In August, a page from a small Danish website turned up on the "recently indexed" admin page of my search engine. That site's robots.txt is two lines long and couldn't be clearer:
A CPU isolation setting sat unchanged for weeks, explicitly documented as deliberately left alone to avoid destabilizing a live system. When it finally got measured instead of just trusted, the setting turned out to be backwards — giving unrestricted access to the exact processes it was supposed to be isolated from, while pinning the processes causing the contention to almost nothing.
When I switched this site's outgoing mail from a missing local sendmail to proper SMTP submission on my own mail server, the first test send failed. Authentication worked, STARTTLS worked, and then the server rejected the recipient:
450 4.2.0 <...>: Recipient address rejected: Greylisted
After I fixed the wrapper script for this site's article pipeline so it no longer carries on without its grammar checker, I added one more line to its cleanup function: wait for the LanguageTool server to exit after killing it, so its port is free by the time the script returns.
Three packages in this Emacs config are installed the same way: skip the archive-based package manager, fetch straight from GitHub with package-vc-install, and guard the call so it only ever runs once.
In CaRMen, my CRM, every deal has an owner and every activity has an assignee: a user. For a while the deal list showed "-" in the Owner column for every deal, which looked like a display bug. It was worse than that. Opening a deal and saving it, without touching the owner field, removed the owner from the deal. The same happened to an activity's assignee.
Parts 2 to 4 were about building the search engine: getting pages, deciding which ones count, computing authority.
On the database server of my search engine project, /etc/ssh/sshd_config said PasswordAuthentication no. The server accepted password logins anyway, and a bot on the internet was guessing the root password around the clock. Every attempt failed, but only because the password held, not because the setting did.
CaRMen, the small CRM I run for myself, had unit and controller tests from early on, but nothing that drove an actual browser against the actual frontend until October. Setting up Playwright properly — @playwright/test instead of plain playwright, a Chromium-only project, role-based locators, a shared login helper — took one evening.
Part 3 ended on an assumption: that the authority score behind every ranking was right. Authority comes from PageRank, computed over the whole link graph, and it's the part of this search engine that has never fitted comfortably anywhere.