.tip

Jul 10, 2026 · one of the small things

If the fix is 'wait', it should not page

An alert that resolves on its own before anyone could act on it trains the on-call to ignore the pager. Wait it out with a for clause, and if it always resolves in five minutes, it is a ticket, not a page.

for: 10m

Page for things that need a human in the next fifteen minutes. Everything else goes to a channel and is reviewed in the morning.

observabilitysre

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close