08 Mar 2026 00:00:00 +0700https://sangtd.net/elk-logs-tell-stories-not-facts/Logs are narrative, not data. A search for an error message returns ten thousand results. Filtering by service yields five thousand. Filtering by time range yields five hundred. An hour is spent scrolling through irrelevant entries. By the time the relevant log is found, the original question is forgotten. This is the problem with treating logs as data. When everything is logged, facts are collected without context. “Request received.” “User logged in.https://sangtd.net/message-queues-delivery-processing/Sun, 01 Mar 2026 00:00:00 +0700https://sangtd.net/message-queues-delivery-processing/Message queues guarantee delivery, but delivery is not the same as processing. The queue ensures the message arrives; the application must ensure it is processed correctly. Service A sends a message. The queue holds it. Service B consumes it, processes it, and acknowledges it. The system works—until Service B crashes after processing but before acknowledging. The queue redelivers the message. Service B processes it again. Now there is duplicate data in the database.https://sangtd.net/tracking-apps-the-escape-hatch-from-data-lock-in/Sat, 28 Feb 2026 00:00:00 +0700https://sangtd.net/tracking-apps-the-escape-hatch-from-data-lock-in/You know you should stop using platforms that exploit your data. You want to. But you cannot, because all your history is locked inside them. Ten years of Spotify playlists. Five hundred books logged on Goodreads. A decade of watched films on Netflix. These are not just lists. They are a record of your tastes, your memories, your identity as a consumer of culture. Leaving the platform means losing all of that.https://sangtd.net/monitoring-three-questions-three-pillars/Sun, 22 Feb 2026 00:00:00 +0700https://sangtd.net/monitoring-three-questions-three-pillars/The monitoring dashboard shows CPU at 90%, memory at 85%, and error rate at 5%. Something is wrong, but what? The logs contain thousands of entries. The services all seem healthy. There are metrics, there are logs, but the question remains unanswered: why is the system slow? This is the observability gap. Data without understanding is not observability. Something is wrong, but why it is wrong or where it is happening cannot be seen.https://sangtd.net/maintain-risk-compounds-silently/Sat, 14 Feb 2026 00:00:00 +0700https://sangtd.net/maintain-risk-compounds-silently/Risk compounds silently. Every day maintenance is deferred, the risk increases. A security vulnerability discovered today might have been patched last month if dependencies had been updated. A bug that causes a production outage might have been fixed in a newer version of the library. The cost of inaction is not static; it grows over time. A security audit reveals the application is running a version of lodash with a known prototype pollution vulnerability.https://sangtd.net/ci/cd-the-cost-of-change-curve/Sun, 08 Feb 2026 00:00:00 +0700https://sangtd.net/ci/cd-the-cost-of-change-curve/The cost of fixing a problem increases exponentially as it moves through the pipeline. A syntax error caught by the compiler costs minutes to fix. A logic error caught by tests costs hours. A configuration error caught by staging costs days. A performance issue caught in production costs weeks. CI/CD pipelines exist to catch problems at the cheapest possible point. Every stage is a feedback loop. Every feedback loop reduces the cost of change.https://sangtd.net/gitops-pull-vs-push/Sun, 01 Feb 2026 00:00:00 +0700https://sangtd.net/gitops-pull-vs-push/Traditional CI/CD pipelines push changes to infrastructure. The pipeline watches Git, builds artifacts, and executes commands against the cluster. It holds credentials, it knows the cluster endpoint, it has write access. The pipeline is the orchestrator, and the deployment is a one-way street: Git to cluster. GitOps inverts this relationship. Instead of the pipeline pushing changes to the cluster, a controller inside the cluster pulls changes from Git. The controller watches the Git repository.https://sangtd.net/infrastructure-as-code-drift-is-inevitable/Sun, 25 Jan 2026 00:00:00 +0700https://sangtd.net/infrastructure-as-code-drift-is-inevitable/Drift is the gap between what the code says should exist and what actually exists in the infrastructure. It is the bane of Infrastructure as Code, and it is inevitable. A security group rule is added at 2 AM to fix a production issue. It is a temporary fix, the promise goes. The code will be updated tomorrow. Tomorrow comes, and the fix is forgotten. A week later, terraform plan shows a diff.https://sangtd.net/kubernetes-the-reconciliation-problem/Sat, 24 Jan 2026 00:00:00 +0700https://sangtd.net/kubernetes-the-reconciliation-problem/Kubernetes uses a reconciliation loop to maintain desired state. The desired state is described in a YAML file, and the control plane continuously works to make reality match that description. No scripts, no deployment pipelines, no manual steps. Just a document and a loop that closes the gap between current state and desired state. The abstraction is clean. The system is told what is wanted, not how to get it, and the system figures out the rest.