Blog
The case for a head of engineering staying hands-on, written as a confession rather than a boast, because the compulsion is the problem.
A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.
The national vulnerability database is buckling under defunding and volume, which changes what a severity score is actually worth.
Operational telemetry can be personal data, and a web service has no first-run prompt to ask on. So plumbing is not an answer.
Three traps release-plz sets for a Rust workspace, starting with a default tag template that collides the moment you have more than one crate.
Two telemetries with opposite consent defaults on one OTLP layer: consent-gated analytics for a CLI, implied-consent observability for a service.
Publishing a seventeen-crate Rust workspace to crates.io, and why the same release configuration produced two different answers.
Add OpenTelemetry traces, metrics and logs to a Go service with middleware and manual spans, and get one end-to-end trace through the gateway.
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
Generate an OpenAPI v3 document from an annotated proto file and serve it from the same HTTPS server with an embedded Stoplight Elements UI.
Campfire
go-tool-base
Security
signing
Pioneering
Soapbox
cicd
rust-tool-base
Orienteering
