Why We Can't Have Nice Things

Once a year I open a form with four boxes on it.

Last time I built a fleet-wide go mod why — build-time SBOMs loaded into a graph, so I could ask where an interesting dependency enters a fleet and along which paths.

There’s a moment every Go developer has had.

Part of my job is answering a question that doesn’t have a number: is this developer growing?

You have agreed to thousands of pages of contracts you never read.

You know the invite.

The password is the worst idea in security that absolutely refuses to die.

Every password login you have ever written has a dirty little secret: the server sees the password.

Last post I built up an AWS Nitro Enclave that generates an ed25519 signing key it won’t let anyone read, serves it over TLS, and proves — by attestation — exactly which code is holding that key.

Eleven years ago I told everyone to use GPG to sign things.