posts on krtffl.dev

i said i quit testing. then i shipped seven things.

Thu, 16 Jul 2026 00:00:00 +0000

about a year ago i wrote a post declaring, with the serene confidence of a man who has never once been burned, that testing was a waste of time for a solo developer. write the feature, click around, push to prod, let the users find the bugs. i called it — and i am quoting myself here — “testing enlightenment stage three.”

i’d like to retract about sixty percent of that.

verifactu in go: a sha-256 hash chain is spain's answer to invoice fraud

Wed, 08 Jul 2026 00:00:00 +0000

for years the spanish way to skim a business was the software de doble uso — a till program with a quiet second set of books. you ring up a sale, the customer walks off with their receipt, and then, later, the invoice simply… isn’t there anymore. the record gets deleted, edited, renumbered. the tax office (the aeat) shows up, asks for invoice 47, and invoice 47 was never born. good luck proving a negative.

spain’s answer, live and mandatory, is delightfully low-tech and i mean that as a compliment: make every invoice cryptographically point at the one before it, so deleting number 47 leaves a hole that screams.

docker stack deploy silently dropped my command (and 3 other swarm lies)

Mon, 22 Jun 2026 00:00:00 +0000

picture the scene: green across the board. the deploy script ran all three of its pre-flight gates, docker compose config came back clean, docker stack deploy converged every service, and the post-deploy verifier printed a wall of OK in cheerful green. i closed the laptop.

then, a day later, i went looking at postgres and found it running with the default max_connections, and no TLS, and none of the eighteen -c tuning flags i’d very carefully written into the stack file. the flags were right there in the yaml. docker compose config printed them back to me, perfectly. and the running container had never seen a single one of them.

one schema crate, two analyzers: bilingual full-text search with embedded tantivy

Mon, 15 Jun 2026 00:00:00 +0000

you can see the word. it’s right there on the page — filósofos, third line of a plutarch translation i typed out by hand. you paste it into the search box, hit enter, and the archive tells you it has never heard of it. no error, no red box, no “did you mean.” a clean, confident, empty result set — byte-for-byte the same empty set you’d get for a word that genuinely isn’t in the corpus.

the index knew the word. i had watched it index the word. the reader just asked for it in a dialect the writer never spoke.

two databases, one binary: duckdb for reads, sqlite for state

Mon, 08 Jun 2026 00:00:00 +0000

the tracking endpoint has exactly one job: say 202 and get out of the way. a beacon fires on someone else’s website, my server catches it, and the visitor is already three paragraphs into an article before my response even lands. nobody is waiting on that request — the whole point of a sendBeacon is that the page has already moved on. so the afternoon i read a flame graph and found the ingest handler parked inside a duckdb INSERT, holding a request open while the disk did its thing, i felt a very specific kind of stupid. i’d taken a fire-and-forget pixel and taught it to block on fsync.

fixing that is most of this post. but the fix only makes sense on top of a decision most tutorials would have talked me out of: i put two different databases in one small rust binary, on purpose.

brute-forcing the pit window: when 'just try them all' is the right call

Mon, 01 Jun 2026 00:00:00 +0000

lights out. and this time the car has to stop.

two posts ago i drew stintlab’s charts in rust on canvas2d and swore a chart was just rectangles and lines. one post ago i fit the tire-degradation model by hand — ordinary least squares, cramer’s rule, and a singular-matrix guard that turned a collinearity bug into an honest None. both of those were setup. this is the payoff: the thing that takes that model and actually makes a decision.

because a degradation model, on its own, just draws a number — how much slower a tire gets, lap after lap. lovely. now what? a real race is decided in one call from the pit wall: when do you box, and onto what rubber? stop too early and you throw away tire life; too late and you bleed seconds to a fresher car behind. that call wins races. i wanted to make it automatically, and the algorithm i reached for is the single dumbest one in the book: try every option and keep the best.

and i’m going to argue that’s exactly right.

a query language in ~1000 lines: lexer, parser, evaluator

Mon, 25 May 2026 00:00:00 +0000

here’s a question that sounds trivial and isn’t: show me every 5xx response that also mentions a timeout.

in grep that’s a fragile little dance — grep -E 'status[=:] ?5[0-9]{2}' piped into another grep timeout, and now you’re matching 500 inside a request id, timeout inside a url, and you’ve quietly stopped trusting the output. what you wanted was this:

text

status >= 500 AND message contains "timeout"

and have the machine read >= as numeric greater-or-equal, AND as boolean conjunction, and "timeout" as a substring on one named field. that’s not grep. that’s a little language, and little languages need a lexer, a parser, and something to run them.

don't let your backtest lie to you: leakage guards for a solo research codebase

Mon, 18 May 2026 00:00:00 +0000

lights on the wrong thing.

the backtest printed a return rate north of 1.0 — more money notionally out than in, across a full season the model had never been allowed to see. for about four seconds i believed it. then i did the only responsible thing you can do with a number that flattering when you’re the only person checking your work: i assumed i’d cheated somewhere, and went looking for where.

clean and verified are different claims: a two-axis trust state machine in postgres

Mon, 11 May 2026 00:00:00 +0000

ask a language model for a line of tacitus in spanish and it will hand you a sentence. fluent, confident, correctly punctuated. and sometimes the sentence contains a word that no translator ever wrote — a word a scanner invented, when it read the á in a 1919 printing as the digit 4, or turned violento into violen10, and then a spell-checker came along afterward and smoothed the wreckage into something that looks like spanish.

the text is clean. it is not correct. and nothing about the way it reads tells you which.

cookieless analytics: how a rotating daily salt kills the consent banner

Mon, 04 May 2026 00:00:00 +0000

every week i click “reject all” maybe forty times. cookie wall, reject all. cookie wall, manage preferences, uncheck the eight hundred “legitimate interest” partners, confirm. the banner that buries its reject button two clicks deep because the law says both choices must be equally easy and everyone pretends theirs is. it’s the loading screen of the modern web, and almost nobody consents to anything — they just want the thing gone.

here’s the part that took me embarrassingly long to internalise: most of those banners exist to prop up analytics that never needed your personal data in the first place.

hand-rolling ols regression in rust, and the collinearity trap that ate my coefficients

Mon, 27 Apr 2026 00:00:00 +0000

lights out, again.

last time out i argued that a chart is just rectangles and lines, drew stintlab’s entire ui in rust on canvas2d to prove it, and promised — right at the bottom of that post — to come back for the degradation model itself: the math the pictures are pictures of. this is that post.

the pictures draw a number. how much slower a tire gets, lap after lap, as it wears out. pin that number down and you can start to guess when a car should box. so i tried to fit it with a multiple linear regression i wrote by hand — no nalgebra, no ndarray, just the normal equations and a determinant — and the thing handed me back confident, well-formed garbage. it took a comment in one of my own tests to explain why.

rust + wasm canvas2d charts with zero javascript libraries

Mon, 20 Apr 2026 00:00:00 +0000

lights out. one car jumps another off the line, and forty laps later a strategist on the pit wall wins the whole race with a single number: when to box. i don’t have a pit wall. i have a laptop, a free public api ↗ , and an unreasonable urge to see tire strategy as a picture instead of a table of lap times.

so i wanted a chart. the boring way to get one is npm install something with a d3 buried in its dependency tree, feed it an array, and move on with my life. i did not do the boring way. i drew the whole thing in rust, compiled it to webassembly, and painted it onto a <canvas> pixel by pixel with zero javascript charting libraries in the bundle.

welford's algorithm and why i never store the samples

Mon, 13 Apr 2026 00:00:00 +0000

you want to know if the error rate just spiked. that’s a z-score: how many standard deviations is right now away from what normal looked like. simple formula, (x - mean) / stddev, you learned it before you could legally drink.

except a standard deviation needs a mean, and a mean needs all the numbers, and the numbers are a log file the size of a small moon. so where, exactly, are you keeping them?

multi-tenant isolation is a security boundary, not a query filter

Mon, 06 Apr 2026 00:00:00 +0000

i’m building a small multi-tenant cms for local businesses — a barbershop, a physio, a bakery each get a little site they can edit themselves. one payload backend, one postgres, many tenants. the whole promise is that the bakery’s editor logs in and sees the bakery. not the barbershop. never the barbershop.

so during a pre-launch hardening pass i did the thing i’ve learned to do: i stopped admiring the isolation and started attacking it. i logged in as a low-privilege editor — scoped to exactly one tenant — and sent one request to edit my own user account. not someone else’s. mine. i just added a second tenant to the list of tenants i belong to.

it went through. 200. and on the next request i could read, edit and delete another business’s pages as if they were my own.

nobody broke in. i handed myself the keys through the front door, using an endpoint that exists specifically so users can edit themselves. an isolation boundary you can widen with a PATCH to your own profile isn’t a boundary. it’s a default you forgot to close.

building three mcp servers in rust with rmcp

Mon, 30 Mar 2026 00:00:00 +0000

i wanted to ask an llm “is my server on fire?” without ssh-ing into the box, running htop, squinting, giving up, and running docker ps instead. i wanted it to just know — pull the cpu number, list the containers, hit prometheus, and tell me in a sentence.

the model context protocol makes that possible. you hand an llm a set of tools, it decides when to call them. fine. so i built one server for my infra. then i wanted one for spanish government open data — the boe, the tax calendar, the property registry. then a third for formula 1 telemetry, because it’s my blog and i do what i want.

three servers. and i could already see the future: three near-identical binaries, three copies of the same http-client boilerplate, three subtly different cache bugs. the copy-paste tax.

implementing the drain algorithm in rust

Mon, 23 Mar 2026 00:00:00 +0000

picture the scene: something is on fire in production, you ssh into the box, tail a log file, and you’re greeted by forty thousand lines that all look almost the same but not quite. your eyes glaze over. you grep error, then grep -v the noise, then pipe the whole thing into sort | uniq -c and pray.

there’s a better way, and it’s older than you’d think.

i didn't leave go for rust. i split my stack.

Mon, 16 Mar 2026 00:00:00 +0000

“so are you a go guy or a rust guy now?”

somebody asked me that recently and i realised i’d been dodging it for the better part of a year. the honest answer is annoying, which is why nobody likes it: i’m both. and it’s not a fence i’m sitting on, it’s a split — i write go and i write rust, on purpose, for different jobs. the moment i stopped treating “which language” as a personality question and started treating it as a tooling question, the whole tired argument just dissolved.

i audited my side project like it was about to go viral (before it was)

Mon, 29 Dec 2025 00:00:00 +0000

i ended the last post with a promise: a public stats page that ran three full-table scans on every request and fell over the first time i pointed real concurrency at it. this is that post — the last of three findings from the same pre-launch audit of a little pairwise-voting side project, a nougat-ranking toy where you pick between two flavours and a leaderboard falls out.

the first two findings were bugs: an elo race that ate 79% of every vote , and a rate limiter a rotated header walked straight through . this one is a bug too, but it’s really about the method that surfaced it, because the method is the transferable part. the bug — a page doing linear work per request against a table that only grows — is one you’ve almost certainly got somewhere right now and can’t see, for the exact reason i couldn’t: on your dev box the table has forty rows and everything’s instant. the page isn’t slow. the page is a landmine with the pin still in, and the only way to find it before your users do is to go step on it yourself.

so that’s the method. stand up a throwaway postgres, seed it with the amount of data you’d have if the thing actually worked — if it went viral, if the launch landed — and then measure the hot paths under that load instead of guessing. the very first page i pointed it at turned out to be a denial-of-service i was hosting for free, on purpose, with a smile.

your rate limiter trusts x-forwarded-for. mine did too, until it was measured.

Mon, 22 Dec 2025 00:00:00 +0000

last time i told you about the elo race that ate 79% of every vote — the anchor finding from a pre-launch hardening pass on a little pairwise-voting side project. i promised, at the bottom of that post, that the other critical finding was a vote rate-limiter that a rotated header walked straight through. this is that post.

here’s the setup. the side project is a nougat-ranking toy: you get shown two flavours, you pick one, an elo rating moves, a leaderboard falls out. because the leaderboard is the entire point, the interesting attack is obvious — cast a pile of votes for your favourite and bend the ranking. so i’d put a rate limiter in front of it. two, actually. i felt responsible.

then, during the audit, i sat down and attacked them instead of admiring them. both fell over. one to a header i let the open internet write. one to a cookie i simply didn’t send. neither took more than a few lines of curl.

a limiter you have never fired a spoofed header at is not a limiter. it’s a comment.

the elo race that silently ate 79% of every vote

Mon, 15 Dec 2025 00:00:00 +0000

it’s the kind of bug that lets you sleep fine for weeks.

i’d built a little nougat-ranking toy — you get shown two flavours, you pick the one you’d rather eat, and an ELO rating quietly updates in the background so a leaderboard falls out of thousands of these pairwise duels. side project, single box, htmx and go and postgres, held together with database/sql and good intentions. it worked. people voted. the leaderboard moved. every vote came back with a fresh pairing and a 200. green across the board.

then, before pushing it anywhere with real traffic, i did a proper hardening pass: stand up a throwaway postgres, seed it with a plausible went-viral amount of data, and hammer every endpoint like someone who wants to break it. the very first thing i measured told me that roughly four out of every five votes had been quietly doing almost nothing the whole time.

not erroring. not failing. the vote was recorded. the rating just didn’t move the way it was supposed to.

sqlc + pgx over an orm: type-safe sql that fails at compile time

Mon, 24 Nov 2025 00:00:00 +0000

the endpoint was slow and i couldn’t tell you which query to blame, because i hadn’t written any. that’s the deal you sign with a reflection-based orm: you describe some structs, you call db.Preload("Photos").Find(&pets), and somewhere behind the curtain the library assembles sql you never see, fires off a number of round trips you never counted, and hands you back objects. when it’s fast, it’s lovely. when it’s slow, you’re debugging a library’s imagination.

vibe coding: the tiktok of programming

Fri, 21 Mar 2025 00:00:00 +0000

well, shit happened. let me tell you about something that occurred recently that made me realize we might have a problem with this whole vibe coding trend.

the solo founder's guide to enterprise-grade infrastructure on a budget

Tue, 11 Mar 2025 00:00:00 +0000

let me tell you a story about infrastructure. no, wait. don’t leave. i promise this won’t be boring.

testcontainers 103

Sat, 08 Mar 2025 00:00:00 +0000

ah, so here we are. the long-awaited part three of my testcontainers saga. the finale? definitely. but not for the reasons you might think. spoiler alert: i’ve been wasting my time. and maybe you have too.

owner-scoped rbac: enforcing 'you can only see your own'

Mon, 23 Dec 2024 00:00:00 +0000

two users hit GET /dojos. same route, same handler, same line of sql underneath. the admin gets back every dojo in the database. the dojo owner gets back exactly one — theirs. nobody wrote a second endpoint, nobody passed a flag. the query just quietly narrowed itself on the way down, and the owner never learns the other rows exist.

the first time that worked in mojodojo i felt clever. “you can only see your own” is the whole ballgame in a multi-tenant app, and here it was falling out of the architecture for free. then i went looking for where it happened, and the answer was: two different files, in two different layers, that don’t fully agree with each other. one of them has a hole you could drive a truck through.

the boilerplate tax: fourteen entities, an 890-line router, and go

Mon, 09 Dec 2024 00:00:00 +0000

there’s a file in mojodojo called dojo.go that declares six sentinel errors. two of them are misspelled: "coulnd't create dojo" and "dojo not foud". i knew they were misspelled when i wrote them. and then i wrote the same six errors, with the same two typos, thirteen more times — "coulnd't create belt", "fighter not foud", "coulnd't count fees" — because every entity got its own file, and i was copy-pasting the last one.

nobody re-reads the ninth near-identical file. that’s the whole story of this post.

shipping a single self-contained go binary

Mon, 18 Nov 2024 00:00:00 +0000

picture it: a fresh vps, your ssh key just accepted, a blank box that has never heard of your app. you scp up a binary. then you scp up a config.yaml. then you remember the database is empty, so you apt install the migrate cli, scp up the migrations/ folder too, point one at the other, and pray the versions line up. four artifacts and a small ceremony, just to watch the thing print a banner and die because the config key got renamed two commits ago.

i did that dance one too many times on a little learning project and thought: why does a single go binary need a goddamn support convoy to boot?

hexagonal architecture in go without the ceremony

Mon, 14 Oct 2024 00:00:00 +0000

every go web app i wrote before this one had The Struct. you know the one. it starts life innocent — three fields, a name, an id — and then someone needs to persist it, so it grows a gorm:"primaryKey" tag. then it needs to go over the wire, so it grows a json:"id" tag. then a binding:"required" for the request validation, because why not. six months later that struct imports your orm, your web framework, and your validation library, and it has a method called BeforeSave that quietly does business logic inside a database hook.

that struct knows too much. it can’t be tested without a database. it can’t be reasoned about without opening four dependencies. and every time you change your database, your json api changes too, because they’re the same forty lines of code wearing three different hats.

testcontainers 102

Sun, 22 Sep 2024 00:00:00 +0000

alright. so the last post was a simple introduction to testcontainers: what are they, how to set it up, how to run a couple integration tests against a database… it was quite good for an introduction, but there were of course things missing.

testcontainers 101

Sun, 15 Sep 2024 00:00:00 +0000

well, it was about time to start writing some code in this - supposedly - blog. time to get our hands dirty.

the meta post

Fri, 13 Sep 2024 00:00:00 +0000

this is probably the post that makes the least sense of all but i still need to get some practice before i get into business and dive deep into the technicalities so here it is