I have two new open-source projects to announce. Both target the same problem from different angles: making it easier to move payment applications that depend on a hardware HSM onto AWS Payment Cryptography (APC). aws-payment-cryptography-hsm-proxy : a Rust TCP proxy that speaks Thales payShield 10K and Futurex Excrypt wire protocols and translates outbound calls to AWS Payment Cryptography.…
I ended Moving from ChatGPT to Claude with "more once I've actually used it." I've used it. The answer isn't simple because chat and coding are different enough to warrant separate conclusions. I'll preface this with noting that these are my observations and not scientific conclusions. Overall Claude's setup friction was real. Claude depends on more non-Anthropic services than you'd expect and…
When I hear companies like Anthropic make claims that they don’t know why AI comes to some conclusion, or they suggest that Claude somehow “resorted to blackmail” to prevent itself from being shut down as featured on 60 Minutes , it makes me feel we deserve a more honest take than we're getting. AI marketing, at least as it exists at the time of this article's writing, is filled with disingenuous…
Update, May 2026: After completing a deeper review of the CyberChef Payments work, I split the project into a small ecosystem. The CyberChef fork remains the implementation/runtime layer, while CyberChef-Payments is now the workflow library and discovery surface. —— I built a set of payment cryptography extensions for CyberChef using Codex. The fork is at github.com/J8k3/CyberChef and there's a…
I’ve been using ChatGPT and Codex for a while and I’m starting to evaluate Claude. No conclusions yet. Getting started was rough. The desktop app would look like it was working and then throw “unable to connect,” and when I tried to subscribe the Stripe payment page wouldn’t load at all. Claude also had an outage around the same time, which didn’t help, but even after recovery things were still…
AWS announced support for Cartes Bancaires in AWS Payment Cryptography. You can read the official announcement here: https://aws.amazon.com/about-aws/whats-new/2026/02/payment-cryptography-cartes-bancaires/ I was not there for the final announcement, but I was heavily involved in the work that made it possible. A large part of that work was audit readiness and making sure the implementation would…
As a manager of software teams, I’ve been asked many times about the transition from building software to managing the people who build it. It’s an existential question for a lot of engineers as they think about career growth: Do I become a manager, or do I stay technical? That framing has always bothered me, because it assumes something I don’t believe to be true: that managing and continuing to…
Note: I originally sketched this post years ago and never finished it. I’m publishing it now as a retrospective on how I think about VPC Flow Logs at scale. VPC Flow Logs: Use Them Intentionally For a long time, the default guidance in AWS environments was simple: enable VPC Flow Logs everywhere. At small to moderate scale, that advice is usually fine. At large scale, it becomes expensive, noisy,…
Note: I originally wrote this post in 2017 but never published it at the time. Please note that the AWS certification landscape has changed significantly since then; this is provided strictly as a historical reference. Another year another re:Invent. This year at re:Invent 2017, because my associate was up for renewal again, I decided to sit for the AWS Solutions Architect Professional Exam. The…
AWS announced AWS Payment Cryptography is now available in the Asia Pacific (Sydney) Region. You can read the official announcement here: https://aws.amazon.com/about-aws/whats-new/2025/12/aws-payment-cryptography-in-sydney/ This was a particularly difficult launch. Not because of one major issue, but because there were a lot of moving pieces all happening at once. Hardware deployment issues,…
AWS announced Multi-Region Keys in AWS Payment Cryptography. You can read the official post here: https://aws.amazon.com/blogs/security/multi-region-keys-a-new-approach-to-key-replication-in-aws-payment-cryptography/ This was a meaningful launch because it crossed one of the boundaries AWS takes very seriously: Region isolation. Replicating payment cryptographic keys across Regions meant moving…
AWS announced the launch of AWS Payment Cryptography this week, and I’ve had the opportunity to lead the service from its earliest definition through production launch. The official AWS announcement is here: https://aws.amazon.com/about-aws/whats-new/2023/06/aws-payment-cryptography/ . This was one of those projects where the hard part was never just building software. The challenge was defining a…
The AWS Key Management Service (KMS) provides a capability to manage encryption keys with transparent integration to many other AWS services. Of particular significance is transparent data at rest encryption for the AWS Elastic Block Store (EBS) service. When using KMS encryption, the data stream from the underlying storage medium is encrypted/decrypted at the hypervisor level. KMS is a regional…
The cloud market continues to get more competitive. AWS built its early success by winning developers first. Startups and builders were willing to take risks, move fast, and trust new platforms if those platforms made their jobs easier. AWS became the default choice because it gave developers access to infrastructure and services that previously required enormous capital, time, and operational…
*** NOTE: AWS has pulled this specific certification version, refunding those who took the original beta exam. *** 2026 Status Update: The AWS Certified Security - Specialty is now a mature, standard certification. While the beta period mentioned below ended years ago, the core focus on deep-dive security across IAM, Encryption, and Incident Response remains the primary objective of the current…
Implementing the Amazon Cognito User Pool Admin Authentication Flow with AWS SDK For .NET offers a path to implement user authentication without management of a host components otherwise needed to signup, verify, store and authenticate a user. Though Cognito is largely framed as a mobile service, it is well suited to support web applications. In order to implement this process you would use the…
For those of us that are .NET developers at heart, we have powerful tools for running serverless C# applications on AWS. AWS Lambda now officially supports .NET 10 as a managed runtime, providing long-term support (LTS) through November 2028. Modern C# support in Lambda has evolved beyond early .NET Core. Developers can now utilize C# File-Based apps , which eliminate much of the traditional…
Note: The US Government cloud security policy landscape has changed significantly since this was originally written. I no longer have the first-hand, current context required to provide a meaningful update to this information, so please treat the following as a historical reference. The Federal Information System Management Act (FISMA), a US Law signed in 2002, defines the information protection…
Looking for a quick and easy way to query an Amazon Redshift Database Cluster? I was and the first place I turned was to my favorite tool for this kind of thing, Linqpad . I was a bit dismayed to find that none has developed, that I could find, a Linqpad database driver for Redshift. Small note, there are a few Postresql options and Redshift is supposed to be Postresql compatible however, none of…
CloudWatch includes a powerful feature that enables auto recovery of an EC2 instance if it ever fails a system status check. A key benefit of this feature is that it relaunches an instance with the exact same configuration, preserving any auto-assigned public IP addresses and using the current instance volumes. Modern Update (2026): Automatic recovery is now supported for most deployed Amazon EC2…
Automating EBS snapshots is a critical part of maintaining a resilient infrastructure. Below is a simple Python Lambda function that identifies all volumes attached to an EC2 instance and creates a snapshot for each. Modern Update (2026): While custom Lambda scripts like this one are great for specific logic, AWS now recommends using Amazon Data Lifecycle Manager (DLM) for standardized snapshot…
While newer versions of Windows Server (2022/2025) have improved, installing .NET 3.5 still frequently fails because the payload is not part of the local Side-by-Side (SxS) store. The easiest way to solve this is to point the installer to the original installation media. 2026 Update: This method remains the gold standard for Windows Server 2022 and 2025 . If you are in an air-gapped or…
If you're working with a Windows Server 2012/2012 R2 server that has had DISA Security Technical Implementation Guide (STIG) mitigations implemented and attempting to promote that server to a domain controller, you will very likely encounter an error that forces the server to reboot automatically. If you see "A critical system process, C:\Windows\system32\lsass.exe , failed with status code…
*** UPDATE: This project was migrated from CodePlex to GitHub *** Obtaining Your Amazon SES SMTP Credentials can be more confusing than one would think. If you find yourself having difficulty authenticating to SES with the credentials that you got from the AWS Console, fret not, it's likely a simple fix. It is possible to create an IAM user both from the IAM and SES area of the Console. Depending…
I've found myself wondering on more than one occasion if a network issue I'm having is a result of security configuration (Routing Rules, Network ACLs, Security Groups) or something else entirely. To solve this, I originally wrote a network modeling tool to trace traffic flow from a source to a destination, simulating security evaluation at each hop. Deprecation Notice (2026): This custom tool is…