Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Read TLS Plaintext From a Process on Linux Without the Keys (2026)
Uprobes on SSL_write and SSL_read read the buffer on either side of encryption, so no private key is involved and TLS 1.3 forward secrecy does not matter. Why you need four probes, why every Python since 3.10 calls the _ex variants and silently breaks a legacy probe, where bpftrace drops events, and why Go and rustls need different work.
7 bpftrace Alternatives for Linux Tracing in 2026
bpftrace is unbeatable for a one-liner, but the moment the trace is not the deliverable you need something more. Seven bpftrace alternatives compared, and why a runtime like yeet is the one that covers the most ground: a real userspace language, no toolchain on the host, enforcement, and a running interface, all at once.
bpftrace vs BCC in 2026: Which One to Start Your eBPF Project With
Start with bpftrace unless your project already needs flags, floating-point math, or hosts with no compiler on them, in which case start with BCC. A side-by-side review of what each one installs, what each one refuses to do, the 512-byte stack limit that ends a bpftrace script, and how to tell today which one you will outgrow.