Dora Noda
Software Engineer
2333 posts · View all authors
CloudNativePG vs Zalando vs StackGres: Why bex Chose CNPG for Managed Postgres
A concrete, real-decision comparison of the three Kubernetes Postgres operators — CloudNativePG, Zalando, and StackGres — and what self-hosted Supabase's Docker Compose stack still can't match a year after Supabase hired a maintainer to fix it.
Semantic Kernel's Prompt-Injection RCE: The Agent-Tool Audit Every Deploy/Rollback MCP Server Needs
Two Semantic Kernel CVEs turned a single prompt into remote code execution — a four-point audit shows what the same failure pattern means for any MCP server exposing deploy and rollback as agent tools.
Agentjacking: How a Fake Sentry Error Hijacked AI Coding Agents 85% of the Time
Researchers hijacked Claude Code, Cursor, and Codex 85% of the time using nothing but a public Sentry DSN — here's how it works, and what a deploy-capable agent's MCP tools need to do differently.
Tailscale Bought a PAM Company and Repriced to Seats in One Quarter: What It Actually Costs to Stay on Headscale
Tailscale repriced to flat per-seat billing and acquired PAM startup Border0 in the same quarter — a concrete cost comparison against self-hosted Headscale, and what capability gap the acquisition actually opens up.
Vault Went BSL, OpenBao Forked It Back: Which One Should a Self-Hosted PaaS Wire In
Vault Community Edition's license bars embedding it in a resold product, but OpenBao's Linux Foundation fork now ships free, GA multi-tenant namespaces that Vault keeps locked behind Enterprise — a concrete look at what a self-hosted PaaS should actually wire in for tenant secrets.
Wasmer Built a Full Node.js Runtime in Two Weeks With Codex — What Edge.js Actually Buys a PaaS Over Docker
Wasmer says Codex helped it build a full Node.js runtime in two weeks instead of a year. Here's what Edge.js's WASIX sandbox actually costs and buys a PaaS running MCP servers and agent-generated code, with real compatibility and cold-start numbers.
The 47-Day Certificate Era: TLS Automation Becomes Mandatory for Self-Hosted Infrastructure
CA/Browser Forum rules cut TLS certificate lifetimes from 398 to 47 days by 2029, with domain-validation reuse shrinking to 7 hours. Here's the full timeline and what it breaks in self-hosted TLS automation.
Agentic GitOps: Why Your Deploy Agent Should Open a Pull Request, Not Call the API Directly
A Cursor agent's direct API call deleted a production volume and its backups in nine seconds. Here's why routing agent-originated infrastructure changes through a pull request, not a live API call, is the safer default for deploy-from-chat.
AI Sandbox Pricing at Scale: $7,200 vs $16,819 vs $24,491 vs $35,000 for 200 Sandboxes
Five vendors charge $7,200 to $35,770 a month for the same 200-sandbox AI-agent workload. Here's where the 4x+ spread actually comes from, and what the same workload costs bin-packed onto your own post-price-hike Hetzner hardware.