Blog
Field notes from real projects: software licensing, IoT backends, data recovery, hotel systems, and running software projects that succeed.
Visitor Management: Who Is Inside Right Now?
A visitor system's real job isn't printing badges. It's knowing who is inside right now — and proving it when the fire alarm goes off.
When Remote Support Turns Against the Technician
ConnectWise patched a 9.9-rated ScreenConnect flaw on 8 September 2026. The twist: the machine being helped pushes files onto the technician's own PC.
Choosing KBLI Business Codes for IT Consultants
Four core codes, a second layer per service line, and the trading codes worth taking early — plus the ones that quietly drag heavy licensing.
Vendors Now Have 24 Hours to Report Exploited Bugs
Since 11 September 2026, anyone selling a connected product into the EU must report exploited holes in 24 hours. What Indonesian buyers should demand.
MikroTik Routers Under Attack: Check Yours Today
Attackers hijacked internet-facing MikroTik routers a day before the 3 September patch. Indonesia has 7,100 exposed. Here is the check order.
Finding Wasted Energy With Building Meter Data
Interval meter data plus the booking schedule turns 'the AC gets left on' into a number you can budget, bill, and actually fix.
When ChatGPT, Claude, and Grok Fail Together
Three AI providers failed the same morning with three different causes. What that means for any business with an AI call on the request path.
Smart Breakers on Modbus: Retrofit Energy Metering
RS485 breakers give per-circuit metering for a DIN-rail swap. What the datasheet leaves out: the register map, the 12V feed, and why it is not a billing meter.
Nurse Call and Code Blue: Life-Critical Alert Design
A nurse call button carries a stricter contract than telemetry: bounded latency, at-least-once delivery with dedup, human acknowledgement, and a second path.
CCTV Storage Sizing: Why 30 Days Isn't 30 Days
The retention formula is simple. The inputs are where systems fail. Why a 30-day CCTV target needs roughly 35 days of disk, and where the missing days go.
Clock Drift: When Timestamps Stop Being Evidence
Cameras, controllers, and sensors each keep their own time. When an incident forces you to align their logs, drift is what you end up reading.
KKI on QRIS: What Merchant Systems Must Handle
Indonesia's domestic credit card now funds QRIS payments. Your acceptance layer needs no change, but ticket sizes, issuer codes, and refunds do.
RAID Is Not a Backup: What Array Failure Actually Costs
RAID buys uptime, not recoverability. The rebuild math, the failure modes it never covered, and why array recovery bills by the disk.
Why SD Cards Die in Edge Devices and How to Design Around It
Consumer SD cards fail in the field for reasons that are not bad luck. The fix is a write budget and a read-only rootfs, not a bigger card.
SBOMs in Practice: Automating License Compliance Before Delivery
A build carries a thousand licenses. An SBOM plus a policy gate in CI is how you find the three that will cause a problem at delivery.
SNMP for CCTV Fleets: Monitoring Cameras Before Footage Goes Missing
A video analytics deployment is only as good as its cameras being alive. SNMP polling with net-snmp plus RTSP frame-age checks catches the ones that aren't.
Why AI Coding Pilots Stall Before Production
Most enterprise AI-coding-agent pilots stall before production, and the blocker is governance infrastructure, not model quality.
Bus Factor: When One Person Is the Single Point of Failure
What happens when the only person who knows the deploy process, the vault password, or the vendor contact walks out the door.
The $120K Control System and the $1,600 Retrofit: What Vendor Lock-In Actually Costs
A $120k bowling system replaced with $1,600 in ESP32s. What that HN thread says about vendor lock-in, and how to scope a retrofit safely.
QRIS MDR Changes on October 1: What Your Payment Integration Must Handle
BI's Oct 1 QRIS MDR expansion isn't just a fee cut. It's a fee-logic change your POS and gateway integration has to handle correctly.
UU PDP Fines Changed Under the New KUHP: Smaller Numbers, Same Obligations
UU PDP's criminal fines shrank under the new KUHP, but administrative sanctions, the ones SMEs actually face, didn't move.
CCTV Firmware Hardening Checklist: Before the Camera Goes Live
Default credentials, open RTSP, and vendor P2P tunnels make CCTV the easiest device class to compromise. A checklist for commissioning day.
Twenty Incidents in Eight Days: What the Cloudflare Streak Means for Your Stack
20 status-page incidents in 8 days at Cloudflare, and the credential-rotation slip that caused an earlier one. What SMEs should check.
What 99.9% Uptime Actually Buys You: Reading an SLA Like an Engineer
Translate SLA percentages into real downtime, learn what credits actually cover, and use an error budget instead of shopping for more nines.
A 16-Year-Old SQLite Bug and the Limits of Boring Technology
A 16-year-old SQLite bug silently dropped committed data. Why boring tech stops being boring once you use it differently.
Agentic Tool Loops: When the Chatbot Needs to Do Things, Not Just Talk
Typed tools, a bounded loop, per-tool guardrails: how agentic chatbots handle multi-step work single-shot RAG can't.
Integrating Access Control and VMS With Your Own Systems
Getting events out of closed access-control panels and camera VMS, then mapping them into your own domain model.
The Handover Package: Making Sure Your Software Outlives Your Vendor
What a real handover package contains, why the vendor is a single point of failure too, and how to test one before you need it.
Recovering Fragmented Video When File Carving Gives Up
When signature carving returns broken files, cluster-level reassembly with global verification loops can still rebuild fragmented video.
Fixed Price vs Time and Materials: Picking the Right Contract for a Software Project
Fixed price, T&M, or milestone hybrid — who carries the risk, why fixed quotes run high, and red flags in both.
Room-Level Energy Control With Smart Breakers
Smart breakers put metering and remote cut in one DIN-rail device — per-room billing, enforcement workflows, and payback for rented spaces.
Who Owns the Code? IP Clauses Every Client Contract Needs
Work-for-hire vs license grant, toolkit carve-outs, escrow, and payment-linked transfer — the IP clauses every freelance contract needs.
The PMS Integration Mistake That Quietly Costs Hotels Revenue
Three documented PMS integration failure modes quietly cost hotels revenue after go-live — and why the fix is what you connect first.
Two Live AGPL Disputes and What They Actually Teach About the License
ONLYOFFICE vs. Nextcloud and SFC vs. Bambu Lab: two live AGPL disputes showing what the license actually restricts.
Rule Zero of Data Recovery: Image the Drive First
Every read from a failing drive is a risk you only get to take once. Why ddrescue imaging comes first, and what the mapfile buys you.
Taking Over a Legacy System: Stabilize First, Rewrite Never (Almost)
Inherited codebase, developer gone, no docs? The order that works: run it, back it up, test it, then rebuild the worst part.
Designing HMI Dashboards Operators Actually Trust
Gray screens, disciplined alarms, and a cause-and-effect matrix — what separates industrial HMI dashboards operators rely on from decoration.
Warning Signs Your Software Project Is Heading Off a Cliff
Seven client-visible signs a software project is failing, why each one predicts trouble, and the cheap fix for each before the budget is gone.
Controlling LLM Costs: Route by Task, Cap by Day
Route cheap tasks to cheap models, cap spend by day, and set a deadline per turn: practical LLM cost control that scales without surprises.
One Smart Lock Platform, Two Very Different Buildings
Architecture decisions behind a smart lock platform serving BLE-only boarding houses and gateway-connected, booking-linked hotels.
Choosing a License for Your Own Product: MIT, Apache, AGPL, or Closed
How to license the software you ship: closed for client work, MIT for adoption, Apache-2.0 for patent posture, AGPL when you sell the product itself.
Webhooks That Do Not Lose Money: Retries, Signatures, and Dead Letters
How to verify signatures, respond fast, dedupe by event id, and reconcile so payment webhooks stop silently dropping money.
Smart Door Access for Boarding Houses and Small Properties
Smart door access for boarding houses: offline-first locks, PIN and card credentials, the tenant lifecycle, and how to decide on a gateway.
The SPOF Hiding in Your IoT Fleet: Gateways, Brokers, and SIM Cards
Broker, gateway, uplink, NTP, and OTA server are five separate single points of failure hiding behind one healthy IoT dashboard.
Self-Hosting Supabase in Production: What You're Actually Signing Up For
Self-hosting Supabase means running a dozen services — backups that include storage buckets, upgrades, JWT discipline, and when managed wins.
Do You Need a Staging Environment? Usually Yes, and Smaller Than You Think
What a staging environment must mirror, what it can skip, and the failure story that shows what happens without one.
Panic Buttons at Scale: Designing an Emergency Alert Fleet for 100 Locations
Scaling panic buttons to 100 locations — WiFi with GSM fallback, heartbeat liveness, escalation chains, test mode, and the audit trail.
Dual Licensing From the Vendor's Chair: AGPL Plus a Commercial License
Releasing a product as AGPL plus a paid commercial license — the mechanics, the NOTICE discipline, and what commercial buyers actually ask.
Software Projects With an Outside Team: A Playbook for SMEs
Scope as outcomes, milestone payments, weekly demos, the four documents that keep a vendor-run project under control.
PGMQ: When Postgres Is All the Message Queue You Need
PGMQ turns the Postgres you already run into a real message queue — visibility timeouts, transactional enqueue, dead letters.
Multi-AZ Is Not Multi-Region: Lessons From the us-west-2 Outage
The us-west-2 outage broke the region's front door, not any single data center. What that means for SME redundancy budgets.
Frame-Synchronized Playback Across Multiple Screens
NTP alone won't keep a video wall in frame. Sync sessions, per-device offsets, and rate-based drift correction that never visibly seeks.
The Vendor SDK With No License Text: A Contract Problem, Not a Gray Zone
A vendor SDK with no license text is all rights reserved by default. The fix lives in the supply agreement, not in assumptions of goodwill.
Guardrails Against Hallucination When the Chatbot Answers About Money
Why confident wrong answers are the real risk, and the verification, fallback, and scoping guardrails that keep an LLM honest about money.
Talking to Vending Machine Controllers: Serial Protocols and Vendor SDKs
Spring vending machines speak serial through closed Android SDKs. How to wrap them, detect motor faults, and capture telemetry worth having.
Monitoring for Small Systems: Enough Signal Without an Enterprise Budget
Enterprise dashboards cost more than small systems need. Three checks and one alert channel catch what actually breaks.
Android Kiosk Mode Done Properly: Device Owner, Lock Task, Watchdog
Device owner provisioning, lock task mode, and a layered watchdog — turning consumer Android hardware into kiosks that survive unattended.
Finding the Single Point of Failure Before It Finds You
The six places single points of failure hide in an SME, how to map them in an afternoon, and when redundancy isn't worth the cost.
Meeting Room Panels That Match Reality: Integrating Microsoft Teams Calendars
Room mailboxes, Graph webhooks with a polling fallback, and check-in auto-release — how door panels stay honest about what a room is actually doing.
LGPL in Practice: The FFmpeg DLLs Inside Proprietary Products
LGPL obligations made concrete: license texts, replaceable dynamic linking, source for the LGPL parts — and the FFmpeg DLLs vendors bundle.
When Database Rows Survive but Files Don't: The Orphaned Blob Problem
A case study in orphaned blobs: 400 media files referenced by healthy database rows, missing from storage — and why only 45% came back.
PPE Detection Cameras: What a Real Deployment Requires
Model accuracy is the easy part of PPE detection. Camera placement, alert workflow, false-positive economics, and worker acceptance decide it.
API Versioning When Vendors Don't Version Anything
Vendor APIs change without notice. Tolerant readers, contract tests, an anti-corruption layer, and pinning keep integrations alive.
RAG Explained for Business Systems: Your Data, Grounded Answers
How RAG grounds LLM answers in your own data, why hybrid search beats either method alone, and when RAG is overkill.
Your pg_dump Is Not a Backup Until You've Restored It
A dated dump file is not a backup. Restore testing, object storage in scope, and the integrity checks that make recovery real.
Choosing a Tech Stack for an SME System: Boring Wins
Why boring, hirable technology beats the newest framework for an SME system, plus vendor questions to ask.
Reading Legacy Utility Meters With a Camera: ESP32-CAM OCR
Retrofitting analog utility meters with ESP32-CAM OCR — mounting, lighting, confidence thresholds, and the economics versus meter replacement.
Offline-First Apps for Field Teams: Design for the Signal You Actually Have
Local queue architecture, conflict rules ops will accept, idempotent ingestion, and what to test before a field app rollout in Indonesia.
AGPL in Commercial Computer Vision: The Ultralytics Question
Ultralytics YOLO is AGPL-3.0. Three compliant options for closed-source CV products, and the questions to ask any CV vendor.
Digitizing a Jastip Order Workflow: What the Minimum System Needs
Small social-commerce sellers outgrow chat and spreadsheets. The minimum system — order status, payment status — that fixes it.
Running a Fleet of Android TV Boxes for Signage and Hospital IPTV
Provisioning, lockdown, content sync, and heartbeat telemetry for fleets of commodity Android TV boxes running digital signage and hospital IPTV.
File Carving With PhotoRec: What Comes Back and What Never Will
What PhotoRec file carving recovers from a failed NTFS drive, what is permanently lost, and how to triage 1,600 documents that come back without names.
Database Indexes for Application Developers: When, Which, and Why Not More
Index write costs, composite column order, reading EXPLAIN without panic, why indexing every column is a smell.
From Meter Reading to Invoice: Architecture of IoT Utility Billing
IoT utility billing end to end: meter ingestion, interval aggregation, tariff engine, billing cycles, and a dispute-proof audit trail.
AI Licensing: Code, Weights, and Datasets Are Three Different Contracts
An MIT badge on the repo green-lights only the code. Why weights and training data are separate contracts, and how to clear all three.
Idempotency in Payment APIs: Surviving Retries Without Double Charges
Idempotency keys stop retried payment requests from double-charging customers. How Stripe, Adyen, Midtrans, and Xendit each implement them.
Open-Source Licenses in Commercial Software: What Actually Bites
MIT, Apache, LGPL, GPL, AGPL — what each license obligates in commercial software, and where teams get burned.
Grouping Multi-Timezone Data in PostgreSQL Without Getting It Wrong
Grouping events by local day or hour in PostgreSQL breaks on half-hour zones and DST. The tested pattern that keeps multi-timezone dashboards correct.
Adding WhatsApp Automation to Hotel Operations
Use WhatsApp as an operational layer for hotels — confirmations, reminders, room-ready messages, and staff alerts, each tied to a business event.
Modbus Polling vs Event-Driven Ingestion in IoT Backends
Polled Modbus vs event-driven MQTT — how each works, when to use which, why connection health matters more for polling.
How to Prevent Hotel Overbooking: Inventory vs Physical Room Assignment
Prevent hotel overbooking by separating room-type inventory from physical room assignment, with database constraints and short-lived reservation locks.
Unifying Multi-Protocol Devices (Modbus, BLE, MQTT) into One Backend
How to unify Modbus, BLE, and MQTT devices behind protocol adapters and a normalization layer that writes one common telemetry data model.
Modeling Hotel Room Status as a State Machine
Why hotel rooms need a status state machine — clean, dirty, inspected, maintenance, ready — so housekeeping and front desk never collide.
MQTT vs WebSocket for Real-Time IoT: When to Use Each
MQTT vs WebSocket for IoT — what each is for, why real systems use both, and how data flows from broker to dashboard.
Hotel Management System: A Complete Guide for Independent Hotels
A complete guide to hotel management systems (PMS) for independent hotels: room status, bookings, overbooking, staff, and WhatsApp automation.
A Complete Guide to IoT Backends: MQTT, WebSocket, and Multi-Protocol Telemetry
Ingesting MQTT, WebSocket, Modbus, and BLE telemetry, then normalizing it into one real-time data model.
Building a Hotel Management System for a Real Hotel
Building a hotel system in Pekalongan with Next.js 16, Drizzle, PostgreSQL, room state machines, and WhatsApp automation.
Building Dashboards That Connect Different Systems
A practical story about connecting system control, visitor management, and operational signals into dashboards teams can trust.
Freelance MQTT and WebSocket Backends for Real-Time IoT
A real freelance IoT story about MQTT telemetry ingestion, live WebSocket dashboards, nurse call systems, PLC integration, and multi-brand control systems.