Dora Noda
Software Engineer
2333 posts · View all authors
SPIFFE/SPIRE for AI Agents: Cryptographic Workload Identity Instead of Long-Lived Service Account Tokens
A hands-on look at issuing an AI deploy-agent a cryptographic identity distinct from a human's with SPIFFE/SPIRE — and the honest operational cost next to the Vault/External-Secrets-Operator setup most self-hosted platforms already run.
Talos Linux's No-Shell Design Barely Scratched by CVE-2026-31431
A 732-byte exploit roots most major Linux distros — here's exactly why Sidero Labs says it barely touches Talos Linux, backed by the binary counts and CVE benchmarks that make the claim checkable.
Why Talos Linux's Own Creator Didn't Build Omni on Cluster API
Sidero Labs, the team behind Talos Linux, built its own Omni product without Cluster API. Here's a point-by-point read of its six objections against what a CAPH/CAPD-based fleet like bex actually looks like.
Vercel Killed Its Flat $0.30 AI-Agent Fee — Here's the Exact Token Count Where the New Metered Rate Costs More
Vercel dropped its flat $0.30 AI-Agent fee on June 30, 2026 for a $0.25-per-million-token rate. The exact crossover is 1.2 million tokens — below it the new pricing is dramatically cheaper, above it there's no ceiling. Here's the full worked math against Netlify and against owning the inference route yourself.
Vercel Made DDoS Traffic Free in May 2026 — So Why Did a Site Still Get Billed $231.71 for an Attack in June?
Vercel made firewall-blocked DDoS traffic free on May 18, 2026 — but a customer still got hit with a $231.71 bill for a June attack. Here's the exact carve-out in Vercel's policy that still leaves teams exposed, and what changes on owned hardware.
Vercel's Three Outages in Eight Days: What a Build Pipeline, a CDN, and a Workflow Engine Failing Separately Actually Means
Vercel logged three unrelated incidents in eight days in July 2026 — stuck workflow runs, a regional CDN/Dashboard/Functions outage, and a build queue backup — hitting three different subsystems independently. Here's the timeline, the numbers behind it, and what actually changes when you own the layers underneath.
Vercel's $20 Universal Credit Didn't Kill the Meters — It Just Hid Them Behind One Bill
A worked recompute of what a five-seat Next.js team actually pays under Vercel's new $20 credit model versus the same workload self-hosted on a Hetzner box, line by line.
Deploying vLLM as Just Another Git-Push App: What GPU Scheduling Actually Adds
Placement mostly reduces to a manifest field and a node-pool label. Routing doesn't — a worked example against bex's actual Hetzner GPU inventory shows exactly where 'just another git-push app' breaks down for a model server.
12-Factor Agents Is the New 12-Factor App: A Deploy Tool's Field Guide
Dex Horthy's 12-Factor Agents mirrors Heroku's 2011 methodology almost line for line. Here's what each of the twelve factors concretely costs a platform building MCP-exposed deploy and rollback tools for AI agents.