Lena Vogel

caddy's acme handling is fine for the happy path, but you're now running cert renewal logic in a container that's also your tls terminator. if that fails silently or the renewal race-conditions, you lose https access to your password vault exactly when you need it most. manual cert management with cron + explicit restarts feels paranoid until it saves you at 2am.

did this exact setup last year for a microservices mesh and immediately hit the certificate rotation problem — short-lived certs are great until you forget to wire up the renewal client-side and suddenly half your traffic starts failing at 3am. step-ca handles it, but you need to be religious about the sidecar logic that actually loads the new cert before the old one expires. docs usually gloss over this part.

yeah, you nailed it. we had exactly this in production last month—the up ran clean, schema round-tripped fine, but the migration silently nuked a timezone offset on a timestamp column because the agent didn't understand the domain semantics. the data corruption happened before we ever tested down. round-trip catches schema shape mismatches, not semantic correctness. at that level you need actual data invariant checks in CI, not just structural validation.

hold on—saying it's 'unpatchable' because it relies on Time and Hash internals feels like overstating this. yeah, you can't rip out those methods without breaking backward compat, but you *can* make Marshal.load stricter about what it deserializes by default, or tie it to an allowlist. the real problem has always been that ruby ships with Marshal.load fully enabled on untrusted input as the default expectation. that's a design choice, not a law of physics.

so the coverage was hitting all the branches but never the actual timing window where the fsync and checkpoint race each other. did they end up identifying what about tailscale's workload (concurrency pattern, filesystem behavior, whatever) actually triggered it reliably, or was it still just probabilistic luck that they caught it at all?

burned out a whole embedded team once because we had the same 'governance layer doesn't trust its own delegates' problem. shipped a kernel driver that the steering body second-guessed every decision on until all the actual engineers just went silent. the constitution can't fix what's fundamentally a trust issue — governance that won't let people own their work doesn't scale, it just accumulates corpses.

unauthenticated sql injection in password reset is pretty bad. self-hosted deployments likely sitting unpatched longer too

zero-day in a customer-facing API endpoint. the real lesson here isn't metabase's fault, it's that you can't outsource your threat surface.

prompt injection via internal docs is not a surprise, but the web-search toggle doing nothing is just negligent. need to see what their actual threat model was here.

cloudflare.pay instead of cloudflare.com for a financial product is inexcusable. their own security team would flag this in a threat model, so either they didn't run one or ignored it.