Note di Matteo

unMTA è un nuovo servizio di invio email (transazionali/massive) che usa un modello che si vede raramente nel settore, cioè infrastruttura dedicata con invii illimitati e senza pagamento a consumo per messaggio. Ha ovviamente senso solo per volumi elevati (>500k al mese) ma è altrimenti interessante. Startup USA. Più contesto qui.

Scaleway apre una region cloud a Milano:

La cloud region di Milano comprenderà tre availability zone, l'architettura standard utilizzata da Scaleway per garantire alta disponibilità e ridondanza nativa per i carichi di lavoro mission-critical. La prima availability zone, realizzata in un data center a Settimo Milanese, è già operativa. Le altre due, situate in data center diversi, saranno completate nei prossimi mesi e avranno sede a Basiglio e a Milano.

Migrating from DigitalOcean to Hetzner: From $1,432 to $233/month With Zero Downtime. Contiene utili istruzioni su come migrare un database MySQL enorme con quasi-zero downtime.

Wow, un datacenter AWS negli Emirati Arabi Uniti è stato colpito da un "oggetto" (missile/drone) e ha preso fuoco.

Mar 01 9:41 AM PST We want to provide some additional information on the power issue in a single Availability Zone in the ME-CENTRAL-1 Region. At around 4:30 AM PST, one of our Availability Zones (mec1-az2) was impacted by objects that struck the data center, creating sparks and fire. The fire department shut off power to the facility and generators as they worked to put out the fire. We are still awaiting permission to turn the power back on, and once we have, we will ensure we restore power and connectivity safely. It will take several hours to restore connectivity to the impacted AZ. The other AZs in the region are functioning normally. Customers who were running their applications redundantly across the AZs are not impacted by this event. EC2 Instance launches will continue to be impaired in the impacted AZ. We recommend that customers continue to retry any failed API requests. If immediate recovery of an affected resource (EC2 Instance, EBS Volume, RDS DB Instance, etc.) is required, we recommend restoring from your most recent backup, by launching replacement resources in one of the unaffected zones, or an alternate AWS Region. We will provide an update by 12:30 PM PST, or sooner if we have additional information to share.

Ecco gli aumenti di prezzo di Hetzner che erano stati pre-annunciati qualche giorno fa.

Anche nelle altre location, anche per i server dedicati e per volumi e snapshot.

Qua la versione archiviata della pagina.

Andrea Ayer in Why IP Address Certificates Are Dangerous and Usually Unnecessary spiega perché i certificati per indirizzi IP sono poco sicuri. Per via della rapida intercambiabilità degli IP in ambienti cloud e delle regole di validazione della proprietà dell'indirizzo molto allentate, è relativamente facile per un attaccante disporre di un certificato valido per un indirizzo IP che non è più autorizzato a rappresentare.

The basic security property provided by a certificate is that the certificate authority has validated that the certificate subscriber (the person who applies for the certificate and knows its private key) is authorized to represent the domain name or IP address in the certificate. This ensures that the other end of a TLS connection is truly the domain or IP address that you want to connect to, not a MitM impostor.

But the validation is not done every time a TLS connection is established; rather, it was done at some point in the past. Thus, the certificate subscriber may no longer be authorized to represent the domain or IP address.

How old might the validation be? As of February 2026, certificate authorities are allowed to issue certificates that are valid for up to 398 days. So the validation may be 398 days old. But it gets worse. When issuing a certificate, CAs are allowed to rely on a validation that was done up to 398 days prior to issuance. So when you establish a TLS connection, you may be relying on a validation that was performed a whopping 796 days ago. You could be talking not to the current assignee of the domain or IP address, but to anyone who was assigned the domain or IP address at any point in the last 2+ years.

È un problema che c'è evidentemente anche con i domini, ma lo spazio dei nomi di dominio è molto più grande di quello degli IPv4 e quindi il problema non è di fatto un problema:

This is a problem with both domains and IP addresses, but it's way worse with IP addresses. While it's still very possible to register a domain that no one has ever registered before, you don't have this luxury with IPv4 addresses. There are no unassigned IPv4 addresses left; when you get an IPv4 address, it has already been assigned to someone else.

Questa vulnerabilità si ridurra assieme alla riduzione della durata massima dei certificati (47 giorni + 10 giorni di periodo di validazione nel 2029). Nel frattempo si può consultare o monitorare i log di trasparenza (es. crt.sh) per vedere quali certificati sono stati emessi per un indirizzo IP o un dominio.

Mistral ha acquisito Koyeb, startup francese che sviluppa una piattaforma cloud agnostica (deployabile quindi anche su AWS e altri provider). Buon acquisto per Mistral, meno per i clienti Koyeb dato che "the entire Koyeb team is joining Mistral AI and will be fully dedicated to working on Mistral Compute".

Heroku si avvia verso la chiusura. Salesforce ha pubblicato un comunicato estremamente vago e confuso in qui sembra dire che Heroku è ora in "maintenance mode". La fine di un'era.

Uno vorrebbe anche fidarsi di OVHcloud, il più longevo e promettente provider cloud europeo, ma ne combina una dopo l'altra. Oggi:

The incident was caused by our cloud infrastructure provider accidentally triggering simultaneous restart of all compute nodes in the EU-WEST-PAR region, rather than performing the intended rolling update.

Le setup fee dei server dedicati Hetzner crescono significativamente per via dell'aumento dei prezzi di RAM e SSD. Aumenteranno anche i prezzi mensili, scrivono nel comunicato ufficiale.

Da Hacker News:

EX44: €79 → €99

EX63: €79 → €99

EX130-R: €159 → €476

EX130-S: €159 → €359

AX41: €0

AX42: €79 → €107

AX102: €79 → €269

AX162-R: €159 → €542

AX162-S: €159 → €411

SX65: €79 → €109

SX135: €159 → €209

SX295: €159 → €399

GEX44: €159 → €264

GEX131: €159 → €1555

Dell DX

DX153: €0 → €771

DX182: €0 → €897

DX293: €0 → €944

Da oggi è disponibile AWS European Sovereign Cloud (AWS.eu). Non ci sono tutti i servizi ma è comunque interessante. Account separato e (credo) region separata, per ora in Germania, con staff 100% europeo e nessuna dipendenza "tecnica" sugli USA.

Dopo Quickwit scopro Nixiesearch, essenzialmente un Elasticsearch backed by object storage (S3, ecc.).

How Temporal Powers Reliable Cloud Operations at Netflix. Netflix, sempre molto trasparente sulle scoperte ingegneristiche che fa alla sua scala, spiega come usa Temporal nei deployment per ridurre il tasso di errori delle operazioni mutazione dell'infrastruttura cloud.

Temporal is a Durable Execution platform which allows you to write code “as if failures don’t exist”. It’s become increasingly critical to Netflix since its initial adoption in 2021, with users ranging from the operators of our Open Connect global CDN to our Live reliability teams now depending on Temporal to operate their business-critical services. In this post, I’ll give a high-level overview of what Temporal offers users, the problems we were experiencing operating Spinnaker that motivated its initial adoption at Netflix, and how Temporal helped us reduce the number of transient deployment failures at Netflix from 4% to 0.0001%.

SlateDB. slatedb is an OSS embedded key-value database built on object storage.

Interesting:

Today we are going public with the developer preview of exe.dev, a new VM hosting service. We will keep the service open for new users as long as our capacity lasts. Try it out with:

ssh exe.dev

Analisi della conformità agli standard Internet moderni dei domini istituzionali della PA italiana di Fabrizio Tarizzo.

Postmortem di Railway, la creazione di un indice PostgreSQL ha tirato giù tutto:

A routine change to this Postgres database introduced a new column with an index to a table containing approximately 1 billion records. This table is critical in our backend API’s infrastructure, used by nearly all API operations.

The index creation did not use Postgres’ CONCURRENTLY option, causing an exclusive lock on the entire table. During the lock period, all queries against the database were queued behind the index operation. [...] Manual intervention attempts to terminate the index creation failed.

Le misure:

We’re going to introduce several changes to prevent errors of this class from happening again:

• In CI, we will enforce CONCURRENTLY usage for all index creation operations, blocking non-compliant pull requests before merge.
• PgBouncer connection pool limits will be adjusted to prevent overwhelming the underlying Postgres instance's capacity.
• Database user connection limits will be configured to guarantee administrative access during incidents, ensuring maintenance operations remain possible under all conditions.

A conspicuous part of Let’s Encrypt’s history is how thoroughly our vision of scalability through automation has succeeded.

In March 2016, we issued our one millionth certificate. Just two years later, in September 2018, we were issuing a million certificates every day. In 2020 we reached a billion total certificates issued and as of late 2025 we’re frequently issuing ten million certificates per day. We’re now on track to reach a billion active sites, probably sometime in the coming year.

(LE)

How we deploy the largest GitLab instance 12 times daily. La strategia di deployment di GitLab, interessante per la scala, per la progressività con canary e la strategia di migrazione del db.

Dati Black Friday di Shopify:

This Black Friday Cyber Monday, the scale of global commerce surged. At peak, we processed 11TB of logs per minute.

Shopify’s edge (post-CDN) averaged 312 million requests per minute across BFCM, peaking at 489 million requests per minute.

At peak, our global Kubernetes fleet ran over 3.18 million CPU cores.

Powered largely by MySQL 8, our database fleet sustained 53.8 million queries per second and 4.28 billion row operations per second at peak 🌐

Kafka + Flink powered real-time experiences for merchants and buyers.

Flink processed over 150 MB per second and streaming analytics latency improved 103x since BFCM 2024, supercharged by our migration to Flink SQL.

Our CDN [Cloudflare] served 183 million requests per minute, with 97.8% from cache for fast responses. At peak, we ran 23.2 million async jobs per minute.

(Shopify Engineering)

→ Merchants’ sales globally were $14.6 billion, up 27% from last year

→ 81 million shoppers bought from Shopify-powered brands

→ 15,800+ entrepreneurs made their first sale

→ 136+ million packages tracked in the Shop App

→ 2.2 trillion edge requests

→ Processed and served 90 PB of data from our infrastructure

→ Handled 14.8 trillion database queries and 1.75 trillion database writes

(Tobi Lutke)