Technical Blog
Infrastructure notes from the front line
Practical experience and industry developments across CDN, VPS, data center buildout, cloud architecture, and certificate management — written for teams making real technology decisions.
Checking ICP Filings in Bulk Without Getting Blocked
Filing status disappears without warning, so it has to be rechecked. Past a certain number of domains, checking by hand stops working — and the hard part is rate limits and error semantics, not speed.
Read the full article →Six Things to Check Yourself Before Buying a Pre-Filed Domain
The price gap between pre-filed domains is rarely about the domain. It is about the state of the filing — and most of what matters can be checked before you pay.
Read the full article →Finding Baidu Doesn't Mean Finding the Domain You Care About
Nineteen domains of known status, run against an ICP filing lookup API. The worst failure isn't a miss — it's HTTP 200 with the error string sitting in the ICP number field.
Read the full article →ICP Filings Are Usually Cancelled Because You Changed Hosts, Not Because You Broke a Rule
You move hosting, the old provider cancels the access record, you don't file access with the new one — and the filing becomes a shell awaiting cancellation. The site runs normally throughout.
Read the full article →Do Hong Kong Servers Need ICP Filing? The Exemption Isn't About Where You Bought It
Hong Kong sits outside mainland filing rules, so no filing is required. But the exemption covers the paperwork rather than every regulation — and it most often lapses when a mainland node is switched on for speed.
Read the full article →no-cache Does Not Mean Do Not Cache: What HTTP Caching Headers Actually Say
People reaching for no-cache to prevent caching are in fact permitting storage — it requires revalidation before reuse. no-store is the one that forbids storing, and the difference has real consequences.
Read the full article →Why GeoDNS Sends Users to the Wrong Node: It Sees the Resolver, Not You
Geographic routing sounds straightforward — send people to the nearest node. But the authoritative server only ever sees the recursive resolver, so a user on 8.8.8.8 is effectively anonymous.
Read the full article →Free vs Paid Certificates: It Isn't Encryption Strength, and It Isn't Wildcards
"Paid certificates are more secure" and "paid certificates are a scam" are both wrong. The real line is validation level and operational limits — and wildcards are free, which surprises people.
Read the full article →nginx -t Passing Doesn't Mean the Certificate Is Right: Three Mechanisms That Decouple Config From Reality
The config is edited, the test passes, and users still get the old certificate or one for a different domain. The problem isn't the certificate — it's how Nginx loads and chooses them.
Read the full article →Still Configuring OCSP Stapling? Let's Encrypt Switched It Off
Guides still tell you to enable ssl_stapling, but Let's Encrypt shut its OCSP service down in August 2025 and certificates no longer carry the URL — that directive now does nothing at all.
Read the full article →It Opens in Your Browser, So the Certificate Is Fine? Diagnosing Missing Intermediates
"It looks fine on my machine" — while the app can't connect and the API throws certificate errors. Neither side is lying: desktop browsers quietly repair the missing intermediate, and your code doesn't.
Read the full article →ICP Filing and Pre-Filed Domains: Rules, Timelines and Real Risk
Filing takes weeks, so a market in pre-filed domains exists. Here are the actual rules, what the subject-change regulation says, how verification really works, and when no filing is needed at all.
Read the full article →Why Your DNS Change Hasn't Taken Effect: Record Types, TTL and the Apex Limit
"Still propagating" is the usual explanation, but usually propagation isn't the issue — TTL wasn't lowered first, and lowering it only helps if done beforehand. Also, apex domains can't use CNAME. That one is protocol-level.
Read the full article →Your Transfer Lock Won't Stop a Hijack: What Domain Security Settings Actually Cover
Most people enable transfer lock and feel protected. But that lock lives inside your registrar account — and an attacker who takes the account simply switches it off.
Read the full article →One Test Proves Nothing: Why Cross-Border Quality Needs Continuous Monitoring
Cross-border problems are overwhelmingly time-of-day. You test when users complain and everything looks fine — they aren't mistaken, you're measuring at the wrong hour.
Read the full article →Reading Speed Test Results: Why Enough Bandwidth Still Feels Slow Cross-Border
Most people read a speed test as one number — download Mbps. That's the least useful figure for cross-border services. Latency and packet loss decide what users feel, and their effects multiply rather than add.
Read the full article →Where Certificate Automation Actually Breaks: Choosing an ACME Challenge Type
People assume installing Certbot means automation is done. What actually blocks them is picking the wrong challenge type — HTTP-01 fails behind a CDN, and wildcard certificates can't use it at all.
Read the full article →Certificate Monitoring: A Successful Renewal Doesn't Mean Users Got the New Certificate
Most teams monitor whether renewal ran successfully. What actually causes incidents is renewal succeeding while the certificate never reaches every endpoint — and only one kind of check catches that.
Read the full article →Transferring a Domain Won't Take Your Site Down: Process, Auth Codes, and Timing
Plenty of people stay with a bad registrar because they fear a transfer will break their site. It won't — a transfer changes who manages the registration, not where the site is hosted. Here's the actual process and when not to do it.
Read the full article →You Don't Buy a Domain, You Rent It: Renewals, Transfer Locks, and Redemption Fees
Most people treat registering a domain as buying a name. It's a lease — and the things that actually go wrong are never in year one: renewal pricing, transfer locks, and redemption fees running past $80.
Read the full article →Why Are Connections to China So Slow? It Isn't Just the Firewall
Most people blame the Great Firewall first. In practice, latency and packet loss usually come from three structural factors unrelated to censorship: inter-carrier bottlenecks, concentrated international gateways, and return-path route quality.
Read the full article →How to Choose a VPS: Reading the Specs, Setting the Budget, and Avoiding the Traps
What actually separates shared hosting, VPS, and dedicated servers? How much CPU and memory do you need? And why does the bill triple at renewal? A repeatable process for choosing a VPS.
Read the full article →What Is an IDC? Colocation, Rack Rental, and Purpose-Built Facilities Compared
IDC, colocation, and rack rental get used interchangeably, but their responsibility boundaries differ sharply. Here's what an IDC actually is, how to read Uptime Tier ratings, and when a facility beats public cloud.
Read the full article →SSL Certificate Lifetimes Are Now 200 Days — and 47 by 2029. What Should Your Team Do?
As of March 15, 2026, the maximum lifetime for a publicly trusted TLS certificate dropped from 398 days to 200, with two further reductions scheduled for 2027 and 2029. Here's the timeline, the reasoning behind it, and why manual renewal won't survive the next phase.
Read the full article →