.tip

May 23, 2026 · one of the small things

Dependency alerts need one person and a weekly slot

An alert feed nobody owns grows to three hundred items and stops meaning anything. Give it one person who triages it every week: fix it, mark it not applicable with a reason, or schedule it.

Group the low ones into a monthly bump PR. Anything with a known exploit and a reachable code path ships the same day. Zero alerts isn't the goal. The goal is that a person has looked at every alert and written down why.

securityengineering-practice

~/tips/today — 2026-10-19

~cat tips/today

Never build an index on a live table without CONCURRENTLY

postgresqlmigrations

A plain CREATE INDEX takes a lock that blocks every write to the table for the whole build. On a big table that means minutes of outage that look like a hung app.

CREATE INDEX CONCURRENTLY orders_customer_idx ON orders (customer_id);

It's slower and can't run inside a transaction, so you'll have to tell your migration tool. If it fails halfway, it leaves an invalid index behind, so check pg_index.indisvalid and drop it before you retry.

↵ open y yesterday l ls /tips

esc close