Blog
Articles, guides, and notes on software engineering.
Prerequisite Knowledge Before Starting a Risk Assessment
A single map of the prerequisite knowledge worth having before you start a risk assessment. Starting from assets, threats, vulnerabilities, and risk, it places NIST SP 800-30, ISO/IEC 27005, OWASP ASVS, NIST SP 800-63B, and CVSS v4.0, through to threat modeling and MITRE ATT&CK.
Recent Posts
Why the Domain Fades From View in Web Development, and Why It Eventually Comes Back
Understand what a domain really means, why it works as an architectural boundary, and the structural reasons the domain fades from view in web development.
An Introduction to Monitoring Design: From Purpose to SLIs
Reframing the purpose of monitoring as decision-making, this guide walks through a tool-agnostic way to design monitoring: the big picture, design principles, user-impact scenarios, and SLI definition, for beginners.
Designing Engineering Management as a "Deck"
Don't let management practices—1on1s, OKRs, review rules—pile up as a loose collection. A way to design them as one system (a deck) around the quality and reproducibility of decisions, and the conditions that turn a practice into an outcome.
Hands-On API Learning
Hands-On API Learning
Beyond Vibe Coding
Beyond Vibe Coding
Context Engineering
Context Engineering
How to Craft an Engineering Strategy
How to Craft an Engineering Strategy
Good Code, Bad Code
Good Code, Bad Code
Prompt Engineering for LLMs
Prompt Engineering for LLMs
The Work of a Senior Engineering Leader
The Work of a Senior Engineering Leader
Simplicity: Sustainable, Humane, and Effective Software Development
Simplicity: Sustainable, Humane, and Effective Software Development
The Book You Wish Your Parents Had Read
The Book You Wish Your Parents Had Read
Thinking in Systems: A Primer
Thinking in Systems: A Primer
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
Explains where to store access tokens in an SPA (the danger of localStorage), a BFF + session design that keeps tokens out of the browser, and why starting token-less is often enough.
What is the Big Picture of Service-to-Service Authentication? mTLS, Token Exchange, SPIFFE, and Zero Trust
Organizes service-to-service authentication in microservices across three layers: network, token, and identity foundation. Covers mTLS, Token Exchange (RFC 8693), SPIFFE, Zero Trust (NIST SP 800-207), and BeyondProd.
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
What is Dynamic Client Registration (DCR)? An Introduction to RFC 7591 and 7592
Explains Dynamic Client Registration (RFC 7591) and Client Registration Management (RFC 7592), which register and manage OAuth clients via an API. Covers the registration endpoint, registration access token, and security considerations.
OIDC Logout and Security Event Token (SET)
Explains OpenID Connect Front-Channel Logout and Back-Channel Logout, and how the Security Event Token (RFC 8417 SET) enables session revocation and event notification.
Access Token Validation and Revocation: Introspection, JWT AT, and Revocation
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.