Blog

Featured

One Strait, Two Corridors: How Türkiye Protected 19.8 Million Tons of Wheat During the Hormuz Shock

The Hormuz crisis that began on 28 February completed its 80th day; the FAO Food Price Index rose for a third consecutive month and fertilizer costs have already mortgaged the 2027 harvest. Türkiye's table tells a different story: a 19.8-million-ton bumper wheat harvest is on the way, 7.2 million tons of imports still flow from the Black Sea, and TMO purchase prices were lifted 35-46%. This piece walks through, from a systems engineer's eye, why Türkiye needed two supply corridors at once and which design choices held up during the 80-day shock.

0 comments 440 views

  • Domestic Chip, 2027 Target: Is ASELSAN's 180 Billion TL Revenue Enough for a New Smartphone?

    0 comments 1609 views

    On Monday 18 May 2026 in Ankara, Türk Telekom and ASELSAN unveiled a strategic partnership for a 100% domestic smartphone targeting a 2027 launch. The domestic processor and long-life domestic battery claims dominated the day's headlines. ASELSAN closed 2025 with 180.4 billion TL revenue and 1.36 billion USD R&D spend; Türk Telekom holds a 550,000-kilometre fibre network and won a 425-million-USD package in the 5G tender. This piece reads the partnership through a computer engineer's eye: is the 100% domestic chip claim realistic, can a domestic brand whose flagship Reeder holds a 0.33% market share against the Qualcomm-MediaTek-Apple triangle stem the 3.03-billion-dollar import bleed, and is JioPhone or Lumia the right template?

    Read more

  • I/O 2026: Is Gemini Spark Quietly Taking Over Your Phone? Antigravity 2.0, Omni World Model & Android XR Glasses

    0 comments 537 views

    At Google I/O 2026, Sundar Pichai formally opened the agentic era. A single keynote introduced Gemini 3.5 Flash, the Spark proactive agent that wants to manage your phone 24/7, the Omni world model, Antigravity 2.0 developer platform, an AI Mode Search overhaul, and Android XR smart glasses. This article walks through each piece from a developer and end-user lens.

    Read more

  • AttackProbes and ThreatScore: Scoring Attack Probes in .NET 10

    0 comments 438 views

    Our origin classifier writes every attack attempt into the dbo.AttackProbes table; the ThreatScore persisted computed column produces a 0-25 score from the formula Severity × Confidence / 20. Forty-nine path patterns, thirteen scanner User-Agent signatures and twelve query-string patterns live in three separate static registries. A probe whose score crosses the threshold of 11 gets the IP auto-blocked; the ones below it fall to a 15-minute burst counter. The table schema, the reasoning behind the scoring formula, the three-layer pattern matching and the RecordAttackAsync classification code — straight from the live bilalkose.com.tr system.

    Read more

  • Cloudflare IP List API: Pushing Bulk IP Blocklists from .NET 10

    0 comments 447 views

    The Cloudflare free plan gives you 5 WAF rules per zone; turn each blocked IP into its own rule and you run dry almost at once. So we don't — one rule points at a Cloudflare List instead, and a list holds 10,000 IPs. Ten lists per account puts the real ceiling near 100,000 addresses behind a single rule. Our .NET 10 service writes every auto-blocked IP into the list with a fire-and-forget push, works around the bulk endpoint's operation_id vs item_id trap, and deletes the list item when the TTL expires. The ICloudflareIpListService interface, the IpBlocklist table and the TTL expirer — full production code from the live bilalkose.com.tr system.

    Read more

  • .NET 10 LTS Production Patterns — A Migration Story

    0 comments 845 views

    On May 7, 2026, I migrated bilalkose.com.tr from .NET 8 to .NET 10 LTS — 6 csproj bumps, 26 Microsoft package updates, 9 custom packages major-bumped, AspNetCoreRateLimit dropped for native AddRateLimiter, AutoMapper 16 ctor adapt, SqlClient TLS defaults. 0 errors + 18 warnings, 10/10 smoke tests. This article walks through the six production gotchas I hit.

    Read more

  • Cloudflare WAF API Custom Rules: Full CRUD Management from .NET 10

    0 comments 1224 views

    Manage Cloudflare WAF Custom Rules from .NET 10 via the v4 API and guarantee the same 4 code-pushed rules + 1 manual exception across pod restarts with an idempotent seeder. An ICloudflareWafRulesService interface backed by typed HttpClient + Polly 429 retry + structured logging avoids the legacy dynamic parsing trap. Six DSL traps, error handling, test strategy and idempotent seed pattern in one place — straight from the live bilalkose.com.tr system.

    Read more

  • PageHits Middleware: Minimal-Allocation Request-Counting Pipeline in ASP.NET Core 10

    0 comments 451 views

    Take the ASP.NET Core 10 middleware that writes a dbo.PageHits row per request and drive its allocation profile near zero: Span<char> for path/UA parsing, IMemoryCache 30-second dedup, fire-and-forget Task.Run INSERT. Under a synthetic 50K req/minute load, Gen0 GC drops from 15% to 2% and P99 latency goes 12ms → 3ms. Full code, dotnet-counters measurements, Span optimization traps and fire-and-forget gotchas all in one — straight from the live bilalkose.com.tr system.

    Read more

  • Cloudflare Edge Security with .NET: WAF + IP Blocklist on Kubernetes

    0 comments 561 views

    If you're running a .NET 10 service on Kubernetes, most attacks can be stopped at the Cloudflare edge before they ever reach your origin. With WAF API integration, IP blocklist push, ASN-based bot detection and a UFW second line, we caught 100% of 157 attack probes at the edge in 24 hours. This post covers architecture, real production code and live metrics — 33% real visitors vs 67% datacenter/VPN/null ASN, 15 auto-blocked IPs, 61% origin CPU drop.

    Read more

  • Origin-Side Security Telemetry with .NET and Kubernetes: Real Visitor Detection

    0 comments 517 views

    If your analytics dashboard shows 100 visitors a day, your real human count is roughly 33. The remaining 67% is datacenter, VPN and null ASN traffic. I'm running a live production system that separates bot from human using PageHits + AttackProbes + IsSuspectNetwork, auto-blocks via a MERGE+OUTPUT sliding-window burst counter, and stores it all with a KVKK-compliant PII-free design for 90 days. Full SQL schema, code and real 24-hour production measurements inside — 246 PageHits backfill, 503 AttackProbes ETL, 9 attack categories.

    Read more