.tip

May 1, 2026 · one of the small things

Ship the Content-Security-Policy as Report-Only first

A CSP missing a single source breaks the page for every user at once. The report-only header logs violations and blocks nothing.

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://cdn.example.com; report-to csp

Run it for a week, read the reports, and add the sources you forgot. Then rename the header, since the policy string stays the same.

securityhttp

~/tips/today — 2026-10-19

~cat tips/today

Never build an index on a live table without CONCURRENTLY

postgresqlmigrations

A plain CREATE INDEX takes a lock that blocks every write to the table for the whole build. On a big table that means minutes of outage that look like a hung app.

CREATE INDEX CONCURRENTLY orders_customer_idx ON orders (customer_id);

It's slower and can't run inside a transaction, so you'll have to tell your migration tool. If it fails halfway, it leaves an invalid index behind, so check pg_index.indisvalid and drop it before you retry.

↵ open y yesterday l ls /tips

esc close