This week in caching: a triage checklist for 'I deployed but users see old content'

Work the layers outward — the bug is almost never where you look first.

— Start at the browser — hard-reload and check if it's gone; if so, your HTML had a long max-age it shouldn't. Fix the document Cache-Control.
— Then the CDN — check the Age header; a high Age means the edge is still serving the old object and your deploy purge didn't fire.
— Then full-page cache — Varnish/nginx/plugin may not have purged; confirm the cache-status header reads MISS after deploy.
— Then OPcache — with validate_timestamps=0, old PHP runs until you reset OPcache; this is the sneakiest one.
— Last, the object cache — a stale serialized object in Redis can outlive the code that changed; flush the relevant keys, not everything.

Credit to countless post-mortems naming OPcache as the layer everyone forgets.

Bookmark: a one-page 'cache layers, outermost to innermost' diagram — tape it to your deploy doc.

Meta ограничивает расходы на токены для сотрудников

Meta ввела внутренние лимиты на использование ИИ из-за резкого роста расходов: в 2026 году только на сотрудников заложены миллиарды долларов, а общий бюджет на ИИ-инфраструктуру оценивается в 130–145 млрд. Вывод простой: даже у Big Tech ИИ перестал быть бесплатной игрушкой и требует жёсткого контроля затрат.

➡️ Читайте на сайте: https://aff.top/blog/meta-ogranichivaet-raskhody-na-tokeny-dlia-sotrudnikov

🧠 Ещё больше инсайтов → в канале AFF.top

Claude Cowork, Claude Design объединили в один Claude

➡️ Читайте на сайте: https://aff.top/blog/claude-cowork-claude-design-obedinili-v-odin-claude

🧠 Ещё больше инсайтов → в канале AFF.top

This week in caching: hardening a Redis cache box before prod

A pre-flight checklist so your cache layer doesn't become an incident. Skip if you're on a managed service.

— Pick the right eviction policy — a pure cache wants allkeys-lru or allkeys-lfu; the default noeviction turns a full cache into write errors across your app.
— Set maxmemory explicitly — unset, Redis eats RAM until the OOM killer takes it down at peak.
— Disable dangerous commands — rename or block FLUSHALL, KEYS, and CONFIG in production; one stray KEYS * blocks the whole server.
— Bind and auth — never expose 6379 to the internet; set requirepass and bind to private interfaces. Open Redis boxes get cryptomined within hours.
— Watch evicted_keys and used_memory — rising evictions mean your working set outgrew memory; scale before the hit ratio collapses.

Credit to the Redis admin and security docs for the rename-command hardening.

Bookmark: the Redis 'Securing Redis' page — the eviction + auth defaults everyone should change.

This week in caching: Redis round-trip reduction

The cache was fast; the network wasn't. How teams fixed the gap:

— Feed service — replacing 300 sequential GETs with one MGET / pipeline dropped page render from 240ms to 18ms; same Redis, the win was killing 300 network round-trips.
— Laravel app — moving Redis off a remote managed host onto a local unix socket cut per-call latency from 0.8ms to 0.05ms; on a page doing 200 cache calls that's a real 150ms.
— API — Lua scripting a read-modify-write into one atomic call removed a race and a round-trip at once.

The lesson: cache hit latency is dominated by network round-trips, not Redis itself. Batch and co-locate.

Bookmark: redis-cli --latency and --intrinsic-latency — separate network cost from server cost before you tune.

Microsoft планирует вставлять рекламу в игры

➡️ Читайте на сайте: https://aff.top/blog/microsoft-planiruet-vstavliat-reklamu-v-igry

🧠 Ещё больше инсайтов → в канале AFF.top

Myth: more cache layers always means faster
This week in caching, the layering fallacy:
— The claim: stack page cache + object cache + CDN + browser cache and speed compounds.
— The correction: each layer adds an invalidation surface; a stale object cache can poison your fresh page cache, so a miss now costs a multi-layer rebuild instead of one.
— Worth your time: audit which layer actually owns the TTL for a given URL before adding another. Two coherent layers beat four that fight over the same key.
Bookmark: map your stack as a dependency tree, not a pile. The bottom layer's staleness window caps everything above it.

This week in caching: private browser cache vs shared CDN cache

The header nuance that causes the most cache bugs:

— Cache-Control: private means only the user's browser may store it — correct for logged-in dashboards. A CDN must skip it.
— public opens it to shared caches (CDN, proxies) — correct for anonymous pages.
— The killer: s-maxage overrides max-age for shared caches only. So you can tell the CDN 'cache 1 hour' while telling browsers 'cache 1 minute' — long edge life, fresh-ish clients, no header conflict.

Classic outage: serving a logged-in page as public and leaking one user's cart to everyone behind the CDN. Always pair user-specific responses with private AND a Vary on the auth cookie.

Bookmark: MDN's Cache-Control reference — keep the private/public/s-maxage section open while you debug.

Myth: set opcache.revalidate_freq=0 for safety
This week in caching, the OPcache stat trap:
— The advice you've seen: keep revalidate_freq at 0 so PHP always picks up code changes.
— Why it's wrong: 0 means a filesystem stat() on every include on every request, which is the exact syscall overhead OPcache exists to kill.
— The real move: on production set opcache.validate_timestamps=0 and reload PHP-FPM on deploy. That's the configuration that actually buys you the cached-bytecode win.
Bookmark: revalidate_freq only matters when validate_timestamps is on; turning the latter off makes the former irrelevant. Tie cache busting to your deploy, not to the clock.

This week in caching: Vary header vs separate URLs for variants

Serving mobile/desktop or multi-language from one cache — two roads:

— Vary header (e.g. Vary: Accept-Encoding) keeps one URL and lets the cache store per-variant. Clean for encoding/compression. But Vary: User-Agent is a hit-rate killer — thousands of UA strings = thousands of cache entries for one page.
— Separate URLs (/en/, /de/, m.site.com): each variant is its own cacheable object with high hit rate, and it's SEO-friendly. Cost: routing/redirect logic and canonical tags.
— The middle path: normalize the varying input to a small set (UA → 'mobile'/'desktop' bucket) before it hits the cache key, so you get Vary's single-URL simplicity without the explosion.

Rule: Vary only on low-cardinality headers; for anything high-cardinality, bucket it or split the URL.

Bookmark: Smashing Magazine's 'Vary header' deep-dive on cache-key cardinality.