Andy Dixon: BlogDaily technical writing by Andy Dixon: Go and Rust internals, Linux and security how-tos, cryptography and UK privacy law, checked against source.https://dixon.cx/blog2026-09-17T03:39:30ZAndy Dixonhttps://dixon.cx/Copyright 2026 Andy DixonGo's log/slog: Structured Logging Without Reaching for a Third-Party Loggerhttps://dixon.cx/blog/go-slog-structured-logging.html2026-09-17T03:39:30Z2026-09-17T03:39:30ZHow Go's log/slog package gives you structured, leveled logging with context propagation, without adding zap or zerolog to go.mod.Go's GOMEMLIMIT: Keeping the OOM Killer Away From a Containerhttps://dixon.cx/blog/go-gomemlimit-oom-killer-containers.html2026-09-16T23:40:07Z2026-09-16T23:40:07ZWhy a Go service can be OOM-killed inside a memory-limited container despite having a garbage collector, and how GOMEMLIMIT fixes the pacing.Digital Forensics 101: Why dd and a Hash Beat cp When Imaging a Drivehttps://dixon.cx/blog/forensic-disk-imaging-dd-vs-cp.html2026-09-16T19:39:25Z2026-09-16T19:39:25ZWhy bit-for-bit disk imaging with dd, a write blocker and a SHA-256 checksum beats a filesystem copy when acquiring a drive for forensic analysis.Go's io.Copy Can Write Gigabytes Before Reporting an Errorhttps://dixon.cx/blog/go-io-copy-partial-writes-errors.html2026-09-16T15:41:30Z2026-09-16T15:41:30ZLearn why io.Copy can partially mutate a destination before failing, how its byte count helps, and when to stage writes for an atomic result.TOTP From Scratch in Go: Implementing RFC 6238 Without a Libraryhttps://dixon.cx/blog/totp-from-scratch-in-go-rfc6238.html2026-09-16T03:39:49Z2026-09-16T03:39:49ZHow the six digits in your authenticator app are actually produced: HMAC-SHA1, dynamic truncation and time steps, built in plain Go.OAuth 2.0 Device Authorization Grant: How CLI Tools Log In Without a Browser Redirecthttps://dixon.cx/blog/oauth-device-authorization-grant-cli-login.html2026-09-15T23:39:35Z2026-09-15T23:39:35ZRFC 8628 explained: how tools like gh, docker and kubectl authenticate on headless machines by polling a token endpoint instead of a browser redirect.Go's errgroup: Cancelling Goroutines Without Reinventing sync.WaitGrouphttps://dixon.cx/blog/go-errgroup-cancelling-goroutines.html2026-09-15T19:39:26Z2026-09-15T19:39:26ZHow golang.org/x/sync/errgroup collects errors, cancels sibling goroutines on first failure, and bounds concurrency without a semaphore channel.Go's errors.Join: Combining Errors Without Losing errors.Ishttps://dixon.cx/blog/go-errors-join-combining-errors.html2026-09-15T17:22:11Z2026-09-15T17:22:11ZHow errors.Join builds a tree of errors that still works with errors.Is and errors.As, and where the abstraction leaks.DKIM, SPF and DMARC for Self-Hosted Mail: A Practical Setuphttps://dixon.cx/blog/dkim-spf-dmarc-self-hosted-mail.html2026-09-15T12:25:10Z2026-09-15T12:25:10ZA step-by-step guide to configuring SPF, DKIM and DMARC for a self-hosted mail server, and why the DNS records alone will not stop spam folders.Shamir's Secret Sharing in Go: Splitting a Key So No Single Person Holds Ithttps://dixon.cx/blog/shamirs-secret-sharing-in-go.html2026-09-15T11:42:55Z2026-09-15T11:42:55ZHow Shamir's Secret Sharing splits a key into shares using polynomial interpolation over GF(256), with a working Go implementation.Age Verification Under the Online Safety Act: What 'Highly Effective' Actually Means in Practicehttps://dixon.cx/blog/age-verification-online-safety-act-highly-effective.html2026-09-15T03:40:40Z2026-09-15T03:40:40ZOfcom's 'highly effective' age assurance rests on four criteria, not a fixed toolset, and 2026 enforcement shows what that means for real services.Encrypted Client Hello: The TLS Extension That Finally Hides Which Site You're Visitinghttps://dixon.cx/blog/encrypted-client-hello-tls-sni-privacy.html2026-09-14T23:42:01Z2026-09-14T23:42:01ZTLS 1.3 still leaks the hostname you're connecting to in plaintext. Here's how Encrypted Client Hello fixes that, and where it still falls short.seccomp-bpf in Go: Restricting Syscalls Without a Containerhttps://dixon.cx/blog/seccomp-bpf-go-restricting-syscalls-without-a-container.html2026-09-14T19:41:29Z2026-09-14T19:41:29ZHow to build and install a seccomp-bpf syscall filter from a plain Go binary with golang.org/x/net/bpf, and why goroutines need the TSYNC flag.The UK-US Data Bridge: Where GDPR Adequacy Actually Stands in 2026https://dixon.cx/blog/uk-us-data-bridge-gdpr-adequacy-2026.html2026-09-14T15:42:48Z2026-09-14T15:42:48ZA status check on the UK-US Data Bridge: PCLOB's quorum collapse, the Latombe appeal at the CJEU, and the UK's own EU adequacy renewal.Go's testing/synctest: Testing Concurrent Code Without Sleeping in Testshttps://dixon.cx/blog/go-synctest-testing-concurrent-code.html2026-09-14T11:40:51Z2026-09-14T11:40:51ZHow Go 1.25's testing/synctest package lets you test timers, retries and debounce logic deterministically, without real time.Sleep calls.Go's rate.Limiter: Token Buckets Explained by Reading the Sourcehttps://dixon.cx/blog/go-rate-limiter-token-buckets-source.html2026-09-14T03:40:19Z2026-09-14T03:40:19ZA walk through golang.org/x/time/rate's actual source to see how Go's token bucket limiter tracks tokens without a background goroutine.Linux pidfds: Closing the PID Reuse Race in Supervisorshttps://dixon.cx/blog/linux-pidfds-closing-pid-reuse-race.html2026-09-13T23:42:01Z2026-09-13T23:42:01ZLearn how Linux pidfds provide a stable handle for polling, signalling and waiting without accidentally targeting a reused PID.Go's comparable Constraint: Why a Struct with a Slice Field Can't Satisfy Ithttps://dixon.cx/blog/go-comparable-constraint-slice-field.html2026-09-13T19:39:23Z2026-09-13T19:39:23ZWhy Go's generics compiler rejects structs containing slices as comparable, the reasoning behind it, and how to work around it.Right to Erasure vs Backups: What UK GDPR Actually Requireshttps://dixon.cx/blog/right-to-erasure-vs-backups-uk-gdpr.html2026-09-13T15:40:39Z2026-09-13T15:40:39ZWhy UK GDPR's right to erasure doesn't mean scrubbing every backup tape immediately, and what the ICO actually expects organisations to do instead.What 'Authorisation' Actually Means Under the Computer Misuse Acthttps://dixon.cx/blog/computer-misuse-act-penetration-testing-authorisation.html2026-09-13T11:39:55Z2026-09-13T11:39:55ZThe Computer Misuse Act has no good-faith defence, so a pentest's legality rests entirely on paperwork. Here's what that paperwork actually needs to say.Go's sync.Map: When It Actually Beats a Mutex-Protected Maphttps://dixon.cx/blog/sync-map-vs-mutex-map-go.html2026-09-13T03:40:51Z2026-09-13T03:40:51ZWhy sync.Map only wins for two specific access patterns, how Go 1.24's trie-based rewrite changed the numbers, and when a plain mutex wins instead.ESP32 Deep Sleep Power Budgeting: Why 'Low Power' Mode Still Drains a Battery in Dayshttps://dixon.cx/blog/esp32-deep-sleep-power-budgeting.html2026-09-12T23:39:30Z2026-09-12T23:39:30ZDeep sleep current specs look great on paper, but wake-up current spikes and a board's regulator usually decide the real battery life.Postgres Advisory Locks in Go: Cheaper Than a Distributed Lock Servicehttps://dixon.cx/blog/postgres-advisory-locks-go.html2026-09-12T19:39:52Z2026-09-12T19:39:52ZHow to use Postgres advisory locks from Go for cron dedup and leader election, and the connection-pooling pitfall that breaks them silently.Hybrid Post-Quantum TLS 1.3: Why ML-KEM Rides Alongside ECDHEhttps://dixon.cx/blog/hybrid-post-quantum-tls-mlkem-ecdhe.html2026-09-12T15:40:54Z2026-09-12T15:40:54ZWhy TLS 1.3's post-quantum key exchange combines ML-KEM with ECDHE instead of replacing it, and what that costs in handshake size.Rural Broadband and CGNAT: Why Self-Hosting Needs a Reverse Tunnelhttps://dixon.cx/blog/rural-broadband-cgnat-reverse-tunnel.html2026-09-12T03:31:23Z2026-09-12T03:31:23ZStarlink and most 4G home routers hide you behind CGNAT, so port forwarding does nothing. Here's how a reverse WireGuard tunnel fixes it.Ed25519 vs ECDSA: How Deterministic Nonces Ended a Recurring Bughttps://dixon.cx/blog/ed25519-vs-ecdsa-deterministic-nonces.html2026-09-11T19:01:36Z2026-09-11T19:01:36ZHow a reused ECDSA nonce leaks a private key, why Sony and Android wallets fell to it, and how Ed25519 designs the whole bug class out.Flipper Blue++: Giving the Flipper Zero the Bluetooth Stack It Was Built Forhttps://dixon.cx/blog/flipper-bluepp-full-bluetooth-stack.html2026-09-11T16:29:13Z2026-09-11T16:29:13ZWhy stock Flipper Zero firmware cannot scan or connect over BLE, the three patches that unlock the full stack, and how to drive it from your own app.Go HTTP Response Bodies: Why Close Alone Loses Connectionshttps://dixon.cx/blog/go-http-response-bodies-close-connection-reuse.html2026-09-11T03:35:40Z2026-09-11T03:35:40ZClosing a Go HTTP response body prevents leaks, but HTTP/1 connection reuse depends on reaching EOF. Learn when to drain, cap or abandon a body.Go's iter.Seq and Range-over-Func: What the New Iterator Protocol Actually Costs Youhttps://dixon.cx/blog/go-iter-seq-range-over-func-cost.html2026-09-10T03:33:57Z2026-09-10T03:33:57ZHow range-over-func actually compiles in Go 1.23, why non-local control flow needs hidden state, and where iter.Seq stops being free.Go's DisallowUnknownFields: Catching Silent JSON Typoshttps://dixon.cx/blog/go-json-disallowunknownfields.html2026-09-09T03:31:18Z2026-09-09T03:31:18Zencoding/json ignores JSON fields it doesn't recognise by default. DisallowUnknownFields turns that into an error, but only if you use it correctly.Rust's Pin and Self-Referential Futures: Why async Needs It At Allhttps://dixon.cx/blog/rust-pin-self-referential-futures.html2026-09-08T10:38:18Z2026-09-08T10:38:18ZWhy compiling an async fn into a state machine makes the result self-referential, and how Rust's Pin type stops the compiler from moving it unsafely.Rust's mpsc Backpressure: tokio vs std Under Loadhttps://dixon.cx/blog/rust-mpsc-backpressure-tokio-vs-std.html2026-09-07T03:33:02Z2026-09-07T03:33:02ZWhy tokio::sync::mpsc suspends a task while std::sync::mpsc blocks an OS thread, and why mixing the two on one runtime causes stalls.Go http.Server Timeouts: Why Slowloris Still Gets Throughhttps://dixon.cx/blog/go-http-server-timeouts-slowloris.html2026-09-06T12:31:08Z2026-09-06T12:31:08ZLearn which Go HTTP timeouts cover slow headers, request bodies and keep-alive gaps, and which mistakes leave connections exposed.Go's time.After: The Timer Leak Hiding in Every select Loophttps://dixon.cx/blog/time-after-timer-leak-select-loop.html2026-09-06T03:33:24Z2026-09-06T03:33:24ZHow a select loop that calls time.After every iteration quietly piles up timers on old Go, and why Go 1.23 changed the rules.Why Your Go Worker Pool Deadlocks: An Unbuffered Channel Post-Mortemhttps://dixon.cx/blog/go-worker-pool-unbuffered-channel-deadlock.html2026-09-05T06:55:27Z2026-09-05T06:55:27ZA Go worker pool that deadlocks under load, traced back to an unbuffered results channel, with the fix and why bigger buffers only postpone the problem.A Practical Guide to Hardening SSH: Ciphers, MACs and Key Exchange Algorithms Worth Disablinghttps://dixon.cx/blog/hardening-ssh-ciphers-macs-kex-algorithms.html2026-09-04T10:16:03Z2026-09-04T10:16:03ZA walkthrough of sshd_config's KexAlgorithms, Ciphers and MACs directives: what to strip out, why, and how to verify the change without locking yourself out.Go's sync.Once Isn't a Mutex: What Actually Happens When f() Panicshttps://dixon.cx/blog/go-sync-once-panic-behaviour.html2026-09-03T10:16:03Z2026-09-03T10:16:03Zsync.Once does not retry after f() panics: it quietly marks itself done, while OnceValue re-panics forever. Verified against the Go source.Certificate Transparency Logs: What They Actually Prove About a TLS Certificate, and What They Don'thttps://dixon.cx/blog/certificate-transparency-logs-what-they-prove.html2026-09-02T10:16:03Z2026-09-02T10:16:03ZCT logs make TLS certificate issuance publicly auditable, but they do not validate domain control, check revocation or stop mis-issuance. The actual guarantee.How to Set Up Secure Boot with Your Own Keys Using sbctlhttps://dixon.cx/blog/secure-boot-own-keys-sbctl-linux.html2026-09-01T10:16:03Z2026-09-01T10:16:03ZCreate, enrol and maintain your own UEFI Secure Boot signing keys on Linux with sbctl, without turning the next reboot into a recovery exercise.Rust's Async Drop Doesn't Exist: Why You Can't Await Inside a Destructorhttps://dixon.cx/blog/rust-async-drop-doesnt-exist.html2026-08-31T10:16:03Z2026-08-31T10:16:03ZRust has no async destructor, and it isn't an oversight. Why Drop::drop can't await, and the spawn/block_on/explicit-close patterns people use instead.Go's %w Error Wrapping: Why errors.Is Silently Breaks the Moment You Forget One Verbhttps://dixon.cx/blog/go-errorf-w-verb-errors-is-silent-break.html2026-08-30T10:16:03Z2026-08-30T10:16:03ZA single %v where you meant %w compiles cleanly and passes go vet, but it quietly severs the error chain that errors.Is depends on.How to Set Up Borg Backup with Append-Only Repositories for Ransomware-Resistant Backupshttps://dixon.cx/blog/borg-backup-append-only-ransomware-resistant.html2026-08-29T10:16:03Z2026-08-29T10:16:03ZConfigure BorgBackup with a server-enforced append-only repository, so a compromised client can add backups but never delete or rewrite them.Go's GOMAXPROCS Ignores Container CPU Limits: Why a Pod's Go Service Still Thrashes the Schedulerhttps://dixon.cx/blog/go-gomaxprocs-container-cpu-limits.html2026-08-28T10:16:03Z2026-08-28T10:16:03ZA Go service capped at 0.5 CPU in Kubernetes still spins up dozens of OS threads and gets throttled. Why GOMAXPROCS cannot see the limit, and how to fix it.Subject Access Requests Under UK GDPR: What Organisations Can Legally Redact, and Where They Routinely Overreachhttps://dixon.cx/blog/subject-access-requests-redaction-overreach-uk-gdpr.html2026-08-27T10:16:03Z2026-08-27T10:16:03ZThe DPA 2018 exemptions that let organisations lawfully redact a subject access request, and the patterns of overreach that turn a redaction into a breach.How to Set Up Remote LUKS Unlocking on a Headless Linux Server with Dropbear in initramfshttps://dixon.cx/blog/remote-luks-unlock-dropbear-initramfs.html2026-08-26T10:16:03Z2026-08-26T10:16:03ZA step-by-step guide to embedding a minimal Dropbear SSH server in initramfs so you can type a LUKS passphrase over the network on a headless server reboot.Linux Capabilities vs setuid Root: Why CAP_NET_BIND_SERVICE Is the Better Way to Bind Port 80 in Gohttps://dixon.cx/blog/linux-capabilities-vs-setuid-root-cap-net-bind-service-go.html2026-08-25T10:16:03Z2026-08-25T10:16:03ZBinding to port 80 as a non-root Go process without setuid tricks, using Linux capabilities, CAP_NET_BIND_SERVICE, setcap and systemd's AmbientCapabilities.bcrypt's 72-Byte Truncation: The Password Hashing Bug Hiding in Plain Sighthttps://dixon.cx/blog/bcrypt-72-byte-truncation.html2026-08-24T10:16:03Z2026-08-24T10:16:03Zbcrypt silently ignores everything past the 72nd byte of a password. Why the limit exists, how it produces real collisions, and how to handle it properly in Go.How to Set Up FIDO2 Hardware Key Authentication for SSH with Resident Keyshttps://dixon.cx/blog/fido2-ssh-resident-keys.html2026-08-23T10:16:03Z2026-08-23T10:16:03ZA practical guide to generating resident FIDO2 SSH keys with ssh-keygen, setting a PIN, and recovering the credential onto a new machine with ssh-keygen -K.Timing Side Channels in Go: Why == on a MAC Verification Is a Security Bughttps://dixon.cx/blog/timing-side-channels-go-mac-verification.html2026-08-22T10:16:03Z2026-08-22T10:16:03ZComparing a computed HMAC with == looks correct and compiles fine, but it leaks timing information an attacker can use to forge a valid MAC byte by byte.SCM_RIGHTS and File Descriptor Passing: The Unix Socket Trick systemd Uses to Hand Off Privileged Socketshttps://dixon.cx/blog/scm-rights-file-descriptor-passing-systemd.html2026-08-21T10:16:03Z2026-08-21T10:16:03ZHow SCM_RIGHTS lets one Unix process hand an open file descriptor to another, with a working Go example and a look at where systemd genuinely uses it.