Blog
Long-form, code-heavy writing on software engineering, AI/LLM, payments and system design.
Three signals and the different questions they answer, the trace-ID join that delivers 80% of the value, the collector pattern, tail-based sampling that keeps the interesting 100%, and the incident-driven rollout.
The four flag species and why conflating them causes misery, sticky percentage rollouts with one decision point, the staged rollout playbook with observability hooks, and the hygiene that prevents flag archaeology.
Five layers walked top to bottom — browser headers, CDN edge with its famous incident, Redis with a job description, database-adjacent options — plus the staleness grid that makes TTLs a product decision.
The real leak vectors ranked, the non-negotiables at any size, a three-rung maturity ladder that mostly stops at rung two, and rotation as a rehearsed muscle with two-key overlap.
The honest three algorithms, layered key design including the abuse limits everyone forgets (per victim, not per attacker), the 429 contract, and operational rules — fail open, shadow mode, degrade before deny.
The founding delegation story, the cast renamed into English, the one flow that survived (auth code + PKCE) with every step's attack labeled, ID vs access tokens untangled, and the do-you-even-need-this triage.
Why revocation is where stateless goes to die, the XSS blast-radius problem, the specific habitats where JWTs genuinely shine, and the sessions-at-the-edge / tokens-between-machines architecture.
The unanswerable-timeout thought experiment, the implementation with its three traps disarmed, why the property must compose down the whole call chain, and the cheaper natural-key alternatives.
The specific problem it solves brilliantly, the five bills itemized — resolver N+1s, forfeited HTTP caching, query-surface DoS, field-level auth, the toolchain — and the BFF alternative most teams actually need.
What gRPC actually is (three technologies in a trench coat), the honest performance paragraph, where each protocol is simply correct, and the hybrid edge-REST/interior-gRPC topology mature systems converge on.
