Designing Engineering Management as a "Deck"
# Introduction
bmf-tech
Latest posts
Prompt Engineering for LLMs
I read [Prompt Engineering for LLMs](https://amzn.to/3TmcN4h).
Good Code, Bad Code
I read [Good Code, Bad Code](https://amzn.to/44Xjuwa).
Context Engineering
I read [Context Engineering](https://amzn.to/4fCkdHR).
Thinking in Systems: A Primer
I read [Thinking in Systems: A Primer](https://amzn.to/4wmhbyF).
Beyond Vibe Coding
I read [Beyond Vibe Coding](https://amzn.to/4pRepze).
Hands-On API Learning
I read [Hands-On API Learning](https://amzn.to/3Tp7EIL).
How to Craft an Engineering Strategy
I read [How to Craft an Engineering Strategy](https://amzn.to/3RCnVcz).
Simplicity: Sustainable, Humane, and Effective Software Development
I read [Simplicity: Sustainable, Humane, and Effective Software Development](https://amzn.to/4x7sD1k).
The Book You Wish Your Parents Had Read
I read [The Book You Wish Your Parents Had Read](https://amzn.to/4x58qsP).
The Work of a Senior Engineering Leader
I read [The Work of a Senior Engineering Leader](https://amzn.to/4wYFMJY).
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
# Overview
What is the Big Picture of Service-to-Service Authentication? mTLS, Token Exchange, SPIFFE, and Zero Trust
# Overview
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
# Overview
What is Dynamic Client Registration (DCR)? An Introduction to RFC 7591 and 7592
# Overview
OIDC Logout and Security Event Token (SET)
# Overview
Access Token Validation and Revocation: Introspection, JWT AT, and Revocation
# Overview
What are OpenID Connect Discovery and Metadata? Auto-configuration and Key Retrieval
# Overview
What is OAuth 2.1? Changes from OAuth 2.0 and the Security BCP (RFC 9700)
# Overview
What is JOSE? An Overview of JWT, JWS, JWE, JWK, and JWA
# Overview
Reading Platform Engineering Through Systems Thinking
## Why This Lens
Systems Thinking Basics: Seeing the World as Stocks and Feedback
Many problems resist us. A fix backfires, or a symptom returns once the cause looks gone. Systems thinking is a way to handle these stubborn problems.
Maybe Postgres Is Enough: Check Postgres Before Adding Another Database
# Overview
You add Redis for caching, Elasticsearch for search, and Sidekiq for jobs, and soon your app depends on many datastores. Each one needs its own deployment, backup, monitoring, and incident ...
Comparing API Styles: REST, GraphQL, gRPC, Webhooks, WebSocket, and Messaging
# Introduction
'API' covers more than one communication style.
Comparing Real-Time Web Communication: Polling, SSE, WebSocket, WebRTC, and WebTransport
# Introduction
On the web, you often need to push data from server to client right away.
Search
Cryptography Fundamentals: Symmetric, Asymmetric, One-Way Functions, Hashing, and Digital Signatures
# Introduction
HTTPS, SSH, and JWT all rest on cryptography for their security.
When to Use GraphQL: Adoption Criteria and Trade-offs
# Overview
GraphQL is a query language for APIs that lets a client fetch exactly the data it needs, in the shape it needs. This article organizes GraphQL at the level you need to make an adoption deci...
Cryptography in Practice: TLS, JWT, and SSH
# Introduction
This is Part 3, the final part of the cryptography series.
When to Use gRPC: Adoption Criteria and Trade-offs
# Overview
gRPC is an RPC framework from Google that has gained traction for service-to-service communication. This article organizes gRPC at the level you need to make an adoption decision: when to c...
Key Exchange and PKI: Diffie-Hellman, Certificates, and Certificate Authorities
# Introduction
This is Part 2 of the cryptography series.
Three Uses of a Public Key: Signing, Encryption, and Key Exchange
# Introduction
Modern authentication and security, including HTTPS, SSH, JWT, and passkeys, rest on public-key cryptography.
What is sqlc? A Practical Introduction to Type-Safe SQL in Go
# Overview
When you work with SQL in Go, the standard `database/sql` package forces you to write a lot of boilerplate, while an ORM hides mistakes until runtime. sqlc fills the gap between these two a...
What Is the TCP Three-Way Handshake?
# What Is the Three-Way Handshake?
The three-way handshake is the procedure where a client and a server establish a connection before they start communicating over TCP. Through three packets (SYN → SY...
Comparing Data Transformation Methods: Encoding, Serialization, Encryption, Hashing, Compression, Compilation, and Parsing
# Introduction
'Data transformation' covers a lot of ground, and the goals vary widely.
Comparing API Versioning Strategies: Path, Query, Header, and Payload
This post compares four common approaches to API versioning.
What Is EventStorming
# Overview
What Is AI-DLC (AI-Driven Development Life Cycle)?
## Introduction
If You Want Managed Certificates for an Internal LB's HTTPS, the Domain Must Live in Public DNS
While designing a setup to secure internal VPC traffic (a call from one app to another app's internal API) with HTTPS, I wondered: 'Couldn't the certificate's domain just be a private domain handed ou...
bmf as a Service
A list of services I offer as an individual. All requests go through the contact form.
Into the World of Systems Thinking: For Software Engineers Who Keep Thinking in an Increasingly Complex Era
[Into the World of Systems Thinking: For Software Engineers Who Keep Thinking in an Increasingly Complex Era](https://amzn.to/3RoYuuK) is a book I read.
Production-Ready Microservices: Building Standardized Systems Across an Engineering Organization
[Production-Ready Microservices: Building Standardized Systems Across an Engineering Organization](https://amzn.to/4wK5aUk) is a book I read.
Accidental Complexity and the Absence of Decision Records
## Introduction
My Career Vision as of May 2026
# Introduction
Three Common Patterns for Distributed Transactions — 2PC, Saga, and Outbox
Once you adopt microservices, you almost inevitably run into the question: **how do you keep writes consistent when they span multiple databases, or span a database and a message broker?** This articl...
Product Management in Practice, 2nd Edition
[I read Product Management in Practice, 2nd Edition](https://amzn.to/4efiHwy).
Architecture Modernization: Socio-technical alignment of software, strategy, and structure
[I read the Japanese edition of Architecture Modernization by Nick Tune et al.](https://amzn.to/4w4239F) (originally published by Manning).
パスキーのすべて: Adoption, UX Design, and Implementation
[I read パスキーのすべて ―導入・UX設計・実装](https://www.amazon.co.jp/dp/4297146533).
The Crux: How Leaders Become Strategists
[I read The Crux](https://amzn.to/4eaGfTa).
Fundamentals of Software Architecture, 2nd Edition: An Engineering Approach
[I read Fundamentals of Software Architecture, 2nd Edition](https://amzn.to/4ufbukz).