Xe Iaso

I've been running a blog at https://xeiaso.net for almost a decade now. It has been the single best decision I have ever made in my career. It allows me to skip technical screening interviews. It has made interviewing at companies _easy_ because I have _already proven_ that I understand what I'm talking about. Learning how to write well also makes it so much easier to explain things succinctly, especially when working remote like I prefer to. I've also been told that more junior people look up to me as a role model because of my blog, which is something that I am still getting used to, but I can accept.

I agree with all the points in this post. And, I love NixOS. It's really special and very different than the other Linux I've used for 20 years. I have been curious to try Guix at some point. Does anyone know if there is a good comparison write-up? Also, can anyone speculate why the community has had such a hard time documenting this incredible technology? There are great posts like this from Xe: https://xeiaso.net/ but not generally getting started guides that are up to date. Why is this so hard to do? I mean, I'm not doing it because I personally feel like everything I do to get something working on Nix is a quasi-hack and not the standard and most up-to-date way to do it, so I'm hesitant to share. But, surely there are experts that like to write. Is this a problem with a simple technology solution (choose a better documentation tool)?

https://xeiaso.net/ is equally great content in a similar style in my opinion. Different area of topics a bit, but I enjoy both very much

I personally remember being inspired by Erase your Darlings and Paranoid NixOS Setup back in the day, less for the hardening measures and more because of how great the Nix syntax looked. Huge, monumental ass-pain setups could be scripted away in one or two lines like it was nothing. You could create wildly optimized configurations for your specific use-case, and then divide them into modules so they're portable. It's not advisable to switch to one of these paranoid configurations outright, but they're a great introduction to the flexibility provided by the NixOS configuration system. I'd also recommend Xe's documentation of Nix Flakes, which can be used on any UNIX-like system including macOS: https://xeiaso.net/blog/nix-flakes-1-2022-02-21/ https://grahamc.com/blog/erase-your-darlings/ https://xeiaso.net/blog/paranoid-nixos-2021-07-18/

This clever bunny did something very similar.. (but self hosted) https://xeiaso.net/blog/2025/anubis/ I love the approach.. If I could be arsed blogging I'd probably set it up myself.

Unfortunately it seems pretty half-baked and rushed out just so they can check the box without being as useful as it could be. Here is the best commentary that I've read on the subject from someone who works regularly in generative AI: https://xeiaso.net/blog/2025/squandered-holy-grail/

My favorite illustration of this is Xe’s blog: https://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2024-9632/

Thanks! When using full open-source HyperDX (beyond the Kibana part), inclusive of your choices of ingestion and controlling Clickhouse, does it set up the recommended indexes automatically? That is, is it a full drop-in for a typical Grafana + Loki deployment? For context, I'm currently following the approach described in https://xeiaso.net/blog/prometheus-grafana-loki-nixos-2020-11-20/ where with ~40 lines of NixOS config it pushes my entire server cluster's systemd journald logs into Grafana. Roughly how much effort would one have to put in to achieve the same with HyperDX? If it's not too hard, I might get around to package it as a NixOS service.

There has been a lot of ink spilled about how V is not as advertised. I am not going to repeat everything here, but here are some articles you can have a look at: * "V Language Review (2022)": https://mawfig.github.io/2022/06/18/v-lang-in-2022.html * "V is for Vaporware": https://xeiaso.net/blog/v-vaporware-2019-06-23/ (and its follow-up, "V is for Vvork in Progress": https://xeiaso.net/blog/v-vvork-in-progress-2020-01-03/) * This comment on Reddit: https://old.reddit.com/r/ProgrammingLanguages/comments/vq4ul6/why_does… There's a whole lot more out there too.

> I super doubt these limitations are there because of any EC2 requirements. I think you are misreading me, but to be fair, I was being vague about timelines. my main thrust is that S3 is dominant because EC2 was/is lacking. S3 is optimised for uptime and consistency, which means that its brilliant at mostly static file hosting. It will work for more dynamic state type stuff, its just not really designed for it (see https://xeiaso.net/blog/anything-message-queue/) making your own object store that is fast, durable and available and has another feature is really really hard to do at scale. Its far easier to put up with s3 than make your own.

You’re very focused on specifics, which aren’t paramount here. This is not the end of the story, it’s the beginning. Not to mention iterm development has slowed a lot in recent years. Who knows how much longer the author will be around. From: https://xeiaso.net/notes/2024/ai-hype/ “A terminal emulator is probably also a fairly bad place to implement this because it's probably one of the most privileged programs on a developer's machine. It deals with all the secrets in the world, and the threat that it could be used to upload them all to a third party is great enough that people are willing to switch away from it sight unseen.” It’s important to call out poor judgment around development of our FLOSS tools, they are precious.

Alas, many top experts/writers publish quite infrequently. Therefore I personally think that HN/Lobsters/Fediverse is much more convenient than RSS. With that said, I really like these blogs: https://jvns.ca/ https://xeiaso.net/ http://www.paulgraham.com/

Another long time reader chiming in to appreciate your great work. https://xeiaso.net/blog/paranoid-nixos-aws-2021-08-11 is one of my personal favorites, as well as https://tailscale.dev/blog/headscale-funnel

https://nelson.cloud I mainly write about things I learn about in the field. I am slowly putting up more opinions/thoughts. Some of my fav blogs are: - https://xeiaso.net/ - https://jvns.ca/

Love this line! "This code is free as in mattress. If you decide to use it, it's your problem." https://xeiaso.net/blog/GraphicalEmoji

What are you missing from https://xeiaso.net? There's also a short interview over at: https://usesthis.com/interviews/christine.dodrill/

I wish Elon Musk all the best handling whatever this is with a skeleton crew of people who hate him on Tuesday: https://xeiaso.net/blog/openssl-3.x-secvuln-incoming.

> know's how to write In fact Xe's personal writings[1] are quite regularly on the frontpage as well. I'd post an HN domain listing link, but the domain recently changed. [1]: https://xeiaso.net

It's interesting how the language author of V was bullied and harrassed for his early language [0] and with time V has made very substantial progress with C2V [1], and an OS written in V [2] and various language improvements. This (and many future updates of V) has now rendered pretty much most criticisms in this attack post irrelevant, after all of this V is gaining traction, a community forming around the language and with great backing, It goes to show that programmers are far too quick to jump the gun on languages. I congratulate Alex for persisting on V. [0] https://xeiaso.net/blog/series/v [1] https://github.com/vlang/c2v [2] https://github.com/vlang/vinix

JdeBP is surely referring to https://xeiaso.net/

> If the site really was static before, and no JS was needed One does not imply the other. This forum is one example. (Or rather, hn.js is entirely optional.) > Another great solution? Just ask users to login (no js needed). I'll stand pretty firmly behind "If you aren't willing to make an account - you don't actually care about the site". Accounts don't make sense for all websites. Self-hosted git repositories are one common case where I now have to wait seconds for my phone to burn through enough sha256 to see a readme - but surely you don't want to gate that behind a login either... > My take is that search engines and sites generating revenue through ads are the most impacted. I just don't have all that much sympathy for either. ...and hobbyist services. If we're sticking with Anubis as an example, consider the author's motivation for developing it: > A majority of the AI scrapers are not well-behaved, and they will ignore your robots.txt, ignore your User-Agent blocks, and ignore your X-Robots-Tag headers. They will scrape your site until it falls over, and then they will scrape it some more. They will click every link on every link on every link viewing the same pages over and over and over and over. Some of them will even click on the same link multiple times in the same second. It's madness and unsustainable. https://xeiaso.net/blog/2025/anubis/ > Functionally - I think trying to draw a distinction between accessing a site directly and using a tool like…

https://xeiaso.net/blog/2025/anubis/ links to https://pod.geraspora.de/posts/17342163 which says: > If you try to rate-limit them, they'll just switch to other IPs all the time. If you try to block them by User Agent string, they'll just switch to a non-bot UA string (no, really). This is literally a DDoS on the entire internet. My gut is that the switch between IP addresses can't be that hard to follow. That the access pattern it pretty obvious to follow across identities. But it would be non trivial, it would entail crafting new systems and doing new work per request (when traffic starts to be elevated, as a first gate). Just making the client run through some math gauntlet is an obvious win that aggressors probably can't break. But I still think there's probably some really good hanging fruit for identifying and rate limiting even these somewhat rather more annoying traffic patterns, that the behavior itself leaves a figure print that can't be hidden and which can absolutely be rate limited. And I'd like to see that area explored. Edit: oh heck yes, new submission with 1.7tb logs of what AI crawlers do. Now we can machine learn some better rate limiting techniques! https://news.ycombinator.com/item?id=44450352 https://huggingface.co/datasets/lee101/webfiddle-internet-raw-cache-da…

They need a better PR department. When I read "MCP is eating the world" I took it as, "this is a bad thing." Which, based on the last blog post I read from a knowledgeable person[0], it is. And the more I read this article, I feel like it still is. "The models finally got good enough" is followed by: > Of course, models and agents are still far from perfect—the better models are pretty slow, context sizes are still limited, and performance degrades when more and more context is present. > What’s important is that the models are good enough—once models cross that threshold, the overhead of integrating tool use drops dramatically. MCP just showed up right on time. That's like saying we invented worker ants just in time to help an insane queen. I searched the article for the word "secure" or "security" and quit reading when I couldn't find it. [0] https://xeiaso.net/blog/2025/rolling-ladder-behind-us/

So first, let me prefix this by saying I generally don't accept cookies from websites I don't explicitly first allow, my reasoning being "why am I granting disk read/write access to [mostly] shady actors to allow them to track me?" (I don't think your blog qualifies as shady … but you're not in my allowlist, either.) So if I visit https://anubis.techaro.lol/ (from the "Anubis" link), I get an infinite anime cat girl refresh loop — which honestly isn't the worst thing ever? But if I go to https://xeiaso.net/blog/2025/anubis/ and click "To test Anubis, click here." … that one loads just fine. Neither xeserv.us nor techaro.lol are in my allowlist. Curious that one seems to pass. IDK. The blog post does have that lovely graph … but I suspect I'll loop around the "no cookie" loop in it, so the infinite cat girls are somewhat expected. I was working on an extension that would store cookies very ephemerally for the more malicious instances of this, but I think its design would work here too. (In-RAM cookie jar, burns them after, say, 30s. Persisted long enough to load the page.)

It's kind of the opposite problem as well; huge well-funded companies bringing down open source project websites. See Xe's journey here: https://xeiaso.net/blog/2025/anubis/ One may posit "maybe these projects should cache stuff so page loads aren't actually expensive" but these things are best-effort and not the core focus of these projects. You install some Git forge or Trac or something and it's Good Enough for your contributors to get work done. But you have to block the LLM bots because they ignore robots.txt and naively ask for the same expensive-to-render page over and over again. The commercial impact is also not to be understated. I remember when I worked for a startup with a cloud service. It got talked about here, and suddenly every free-for-open-source CI provider IP range was signing up for free trials in a tight loop. These mechanical users had to be blocked. It made me sad, but we wanted people to use our product, not mine crypto ;)

I joined Vlang GitHub organisation after I was invited. I was aware of the "V for Vaporware" articles [1] that already existed, but at that point they were more than a year old, so things had probably changed. It didn't take long for me to disagree with the way things were moderated, with many negative responses by the moderators to the people with criticism (often valid). I'm talking about moderators calling people "idiots" in the general publicly available chat. I loved the idea of simplicity, autofree, the UI framework, the browser, Volt app, GitHub alternative, operating system and so much more. But it just didn't seem to go anywhere. The syntax however was simple, I really admired it and by 0.3 they would have a syntax freeze, but I do see that some major syntax has changed after 0.3 multiple times. I left the same day another developer did, and having talked with multiple V developers shortly after, four of them said they agreed to my criticism about moderation and broken promises. Alex (the creator) wrote to me personally, but denied all the criticism which was mentioned in the "V for Vaporware" articles. In the moderator channel Alex mentioned that autofree wouldn't be delivered in 0.3 and this became my main criticism in the DMs. He could not see why I found it important to notify the community about this, while also telling me to "grow up" for not supporting offensive language, referencing some of the ways Linus Torvalds has written responses. Shortly thereafter…

As far as I heard the V programming language is largely considered to be Vaporware (see eg. https://xeiaso.net/blog/vlang-update-2020-06-17, and other articles by Xe). I agree that I (in theory) quite like some of the design decisions, but as far as I know nothing of this actually works in practice. Like, it's not even close to being production ready, and people are seriously doubting whether the language will ever even come close to being a viable option. I'm not up to date on all of the issues (in the code or in the community), but the last thing I heard is that the developers of V are still working on the "auto-free" memory management model (which is supposed to infer when 'free' needs to be called), but it's not working (and afaik proven to be undecidable in general). Edit: Another reason why I'd be rather skeptical of this language is the claims it makes on the 'Compare' page: https://vlang.io/compare It starts off stating that "V was created because none of the existing languages had all of the following features:" and then goes and lists an incredibly ambitious list of features, which essentially amount to "As safe as Rust, but Go's simplicity and fast-compilation time, and a small compiler with zero dependencies", and more. These are hard problems, especially if you're also working on developing an experimental memory management technique.

> It can lock down free and open computing and this is far greater than the threat by trojans that I didn't have in the last 20 years. I see this claim made over and over, yet we are still to see an actual "act of aggression" (modulo incompetence of an individual vendor - slip ups happen[0]). Every single PC system I ever heard of, allows either enrolling your own keys, or just disabling secure boot; most accept the MS-signed bootloader shim found in common desktop distros; I think this is even mandated in MS' specification that it must be possible for the users to bypass this. If you haven't had a trojan in the last 20 years, you have been diligent and/or lucky. Scattershot malware (cryptolockers, miners) is incredibly common, one of our customers was hit several times (on systems we weren't managing). More sophisticated attacks are an everyday thing against high-value targets[1][2]. Exploiting computer (in)security is a multi-billion dollar business, platforms far more locked down than PC are being routinely targeted and exploited. Real people, fighting for IRL freedom - journalists, activists, opposition politicians - are in danger. Please stop spreading the FUD against secure boot, and please back your claims with facts. [0]: https://mjg59.dreamwidth.org/59931.html https://news.ycombinator.com/item?id=32023868 [1]: https://techcrunch.com/2023/01/14/circleci-hackers-stole-customer-sour… [2]: https://xeiaso.net/blog/spearphishing

There seems to be some speculation that this is credit card details being hacked. Firing your _entire_ security team sounds like the sort of action taken if basic security practices are not being done. Until we know more, hold out on hiring these people. Xe has commented on this and is suggesting to simply enable 2FA to deal with security concerns [1], as apparently a more measured response to security issues at Patreon. This seems to be more self-serving advice rather than good advice [2], the better suggestion would be to simply move to one of the many alternatives. The assumption is that the login system is somehow insecure, instead of the bank details themselves being stored insecurely. (Hypothetically) If you suffered a large leak of payment details, when payment processing is your _main_ income revenue, and you find out your security team of X people at probably $100k+ a year for N years have done nothing to secure payment details, you too may fire them on the spot. Until Patreon explain why they fired their _entire_ security team, the best advice is to remove your card details immediately. You can always add it back at a later date, or use an alternative payment processor. [1] https://xeiaso.net/blog/patreon-happening [2] https://www.patreon.com/cadey (Edit: As pointed out, Xe didn't mention credit card details.)

I'm a PhD student, and as a result often have to write. I've always had the problem of editing as I type, constantly back tracking, writing alternate versions of a sentence, insisting that I get it right the first pass. Increasingly, I've taken to outlining my work (like Xe Iaso recommends[0]) on pad and paper (helps if you have a nice pen and nice paper), and then trying to write a stream of consciousness for each section. Then, I'll go to my text editor of choice and start forming more coherent, cogent, and discrete thoughts and arguments from the previous word salad. All to say, I appreciate that typewriters make it really hard to revise your work while you're writing as it facilitates that draft phase. Same deal with writing in pen, you can only scratch out so much before the page becomes an ink rag. Perhaps this implementation was sloppy in that it _only_ has this no-cursor/no-backspace mode. A physical dial could be a cool alternative ("Draft Mode", "Editing Mode") [0] https://xeiaso.net/blog/doing-a-writing