Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Read TLS Plaintext From a Process on Linux Without the Keys (2026)
Uprobes on SSL_write and SSL_read read the buffer on either side of encryption, so no private key is involved and TLS 1.3 forward secrecy does not matter. Why you need four probes, why every Python since 3.10 calls the _ex variants and silently breaks a legacy probe, where bpftrace drops events, and why Go and rustls need different work.
How to Let an AI Agent Troubleshoot Your Network on Linux in 2026: Give It the Wire, Not the Dashboard
Agentic NetOps products from NetBrain, Cisco and Selector reason over telemetry a device already exported, and a Wireshark MCP server needs a capture that was running when the failure hit. Here is what an agent has to be able to read to find a reset, a stale DNS answer or a failed handshake on a Linux host, and how yeet lets it read the wire from the kernel without a shell or root.
Why Is My TLS Handshake Failing on Linux? (2026)
A TLS handshake fails before your application logs anything useful, which is why the error you get is generic and the cause is not. The negotiation itself is cleartext on the wire, including the hostname your client sent and the alert that ended it. Here is how to read both on Linux without the private key and without restarting the process.