标签：#work

How SCPN Phase Orchestrator v0.8.0 turns Kuramoto dynamics into a domain-agnostic control compiler, why we verify math across five languages, and the honest truth about building a Boeing 747 when most people need a bicycle. The $5.2 Billion Blackout That Started This On August 14, 2003, a cascading failure in the US Northeast power grid left 55 million people without electricity. The final report cited something deceptively simple: synchrony loss . A generation unit in Ohio drifted out of phase. The protective relays, designed to prevent damage, tripped in sequence. One desynchronized oscillator triggered a cascade that propagated across 265 power plants in nine minutes. The grid had controllers. It had models. What it lacked was a shared, reviewable language for coherence — a way to ask, in real time: "Is this synchrony valuable or dangerous? And if I touch this knob, can I prove what will happen before the electrons move?" That question is why I built SCPN Phase Orchestrator . It is not a Kuramoto simulator. It is a coherence control compiler — a system that takes any cyclic process (power waves, cloud retries, neural spikes, traffic signals) and compiles it into a unified phase space where synchrony can be observed, classified, and modified with bounded, auditable, replayable actions. Version 0.8.0 just shipped. It includes something I have not seen in any other open-source oscillator library: cross-language mathematical parity verification and Lean proof obligations for safety-critical control chains. This post is the honest story of why we built it, how it works, and where we might have gone too far. The Fragmentation Problem If you work on synchrony in 2026, you live in silos. Power engineers use PSS/E or PowerFactory with swing-equation models. Cloud operators use Airflow, Kestra, or Temporal for workflow orchestration — none of which understand phase dynamics. Neuroscientists use FieldTrip or MNE-Python for EEG phase analysis, but the tools stop at visualiza

One of the first networking concepts that confused me was this: Why does a computer need both a MAC address and an IP address? At first glance, they seem to solve the same problem. Both appear to identify a device. Both show up in networking tools. Both appear in packet captures. So why do we need two different addresses? While exploring Linux networking tools and Wireshark, the distinction finally started making sense. This article summarizes the mental model that helped me understand the difference. Looking Inside the Machine Before discussing addresses, it helps to understand where they come from. If you open a typical laptop, you will usually find components such as: Battery RAM Storage Processor Cooling system Network interfaces One of those network interfaces is typically: A Wi-Fi card An Ethernet controller These components are responsible for network communication. They are the parts of the machine that actually send and receive data across a network. Every Network Interface Has an Identity A network interface needs a way to identify itself. This is where the MAC address comes in. A MAC address is associated with a network interface card (NIC). Example: ```text id="q3d9nm" 2C:9C:58:8B:2D:7B Think of it as the identity of the network interface itself. Not the operating system. Not the browser. Not the application. The network hardware. --- ## What Is a MAC Address? MAC stands for: **Media Access Control** A MAC address operates at the **Data Link Layer** of the OSI model. Its primary purpose is to help devices communicate within a local network. Examples include: * Laptop to router * Router to switch * Switch to printer In other words: > MAC addresses help devices find each other on the same local network. --- ## What Is an IP Address? An IP address serves a different purpose. Example: ```text id="g8x4tc" 192.168.1.20 or ```text id="v6u7mz" 2405:201:8000::1 IP addresses operate at the **Network Layer**. Their job is to identify where a device exists within a

Quiet Defaults, DNSSEC Cracks, and Agents in the Data Plane I read the AWS Nitro V6 TCP timeout change twice before I believed it. Default went from 432,000 seconds to 350 seconds. Five days to six minutes. On the newest instance family. Quietly, in release notes most people won't read until something breaks. That sort of set the tone for May. No flagship launch to anchor the month around. What there was a lot of: defaults moving in places vendor press releases don't celebrate. Post-quantum crypto pushing into campus boot chains. Every cloud vendor shipping some flavor of agentic-networking pattern. The .de TLD briefly breaking because of DNSSEC. None of it announced loudly. All of it the kind of thing that breaks production at 2am if you weren't paying attention. What Moved This Month Three things, fast. Post-quantum crypto left the VPN tunnel. Cisco's full-stack PQC for campus and branch is the next chapter after April's PQ IPsec story — boot, firmware signing, supply chain attestation, and transport-layer crypto all moving together. If your campus has mixed-vintage gear (which is basically everyone), this is multi-year partial coverage with no clean switchover. Agentic networking became a real category. Cloudflare's Town Lake / Skipper writeup and Claude Managed Agents , Palo Alto's Portkey-based unified AI Gateway , and AWS's Bedrock AgentCore connectivity patterns all dropped this month. The right question stopped being "can my agent reach the model" and became "what IAM blast radius does this agent have if it gets prompt-injected." DNSSEC had a rough month. The .de TLD broke briefly, the DNSSEC root key was rolled, and Cloudflare also debugged a QUIC CUBIC death spiral that was hiding in plain sight. The Internet's core had a louder month than usual, and not in a good way. 1. Agentic AI Is Now Actually A Networking Problem An agent in production isn't a fancy chatbot. It's a thing that calls APIs, reads logs, accesses SaaS data, and sometimes writes back to sy

If you run Aviatrix on Azure, there is a slow-moving infrastructure change happening underneath your gateways right now that is worth paying attention to. Microsoft started rolling out a new generation of network hardware on May 26, 2026, called MANA (Microsoft Azure Network Adapter). For most Azure workloads, the change is invisible. For network virtual appliances (NVAs) like Aviatrix gateways, it is not, and Aviatrix has issued a field notice ( FN-2026-AZ-001 ) telling customers to take action. What is MANA and Why is Microsoft Rolling it Out? For roughly a decade, Azure VMs with Accelerated Networking enabled have used Mellanox-based NICs exposed to the guest as mlx4/5 SR-IOV adapters . SR-IOV (Single Root I/O Virtualization) lets the VM talk to the network card hardware directly, bypassing the hypervisor's virtual switch. This is what gives Accelerated Networking its low-latency, high-throughput characteristics. Microsoft has been quietly building its own in-house networking silicon. MANA is the result: a Microsoft-designed network adapter that replaces the Mellanox hardware Azure has been using on the host side. From an Azure customer's perspective, MANA preserves Accelerated Networking semantics, but the device the guest OS sees is different. The driver is different. The interface name is different. And that is where Aviatrix gateways run into trouble. Why Aviatrix Gateways Are Affected Aviatrix gateways are not generic VMs. They run a custom data plane that binds tightly to the underlying NIC for performance reasons. Specifically, the gateway image expects the Mellanox driver to be present and operational. On MANA hardware, that driver is no longer in play, and the gateway image does not yet include a MANA-aware driver. Per the field notice, the symptom is intermittent performance degradation rather than an outright outage. That makes it harder to detect: throughput drops, latency spikes, or session resets that look like noise can be the early signs of a gate

The Problem If you've ever audited your Windows network traffic during a boot-up sequence, you know the truth: there's a "blind spot." Between the moment your network drivers initialize and your VPN/WireGuard tunnel actually establishes, your traffic is leaking. Many third-party solutions exist, but they are often bloated, use proprietary binaries, or act as black boxes. I wanted something transparent, native, and bulletproof. The Solution: WG-KillSwitch I developed a pure PowerShell-based kill switch architecture. It doesn't rely on third-party libraries—it uses native Windows system components to enforce security. Key Architectural Features: Zero-Trust Firewall Matrix: Hardens the system by blocking all outbound traffic by default, allowing only authenticated tunnel traffic. WMI Persistent Watchdog: Unlike standard scripts that can be killed via Task Manager, this project uses WMI Event Subscriptions. If the watchdog process is terminated, Windows itself immediately respawns it. Resilience: Survives hard reboots, modem resets, and Windows service cycling. Resilience & Leak Testing I've put this through a gauntlet of tests: Forced Reboots: Zero leaks detected during driver load. Process Termination: The WMI engine restores the protection in milliseconds. Dynamic Network Resets: The firewall matrix remains active regardless of adapter status. Let's Collaborate This is open source, transparent, and built for the community. I'm looking for security audits and feedback. Check out the source code, open an issue, or submit a PR: https://github.com/ryderlacin-pixel/Windows-WireGuard-KillSwitch

If you've been running local models/apps across more than one machine for any length of time, you've probably noticed that everything is served over plain HTTP, whether its the backend llm apis, the front end sites, or whatever other stuff you've tossed in: most of it is HTTP-only out of the box, no TLS option anywhere in sight. On one machine thats usually fine since its all loopback, but the second you spread apps across a few different computers ( which some of us do ), every prompt and every response starts crossing your LAN in plaintext. Is plaintext on your own LAN a huge deal? Honestly... a lot of folks would say it's probably low risk. But the moment you've got guests, other people's phones, or random IoT junk sharing that network, your prompts and the models responses flying around in the clear are more exposure than you'd probably be comfortable with if you sat down and thought about it. So, with that said- I figured Id write up how I've dealt with that, because the textbook answer ( certs ) is annoying enough on a local network that I think a lot of folks just dont bother. This is a lot easier, especially on something like a mac where you can make sure it kicks off automatically via launchd . Why not just do TLS The "correct" answer is to put TLS on everything; HTTPS everywhere. And you can. But walk through what that actually means on a home network full of mixed machines: You stand up your own little CA, then sign a cert for each host ( unless you want to deal with some code just straight up rejecting the cert ). You install and trust that CA on every client. Every browser, every OS trust store, and ( this is the annoying one ) every app that ships its own trust store and ignores the system one. Plenty of python and node apps do that. A lot of these local LLM apps dont even expose a TLS option, so to add it you front them with something like nginx or Caddy, which is now another moving part on every box ( Setting up Caddy is what convinced me to go this

I put my coursework from SIUe's Master's in Mathematics program up on the problem sets section of this site. Five courses from 2021-2022 that formed the core of my graduate statistics work. The Courses STAT 478 - Time Series Analysis Spring 2021, Dr. Beidi ARIMA models, forecasting, spectral analysis, state space methods. The problem sets mix theoretical derivations with R implementations for temporal data. STAT 482 - Regression Analysis Fall 2022, Dr. Andrew Neath Linear models, diagnostics, variable selection, model comparison. Neath's approach put the theoretical foundations front and center, with application following from understanding. STAT 575 - Computational Statistics Summer 2021, Dr. Qiang Beidi Probably the most hands-on course of the five. Topics included: Newton-Raphson and numerical optimization Monte Carlo simulation Sampling methods (inverse transform, acceptance-rejection) Hand-coded MLE for Poisson regression Implementing these algorithms from scratch instead of calling library functions teaches you what the methods are actually doing. You hit the edge cases. You debug convergence failures. That's where the understanding comes from. STAT 579 - Discrete Multivariate Analysis Spring 2021, Dr. Andrew Neath Categorical data analysis, log-linear models, contingency tables. Both the mathematical theory and R implementations for discrete multivariate data. STAT 581 - Statistical Methods Fall 2021, Dr. Neath Experimental design, ANOVA, general linear models with practical applications. Why Share This? A few reasons. Learning resource. Worked solutions for graduate statistics are surprisingly hard to find online. If someone studying this material stumbles across these and they help, good. Personal archive. I did much of this work during cancer treatment. Keeping it organized and accessible matters to me. Reference. I still look up my own derivations and implementations when something comes up in research. Easier to find them here than to dig through old dir

Kubernetes networking is one of the most misunderstood parts of running containerized workloads. A pod can reach another pod by IP — but why does that stop working after a deployment? A service exists and resolves in DNS — but traffic isn't arriving at the application. An Ingress resource is configured — but requests return 502. These puzzles are common and they stem from the same root: Kubernetes networking has several distinct layers, each solving a different problem, and it's easy to conflate them. This article walks through how Kubernetes networking actually works at each layer — from pod networking to services to Ingress to network policy — so the next time something breaks, you have a mental model to reason from. The fundamental promise: flat pod networking Kubernetes makes one core promise about networking: every pod can communicate directly with every other pod in the cluster without NAT. Every pod gets a real IP address from the cluster's pod CIDR range, and those IPs are routable between pods regardless of which node they're running on. This is not something Kubernetes itself implements. It's a contract that every Kubernetes-conformant CNI (Container Network Interface) plugin must fulfill. When you install Calico, Cilium, Flannel, Weave, or any other CNI, you're installing the component that actually creates this flat network. The mechanism varies — Flannel uses VXLAN overlays, Calico can use BGP for direct routing, Cilium uses eBPF — but the result is the same: pod-to-pod communication without NAT. Here's what a pod's network namespace looks like: $ kubectl exec -it my-pod -- ip addr 1: lo: ... 3: eth0@if12: ... inet 10.244.1.15/24 brd 10.244.1.255 scope global eth0 $ kubectl exec -it my-pod -- ip route default via 10.244.1.1 dev eth0 10.244.0.0/16 via 10.244.1.1 dev eth0 The pod has an IP ( 10.244.1.15 ) on a /24 subnet. The node this pod runs on has an IP from the same range — or a different /24 within the same /16. Traffic from this pod to 10.244.2.8 (

If you're a networking instructor — at a university, technical college, boot camp, or corporate training program — you know the frustration of teaching the OSI Model. Static PowerPoint slides can only do so much. Students nod along in class, but when exam time arrives, the layers blur together. The PDU names become a confusing jumble. The OSI Model Simulator by Roboticela was built with educators in mind. It transforms a passive lecture into an interactive demonstration that students engage with, remember, and take home to explore on their own. Classroom Use Cases Live Demonstration Project the simulator on a classroom screen. Have students suggest messages to send and protocols to use. Step through each layer together as a class, stopping to ask questions: "What's happening here? What header was added? What device would operate at this layer?" The interactive format maintains attention far better than any lecture. Lab Assignments Assign students to run specific simulations and document their findings: "Run HTTP and HTTPS simulations. Screenshot the Presentation Layer for each. Explain in writing what differs and why." This assignment tests both tool usage and conceptual understanding. Flipped Classroom Send students to app.osi-model-simulator.roboticela.com before class. Ask them to run three simulations and come prepared to discuss what they observed. Class time becomes richer discussion rather than basic concept delivery. Protocol Comparison Exercise Have students run simulations for all five protocols — HTTP, HTTPS, SMTP, DNS, FTP — and create a comparison chart noting the differences at each OSI layer. This develops deep protocol literacy that traditional instruction rarely achieves. Why It Works: The Science of Active Learning Research in educational psychology consistently shows that active learning produces dramatically better retention than passive instruction. The "Learning Pyramid" (Edgar Dale's Cone of Experience) suggests: Lecture: ~5% retention after 2

Networking certifications like CompTIA Network+ and Cisco's CCNA are career-defining credentials. They validate your understanding of networking fundamentals — and both exams test OSI Model knowledge extensively. In fact, the OSI Model is arguably the single most tested conceptual framework in entry-level and intermediate networking certifications. Why OSI Is So Critical for Certification Exams Exam questions on OSI take many forms: "At which layer of the OSI model does a router operate?" (Layer 3) "What PDU is used at the Transport Layer?" (Segment) "Which protocol operates at the Application Layer?" (HTTP, DNS, SMTP...) "A user cannot connect to a website. Troubleshooting should begin at which OSI layer?" (Layer 1, then up) "Which device operates at Layer 2?" (Switch) "What is the function of the Presentation Layer?" (Translation, encryption, compression) These questions seem straightforward on paper but are notoriously confusing under exam pressure without deep conceptual understanding. How the OSI Simulator Accelerates Your Studies Visual Memory Formation Research in cognitive science consistently shows that visual and kinesthetic learning creates stronger memories than text-only reading. When you watch the OSI Simulator animate your message through all seven layers, you're forming episodic memories — vivid, experience-based memories that are far more durable than rote memorization. Protocol-to-Layer Association One of the most commonly missed exam categories is protocol-to-layer mapping. The OSI Simulator makes this automatic: when you select HTTP, the Application Layer is highlighted. When you watch TCP headers form, you associate TCP with Layer 4 viscerally, not just verbally. PDU Name Mastery Data, Segment, Packet, Frame, Bits — the five PDU names are shown explicitly at each layer in the simulator. After running 10 simulations, these names become second nature. No flashcard can match this experiential learning. Troubleshooting Framework Practice Network+ an

Getting started with the OSI Model Simulator takes less than 60 seconds. The interface is thoughtfully designed to be intuitive for beginners while offering enough depth to satisfy advanced learners. Here's your complete step-by-step guide. Step 1: Open the Simulator Navigate to app.osi-model-simulator.roboticela.com in any modern web browser. No account required, no download necessary, and no cost. The app loads instantly and is ready to use immediately. Alternatively, visit the landing page to learn more about features and download the desktop app for offline use. Step 2: Enter Your Message In the message input field, type any text you like. This is the "data" your simulation will encapsulate. Examples: Hello, World! GET /index.html HTTP/1.1 {"user": "alice", "action": "login"} Your own name or a phrase you'll remember Using a personally meaningful message makes the encapsulation feel real rather than abstract. Step 3: Choose Your Protocol Select from five real protocols: HTTP, HTTPS, SMTP, DNS, or FTP. Each choice changes the Application Layer headers added to your data. For beginners, start with HTTP. Then re-run with HTTPS to see the Presentation Layer encryption difference. Step 4: Choose Your Transmission Medium Select your Physical Layer medium: Ethernet, Wi-Fi, Fiber Optic, Coaxial, or Radio. This affects how the Physical Layer is visualized at the end of the simulation. Step 5 (Optional): Set Custom IP Addresses For a more realistic Network Layer demonstration, enter a source IP address (simulating your device) and a destination IP address (simulating the server). This makes the Layer 3 packet header concrete and personally relevant. Step 6: Run the Simulati on Click the Run or Start button. Watch as your message travels through all seven layers: Application Layer adds protocol headers Presentation Layer adds encryption (if HTTPS) Session Layer adds session management Transport Layer segments and adds TCP/UDP header Network Layer wraps in IP packet Data Li

The Physical Layer's choice of transmission medium profoundly affects the performance, cost, security, and reliability of a network. The OSI Model Simulator supports all five major media types — making it a powerful tool for understanding how physical choices ripple up through all seven OSI layers. Medium Speed Max Distance Security Cost Ethernet Up to 10 Gbps+ 100m (Cat6a) High (physical access) Low Wi-Fi Up to ~9.6 Gbps (Wi-Fi 6) ~100m indoor Medium (WPA3) Low Fiber Optic Terabits/s 100s of km Very High High Coaxial Up to 1 Gbps 500m (RG-8) Medium Medium Radio Variable (5G: Gbps) km to global (satellite) Low–Medium Variable Ethernet: The Reliable Standard Ethernet is the dominant wired networking standard in homes, offices, and data centers. Using twisted-pair copper cables (Cat5e, Cat6, Cat6a), it provides reliable, high-speed connectivity with predictable latency. The IEEE 802.3 standard governs Ethernet, and modern variants include 1GbE, 10GbE, 25GbE, 40GbE, and 100GbE. Wi-Fi: Wireless Freedom Wi-Fi (IEEE 802.11) eliminated the need for physical cables in most consumer settings. Wi-Fi 6 (802.11ax) and Wi-Fi 6E deliver impressive speeds, but shared medium access, interference, and radio propagation challenges mean it will never fully replace wired Ethernet for critical applications. Fiber Optic: The Internet's Backbone Fiber optic cables carry data as pulses of light through glass or plastic strands. They're immune to electromagnetic interference, support enormous bandwidth, and can span continents — literally. Every major internet exchange, submarine cable, and data center interconnect uses fiber. Coaxial Cable: The Cable TV Legacy Coaxial cable — familiar from cable TV connections — consists of a central conductor surrounded by insulating layers and a braided metal shield. DOCSIS-based cable internet connections (common from ISPs like Comcast) use coaxial as the last-mile medium. Radio: Wireless at Scale From the cellular 5G network in your pocket to satellite

I run a transparent OPNsense bridge between a UniFi Dream Machine Pro and the rest of my LAN. It is deliberately boring at Layer 3: the UDM keeps routing, DHCP, DNS, firewall policy, WAN handling, and VLAN definitions. OPNsense sits inline as a Layer 2 bump in the wire. The interesting part is that both sides of that bump use LACP . I already wrote the build/configuration guide for this setup here: Building a Transparent LAGG (LACP) Bridge with OPNsense, UDM, and UniFi - A Practical Guide . That article explains how the bridge was built, how the LAGG devices were configured, and why I wanted the firewall to remain transparent. This article is the other half of the story: what happens when that kind of setup fails in a non-obvious way. Not a clean outage. Not a single "the network is down" moment. Just enough instability to make everything feel wrong. 1. Topology and Failure Surface The topology looked like this: +----------------------+ | UniFi Dream Machine | | kantharos-udm-pro | +----------+-----------+ | LACP aggregate, 2 x 1G | OPNsense lagg0 "ingresslagg" igc1 + igc2, LACP | +----------v-----------+ | OPNsense bridge0 | | "laggbridge" | +----------+-----------+ | OPNsense lagg1 "egresslagg" igc4 + igc5, LACP | LACP aggregate, 2 x 1G | +----------v-----------+ | UniFi USW-Lite-16 | | downstream LAN | +----------------------+ On OPNsense, the relevant interfaces were: igc1 + igc2 -> lagg0 -> ingresslagg -> toward UDM igc4 + igc5 -> lagg1 -> egresslagg -> toward USW lagg0 + lagg1 -> bridge0 -> laggbridge The bridge is a FreeBSD bridge. The aggregates are FreeBSD lagg(4) interfaces using LACP. OPNsense exposes those through its Interfaces > Devices UI. The expected healthy OPNsense state is: laggproto lacp status: active laggport: igcX flags=<ACTIVE,COLLECTING,DISTRIBUTING> laggport: igcY flags=<ACTIVE,COLLECTING,DISTRIBUTING> Those three member states matter: ACTIVE : the member is participating in the LACP bundle. COLLECTING : the member may receive traffic. DIS

Last week, Toronto hosted Tech Week. A city-wide celebration filled with events and workshops...

The company is reducing its workforce as it exits 22 countries, reduces management layers, and invests in its infrastructure to scale its platform.

Plex has come a long way from being just a personal media server. Over the past few years, it has transformed into a streaming hub, today featuring ad-supported content and movie rental options. Now, the company is setting its sights on competing with social networking platforms like Reddit and Letterboxd: on Wednesday, Plex unveiled several […]

If you've ever built a REST API with Express, you've probably felt it. Middleware registration, type definitions, body parser setup, connecting Joi or Zod... the structure is simple, but the boilerplate is excessive. When I first saw Hono, I was skeptical. "Another Express clone," I thought. That changed when I actually ran it. Bottom line: Hono v4 is more than just lightweight and fast. TypeScript type inference flows naturally all the way to route handlers. Zod validation connects via a single official package. On Bun, response times are noticeably faster than Express. Everything in this post is based on what I ran in a sandbox in June 2026. Why Hono — Compared to Express and Fastify Understanding where Hono fits means answering three questions. Bundle size : Hono v4 core is about 12KB. Express is 58KB, Fastify is 77KB. The gap might not sound dramatic, but in edge environments like Cloudflare Workers or Deno Deploy, bundle size directly affects cold start time. Edge functions sometimes initialize a new runtime per request — smaller means faster first response. Runtime compatibility : Express is Node.js-only. Fastify targets Node.js by default. Hono was designed from the start to "run anywhere." The same code deploys to Bun, Deno, Cloudflare Workers, Node.js, and AWS Lambda Edge. TypeScript support : Express requires @types/express as a separate install, and properties added to req via middleware don't get type inference. Hono is written in TypeScript from the ground up, and the Hono<{ Bindings: Env; Variables: Variables }> generic gives you type-safe access to environment variables and middleware state. I'm not saying Hono is the right choice for every situation. If your team is deeply invested in Express, or you need a mature plugin ecosystem, there's no compelling reason to switch. But if edge deployment is the goal, or you want type safety from day one, Hono is the most convincing TypeScript API framework right now. Installation and First Server — Response in

PageSpeed Insights had been staring at me for weeks. Desktop was holding at 91. Mobile was stuck at 63. I'd already fixed the obvious stuff — non-blocking fonts, preconnects, fetchpriority on the hero image. But there it was, every single run: Improve image delivery — Est savings of 985 KiB Nearly a megabyte of wasted transfer, just from six project screenshots. And that was just the images visible above the fold. The full list across all projects was worse. The culprit: every image I'd ever uploaded through the Django admin was a PNG. Some of them were over 1 MB. WebP would have cut most of them by 80%. I knew this. I just hadn't done anything about it. So I wrote a management command to fix the backlog, and then made the model auto-convert on every future upload so I'd never have to think about it again. The Problem With PNGs in a Portfolio When you're building a portfolio, you screenshot your work and drag it into the admin. That screenshot is usually a PNG — lossless, full-size, straight from your display. Nobody optimises it because the admin accepts it and it shows up fine in the browser. But "shows up fine" isn't the same as "loads fast." A 1.4 MB PNG of a law firm homepage does not need to be 1.4 MB. Served as WebP at quality 85, it's 175 KB. Same visual result. Eight times smaller. Multiply that across 28 projects and you're looking at tens of megabytes that mobile users on slow 4G are downloading just to scroll past thumbnails. The One-Time Backlog Fix: A Management Command First, I needed a way to convert everything that was already in S3. A management command was the right tool — it runs in the production container with full access to the Django ORM and the configured storage backend, so it can read and rewrite files without needing to know whether they're on S3, local disk, or anywhere else. # backend/projects/management/commands/convert_images_to_webp.py from io import BytesIO from django.core.files.base import ContentFile from django.core.management.b

⚠️ この記事はアフィリエイト広告（プロモーション）を含みます。リンク先で発生した収益の一部が運営者に支払われますが、読者の購入価格には一切影響ありません。 If you work remote from rural Japan, by the end of this article you'll have two runnable Python scripts: one that computes your exact furusato-nozei (hometown tax) ceiling from your real side-income, and one that scores your electricity contract against your actual kWh log so you stop overpaying. No spreadsheets, no "consult a tax accountant" hand-waving. Copy, run, save money tonight. Result from my own 2025 numbers: ¥41,000 of furusato-nozei reward goods for a net cost of ¥2,000, plus ¥28,400/year shaved off my power bill after switching plans. Total ≈ ¥67,400 recovered, and because I work from home in Niigata, my commute cost to earn it was literally ¥0. The trap: side income breaks the "simple" furusato nozei calculator Every portal (Satofuru, Rakuten Furusato, Furunavi) shows a slider that estimates your ceiling from salary alone. The moment you add freelance/blog/ Kindle income, that slider lies to you. In 2024 I trusted it, donated ¥52,000, and ¥9,000 of it fell outside the deductible ceiling because my side income pushed me into a different residual-tax bracket. That ¥9,000 was just a donation — no tax back. The real ceiling depends on your total taxable income (salary + side hustle minus expenses) and the resident-tax (juminzei) cap of roughly 20% of your income-based resident tax. Here's a calculator that actually folds in side income. It uses Japan's 2026 progressive income-tax brackets. # furusato_ceiling.py — Python 3.9+ from dataclasses import dataclass # 2026 national income tax brackets: (upper_bound_yen, rate, deduction_yen) BRACKETS = [ ( 1_950_000 , 0.05 , 0 ), ( 3_300_000 , 0.10 , 97_500 ), ( 6_950_000 , 0.20 , 427_500 ), ( 9_000_000 , 0.23 , 636_000 ), ( 18_000_000 , 0.33 , 1_536_000 ), ( 40_000_000 , 0.40 , 2_796_000 ), ( float ( " inf " ), 0.45 , 4_796_000 ), ] @dataclass class Taxpayer : salary_income : int # after salary-income deduction (給与所得) side_profit : int #

Most people use these technologies every day. Almost nobody knows they exist. Every time you open YouTube, browse Instagram, join a Zoom meeting, or play an online game, your router is quietly performing a series of networking tricks behind the scenes. Those tricks have names: NAT SNAT DNAT PAT Port Forwarding They sound intimidating. They're actually much simpler than they appear. Let's break them down using something familiar: your home Wi-Fi. The Problem the Internet Had to Solve Imagine a family of five living in one house. Everyone owns a device: Laptop Phone Smart TV Gaming Console Tablet Each device needs internet access. The problem? Your Internet Service Provider usually gives you only one public IP address . Something has to manage all those devices sharing a single internet connection. That's where NAT comes in. NAT: The Receptionist of Your Network NAT stands for Network Address Translation . Think of NAT as a receptionist in an office building. People inside the building have room numbers: Laptop = Room 101 Phone = Room 102 TV = Room 103 But when communicating with the outside world, everyone uses the building's main address. The receptionist keeps track of who sent what. Your router does exactly the same thing. What Happens When You Visit Google? Inside your home: Laptop 192.168.1.10 Your router: Public IP 49.x.x.x When you open Google: 192.168.1.10 ↓ Router ↓ 49.x.x.x ↓ Google Google never sees your private IP. It only sees your router's public IP. That's NAT in action. SNAT: Changing the Sender's Address SNAT stands for Source Network Address Translation . The keyword is: Source It changes the sender's address. Before leaving your network: Source: 192.168.1.10 After SNAT: Source: 49.x.x.x The router replaces your private IP with its public IP. Without SNAT, websites wouldn't know how to send responses back to you. Real-Life Example Imagine mailing a letter. Instead of writing your bedroom number as the return address, you write the house address. Tha