Guides
Long-form guides organized by pillar. Every guide is sourced to primary documentation and paired with a working tool where one exists.
Prefer a chronological view? Browse the article archive.
Tool-paired guides
tls-certs
Certificate Lifetime Checker and 2027 Renewals
How the lifetime checker reads Certificate Transparency history, checks each certificate against the SC-081 limits, and flags renewal schedules that will break.
tls-certs
CAA Record Checker: Find Gaps Before Renewal
How the CAA checker finds the record a CA uses, compares it with Certificate Transparency history, and flags renewal risks and partial account binding.
web-dev
Unix Timestamp Converter: Epoch and Zones
Convert Unix timestamps safely: detect seconds versus milliseconds, render RFC 3339 with the right offset, handle DST gaps, leap seconds, and the 2038 limit.
web-dev
HTTP Header Inspector: Read Response Headers
Inspect HTTP response headers to debug redirects, caching, HSTS, CSP, CORS, and content negotiation with a repeatable, operator-friendly workflow.
web-dev
curl Command Builder Guide
Turn an HTTP request into a readable curl command, then check quoting, query encoding, redirects, authentication, and the browser fetch equivalent.
web-dev
JavaScript Regex Tester: Flags & Groups
Use a JavaScript regex tester to inspect flags, capture groups, replacements, Unicode behavior, and ReDoS risks before code reaches production safely.
tls-certs
DNS Lookup Troubleshooting Guide
Use a DNS lookup to debug A, CNAME, MX, CAA, TXT, and DNSSEC failures. A resolver-first checklist with dig commands, TTLs, and safe next steps.
web-dev
Nginx and Caddy Reverse Proxy Config Guide
Compare Nginx proxy_pass and Caddy reverse_proxy, then choose safe headers, WebSocket handling, TLS defaults, and validation steps for a new service.
web-dev
Base64 Encoding: Padding, URLs, and UTF-8
Learn how Base64 turns bytes into text, when padding matters, why base64url differs, and how to avoid common JavaScript UTF-8 decoding mistakes.
tls-certs
Hash Generator: SHA-256, SHA-384, SHA-512
Choose the right hash for files, checksums, HMACs, and passwords. This browser-first guide explains SHA-2, output formats, and the traps to avoid.
yaml-json
How JSON.parse actually validates your JSON
The pretty-print button hides a strict spec. Here's what the browser really checks, why some errors are unhelpful, and how to read them anyway.
All guides
tls-certs
The Control Plane — Week of Mon Oct 26, 2026
Eight eMudhra CA keys compromised, PHP2Shell and Node2Shell hit KEV, Kubernetes October patches finally ship, Node.js 26 goes LTS, and certificate lifetimes.
tls-certs
ACME Renewal Settings for 64-Day Certificates
Where Certbot, cert-manager, Caddy, lego, acme.sh, Traefik and win-acme keep their renewal threshold, and what each does with a 64-day certificate.
web-dev
The OVHcloud CLI Swap and How to Verify Downloads
Attackers swapped OVHcloud CLI release archives and their checksum file for 94 minutes. What caught it, and how 37 popular CLIs let you verify downloads.
tls-certs
The Control Plane — Week of Mon Oct 19, 2026
Node.js fixes 10 CVEs, Kubernetes October patches slip again, a power event downs europe-west2-b, OVHcloud CLI releases get swapped, and renewal timing data.
yaml-json
The Same YAML, Eight Different Answers
We parsed 22 tricky YAML values with eight parsers. NO, on, y, 0644 and duplicate keys came back differently, and Kubernetes turned a key y into true.
kubernetes
Kubernetes Patch Releases Are Running Late
Kubernetes patch rounds ran 8 to 9 days late from July to September 2026, and AKS lagged upstream by a median 44 days. The data and what to change.
tls-certs
The Control Plane — Week of Mon Oct 12, 2026
Let's Encrypt sets 64-day certificates for February 2027, Microsoft ships a record Patch Tuesday, Ivanti is exploited again, and Node.js changes its release schedule.
sre
Why a New DNS Record Still Returns NXDOMAIN
A record you just created can stay NXDOMAIN for minutes or a day. How DNS negative caching works, how to reproduce it, and a pre-cutover check that prevents it.
tls-certs
CAA Records on 60 Developer Sites: 2026 Data
We checked CAA on 60 developer-infrastructure domains on October 10, 2026: 34 publish it, one binds every allowed CA to an ACME account, and one mismatches.
tls-certs
The Control Plane — Week of Mon Oct 5, 2026
ccTLD registry hijacks minted trusted certificates, Kubernetes 1.38 gate removals, an exploited FortiMail flaw, Chrome 155, and GitHub's Actions incident.
kubernetes
Kubernetes Service No Endpoints: Debug Checklist
Fix a Kubernetes Service with no endpoints: check EndpointSlices, selectors, readiness, targetPort, terminating Pods, and selectorless Services in order.
tls-certs
The Control Plane — Week of Mon Sep 28, 2026
Cloudflare's CA plan, Kubernetes patch releases, exploited NetScaler flaws, Firefox 157, the NATS incident report, and a CT sample of who issues dev certificates.
kubernetes
The Control Plane — Week of Mon Sep 21, 2026
Kubernetes PVC idle tracking, S/MIME key changes, GitHub Actions protections, Chrome DevTools updates, a cloud incident review, and a CT certificate sample.
sre
Prometheus No-Data Alerts: Practical Policy
Design Prometheus alerts for missing metrics without paging on every scale-down. Use absent_over_time, scrape health, and explicit no-data policy.
kubernetes
The Control Plane — Week of Mon Sep 14, 2026
Kubernetes 1.37 storage and DRA changes, S/MIME key rules, containerd 2.4, Chrome WebGPU updates, and a current CT certificate sample.
yaml-json
YAML to JSON: A Practical Guide
Convert YAML to JSON without losing meaning: understand scalar types, comments, anchors, merge keys, multi-document files, and Kubernetes validation.
kubernetes
The Control Plane — Week of Mon Sep 7, 2026
Kubernetes 1.37 operations, DNSSEC certificate rules, an Artifactory security fix, Chrome 153, a Chronicle incident, and a CT-log lifetime sample.
kubernetes
Kubernetes HPA Scale-to-Zero Safely
Kubernetes 1.37 makes HPA scale-to-zero practical for queue workers. Configure external metrics, preserve wake-up signals, and roll out the beta safely.
kubernetes
The Control Plane — Week of Mon Sep 1, 2026
Kubernetes 1.37 control-plane changes, certificate-lifetime planning, ingress-nginx defense, Chrome 153 cadence, and a Google Cloud outage review.
kubernetes
The Control Plane — Week of Mon Aug 24, 2026
Kubernetes 1.37, shorter ACME certificates, ingress-nginx defense, Chrome 152, Node 26.8, GitHub outage lessons, and a CT-log sample.
kubernetes
Kubernetes 1.37 Upgrade Readiness Checklist
Kubernetes 1.37 is scheduled for August 26. Use this operator checklist to test version skew, cgroup v2, static Pods, PDBs, feature gates, and rollback steps.
tls-certs
The Control Plane — Week of Mon Aug 17, 2026
Kubernetes 1.37 prep, 45-day ACME certificates, high-severity container flaws, Chrome XSLT removal, and a fresh CT certificate-lifetime sample.
yaml-json
Kubernetes KYAML: A Safer YAML Output Format
Kubernetes KYAML makes manifests more explicit with braces, brackets, quoted values, and comments. Learn when to use it and where conversion can surprise you.
tls-certs
The Control Plane — Week of Mon Aug 10, 2026
Gateway API 1.6, DNSSEC ballot SC100, ACME rate limits, a Kubernetes tenant-isolation CVE, Node 24 LTS, and capacity lessons from GitHub Actions.
sre
SLO Burn-Rate Alerts with PromQL
Build SLO burn-rate alerts with PromQL: calculate error ratios, choose multiwindow thresholds, prevent flapping, and test the policy before paging.
web-dev
HTTP/3 Deployment Checklist
Deploy HTTP/3 without breaking HTTP/2: open UDP, verify TLS 1.3 and Alt-Svc, test fallback, measure protocol use, and roll back safely in production.
kubernetes
The Control Plane — Week of Mon Aug 03, 2026
Gateway API 1.6, shorter certificate lifetimes, a Traefik security fix, Node 24.19 LTS, and the operator lessons from Spotify’s capacity incident.
kubernetes
Kubernetes Readiness Probe Debugging
Debug Kubernetes readiness probes in 15 minutes: read events, test endpoints, trace Service endpoints, and fix timing, path, port, and dependency errors.
web-dev
HTTP headers cheatsheet
A practical HTTP headers cheatsheet for requests, responses, caching, cookies, CORS, security policy, and the headers worth checking during an incident.
tls-certs
OpenSSL commands cheatsheet for TLS work
The OpenSSL commands worth keeping for certificate inspection, CSRs, private keys, chains, fingerprints, expiry checks, and TLS handshake debugging.
tls-certs
Why ACME renewal quietly broke last month
Let's Encrypt changed its intermediates, dropped an EKU, killed OCSP, and started shortening lifetimes. None of it throws a renewal error. Here is what to check.
tls-certs
Certificate Transparency explained for devs
The plain-English explanation of Certificate Transparency logs — what they contain, who runs them, and why they matter for every domain you own or ship code to.
kubernetes
Cron syntax, actually explained
The five standard cron fields, the Quartz six and seven field variants, macros, step values, the day-of-month versus day-of-week OR rule, and the timezone traps.
tls-certs
How to find every subdomain with CT logs
Certificate Transparency logs are the most complete public record of a company's hostnames. How to query them, clean the output, and run it as a standing control.
web-dev
Every HTTP status code, and when it shows up
A working reference to the HTTP status codes you will actually meet in production, what each one really means, and the pairs everyone confuses.
tls-certs
JWT, decoded: parts, algorithms, pitfalls
What the three parts of a JWT contain, how the signing algorithms differ, which claims you must validate, and the practices RFC 8725 tells you to adopt.
kubernetes
Karpenter vs cluster-autoscaler in 2026
Both node autoscalers are now SIG Autoscaling subprojects, and in July 2026 they started sharing an API. What actually differs, and how to choose.
kubernetes
kubectl cheatsheet (2026 edition)
A working kubectl reference for Kubernetes 1.36: output formats, JSONPath, debug workflows, server-side apply, drain safety, and the version skew rules.
tls-certs
How to read a TLS certificate
A field guide to the X.509 fields that actually matter — SAN, EKU, validity, basic constraints, SCTs — and the misreads that waste an afternoon of debugging.
web-dev
Regex patterns you will actually use
A working regex reference: the syntax worth memorizing, patterns for logs, semver, URIs and email, flag semantics, dialect differences, and how to avoid ReDoS.
sre
SLOs, SLIs, and error budgets: a primer
How to pick service level indicators, set an achievable objective, calculate an error budget, and alert on burn rate instead of paging on every blip.
yaml-json
The YAML + JSON config reference
How YAML and JSON really differ, why YAML 1.1 versus 1.2 keeps breaking configs, and the type coercion traps that bite Kubernetes, Helm, and Ansible users.