Learning about fine audio synchronization with AI
DSPs can delay speakers in the same zone in a way that hurts to hear. With GCC-PHAT and MLS "noise", you can locate delays down to microseconds of precision.
Levi's Writings
A web application security, web infrastructure, and cryptography focused blog
Latest posts
The broken promise of PRDs, specs, and get shit done
Treating the tools we have like mindless zombies that follow specs won't deliver results.
Claude Code is not safe to use right now
Opus has broken as essential contract as a coding partner. It breaks my code and has broken my trust.
The State of Large Language Models in Q2 2026
The facts about large language models and the terminology to follow along in conversations about AI.
When will multimodal generations truly bamboozle me?
AI video lacks long-form consistency due to the non-portability of its latent space. True realism requires versioned extraction and reproduction.
Cloudflare's AI offerings are [no longer] a joke
Workers AI catalog [was] stale, so I switched to OpenRouter for affordable, reliable inference. It's much less disappointing that way.
It's not the compute, it's the memory bandwidth
We're not held back by the speed or quantity of logical compute. It's the bandwidth of getting bytes from memory that's holding us back.
Notes from 2026 Open Confidential Computing Conference
This year OC3 made Confidential Computing finally feel real. CC is the next thing that model creators and hardware and platforms will research and deploy next.
Font Range Detection with Noto
Supporting multi-lingual text without system font substitution takes a little effort. Here's how to scan fonts and build your own lookup table.
NPM is Case Sensitive. GitHub isn't!
My GitHub action couldn't deploy to an NPM repo because the trusted publisher configuration is case sensitive
Coming soon to Chrome and Safari: WebAuthn related origins
Related origins allow websites that change domains over time or that operate across many to share the same passkeys. Browsers should support it later this year, which may solve the passkey problem X / Twitter has.
Protecting Single Page Applications from Web Skimming on Amazon CloudFront
PCI DSS V4 has new requirements to prevent web skimming on payment pages. Here is how I am tackling that requirement with content security policies and subresource integrity.
Anxiety-Driven Development
Software releases can be fast, predictable, and high quality when engineered with anxiety and empathy. This approach works well for individuals that own the research, development, and release of software.
Audience Verification
Audience verification is an important check to prevent tokens intended for other services being used against yours. I fixed a vulnerability with Facebook tokens.
Erik Paul Nielsen - July 13, 1978 - June 22, 2023
Erik Paul Nielsen has passed. He supported and influenced me professionally.
Experimental WebAuthn PRF Extension Demonstration
A new experimental WebAuthn extension enables web technologies to offload key material sourcing and storage to affordable security keys. Inside is a demonstration of the draft WebAuthn PRF extension.
Converting Fonts to WOFF2 for the web
A quick note to self: How to convert TTF fonts to WOFF2 with specific unicode ranges
New Personal Blog
Starting up a new blog!
I might have a few interactive experiments here and there.
To start, here's some JS that generates a copyable password!
Also, it turns out CSP can't stop browser extensions. Be warned.