Andy Dixon: BlogDaily technical writing by Andy Dixon: Go and Rust internals, Linux and security how-tos, cryptography and UK privacy law, checked against source.https://dixon.cx/blog2026-09-05T06:55:27ZAndy Dixonhttps://dixon.cx/Copyright 2026 Andy DixonWhy Your Go Worker Pool Deadlocks: An Unbuffered Channel Post-Mortemhttps://dixon.cx/blog/go-worker-pool-unbuffered-channel-deadlock.html2026-09-05T06:55:27Z2026-09-05T06:55:27ZA Go worker pool that deadlocks under load, traced back to an unbuffered results channel, with the fix and why bigger buffers only postpone the problem.A Practical Guide to Hardening SSH: Ciphers, MACs and Key Exchange Algorithms Worth Disablinghttps://dixon.cx/blog/hardening-ssh-ciphers-macs-kex-algorithms.html2026-09-04T10:16:03Z2026-09-04T10:16:03ZA walkthrough of sshd_config's KexAlgorithms, Ciphers and MACs directives: what to strip out, why, and how to verify the change without locking yourself out.Go's sync.Once Isn't a Mutex: What Actually Happens When f() Panicshttps://dixon.cx/blog/go-sync-once-panic-behaviour.html2026-09-03T10:16:03Z2026-09-03T10:16:03Zsync.Once does not retry after f() panics: it quietly marks itself done, while OnceValue re-panics forever. Verified against the Go source.Certificate Transparency Logs: What They Actually Prove About a TLS Certificate, and What They Don'thttps://dixon.cx/blog/certificate-transparency-logs-what-they-prove.html2026-09-02T10:16:03Z2026-09-02T10:16:03ZCT logs make TLS certificate issuance publicly auditable, but they do not validate domain control, check revocation or stop mis-issuance. The actual guarantee.How to Set Up Secure Boot with Your Own Keys Using sbctlhttps://dixon.cx/blog/secure-boot-own-keys-sbctl-linux.html2026-09-01T10:16:03Z2026-09-01T10:16:03ZCreate, enrol and maintain your own UEFI Secure Boot signing keys on Linux with sbctl, without turning the next reboot into a recovery exercise.Rust's Async Drop Doesn't Exist: Why You Can't Await Inside a Destructorhttps://dixon.cx/blog/rust-async-drop-doesnt-exist.html2026-08-31T10:16:03Z2026-08-31T10:16:03ZRust has no async destructor, and it isn't an oversight. Why Drop::drop can't await, and the spawn/block_on/explicit-close patterns people use instead.Go's %w Error Wrapping: Why errors.Is Silently Breaks the Moment You Forget One Verbhttps://dixon.cx/blog/go-errorf-w-verb-errors-is-silent-break.html2026-08-30T10:16:03Z2026-08-30T10:16:03ZA single %v where you meant %w compiles cleanly and passes go vet, but it quietly severs the error chain that errors.Is depends on.How to Set Up Borg Backup with Append-Only Repositories for Ransomware-Resistant Backupshttps://dixon.cx/blog/borg-backup-append-only-ransomware-resistant.html2026-08-29T10:16:03Z2026-08-29T10:16:03ZConfigure BorgBackup with a server-enforced append-only repository, so a compromised client can add backups but never delete or rewrite them.Go's GOMAXPROCS Ignores Container CPU Limits: Why a Pod's Go Service Still Thrashes the Schedulerhttps://dixon.cx/blog/go-gomaxprocs-container-cpu-limits.html2026-08-28T10:16:03Z2026-08-28T10:16:03ZA Go service capped at 0.5 CPU in Kubernetes still spins up dozens of OS threads and gets throttled. Why GOMAXPROCS cannot see the limit, and how to fix it.Subject Access Requests Under UK GDPR: What Organisations Can Legally Redact, and Where They Routinely Overreachhttps://dixon.cx/blog/subject-access-requests-redaction-overreach-uk-gdpr.html2026-08-27T10:16:03Z2026-08-27T10:16:03ZThe DPA 2018 exemptions that let organisations lawfully redact a subject access request, and the patterns of overreach that turn a redaction into a breach.How to Set Up Remote LUKS Unlocking on a Headless Linux Server with Dropbear in initramfshttps://dixon.cx/blog/remote-luks-unlock-dropbear-initramfs.html2026-08-26T10:16:03Z2026-08-26T10:16:03ZA step-by-step guide to embedding a minimal Dropbear SSH server in initramfs so you can type a LUKS passphrase over the network on a headless server reboot.Linux Capabilities vs setuid Root: Why CAP_NET_BIND_SERVICE Is the Better Way to Bind Port 80 in Gohttps://dixon.cx/blog/linux-capabilities-vs-setuid-root-cap-net-bind-service-go.html2026-08-25T10:16:03Z2026-08-25T10:16:03ZBinding to port 80 as a non-root Go process without setuid tricks, using Linux capabilities, CAP_NET_BIND_SERVICE, setcap and systemd's AmbientCapabilities.bcrypt's 72-Byte Truncation: The Password Hashing Bug Hiding in Plain Sighthttps://dixon.cx/blog/bcrypt-72-byte-truncation.html2026-08-24T10:16:03Z2026-08-24T10:16:03Zbcrypt silently ignores everything past the 72nd byte of a password. Why the limit exists, how it produces real collisions, and how to handle it properly in Go.How to Set Up FIDO2 Hardware Key Authentication for SSH with Resident Keyshttps://dixon.cx/blog/fido2-ssh-resident-keys.html2026-08-23T10:16:03Z2026-08-23T10:16:03ZA practical guide to generating resident FIDO2 SSH keys with ssh-keygen, setting a PIN, and recovering the credential onto a new machine with ssh-keygen -K.Timing Side Channels in Go: Why == on a MAC Verification Is a Security Bughttps://dixon.cx/blog/timing-side-channels-go-mac-verification.html2026-08-22T10:16:03Z2026-08-22T10:16:03ZComparing a computed HMAC with == looks correct and compiles fine, but it leaks timing information an attacker can use to forge a valid MAC byte by byte.SCM_RIGHTS and File Descriptor Passing: The Unix Socket Trick systemd Uses to Hand Off Privileged Socketshttps://dixon.cx/blog/scm-rights-file-descriptor-passing-systemd.html2026-08-21T10:16:03Z2026-08-21T10:16:03ZHow SCM_RIGHTS lets one Unix process hand an open file descriptor to another, with a working Go example and a look at where systemd genuinely uses it.How to Set Up Fail2ban to Stop SSH Brute-Force Attacks on Linuxhttps://dixon.cx/blog/fail2ban-ssh-brute-force-linux.html2026-08-20T10:16:03Z2026-08-20T10:16:03ZInstall and configure fail2ban on Linux to block SSH brute-force attempts automatically: jail.local, the systemd journal backend and the common pitfalls.Unix Domain Sockets vs TCP on Loopback: The Localhost Attack Surface Most Go Services Ignorehttps://dixon.cx/blog/unix-domain-sockets-vs-tcp-loopback-attack-surface.html2026-08-19T10:16:03Z2026-08-19T10:16:03ZBinding to 127.0.0.1 feels private, but loopback TCP has no concept of "who's asking". Unix domain sockets do, and Go makes using them easy.Rust's Drop Order Isn't What You Think: Why RAII Cleanup Can Fire in the Wrong Sequencehttps://dixon.cx/blog/rust-drop-order-raii-cleanup-sequence.html2026-08-18T10:16:03Z2026-08-18T10:16:03ZRust drops locals in reverse order but struct fields in declaration order. That asymmetry is a documented footgun for locks, file handles and temp directories.How to Set Up Mutual TLS Between Two Go Services with Your Own Private CAhttps://dixon.cx/blog/mutual-tls-go-services-private-ca.html2026-08-17T10:16:03Z2026-08-17T10:16:03ZBuild a minimal private CA in Go and configure two services to authenticate each other with mutual TLS, including the identity check most tutorials skip.Go's os.Exit Skips Every Deferred Function: Why Your Cleanup Never Runshttps://dixon.cx/blog/go-os-exit-skips-deferred-functions.html2026-08-16T10:16:03Z2026-08-16T10:16:03Zos.Exit ends a Go process immediately without unwinding the stack, so no deferred function runs. Why, and how to structure main() so it does not bite you.filepath.Clean Cannot Contain an Attacker: Using openat2 to Stop Symlink Escapes in Gohttps://dixon.cx/blog/filepath-clean-openat2-symlink-escapes-go.html2026-08-15T10:16:03Z2026-08-15T10:16:03ZWhy lexical path checks cannot stop symlink escapes, and how Linux openat2 provides race-resistant directory confinement for Go services.How to Set Up a Default-Deny Firewall with nftables on Linuxhttps://dixon.cx/blog/default-deny-firewall-nftables-linux.html2026-08-14T10:16:03Z2026-08-14T10:16:03ZBuild, test and persist a default-deny nftables firewall without breaking IPv6, flushing container rules or locking yourself out of SSH.Go's Default HTTP Client Has No Timeout: The Footgun Every Tutorial Ships Withhttps://dixon.cx/blog/go-default-http-client-no-timeout.html2026-08-13T10:16:03Z2026-08-13T10:16:03Zhttp.Get and http.DefaultClient have no timeout at all. Here's exactly which phases of a request are bounded, which aren't, and how to fix it properly.Nonce Reuse in AES-GCM: Why Reusing It Once Is Enough to Break Everythinghttps://dixon.cx/blog/nonce-reuse-aes-gcm.html2026-08-12T10:16:03Z2026-08-12T10:16:03ZAES-GCM fails catastrophically, not gracefully, if a nonce is ever reused. Here's what actually breaks, why, and how to stop it happening.How to Set Up a WireGuard Site-to-Site VPN Between Two Linux Servershttps://dixon.cx/blog/wireguard-site-to-site-vpn-linux.html2026-08-11T10:16:03Z2026-08-11T10:16:03ZJoin two LANs over WireGuard: key generation, subnet routing, firewall rules, MTU pitfalls and how to verify the tunnel is actually carrying traffic.The Data (Use and Access) Act 2025: What Actually Changed for UK GDPR Compliancehttps://dixon.cx/blog/data-use-and-access-act-2025-uk-gdpr-changes.html2026-08-10T10:16:03Z2026-08-10T10:16:03ZThe Data (Use and Access) Act 2025 amends UK GDPR rather than replacing it: new lawful bases, looser automated decision rules and a new transfer test.HKDF Explained: Why Hashing Your Key Material Twice Isn't the Same as Deriving It Properlyhttps://dixon.cx/blog/hkdf-explained-key-derivation.html2026-08-09T10:16:03Z2026-08-09T10:16:03ZA look at why sha256(sha256(secret)) is not key derivation, what HKDF's extract-and-expand construction actually buys you, and how to use it correctly in Go.How to Set Up DNS-over-TLS with Unbound for Network-Wide Privacy on Linuxhttps://dixon.cx/blog/dns-over-tls-unbound-network-wide-privacy.html2026-08-08T10:16:03Z2026-08-08T10:16:03ZRun Unbound as a validating, caching DNS-over-TLS resolver on Linux so every device on the network gets encrypted, DNSSEC-checked lookups with no per-app setup.context.Context Cancellation Doesn't Stop Anything: Why Your Goroutines Keep Running Anywayhttps://dixon.cx/blog/context-cancellation-doesnt-stop-anything.html2026-08-07T10:16:03Z2026-08-07T10:16:03Zcontext cancellation in Go is cooperative, not preemptive: it closes a channel and nothing more. Here's where that quietly fails, and how to actually stop work.Why io_uring Doesn't Automatically Make Your Linux Network Service Fasterhttps://dixon.cx/blog/io-uring-network-service-not-automatically-faster.html2026-08-06T10:16:03Z2026-08-06T10:16:03Zio_uring's benchmarks are real, but most of its wins are in storage and syscall-bound workloads. Why bolting it onto a network service often buys nothing.How to Set Up Automated Encrypted Backups with restic and a Remote SFTP Targethttps://dixon.cx/blog/restic-encrypted-backups-sftp.html2026-08-05T10:16:03Z2026-08-05T10:16:03ZA practical guide to backing up a Linux machine with restic over SFTP: repository setup, password handling, systemd timers, retention, and verifying restores.Technical Capability Notices Under the Investigatory Powers Act: What They Can Actually Compel a Company to Dohttps://dixon.cx/blog/technical-capability-notices-investigatory-powers-act.html2026-08-04T10:16:03Z2026-08-04T10:16:03ZWhat a technical capability notice under the Investigatory Powers Act can require, why the Apple ADP dispute turned on one phrase, and why it is secret.PECR and Cookie Banners: Why Most UK 'Reject All' Buttons Are Still Non-Complianthttps://dixon.cx/blog/pecr-cookie-banners-reject-all-non-compliant.html2026-08-03T10:16:03Z2026-08-03T10:16:03ZWhy UK cookie banners with a working 'reject all' button still breach PECR, from consent-timing bugs to IAB TCF legitimate interest loopholes.A Practical Guide to GPG Subkeys: Keeping Your Master Key Offline While Signing and Encrypting Dailyhttps://dixon.cx/blog/gpg-subkeys-offline-master-key-guide.html2026-08-02T10:16:03Z2026-08-02T10:16:03ZHow to split a GPG identity into an offline certify-only master key and day-to-day sign, encrypt and auth subkeys, with backup and rotation steps.TLS Hides Your Data, Not Your Behaviour: What Traffic Analysis Can Still Seehttps://dixon.cx/blog/tls-traffic-analysis-metadata-leaks.html2026-08-01T10:16:03Z2026-08-01T10:16:03ZTLS encrypts the contents of your connections, but packet sizes, timing, SNI and DNS still leak enough to fingerprint sites, videos and even keystrokes.SQLite in WAL Mode: Why Concurrent Writers Still Block, and How Go's database/sql Pool Makes It Worsehttps://dixon.cx/blog/sqlite-wal-mode-concurrent-writers-go-database-sql-pool.html2026-07-31T10:16:03Z2026-07-31T10:16:03ZWAL mode lets SQLite readers and writers coexist, but writers still queue for one lock. Go's connection pool can turn that into 'database is locked' errors.How to Set Up SSH Certificate Authentication with Your Own Minimal CAhttps://dixon.cx/blog/ssh-certificate-authentication-minimal-ca.html2026-07-30T10:16:03Z2026-07-30T10:16:03ZReplace sprawling authorized_keys files with a small self-hosted SSH certificate authority: user and host certificates, principals and revocation.Data Retention Notices Under the Investigatory Powers Act: What ISPs Actually Have to Log, and for How Longhttps://dixon.cx/blog/ipa-data-retention-notices-what-isps-log.html2026-07-29T10:16:03Z2026-07-29T10:16:03ZSection 87 retention notices under the Investigatory Powers Act 2016: what UK ISPs must log, the 12-month cap, entity versus events data, and why it is secret.fsync Lies: What Linux Actually Guarantees About a 'Durable' Writehttps://dixon.cx/blog/fsync-lies-linux-durable-write-guarantees.html2026-07-28T10:16:03Z2026-07-28T10:16:03Zfsync() returning zero feels like a promise the bytes are safe. Page cache, errseq_t, directory entries and disk caches make that promise weaker than it looks.How to Set Up TPM2-Backed LUKS Unlocking with systemd-cryptenrollhttps://dixon.cx/blog/tpm2-luks-unlocking-systemd-cryptenroll.html2026-07-27T10:16:03Z2026-07-27T10:16:03ZEnrolling a TPM2 chip into a LUKS2 volume with systemd-cryptenroll: PCR selection, PIN protection and the kernel-update trap that locks people out.The Online Safety Act's Encryption Clash: What 'Technically Feasible' Client-Side Scanning Would Actually Requirehttps://dixon.cx/blog/online-safety-act-encryption-technically-feasible-scanning.html2026-07-26T10:16:03Z2026-07-26T10:16:03ZOfcom's section 121 powers under the Online Safety Act, what client-side CSAM scanning would involve, and why 'technically feasible' may be a category error.Passkeys Under the Hood: What WebAuthn Actually Signs, and Why Phishing Can't Replay Ithttps://dixon.cx/blog/webauthn-what-gets-signed-phishing-resistance.html2026-07-25T10:16:03Z2026-07-25T10:16:03ZA byte-level look at what a WebAuthn assertion signs: the origin, the challenge and the RP ID hash, and why that binding defeats classic phishing proxies.A Practical Guide to LUKS2 Full-Disk Encryption with a Detached Header on a USB Keyhttps://dixon.cx/blog/luks2-detached-header-usb-key.html2026-07-24T10:16:03Z2026-07-24T10:16:03ZHow to set up LUKS2 disk encryption with the header on a separate USB key: the commands, the backup steps, and what it does and does not protect against.Cancellation Safety in Tokio: Why select! Can Silently Drop Your Workhttps://dixon.cx/blog/tokio-select-cancellation-safety.html2026-07-23T10:16:03Z2026-07-23T10:16:03Ztokio::select! drops the losing branch's future, and for some Tokio methods that means silently lost bytes and desynced protocols. How to spot and fix it.Argon2id in Go: Picking Parameters You Can Actually Defendhttps://dixon.cx/blog/argon2id-go-parameters.html2026-07-22T10:16:03Z2026-07-22T10:16:03ZHow to choose Argon2id memory, time and parallelism parameters in Go that you can actually defend, with a working hash-and-verify implementation.