Project
HAProxy is an open-source TCP/HTTP load balancer and reverse proxy widely used to distribute traffic across backend servers in production infrastructure.
The August 17 postmortem describes a sidecar that hit its concurrency limit while its autoscaler measured the host, then a VS Code retry bug that kept Copilot down hours after everything else returned.
Perspective Coverage
3 publishersReality
Commits on GitHub doubled to 2.9 billion a month between April and August. Set against 130 million merged pull requests, that puts roughly 22 changes behind each human approval. It is a review-capacity number, not a capacity-planning one.
Reality
Rapid7 says the ted backdoor is built into the victim's existing HAProxy 2.8.12 and hooks its filter API, so the load balancer keeps balancing normally while it logs cookies and injects scripts for selected clients.
Perspective Coverage
5 publishersReality
Anthropic's new flagship lists at $4 and $20 per million tokens, a fifth under Opus 5, and cache reads drop 60 percent to $0.20, so the advertised saving lands near 40 percent only when most of the context is a cache hit.
Reality
Every token price on Claude Opus 5.5 fell 20% except cache reads, which dropped 60% to 20 cents a million. For the advertised 40% saving to come from price alone, half a buyer's Opus 5 bill has to be cache reads.
Reality
An HAProxy employee traced the 206ms first-token delay out of the proxy and into the kernel send path, where the H1 mux marks each body write as incomplete and the system holds it back until it can fill a packet.
Reality
GitHub's write-up puts an almost eight-hour outage on an Istio sidecar that hit its concurrency limits while the autoscaling policy watched the wrong load signal, then on four saturated HAProxy nodes and two separate retry loops.
Reality
A dev.to walkthrough of RFC 5798 shows two balancers sharing one virtual IP, electing an owner by priority and heartbeating once a second. The adoption cost includes a firewall rule that names IP protocol 112.
Reality
Rapid7's account puts the ted backdoor inside HAProxy 2.8.12 as an internal filter, matching requests by IP, URL and User-Agent and reducing the same counters an operator would use to triage it. Root was already held.
Reality
A gateway ACL and a backend router are separate parsers with no agreed decode order, which is why /%2Fadmin still lands. Normalizing earlier relocates the window; refusing ambiguous paths is what closes it.
Reality
An RKE2 hub-and-spoke design runs Prometheus, Harbor, Vault and ArgoCD once for four clusters and documents in-cluster failover carefully, while the hub's own sizing and outage behaviour stay unwritten.
Reality
devops.com argues renewal should be modelled as renew, deploy, reload, verify and recover, because a completed ACME transaction says nothing about the certificate a browser is actually handed by your load balancer.
Reality
One developer's fix: a world-readable manifest the machine writes about itself, plus a read-only probe where half the possible outcomes are refusals.
Reality