Top all-time · #2448
Mac's Tech Blog
Personal blog · macchaffee.com/blogprogrammingsecuritysystems
Mac's Tech Blog is a personal blog at macchaffee.com about programming, security and systems. Since 2020, 31 different Hacker News readers have linked it 60 times, most often “Dear friend, you have built a Kubernetes”. It is still writing: the last post was on 2026-08-07, and you can follow it by feed.
Too few sampled comments (26) to say how often HN recommends it.?
Why HN links it
HN readers link Mac's Tech Blog for its DevOps and security writing, especially posts arguing that WAFs do more harm than good and that homegrown infrastructure ends up as a "Kubernetes". Also cited for non-competes, ethics and climate.
Summarised by Claude from a sample of 26 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
I create and deploy software with a focus on DevOps, security, platform engineering, and site reliability engineering.
Most-linked posts?
- Dear friend, you have built a Kubernetes11 people · 15 mentions · first linked 2024-11-24
- Discouraging the use of web application firewalls6 people · 8 mentions · first linked 2023-11-12
- Plain Kubernetes Secrets are fine4 people · 6 mentions · first linked 2022-05-01
- Am I the problem? Interviewing another team to find out4 people · 4 mentions · first linked 2026-08-07
- Hacking Myself to Prove a Point3 people · 5 mentions · first linked 2023-01-21
- Avoid Building a Security Treadmill2 people · 2 mentions · first linked 2025-03-24
- Tech and the Climate Crisis2 people · 2 mentions · first linked 2025-02-26
- Deno shows us there's a better way2 people · 2 mentions · first linked 2025-03-01
- The Next Platform2 people · 2 mentions · first linked 2024-12-03
What Hacker News says?
I don't agree. WAFs usually add more attack surface than they remove. https://www.macchaffee.com/blog/2023/wafs/ Of course, Wordpress is basically undefendable, so I'd never ever host it on a machine that has anything else of value (including e.g. db credentials that give access to much more than the public content on the WP installation).
Comment linking /blog/2023/wafs/
on “Writing "/etc/hosts" breaks the Substack editor”Submitted Dear friend, you have built a Kubernetes as a story · 340 points
HN discussionIn actuality, WAFs hurt more than help. They give a false sense of security since they are so easily bypassable, plus they have a significant performance cost and a significant chance of blocking legitimate traffic: https://www.macchaffee.com/blog/2023/wafs/
Comment linking /blog/2023/wafs/
on “I looked through attacks in my access logs”Submitted Know Your Carrying Capacity as a story · 131 points
HN discussionWhat I really like are solutions that are simple to both install and maintain. For example, look at Docker Swarm: https://docs.docker.com/engine/swarm/swarm-tutorial/create-s... or Hashicorp Nomad: https://developer.hashicorp.com/nomad/tutorials/get-started/... or Kubernetes distros like K3s: https://docs.k3s.io/quick-start Either of those would work better than a bespoke solution a lot of the time, for anyone who i…
Comment linking /blog/2024/docker-compose/
on “Dear friend, you have built a Kubernetes”- b8 · 2023-11-13
Submitted Discouraging the use of web application firewalls as a story · 95 points
HN discussion As PlatformOps (formerly DevOps (formerly SRE (formerly Ops))), either this was hilarious satire or ChatGPT Ketamine trip. I'm not sure. > In the year 2030, no one will remember Kubernetes. So what's going to handle out rolling out new versions of your WASM, setting up whatever Reverse Proxy you pick and other stuff involved getting. A bunch of scripts you wrote to do this for you? https://www.macchaffee.com/blog/20…
Comment linking /blog/2024/you-have-built-a-kubernetes/
on “WASM will replace containers”Submitted We've learned nothing from the SolarWinds hack as a story · 28 points
HN discussionWAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/
Comment linking /blog/2023/wafs/
on “Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?”Submitted Under-Documented Kubernetes Security Tips as a story · 22 points
HN discussionI wrote up a bit of background on non-competes in mid-2024, I see my fears came true: https://www.macchaffee.com/blog/2024/non-competes/
Comment linking /blog/2024/non-competes/
on “NLRB acting general counsel rescinds non-compete labor policy”Submitted Deno shows us there's a better way as a story · 8 points
HN discussionThis was a great read. I've been a sysadmin/SRE/Devops/Platform/infra ( Why are there so many different titles) engineers for many years, for the past ~5 years I've been using Kubernetes and have helped companies migrate lots of workloads to k8s. I've worked with many people who dislike k8s, but almost all of them had almost no experience with k8s. A lot of the anti-k8s people would eventually build out something si…
Comment linking /blog/2024/you-have-built-a-kubernetes/
on “A skeptic's first contact with Kubernetes (2024)”Submitted The Next Platform as a story · 7 points
HN discussionI'd generally confirm that suspicion: https://www.macchaffee.com/blog/2023/wafs/ WAFs have a few valid uses in my opinion: "virtual patching" and the ability to create custom rules such as blocking/challenging/rate limiting obviously bad traffic. But the giant rulesets are actively harmful IMO. "Defense in depth" is not a valid justification for doing something actively harmful to both your users and the time budget…
Comment linking /blog/2023/wafs/
on “Show HN: BunkerWeb – the open-source and cloud-native WAF”Submitted Tech and the Climate Crisis as a story · 5 points
HN discussionFor Infrastructure, we are moving to single monorepo where they PR into the repo and GHA runs it. Most of time, they are using Modules we wrote but we don't run alot of cloud native stuff. Most of it is Database, possibly Redis, maybe storage, occasionally Pub/Sub. Modules are supposed to load up rules and forward it to the teams in Pagerduty but that doesn't always happen which fall through to us. I'd say most team…
Comment linking /blog/2024/you-have-built-a-kubernetes/
on “Launch HN: Infra.new (YC W23) – DevOps copilot with guardrails built in”Submitted Avoid Building a Security Treadmill as a story · 4 points
HN discussionI agree but there's a lot of nuance to the next question of "well what IS bad for the environment" and tech's role in that question. I've been unsatisfied with how people in tech address that complex subject so I wrote about it here: https://www.macchaffee.com/blog/2025/tech-and-the-climate-cr...
Comment linking /blog/2025/tech-and-the-climate-crisis/
on “A cheat sheet for why using ChatGPT is not bad for the environment”Submitted DDoS attacks can threaten the independent Internet as a story · 4 points
HN discussionCounter Argument to "HA HA, Kubernetes sucks": https://www.macchaffee.com/blog/2024/you-have-built-a-kubern... Kubernetes is a rat nest and I long hope for Kubernetes be simpler (Who needs this Gateway API?) but Devs keep building crazy and crazy solutions so we have to pivot to keep up.
Comment linking /blog/2024/you-have-built-a-kubernetes/
on “Kubernetes Is Your Private Cloud”Submitted The Next Platform as a story · 3 points
HN discussionLocation: NC Remote: Yes Willing to relocate: No Resume: https://www.macchaffee.com/ Technologies: Kubernetes, Linux Admin., Security, Python, Ansible, SRE, Platform Engineering Email: On resume
Comment linking /
on “Ask HN: Who wants to be hired? (August 2023)”Submitted Security in the 2000s as a story · 3 points
HN discussionYep, same with cookies and cloud credentials: https://www.macchaffee.com/blog/2023/hacking-myself/
Comment linking /blog/2023/hacking-myself/
on “Russhian Roulette: 1/6 chance of posting your SSH private key on pastebin”Submitted Plain Kubernetes Secrets are fine as a story · 3 points
HN discussionMandatory mention: https://www.macchaffee.com/blog/2024/you-have-built-a-kubern... But yeah, pretty cool DNS resolving features in HAProxy, that's nifty
Comment linking /blog/2024/you-have-built-a-kubernetes/
on “Zero-Downtime Deployments with Docker Compose – No Kubernetes Required”Submitted Plain Kubernetes Secrets are fine as a story · 3 points
HN discussionReminds me of https://www.macchaffee.com/blog/2024/you-have-built-a-kubern...
Comment linking /blog/2024/you-have-built-a-kubernetes/
on “Claude Code refuses requests or charges extra if your commits mention "OpenClaw"”Submitted Please make your software engineering advice more specific as a story · 3 points
HN discussion
