Dora Noda
Software Engineer
2322 posts · View all authors
Your Post-Quantum TLS Migration Isn't a Second Certificate Format — It's the Same Freshness Problem You Already Solved for 6-Day Certs
Let's Encrypt is skipping a direct ML-DSA swap for Merkle Tree Certificates because the naive post-quantum handshake blows past 14,700 bytes. Here's the actual byte math, the late-2026 staging timeline, and what a self-hosted PaaS's ACME automation needs to track before production MTCs land in 2027.
From 3 Days to 11 Minutes: What the Widely-Cited MCP Deploy Speedup Stat Actually Measures
The '3 days to 11 minutes' MCP integration stat traces to one unverified blog testimonial, not a benchmark. Here's what it actually measures, and what a fair before/after would require.
MCP's Enterprise Readiness Push: Why Audit Trails and SSO Matter More When Your MCP Server Can Delete a Database
MCP's 2026 roadmap treats audit trails and SSO as a security-review checkbox. For a deploy-authority MCP server, they're what turns an agent's nine-second production wipeout into a reconstructable incident instead of a lost weekend.
Three JavaScript Quirks, One CVSS 10.0 RCE: What n8n's Sandbox-Escape Chain Means for Every Agent Tool Wired to Your Cluster
Three individually-harmless gaps in n8n's JavaScript sandbox chained into a CVSS 10.0 RCE that reached every stored credential and, on shared instances, the Kubernetes cluster underneath. Here's the exploit chain and what it means for any tool that hands an agent a general-purpose sandbox.
New York Froze 50MW+ Data Centers. The Math Shows Self-Hosted PaaS Was Never in That Weight Class
New York's Executive Order 62 freezes new 50MW-plus data centers — but every self-hosted colocation campus in Europe tops out under that line. Here's the megawatt math, and what the freeze means for hosted PaaS vendors riding on hyperscaler capacity.
Northflank Has Four Kubernetes Modes. Only One Puts You in the Driver's Seat
Northflank markets four ways to run Kubernetes under its platform. Three of them mean Northflank's software still operates the control plane — only one hands that job to you. Here's the breakdown, with real numbers.
npm v12 Turns Off 16 Years of Automatic Code Execution: The Exact Packages You Need to Re-Approve Before Your Build Breaks
npm v12 flipped install scripts, Git dependencies, and remote tarballs to off by default after a year of worm-driven supply chain attacks — here's the exact audit of which packages need re-approving and what it means for a git-push PaaS's Node buildpack.
The NSA Just Published a Threat Model for MCP: What It Means for Your Deploy Agent
The NSA's AI Security Center named four structural risks in MCP's design — and every one already has a real 2026 incident behind it. Here's what each means concretely for a self-hosted MCP server with deploy and rollback authority.
Gitpod Bet the Company on Self-Hosted Agent Infra — Then OpenAI Bought It
Gitpod rebranded to Ona and went self-hosted-only in September 2025. Nine months later OpenAI bought it for Codex. Here's what a hyperscaler choosing to buy customer-owned execution instead of building it actually signals.