Archive 2026
123 articles
Key Exchange and PKI: Diffie-Hellman, Certificates, and Certificate Authorities
How Diffie-Hellman shares a symmetric key safely, how ECDHE adds forward secrecy, and how PKI binds a public key to its owner through certificates, CAs, and a chain of trust. Backed by primary sources such as RFCs. Part 2 of a three-part cryptography series.
When to Use GraphQL: Adoption Criteria and Trade-offs
When should you adopt GraphQL? This guide covers its core ideas (a typed schema, a single endpoint, fetching exactly what you need), where it fits and where it does not, the trade-offs, operational concerns such as N+1, and how it compares with REST and gRPC.
When to Use gRPC: Adoption Criteria and Trade-offs
When should you adopt gRPC? This guide covers its core ideas (RPC, HTTP/2, Protocol Buffers), where it fits and where it does not, the trade-offs, operational concerns, and how it compares with REST and GraphQL.
Three Uses of a Public Key: Signing, Encryption, and Key Exchange
A public key has just three uses: signing, encryption, and key exchange. This article sorts real-world applications such as SSH public-key auth, WebAuthn, mTLS, private_key_jwt, code signing, and container signing into these three, and clarifies how they differ from shared-key schemes such as HMAC, with primary sources.
What is sqlc? A Practical Introduction to Type-Safe SQL in Go
Learn what sqlc is and how it generates type-safe Go code from SQL. A hands-on introduction using SQLite that covers the schema-to-code workflow, the benefits, and common pitfalls.
Comparing Data Transformation Methods: Encoding, Serialization, Encryption, Hashing, Compression, Compilation, and Parsing
A concise comparison of common data transformation methods — encoding, serialization, encryption, hashing, compression, compilation, and parsing — across three axes: reversibility, whether a key is required, and purpose.
What Is the TCP Three-Way Handshake?
A concise explanation of the TCP three-way handshake: the SYN, SYN/ACK, and ACK steps, the state transitions, and why TCP needs three messages instead of two.
Comparing API Versioning Strategies: Path, Query, Header, and Payload
A concise comparison of four API versioning strategies — path, query parameter, header, and message payload — covering their pros, cons, and best fit.
What Is EventStorming
Learn EventStorming, a workshop technique born from domain-driven design that uses sticky notes to rapidly map a business domain and build shared understanding between developers and domain experts.
What Is AI-DLC (AI-Driven Development Life Cycle)?
An article organizing what AWS's AI-DLC (AI-Driven Development Life Cycle) is. Positioning AI as a central collaborator in development, it explains its two pillars, AI executes while humans supervise and dynamic team collaboration, and the mental model of rapidly iterating planning, alignment, and implementation, contrasted with the traditional SDLC.
If You Want Managed Certificates for an Internal LB's HTTPS, the Domain Must Live in Public DNS
Why a Cloud DNS private zone cannot use managed certificates when securing internal VPC traffic with HTTPS, and the practical compromise of a public domain backed by a private IP.
bmf as a Service
Overview of services offered by bmf-san as an individual: consulting, mentoring, sponsorships, and speaking & writing (media inquiries). All inquiries via the contact form.
Production-Ready Microservices: Building Standardized Systems Across an Engineering Organization
A review of Production-Ready Microservices. A book that organizes the requirements microservices must meet to run in production: stability, reliability, scalability, fault tolerance, monitoring, and documentation, presenting them as a standardization checklist. It is grounded in the author's experience at Uber.
Into the World of Systems Thinking: For Software Engineers Who Keep Thinking in an Increasingly Complex Era
A review of a book introducing systems thinking for software engineers. Written from the angle of how software engineers can bring systems thinking into their own work, it connects tools like stocks and flows, feedback loops, and leverage points to phenomena that arise in development and organizations.
Accidental Complexity and the Absence of Decision Records
How accidental complexity emerges, and why the absence of ADRs and Design Docs makes it hard to tell what is essential from what is accidental.
My Career Vision as of May 2026
Articulating my career vision as of May 2026 — aspiring to be an architect who improves the long-term value of organizations and software.
Three Common Patterns for Distributed Transactions — 2PC, Saga, and Outbox
A concise comparison of the three canonical distributed transaction patterns in microservices — 2PC, Saga, and Outbox — covering their mechanics, trade-offs, and when to use each.
Architecture Modernization: Socio-technical alignment of software, strategy, and structure
A review of Architecture Modernization. A translation of the original by Nick Tune et al., it frames modernization as a sociotechnical effort that treats technology, organization, and strategy as one, introducing methods driven by business goals such as BVSSH value assessment and Wardley mapping.
パスキーのすべて: Adoption, UX Design, and Implementation
A review of Everything About Passkeys. From the context of passkeys' rise, password limits and phishing resistance, to WebAuthn and FIDO specifications, server- and platform-side implementation, login UX design, and operational pitfalls like device loss and recovery, it covers the whole picture in one volume.
Product Management in Practice, 2nd Edition
A review of Product Management in Practice, 2nd Edition. Matt LeMay's practical book weighted toward a PM's day-to-day behavior. Rather than career or method theory, it addresses what happens in a day, explaining concrete conduct along the CORE skills: communication, organization, research, and execution.