Blog
Articles, guides, and notes on software engineering.
Simplicity: Sustainable, Humane, and Effective Software Development
A review of Simplicity. A book that asks how to keep software development, so easily swallowed by complexity, simple. Beyond technical techniques, it makes you realize that choices about what not to build and where to stop are what let you keep developing healthily over the long term.
Recent Posts
The Book You Wish Your Parents Had Read
A review of The Book You Wish Your Parents Had Read. A book on parenting and the parent-child relationship by British psychotherapist Philippa Perry. Rather than a set of discipline techniques, it emphasizes how to build a relationship with your child and how to face your own emotions. Its view of valuing repair after mistakes over perfection lingers.
Thinking in Systems: A Primer
A review of Thinking in Systems. A book by Donella Meadows, known as a classic of systems thinking. Around concepts like stocks and flows and feedback loops, it offers a way to see the world as a system of interrelated parts. It argues for finding the cause of problems in structure rather than individual elements, and for discerning leverage points.
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
Explains where to store access tokens in an SPA (the danger of localStorage), a BFF + session design that keeps tokens out of the browser, and why starting token-less is often enough.
What is the Big Picture of Service-to-Service Authentication? mTLS, Token Exchange, SPIFFE, and Zero Trust
Organizes service-to-service authentication in microservices across three layers: network, token, and identity foundation. Covers mTLS, Token Exchange (RFC 8693), SPIFFE, Zero Trust (NIST SP 800-207), and BeyondProd.
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
What is Dynamic Client Registration (DCR)? An Introduction to RFC 7591 and 7592
Explains Dynamic Client Registration (RFC 7591) and Client Registration Management (RFC 7592), which register and manage OAuth clients via an API. Covers the registration endpoint, registration access token, and security considerations.
OIDC Logout and Security Event Token (SET)
Explains OpenID Connect Front-Channel Logout and Back-Channel Logout, and how the Security Event Token (RFC 8417 SET) enables session revocation and event notification.
Access Token Validation and Revocation: Introspection, JWT, and Token Revocation (RFC 7009)
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.
OpenID Connect Discovery and Metadata: Auto-Configuration and jwks_uri Key Retrieval
Explains the role of the OpenID Connect ID Token and how Discovery (OpenID Connect Discovery / RFC 8414 AS Metadata) enables auto-configuration and public key retrieval, including key rotation via jwks_uri.
OAuth 2.1 and the Security BCP: RFC 9700 and RFC 6819 (Changes from OAuth 2.0)
An overview of the changes from OAuth 2.0 to 2.1 and the security measures shown by RFC 9700 Security BCP and RFC 6819 threat model. Covers mandatory PKCE, deprecation of the Implicit grant, Mix-Up defenses, and more.
What is JOSE? An Overview of JWT, JWS, JWE, JWK, and JWA
An overview of the JOSE family (JWT/JWS/JWE/JWK/JWA). Learn the difference between JWT and JWS, the 3-part signed structure and 5-part encrypted structure, and how JWT BCP (RFC 8725) prevents alg confusion and none attacks.
Maybe Postgres Is Enough: Check Postgres Before Adding Another Database
Before adding another datastore for caching or search, check whether Postgres already covers it. A concise table of per-use-case alternatives based on postgresisenough.dev.
Reading Platform Engineering Through Systems Thinking
Platform engineering and systems thinking seem to share a lot of ground. This post puts that hunch into words by applying stocks, flows, delays, archetypes, and leverage points to read platform behavior and the failures that keep recurring.
Systems Thinking Basics: Seeing the World as Stocks and Feedback
A plain-language tour of systems thinking based on Donella Meadows' Thinking in Systems: stocks, flows, feedback loops, archetypes, and leverage points.
Comparing API Styles: REST, GraphQL, gRPC, Webhooks, WebSocket, and Messaging
Six common API styles, REST, GraphQL, gRPC, Webhooks, WebSocket, and Messaging, compared side by side. This article organizes them by communication model, lays out each style's overview, design considerations, and pros and cons, and gives guidance for choosing. A map for picking a style in API design.
Comparing Real-Time Web Communication: Polling, SSE, WebSocket, WebRTC, and WebTransport
Five common real-time web communication technologies, Polling, SSE, WebSocket, WebRTC, and WebTransport, compared side by side. This article sorts them by direction and transport, lays out each one's overview, minimal implementation, and pros and cons, and gives selection criteria. A map for choosing a real-time method.
Cryptography Fundamentals: Symmetric, Asymmetric, One-Way Functions, Hashing, and Digital Signatures
From symmetric versus asymmetric encryption to the one-way and trapdoor functions behind RSA and ECC, plus hash functions and digital signatures, this article explains the building blocks of cryptography with primary sources. Part 1 of a three-part series that groups public-key uses into signing, encryption, and key exchange.
Cryptography in Practice: TLS, JWT, and SSH
How everyday protocols such as TLS, JWT/JWS, and SSH combine symmetric keys, public keys, signatures, key exchange, and PKI, viewed through the three uses of a public key and backed by RFCs. The final part of a three-part cryptography series.