Recent content on allan.reyes.sh
Sometimes I’m AI-pilled and want to AI all the things, all the time , and sometimes I need to take a cold shower and remind myself that these are powerful tools that can wreak havoc in a multitude of ways, perhaps most importantly on what makes humans, human. Here’s an evergreen list of articles—and one quote from each—that ground my enthusiasm around AI and help me be a responsible…
"This is the blog version of a talk I gave at LocoMocoSec 2024. It’s mostly a lightly edited transcript with some screenshots, so if you’d prefer, you can watch the video or just flip through the slides ." This post is about how to keep secrets out of logs, and my claim is that (like many things in security) there isn’t a singular action or silver bullet that lets you do this. I…
I really like lists! I also really like mental models . This post is about both. I use “mental models” quite loosely here: any kind of model, law, idiom, aphorism, etc. that helps me take something about how the world works and capture, compress, and distill it down to something named. They’re like pointers in an index that help me retrieve and recall the right page (and the…
Hello! In the previous post, I covered tainted types as the second of a domain primitives series . Tainted types helped us package dangerous user input into a value object to ensure that all the areas where it propagated to are handled correctly. We’ll extend the value object concept to create a container for sensitive data. It’s one of my favorite domain primitives. They are fantastic…
Welcome! In the previous post, I covered branded types as the first of a domain primitives series . Where branded types helped us ensure upstream code is correct, we can flip the script and use another type of domain object (specifically, a value object ) to ensure that downstream code is correct. As the adage goes, “always validate user input!” We can “taint” user input as…
Code that handles bare string primitives with important semantic and security concerns isn’t using the type system to its fullest extent. —Brendan Eich, probably This is the first post of a series on domain primitives that show how they lay a secure foundation for software. I’ll discuss alternatives to string primitives using an Express web server written in TypeScript as an example,…
Most services and systems that provide webhooks often lack a critical feature: telling you when it’s been changed or shut off. This is a particularly fragile and dangerous setup if you rely on receiving these events for rare but critical events. It might seem obvious, but I see this missing everywhere , and I wish that weren’t the case! On Telling Let’s say you’re using…
This is an “evergreen” page that I’m backfilling from reading notes and keeping updated moving forward. I distill and compress the #1 thing I learned or took away from various pieces of literature (except books, but feel free to check out my reading pipeline ). It’s far from perfect: run-on sentences galore to fit into the arbitrary one-sentence restriction. Nonetheless, I…
👇 Enough blabber? Jump down to courses or degrees . These courses were offered mostly by Coursera , edX , Udacity , (free) and Georgia Tech , with the latter spanning three masters programs (paid). Topics were mostly in computer science, machine learning, data analytics, and security. I want to be clear right out of the gate: I took way too many courses, and I do not recommend to others to follow…
"Hi! I hope this standard letter saves us both some time, which we could all use a little bit more of these days." 👋 Thanks for reaching out. I’m always open to hearing about new and exciting opportunities and what amazing things that people are building. I do get a high volume of recruitment emails, and I totally acknowledge and am thankful for how lucky I am to be in that position.
"You’ve stumbled on my user manual !" I’m a father, software engineer, and veteran. The first one is most important—I love those little kiddos! But also, if you ever hop on a call with me and hear utter chaos in the background, just know that I am barely holding it together . While I enjoy working on security and reliability, I’m an avowed software generalist that loves…
A list of books in various stages of my reading pipeline. There are no affiliate links. Also see: complementary lists for courses and papers, articles, and talks . Currently Reading Patterns of Enterprise Application Architecture On the Radar Algorithms to Live By Design Patterns (GoF) Practical Object-Oriented Design using Ruby The Pragmatic Programmer Programming Ruby Snoozed Crafting…
"Hi! I’m Allan. I build and break software." I am a software engineer with a penchant for security, reliability, and devops. You can learn more about me from my leadership philosophy or reading list . Work A Healthcare Software Company (2025-present). for details .
YAML Ain’t Markup Language (YAML) is a human-readable data serialization language, and if you ever try to abbreviate “Norway,” you just might run into a surprising outcome. Here’s an example: NI : Nicaragua NL : Netherlands NO : Norway # boom! Does it work? NO|No|no, but not “NO”. NO is parsed as a boolean type, which with the YAML 1.1 spec , there are 11 ways…
At best, it represents who you are and what you can deliver as a leader, and at worst, it’s a contract for what you aspire to be. I first wrote down my leadership philosophy about a decade ago by writing down all the values and practices I embraced. At the time, every great leader and commander I served with had a written philosophy—so, I thought I should craft one myself. It changed a lot since…
Wow! I love your app because I start out completely useless. I’m fumbling up this learning curve and I have no idea what I’ll be able to do once I spend the time to master it! — no user ever Start your users with this feeling: Credit: reddit …before you start them at level 1:
I do not employ analytics, trackers, affiliate links, or page view counters. Ain’t nobody got time for that . If you do happen to find something that violates that privacy statement, reach out to me so I can fix it, because it’s likely a programming mistake. While I don’t personally collect anything, this site is hosted using GitHub pages , so you should check their privacy…