Rotating a signing key without breaking self-update
Signing releases is the easy day. Replacing the key you sign with, while every installed copy is still checking against the old one, is a job I went looking for a guide to and couldn't find.
Tags
49 pages
Security
Every suppression is a claim
Forty-two comments telling a checker to stand down. I went through them one at a time to see what each was actually asserting, and some of them were wrong.
Read the report without ever holding the key
Publish an OpenPGP certificate a researcher can encrypt to, and read what they send, without a private key ever existing in your process.
The hero gets the bill
AI found a 22-year-old way to own most of the PHP web, and the fix shipped in a day. The bill for being rescued is still landing, and it isn't addressed to the hero.
My reason for hand-rolling it was wrong
I wrote my own OpenPGP packet code, then deleted the lot to prove I needed it. The reason I'd given turned out to be nonsense, and there was a better one waiting for me.
Half the AI traffic was a scanner in a costume
The busiest AI crawler on this blog nearly doubled in a month. Most of that wasn't the crawler at all, it was something hunting for .env files wearing its name.
A good signature in ten minutes
Ten minutes, a throwaway directory and no cloud account, to find out what a release signature actually is before you decide whether you want one in your pipeline.
The lock I took off
That morning I put a lock on a bucket. By teatime I'd taken it off for good, because it guarded the risk I'd already covered and locked in the ones I hadn't.
The escape hatch that turned out to be french doors
I wanted an FFmpeg that couldn't touch my disk. Building the interface to get one accidentally produced something considerably more useful.
The day a script needs changing everywhere
Eleven variants of one shell script, on hundreds of laptops, launching pods into production. The language was never the problem, and it wasn't the fix either.
