Blog
Articles, guides, and notes on software engineering.
Designing Engineering Management as a "Deck"
Don't let management practices—1on1s, OKRs, review rules—pile up as a loose collection. A way to design them as one system (a deck) around the quality and reproducibility of decisions, and the conditions that turn a practice into an outcome.
Recent Posts
Hands-On API Learning
Hands-On API Learning
Beyond Vibe Coding
Beyond Vibe Coding
Context Engineering
Context Engineering
How to Craft an Engineering Strategy
How to Craft an Engineering Strategy
Good Code, Bad Code
Good Code, Bad Code
Prompt Engineering for LLMs
Prompt Engineering for LLMs
The Work of a Senior Engineering Leader
The Work of a Senior Engineering Leader
Simplicity: Sustainable, Humane, and Effective Software Development
Simplicity: Sustainable, Humane, and Effective Software Development
The Book You Wish Your Parents Had Read
The Book You Wish Your Parents Had Read
Thinking in Systems: A Primer
Thinking in Systems: A Primer
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
Explains where to store access tokens in an SPA (the danger of localStorage), a BFF + session design that keeps tokens out of the browser, and why starting token-less is often enough.
What is the Big Picture of Service-to-Service Authentication? mTLS, Token Exchange, SPIFFE, and Zero Trust
Organizes service-to-service authentication in microservices across three layers: network, token, and identity foundation. Covers mTLS, Token Exchange (RFC 8693), SPIFFE, Zero Trust (NIST SP 800-207), and BeyondProd.
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
What is Dynamic Client Registration (DCR)? An Introduction to RFC 7591 and 7592
Explains Dynamic Client Registration (RFC 7591) and Client Registration Management (RFC 7592), which register and manage OAuth clients via an API. Covers the registration endpoint, registration access token, and security considerations.
OIDC Logout and Security Event Token (SET)
Explains OpenID Connect Front-Channel Logout and Back-Channel Logout, and how the Security Event Token (RFC 8417 SET) enables session revocation and event notification.
Access Token Validation and Revocation: Introspection, JWT AT, and Revocation
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.
What are OpenID Connect Discovery and Metadata? Auto-configuration and Key Retrieval
Explains the role of the OpenID Connect ID Token and how Discovery (OpenID Connect Discovery / RFC 8414 AS Metadata) enables auto-configuration and public key retrieval, including key rotation via jwks_uri.
What is OAuth 2.1? Changes from OAuth 2.0 and the Security BCP (RFC 9700)
An overview of the changes from OAuth 2.0 to 2.1 and the security measures shown by RFC 9700 Security BCP and RFC 6819 threat model. Covers mandatory PKCE, deprecation of the Implicit grant, Mix-Up defenses, and more.
What is JOSE? An Overview of JWT, JWS, JWE, JWK, and JWA
An overview of the JOSE family (JWT/JWS/JWE/JWK/JWA). Learn the difference between JWT and JWS, the 3-part signed structure and 5-part encrypted structure, and how JWT BCP (RFC 8725) prevents alg confusion and none attacks.