Just stuff I get interested in, and need to express to the world.
Once a year I open a form with four boxes on it. Each box is a competency the company has decided to grade me on: Influence , Teamwork , Results Focus , Customer Focus . I’m supposed to write a paragraph in each about how I embodied it, attach evidence, and hand it to a manager who will argue it in a room against other managers arguing for other people. I have filled this form out enough times to…
Last time I built a fleet-wide go mod why — build-time SBOMs loaded into a graph, so I could ask where an interesting dependency enters a fleet and along which paths. Pointed at gopkg.in/yaml.v3 and CVE-2022-28948 , it gave a clean answer: repos_naming_it, repos_reaching_it, repos_actually_importing_it 8, 7, 1 Seven repositories affected. One — platform-telemetry — actually contains the import…
There’s a moment every Go developer has had. Something shows up in go.sum that you didn’t ask for, or a scanner flags a package you’ve never heard of, and you type the one command that makes it make sense: $ go mod why -m gopkg.in/yaml.v3 # gopkg.in/yaml.v3 example.com/fleet/svc-checkout/cmd/svc-checkout example.com/fleet/platform-httpkit example.com/fleet/platform-telemetry gopkg.in/yaml.v3 There…
Part of my job is answering a question that doesn’t have a number: is this developer growing? Not “are they busy.” Busy is easy to see. The people I mentor are early in their careers, and what I actually need to know is whether their work is changing shape over time — whether someone who started the quarter writing solo commits to their own sandbox is, six months later, opening pull requests…
You have agreed to thousands of pages of contracts you never read. So have I. We clicked the button: End User License Agreement …the Licensor reserves all rights in and to the Licensed Application not expressly granted to you. You may not use, copy, reverse-engineer, disassemble, attempt to derive the source code of, modify, or create derivative works of the Licensed Application, any updates, or…
You know the invite. It lands on a Tuesday afternoon: Sync Friday, July 10 · 3:00 – 3:15pm quick chat No location No guest list · No organizer Yes No Maybe Fifteen minutes, no agenda, no attendees you can see, no idea what “sync” means or what you’re supposed to bring. It could be a layoff. It could be someone asking where a config file lives. You have three buttons — Yes , No , Maybe — and not…
The password is the worst idea in security that absolutely refuses to die. Every few years someone announces its death, and every year there are more of them. So instead of killing it, we’ve spent forty years making it less catastrophic to store — each step a reaction to how the previous step got broken. It’s one of the cleaner examples of security evolving by autopsy. I want to walk that history,…
Every password login you have ever written has a dirty little secret: the server sees the password. Maybe only for a few microseconds, maybe only long enough to run it through bcrypt and throw it away — but it sees it. It’s in a request body, it’s in memory, it’s one stray log.Printf away from a breach report. OPAQUE breaks that assumption. It’s an asymmetric password-authenticated key exchange…
Last post I built up an AWS Nitro Enclave that generates an ed25519 signing key it won’t let anyone read, serves it over TLS, and proves — by attestation — exactly which code is holding that key. We ended with an encrypted channel to a box we can trust, and a public key we’ve verified. Now the cheeky part: getting git to sign with that key, without patching git , without a custom credential…
Eleven years ago I told everyone to use GPG to sign things. I still think signing is good. What I’ve soured on is where the key lives . Your commit signing key is sitting in ~/.ssh or a GPG keyring on the same laptop that runs npm install against the entire internet. The signature proves the commit came from your machine . It does not prove it came from you , and it definitely doesn’t prove the…