Recent content in Home on Sauvik Biswas
I joined my current startup as a founding engineer after spending years at large organisations—first at Airbus, and then at VMware (now part of Broadcom). One of the biggest mindset shifts was understanding what “speed” really means in an early-stage startup. A startup that hasn’t yet found product-market fit must constantly validate its product and assumptions with potential…
(In the voice of Internet Historian ) “Opinion? What are opinions?” I’ve seen enough engineering and product fights. You probably have too. It usually starts with a proposal and ends with it being held hostage in meeting-room limbo because two brilliant people have two diametrically opposed, deeply passionate positions. And sometimes, it gets even worse. They will discreetly…
Why resource binding alone is not enough # v09 binds each access token to a named API at mint time. The client sends resource on authorize and token; the auth server sets JWT aud (or introspection aud ) to that URI. Gated routes on the resource server reject tokens bound to the wrong API. That fixes which API may accept a given token. It does not fix who may present the token, or how a middle tier…
Why a generic access token is not enough # v08 replaced the shared JWT_SECRET with RS256 + JWKS. Verifiers fetch public keys and check signatures. That fixed the question of who can forge tokens. It did not fix the question of where a token may be used. In v08, Mode B access tokens carry a hard-coded audience: { "aud" : "resource-server" , "iss" : "auth-server" , "sub" : "user0" } That string is a…
Why verify-only apps shouldn’t hold the signing key # v07 added OpenID Connect on top of v06’s split architecture. The id_token is a signed JWT. Mode B access tokens are JWTs too. Both used HS256 with a shared JWT_SECRET copied into three .env files. That worked in a toy lab. It is not how production IdPs ship. Concern v07 (HS256 + JWT_SECRET ) v08 (RS256 + JWKS) Who can sign tokens?…
A deliberate pause # v07 is in the repo. It consists of OpenID Connect on top of the v06 split; i.e. id_token , discovery, UserInfo, nonce , and the openid scope; while keeping v06’s opaque-or-JWT access-token modes. The runnable snapshot is versions/v07-openid-connect/ . In my opinion, that is a lot of ground for seven incremental snapshots. I started drafting this market-research post…
Why v06 is not enough # v06 split the authorization server from the resource server and taught token validation across process boundaries. That is production-shaped OAuth 2.0. It is not OpenID Connect. Vendors market themselves as OpenID Providers because OIDC standardizes authentication (who logged in) on top of OAuth’s authorization (what APIs this token may call). While technically…
Why a second validation mode # v06 split the authorization server from the resource server and taught the default way a separate resource server trusts a token it never issued: introspection (Mode A). On every GET /api/me , the resource server sends the opaque Bearer token to POST /introspect on the auth server and gets back active , sub , and exp . That works, but it has a cost: a network hop to…
Why v05’s single process is not the finish line # v05 closed the refresh loop: short-lived access tokens, silent renewal via grant_type=refresh_token , and a protected GET /api/me . One convenience hid an architectural lie. In v05, the authorization server and resource server share one Flask process on :25000 . The client calls the same host for POST /token and GET /api/me . Token minting…
Why v04 was not the finish line # v04 closed the loop through a protected API: the client app stores an access_token , calls GET /api/me with Authorization: Bearer … , and shows a profile page. Login means the token works and the resource server agrees. That token has a TTL. v04 minted access tokens with expires_in: 3600 . In production, short-lived access tokens are deliberate: if one leaks,…
Why v03 was not the finish line # v03 closed the authorization half of OAuth: state for CSRF, PKCE for code interception, and POST /token to mint an access_token . After a successful login, the callback page displayed that token as a string. That is a useful checkpoint. It is not a complete application experience. The token is supposed to be a credential. Something has to accept it and return data…
Why v02 needed a fix # v02 closed the login CSRF hole. The client generates random state , the auth server echoes it on the callback, and the client rejects mismatches. That answers: “Did I start this login?” It does not answer a different question: “Is the person trying to redeem this code the same app that requested it?” The authorization code itself is a secret, but for…
Why v01 needed a fix # v01 got the Authorization Code redirect working, but it deliberately left out OAuth state . That absence is fine for learning the spine of the flow; it is not fine for anything you would ship. The next piece to add is a mechanism to stop CSRF (Cross-Site Request Forgery). CSRF is when a site you are on tricks your browser into making a request you did not mean to make. The…
A preamble # What is my motivation behind this # Andromeda has been working on creating a comprehensive solution around Agents. If we look past the hype, the buzzword, and the scepticism, Agents and Agentic AI are here to stay and security is a real concern. Anthropic came up with an initial specification for something called Model Context Protocol (MCP) , which has eventually become a standard.…
A problem in production # A couple of days ago, our stack saw a massive rise in WAL. As a side effect, we weren’t seeing Debezium emit CDC messages to Kafka, which in turn affected some critical workflows from advancing. This was not the first time this had happened. One idea that was thrown around was to limit the tables Debezium subscribes to. However, that doesn’t help. Limiting…
Previous Post: A naive implementation of file-based storage It was impossible to not come across B-Trees or any of the variants (B+Trees) if I had to implement a database. I hadn’t studied this data structure before. Understanding the use case # At its core, B-Trees are multilevel indices for data stored in a database. A good introductory video of its structure and usage can be found here:…
The Broken Ear is the first book with a preconceived plot. In the previous serialisations, Hergé had covered the four cardinal directions—Soviet in the North, Congo in the South, America in the West and China in the East. His approach to stories had changed much after his chance encounter with a fellow artist, Chang. He started using a notebook to jot down plot points, notes, sketches and…
Previous Post: YetiDB: an academic exercise We have a basic implementation of four interfaces— Record . This is the unit of data that can be written or retrieved. Since we are using protobufs, a protoc plugin protoc-gen-go-yeti generates the additional methods that will conform a protobuf to adhere to the Record interface. Driver . A driver holds the connection to an underlying database engine. At…
Over the last couple of years I have seen protobufs being used not only as a means to serialize and deserialize data for transport over network but also as a means to implement a type system, business logic, version control, storage schema, and what not. These often require authoring some sort of custom options (extensions) for the protobuf messages, and writing code that can parse these options…
Goecha-La was my first trek. Back in 2008, me and my friends made an attempt to reach there. Poor planning, poor fitness and general lack of awareness of what a trek entails resulted in a hilarious and failed trip. I haven’t shied away from documenting that embarrassing piece of history. If you are interested, please have a read . Some of my friends (Rajdeep, Akash, Mayank—all ex-colleagues…
Day 0: Preparing for Udupi # 24th December, 2022 I rode all the way from my house to Mittal’s, where we both dismantled and packed our bicycles with bubble wrap, duct tape, some cardboard, and Styrofoam. It took us over two hours to do so—mostly because we didn’t have everything in place. I had packed the following for my trip—2 jerseys, 2 bibless shorts, 1 bermuda short, 1 t-shirt, 2…
Every week at farmer’s market She sets her bench with jars for sale Blueberry jam on a blue tarp Come rain or shine or snow or hail. Thirty winters perfected her Recipe—consistent, precise. Blueberry jam sealed in her jars— She sells them at nominal price. “My boy is doing well in school. My boy has topped his class this time,” Seventeen years ago she said With pride that caused her eyes to shine.…
It feels strange to write a retrospective of the year that was after one-and-a-half months of 2022. It has been a significant year in my life. There were three things that marked important changes in my life. Living with my mom after two decades # I had left my parents’ house in 2002 to pursue my undergraduate degree in Aerospace Engineering at IIT Kharagpur. That was right after my senior…
A writer trembles in a coat that’s too thin On frosty platform that's foggy and dim. Flickering tungsten lamp shivers along. A shadow wearing an overcoat long Approaches him, “Need a cigarette? Ten-thirty today is running quite late.” “Some six years ago I had called it quits But sometimes I give in,” Writer admits. “I am a salesman,” Shadow clarifies, “That was not free. Had you thought…
“I don’t think you can backpack in that condition,” Nitesh, my seasoned backpacker friend warned me. He was right. I was overweight and lacked even the basic stamina to climb a flight of stairs, let alone sustain a multi-day trip with a loaded backpack in the mountains. In no uncertain terms, he reminded me that if I wanted to travel with him and enjoy the trip, I had to lose some weight. I still…
My troubled mind wanders—lost in a troubled state; My peace is the apathy for future outcomes— Apathy for the future is so hard to inculcate. There’s calm before the storm—I let my mind meditate. Impending cloudburst a falling droplet welcomes. My troubled mind wanders—lost in a troubled state. My heartbeat chooses to race with the pace of fate. With each pace, more fickle, arrhythmic it becomes—…
Due to an oversight by my Hotel’s manager, I had no reservation to Guwahati. He was unable to contact any of the drivers last night. Like most people in the hills, they had gone off to sleep early. I woke the Hotel’s manager up at 5:00 am in the morning and walked towards the Sumo counter. In reality, one or two seats are always empty in each vehicle and the booking agents at these…
Dawa came to see me off for one last time in the morning. It was unusual of him to wake up that early. We both had our morning tea with Sangi Thema before bidding them goodbye. Bomdila is situated at a higher altitude than Dirang. Our Sumo snaked its way up through the switchbacks and military settlements for the next hour or so to reach the Sumo terminus opposite to Bomdila Stadium. These Sumos…
In the next two days, Dawa took me to three villages—Chug, Sangti and Thembang. Chug and Sangti # Dawa wanted to show me Chug. It’s slightly inwards from Rama Camp and is famous among Dirang locals for its picnic spots. He had not been there before and had only seen images shared by his friends. When we reached there, we realised that we came at the wrong season. Instead of the beautiful…
Dawa slept till 10:00 am. I should have asked him about his bed timings last night itself. When I called him early in the morning, he didn’t pick his phone up. Since I was already outside, I had my morning tea and paratha for breakfast at the market. Once I was done, I walked from chaarnala up towards Dirang Monastery. It was one of those bright buildings visible from the market itself.
That morning I was contacted by the Sumo driver. Although Sumos from Tawang to Bomdila usually left at 6:30 am, the one in which I had booked a seat was delayed due to the cold. He asked me to wait in front of Laxmi Hotel at Jang. The Sumo would anyways stop for breakfast there. Later, while crossing Jang checkpost, the military man in charge of the books checked the passengers asked me when I had…
Jang is mostly known for its military check-post and Nuranang Falls. I had already paid a visit to the former where I had to do my COVID-19 test a week ago. This time I wanted to visit the latter. Nuranang Falls # After having puri and tea for my breakfast at Laxmi Hotel nearby, I descended down into the valley, hiked past Siddharth School, Jang Bazaar Line and the farmlands of Kharsa before…
For the next one-and-a-half days I walked around Tawang and visited a number of places while spending time with the kids at my hotel. I was not able to notice the Gompa that one spots in the Old Market the day I had arrived. It was too dark to notice anything. It is one of those places that is hard to miss in broad daylight as it is adjacent to the bus and the Sumo stand. The previous day I had…
I woke up quite early that day to catch a glimpse of the morning sun. Akash and the other kids were awake, too. I shared the morning tea with them. Amit, Lobsang and a neighbouring kid Ranveer—being kids that they were—headed to the terrace and played in a greenhouse made of bamboo and translucent plastic. The inside—filled with a number of potted plants, none of which had flowered, yet—was very…
The three markets in Tawang are closed on three different days—Old Market on Tuesday, Nehru Market on Wednesday, and New Market on Thursday. Most eateries remain open all throughout the week—especially those serving breakfast. Most of these breakfast joints either serve puri or paratha for breakfast and are geared towards the working class. Aesthetically, they might not be the best of places, but…
Journey from Tezpur to Tawang # During this pandemic, the authorities are not allowing more than five passengers in a shared Sumo. However, none of the operators care about that rule in spite of charging nearly double the usual price for a trip. One of the reasons is that they are not able to get enough passengers to make a profit from the trip. The operators often club passengers who are headed…
Tezpur (and its district Sonitpur) is a place known for its association to the myth of Banasura . In its modern avatar, Tezpur is what I would call a functional administrative town. Located on the northern banks of Brahmaputra, it is a nice, intimate town that has preserved some of the ancient sites while allowing a number of administrative buildings and a thriving market to flourish. It also acts…
Planning a trip amidst COVID-19 # COVID-19 and its aftermath posed one of the biggest problems in planning a trip this year. Like many of my colleagues and fellow servicemen, I had accumulated a lot of leaves that I had to consume within this calendar year lest they get lapsed. Earlier I had contemplated a couple of routes in the Northern states of Himachal and Uttarakhand. However, I decided to…
Have they abandoned this parking lot? We’ll borrow roller-platforms from those limbless beggars. We’ll skateboard; ride and roll up the concrete While they are too busy patting their sorrows to sleep. Let’s choose a downhill from those we already have, Discover trenches deeper than those we already found. Let’s roll up against gravity and hope of escape velocity And enjoy our time in the air.…
I see a white hare, it’s tuft floating there Traversing over blues. Can I have it? There’s a goose chased by dragon in the sky. Oh wait! Is this season duck or rabbit? Fuzzy shapes they make. Of muffin. Of cake. A bowl. Some noodles! Chopsticks! Artichoke? Look! A perfect one—encircling the Sun. Gods must be skilled in exhaling the smoke. A dark one looms there. It’s far. I’m prepared To name any…
Stranger, would you fetch me please my bowl for alms. I must have forgotten it at the edge of this world. A repurposed soup-can someone left me as a gift Rusted so slightly around the edges of its lip; And a dent from a kind-hearted stranger’s kick. Maybe it’s filled with the kindness of men Or perhaps with emotions discarded and stale. Feel free to take what feels joyous and good And leave all…
Hills beyond a hill, indefinite until Brownish landscape meets with the sky. No sight of trees to slow down the breeze. He gushes with laughter as this river flows by. It all turns dry through winter's cold lens. Such is this provenance of his sentience. Marks on the cliffs reminds him of glyphs— Text of this Earth gets hardened, matured. Imprinted on lime are notes of his time And forces of…
You’ve been out for a couple of seconds You are a slimy drip, you are still. Someone then smacks your back You cry and let your lungs fill. Your first punishment in this world First life-lesson to be instilled— “Don’t forget to breathe” The city you chose to grow up in Is obscured in smog-like stuff. You play around but suffocate When the air is not enough. The corticosteroids will save you— You…
“Here comes Mr. Roy—the rising young star, He steps out of mansion and heads for the car. His girlfriend is with him in a stunning blue dress. He himself in casuals is dressed to impress. Rumour has it—they are headed for a play. They met at a party an year ago, this day. Will he propose? His fans want to know. If he does, we will be the first ones to show.” She moves her mic, “Do you have it on…
Click here to download a pdf version of this play. Cast of Characters # SHAKYA Pahaadi About 35 years old. A god-fearing, traditional pahaadi person. He is married to a pahaadi woman from a neighbouring village across a pass. He has a 12-year-old daughter whom he considers to be very intelligent. Runs a guest-house-cum-tenting facility during the peak hiking season. He farms vegetables like…
Halt o’ kind men, in suit, in pursuit. Listen to the tales I sing on my lute. When I conclude I’ll lighten your mood With three bars of music, and one string of truth. One song for sorrow and three songs of joy; A verse on the verso—this tale is a decoy Of turns of events. Our hero ascents To rectify on recto for you to enjoy. A tale of a trip, a stain on your shirt, A jab of misfortune stuck like…
The genesis of this project came from my desire to publish my writings separately. I wanted it to be detached from the blog with its own look and feel but I did not want to have a separate content management system. I have been using Wordpress for quite some time and I am familiar with the content management backend—the composer, the media library, the settings, etc. I wanted to use the same…
Two weeks ago I started an experiment. I decided that I will not watch YouTube for an entire week. Instead, whenever I have the urge, I will jot the trigger of the urge in my diary. Here are the reasons why I had wanted to open YouTube— Many a times I found myself humming a really silly tune (like this or this ) or recollecting a silly scene from a TV show or movie (like this or this ). I could…
The day they finally hid Jonathan Bakshi in a box And lowered him behind a church that was marked orthodox, Although he wasn’t one, that I can say For I have known him for years, maybe months and even days. His wife departed him—a stroke she couldn’t evade. Behind the same orthodox church, her mortal body was laid. Since the day he outlived her, two decades have gone Leaving him to raise his son…
You are not made of nouns— Not the one gifted properly when you were welcomed into this world, Not the ones of convenience by those that saw you grow up, Not the ones of ridicule for some couldn’t stand your presence, Not the ones of adoration by those who moved your essence. You are not made of nouns— Not the laid out job descriptions nor what you are asked to achieve— Not a writer or a painter;…