Hi! 👋 my name is Andrea Manzini. I’m an Unix System Administrator and a developer. As you can see, I enjoy minimalism and pragmatic solutions for a problem. I am focused on delivery, curious and enjoy learning new things. If you are interested, you can find my resume following this link or contact me using social links on this page. If you appreciate my work, you can buy me a book from my Amazon Wishlist. Thanks!
How much code are you testing ? (5)
🧭 Where we left off Welcome back to our technical journey on measuring binary test coverage! In part 4 we introduced funkoverage, a native, high-performance eBPF-based coverage tracer that leverages uprobe_multi to capture function entry events in GNU/Linux with less than 2% overhead. It parses static library dependencies using ldd during installation and maps uprobes to all discovered functions. But there was a big fat elephant in the room: dlopen(). Some of the most complex, modular software in the world — such as web servers with dynamic modules, plugin-based enterprise applications, and multi-protocol databases — load their dependencies at runtime on-the-fly. Because these libraries are not declared in the ELF binary’s DT_NEEDED header, they are invisible to ldd during installation. Today, we are going to chase the dynamic loading ghost, explore how we solved this with an elegant, highly scalable, event-driven eBPF JIT instrumentation strategy, and battle-test it live on standard, unmodified production binaries like Nginx and OpenSSL! ...
syscalln't 🚫
🤔 What’s a syscall, anyway? Image credits: Mike Norris via Pexels Every time your program reads a file, writes to a socket, or allocates memory, at some point it has to ask the kernel to actually do it. That ask is a syscall, the narrow, well defined boundary where userspace code crosses into the kernel. write(), read(), open(), mmap(), these aren’t just library functions, they’re the entire vocabulary your program has for talking to the outside world. Everything else, fwrite, Python’s file.write(), std::fs::File, is just a wrapper around this same handful of kernel entry points. ...
Mid 2026 recap: coding, conferences, and workshops
📝 Too Long; Didn’t Read We are already at the halfway mark of 2026, and these first six months have been intense. Between coding, conferences, and workshops across Europe, I worked on systems management, green computing, local AI, and software security. This post is a recap of the projects and talks that shaped my February-to-June journey. 🛠️ February to May: deep dive into the Uyuni project For the first four months of this year, my main engineering focus was almost entirely dedicated to the fascinating world of the Uyuni project. If you have not had a chance to work with it yet, Uyuni is an incredibly powerful, completely open-source configuration and infrastructure management solution. It originally started as an evolution of Spacewalk, and today it serves as the upstream community project that feeds directly into SUSE Multi-Linux Manager, which was formerly known as SUSE Manager. ...
How much code are you testing ? (4)
🧭 Where we left off Welcome back to our ongoing series on measuring test coverage for binary programs! In part 1 we used Go’s built-in -cover flag — clean and accurate, but only works if you own the source and can recompile. In part 2 we used valgrind and gdb to trace gzip without touching its source. In part 3 we explored Intel PIN, a proper dynamic binary instrumentation framework — powerful, but it came with a ~100MB proprietary C++ SDK and was limited to x86_64. ...