Category
Technology with judgment: what actually moves the needle, no passing fads.
Neural processing units have stopped being a marketing label on Snapdragon, Apple Silicon and AMD Ryzen AI laptops. Here is what you can actually do from code today, which tools are mature, and when it pays off to target the NPU instead of the CPU or GPU.
gVisor interpone un kernel en espacio de usuario entre el contenedor y el anfitrión. Después de años en producción en Google y adopción creciente en plataformas serverless, merece una lectura honesta sobre cuándo compensa frente a microVMs y runtimes clásicos.
Fly.io has spent years selling the idea that deploying an application across several regions should be almost as simple as pushing an image and writing one config line. After several real projects on the platform, here is an honest read on what it delivers, what is missing, and who it is worth choosing over more classic options.
Garnet es el servidor de caché abierto por Microsoft Research que habla el protocolo de Redis pero está escrito en .NET 8 con un núcleo de almacenamiento orientado a hardware moderno. Tras casi dos años en público, muestra números interesantes y una arquitectura que merece mirarse con calma, aunque el ecosistema Redis siga siendo más maduro.
Tras la adquisición por Microsoft en 2019, Citus vivió un limbo comercial que terminó con Microsoft abriendo el código completo en 2022. Tres años después, la extensión de particionado para Postgres ha madurado y ofrece una ruta práctica para escalar sin abandonar el motor que ya conoces. Un repaso honesto.
OSV-Scanner se ha convertido en una referencia silenciosa para escanear dependencias open source. Su valor no está en el escaneo en sí, que muchas herramientas ofrecen, sino en su conexión directa con OSV.dev como fuente de verdad. Un análisis de por qué esto importa más de lo que parece.
Authentik is one of the sturdiest self-hosted identity projects in the open-source landscape. A practical Docker Compose install guide, the Redis-free architecture since 2025.10, and the real friction points of a first install.
CVE-based attack surface management has moved from an abstract list to an engineering practice with real prioritization. We look at how it works once EPSS, KEV and exposure context enter the same equation.
Unikernels were promised as the future of cloud deployment back in 2015, then faded into obscurity soon after. Ten years later, Unikraft has reached a stable release and reads like a more mature, more useful take on that same idea. A review of what has changed.
Wolfi turned three as a public project and has become the base for Chainguard container images and much of the industry chasing clean software supply chains. A field-tested review of what it offers against Alpine and Debian slim.
Post-quantum cryptography stopped being an academic topic once Cloudflare, Google, and Apple put ML-KEM hybrids into production. By 2025 it already covers the majority of real web traffic. A look at where adoption stands, where friction still shows up, and what to review in your own infrastructure.
Dragonfly lleva tres años como alternativa compatible con Redis, pero con arquitectura multihilo y sin fork para persistencia. En 2025 ya no es una curiosidad: hay despliegues serios que lo eligen por coste y latencia. Repaso de qué cambia y cuándo compensa mirarlo con calma.
Four years ago it was an academic curiosity. Today, scheduling workloads by grid carbon intensity is a built-in option in Kubernetes, in several cloud provider services, and in CI tooling. We look at what genuinely changed and what is still more promise than practice.
Los primeros racks GB200 NVL72 llevan meses en manos de los hiperescalares y ya empiezan a verse mediciones públicas. La generación Blackwell no es una mejora incremental sobre Hopper, sino un cambio en la forma de entrenar modelos grandes. Repasamos qué cambia y qué no.
OpenSSH added hybrid post-quantum key exchange with ML-KEM in version 9.9 and made it the default algorithm in 10.0. The question is no longer whether to migrate SSH to post-quantum, but how to do it without breaking old clients: enable the hybrid mode, keep a classical fallback, and verify with ssh -v that the active algorithm is the right one.
The combination of Parca for continuous profiling, Beyla for eBPF auto-instrumentation, and Grafana as the visualisation layer delivers deep observability without touching code. A look at how the three pieces fit together and where the limits still show.
Kubernetes 1.34 ships with Dynamic Resource Allocation (DRA) graduating to stable, scheduler improvements, and CEL-based mutating admission policies that replace webhooks. A practical rundown of what is safe to upgrade now, what can wait, and what actually changes for teams running production clusters.
WireGuard is simple over a single link, but hand-building a multi-node mesh quickly turns into a tangle of keys and routes. Patterns that work, when pure WireGuard earns its keep, and when it is worth leaning on Tailscale or Headscale instead.
After years of pilots, private 5G is starting to show up in plants, ports, and warehouses with cases that actually work. What changed in 2025, which deployments make sense, and where WiFi 6E or a wired network still win the comparison.
I have spent six months using a MacBook Pro with M4 Pro as my main development machine. I lay out what has genuinely changed versus the previous M2 Pro, where the jump is noticeable, and where the investment is not justified if you already own a recent machine.
Continuous profiling with eBPF samples every process's execution stack every few milliseconds without touching the code, then stores the history so you can compare last week's performance with today's. The cost measured in production runs between 1% and 3% of CPU, and it pays off most in databases, API gateways and high-concurrency services.
Six months after containerd 2.0 reached general availability there is enough real-world mileage to judge the migration from the 1.x branch in production. We cover what changes in the config file, what breaks on Kubernetes and Docker Swarm, and when planning the jump actually pays off.
Prompt injection is the most common vulnerability in LLM applications, and many teams defend against it with filters that do not work. We review defense layers backed by evidence, what actually works, and what is security theater.
Kubernetes 1.32 Penelope shipped in December and has been running in clusters for several months. It is a good time to look at which changes have aged well, which created extra work, and what lessons to carry into the jump to 1.33.
Rust entered the Linux kernel as an experiment in 2022. Three years on it has stable in-tree drivers, an increasingly polished internal API, and a first wave of contributors who treat the language as the default choice for new code.
Headscale es una reimplementación libre del plano de control de Tailscale. Con la versión 0.25 estable, es una opción sensata para mallas WireGuard privadas sin depender de la plataforma comercial. Cuento cómo, cuándo y dónde duele.
NIS2 entered force on 17 October 2024. Six months later, companies are in the trenches. I cover what has actually changed in operational security, what was paper theater, and where the directive still bites.
Cuando un LLM pasa de contestar texto a ejecutar herramientas, la superficie de ataque cambia de categoría. La inyección de prompts, la contaminación de memoria y el abuso de protocolos entre agentes son el nuevo OWASP Top 10.
Valkey 8.1 salió el 31 de marzo y marca el momento en que la alternativa comunitaria de Redis deja de ser experimento. Cuenta una migración real: qué cambió, qué se mantuvo igual, y dónde hubo sobresaltos.
Kubernetes 1.33 (Octarine) lands April 23. In-place pod resize moves to beta and ships on by default, sidecar containers finally reach GA, and several endpoint and security deprecations arrive that operators should review before upgrading from 1.32.
Después de años acumulando SBOMs, el cuello de botella es filtrar qué CVEs afectan de verdad. VEX aparece como la pieza que convierte el ruido en señal, y en 2025 empieza a tener adopción real en pipelines de supply chain.
Semgrep has grown into one of the most pragmatic static analyzers in the ecosystem. A look at why it works where other SAST tools fail, and how to fit it into a pipeline without turning it into noise.
Two years after Zero Trust stopped being a marketing word, it is worth looking at how it connects with the SIEM teams run day to day. A look at useful signals, avoidable noise, and the decisions that actually change security posture.
CodeQL lleva años siendo el motor de análisis estático de GitHub, pero su alcance real no siempre está claro. Balance de qué detecta bien, qué se le escapa y cómo conviene integrarlo en el flujo de revisión.
Nebula es una VPN peer-to-peer liberada por Slack en 2019 que ha ido madurando sin mucho ruido. Explico cómo funciona, cuándo tiene sentido frente a WireGuard o Tailscale, y qué aprendí desplegándola entre varios nodos.
Deno 2.0 salió en octubre de 2024 con una apuesta clara: compatibilidad seria con npm, pnpm, package.json y node_modules, manteniendo la identidad del runtime. Medio año después, miramos qué ha supuesto para proyectos reales y dónde sigue cojeando.
NIST published the final post-quantum cryptography standards in August 2024. Six months on, it is time to move from headline to plan: crypto inventory, crypto-agility, a realistic timeline, and the typical mistakes of teams jumping in now.
WASI 0.3, also known as preview 3, was ratified on June 11, 2026, adding native asynchronous concurrency to the WebAssembly component model through streams, futures, and async functions. It fixes old fragmentation across languages and runtimes, enables real composition between Wasm services, and paves the way for cooperative threads planned in upcoming 0.3.x releases.
Meta publicó Llama 3.2 con modelos tan pequeños como 1B y 3B, pensados específicamente para ejecutarse en dispositivos. Análisis de qué pueden hacer realmente y cómo se comparan con las alternativas.
Cloudflare Workers turned eight in 2025 without slowing down: it now ships D1 for databases, R2 for egress-free storage, Durable Objects for distributed state, and Workers AI for running models without managing GPUs. It remains the fastest option for edge logic; for large in-memory processes or strict global consistency, other platforms fit better.
Qualcomm, Intel and AMD Copilot+ processors have normalised the presence of an NPU in everyday PCs. A 40 TOPS NPU can run quantised Phi-3 Mini drawing just 5-10 W, versus 40-50 W for a laptop GPU doing the same task. What actually changes for running AI models locally, and when it is worth it.
