Application
223 articles
The Lineage of Programming Languages Leading to Go
A source-checked walk through the lineage of programming languages from Algol 60 to Go: Wirth's Pascal-to-Oberon path and Hoare's CSP path through Newsqueak, Alef, and Limbo, and how both streams merge into Go.
9 Books for Writing Good Code (Readability and Refactoring)
A reading list of 9 books for writing readable, change-tolerant code: the basics of readability, improvement through refactoring, facing complexity, and a couple of titles to widen your view. Each entry links to its full review.
9 Books for Learning Go (Beginner to Advanced)
A staged reading list of 9 books for learning Go, from beginner to advanced: language basics, a deeper understanding of the language, and web, systems, and distributed implementation. Each entry links to its full review.
7 Books for Learning Ruby and Rails (Beginner to Advanced)
A staged reading list of 7 books for learning Ruby and Ruby on Rails: getting started, deepening the language, and Rails in practice. Each entry links to its full review.
Good Code, Bad Code
A review of Good Code, Bad Code. A book that concretely shows the difference between good and bad code through lenses like abstraction, modularity, error handling, and testing. It offers judgment criteria you can use directly in daily reviews, such as clarifying contracts, guarding against unexpected input, and making misuse hard.
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
What is Dynamic Client Registration (DCR)? An Introduction to RFC 7591 and 7592
Explains Dynamic Client Registration (RFC 7591) and Client Registration Management (RFC 7592), which register and manage OAuth clients via an API. Covers the registration endpoint, registration access token, and security considerations.
OIDC Logout and Security Event Token (SET)
Explains OpenID Connect Front-Channel Logout and Back-Channel Logout, and how the Security Event Token (RFC 8417 SET) enables session revocation and event notification.
Access Token Validation and Revocation: Introspection, JWT, and Token Revocation (RFC 7009)
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.
OpenID Connect Discovery and Metadata: Auto-Configuration and jwks_uri Key Retrieval
Explains the role of the OpenID Connect ID Token and how Discovery (OpenID Connect Discovery / RFC 8414 AS Metadata) enables auto-configuration and public key retrieval, including key rotation via jwks_uri.
OAuth 2.1 and the Security BCP: RFC 9700 and RFC 6819 (Changes from OAuth 2.0)
An overview of the changes from OAuth 2.0 to 2.1 and the security measures shown by RFC 9700 Security BCP and RFC 6819 threat model. Covers mandatory PKCE, deprecation of the Implicit grant, Mix-Up defenses, and more.
What is JOSE? An Overview of JWT, JWS, JWE, JWK, and JWA
An overview of the JOSE family (JWT/JWS/JWE/JWK/JWA). Learn the difference between JWT and JWS, the 3-part signed structure and 5-part encrypted structure, and how JWT BCP (RFC 8725) prevents alg confusion and none attacks.
Cryptography Fundamentals: Symmetric, Asymmetric, One-Way Functions, Hashing, and Digital Signatures
From symmetric versus asymmetric encryption to the one-way and trapdoor functions behind RSA and ECC, plus hash functions and digital signatures, this article explains the building blocks of cryptography with primary sources. Part 1 of a three-part series that groups public-key uses into signing, encryption, and key exchange.
Cryptography in Practice: TLS, JWT, and SSH
How everyday protocols such as TLS, JWT/JWS, and SSH combine symmetric keys, public keys, signatures, key exchange, and PKI, viewed through the three uses of a public key and backed by RFCs. The final part of a three-part cryptography series.
Key Exchange and PKI: Diffie-Hellman, Certificates, and Certificate Authorities
How Diffie-Hellman shares a symmetric key safely, how ECDHE adds forward secrecy, and how PKI binds a public key to its owner through certificates, CAs, and a chain of trust. Backed by primary sources such as RFCs. Part 2 of a three-part cryptography series.
Three Uses of a Public Key: Signing, Encryption, and Key Exchange
A public key has just three uses: signing, encryption, and key exchange. This article sorts real-world applications such as SSH public-key auth, WebAuthn, mTLS, private_key_jwt, code signing, and container signing into these three, and clarifies how they differ from shared-key schemes such as HMAC, with primary sources.
Comparing Data Transformation Methods: Encoding, Serialization, Encryption, Hashing, Compression, Compilation, and Parsing
A concise comparison of common data transformation methods — encoding, serialization, encryption, hashing, compression, compilation, and parsing — across three axes: reversibility, whether a key is required, and purpose.
Python for Algorithmic Trading
A review of Python for Algorithmic Trading. Yves Hilpisch's introduction to starting algorithmic trading with Python. In one volume it covers Python setup and data analysis, trading strategies like moving averages and momentum, backtesting, prediction with machine learning, and trade automation via broker APIs.
Introducing Asset Trend Simulator — An iPhone App for Compound Interest Simulation
A deep dive into Asset Trend Simulator, an iPhone app built with Flutter and Riverpod that simulates future net worth trends using compound interest calculations based on your household finances.
Introducing Bookstacks — An iPhone Bookshelf App with ISBN Barcode Scanning
A deep dive into Bookstacks, an iPhone app built with Flutter and Riverpod that lets you register books via ISBN barcode scan and organise them with customisable labels.