.tip

Mar 7, 2026 · one of the small things

Always run EXPLAIN with ANALYZE and BUFFERS

EXPLAIN alone shows the planner's guess. EXPLAIN (ANALYZE, BUFFERS) shows what actually happened, including how many pages came from cache and how many from disk. The gap between the estimated and actual row counts is where the bad plans hide.

EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) SELECT ...;

If the actual rows are ten times the estimate, run ANALYZE on the table before you touch the query.

postgresqlperformance

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close