Home on Sauvik Biswas

I joined my current startup as a founding engineer after spending years at large organisations—first at Airbus, and then at VMware (now part of Broadcom).

(In the voice of Internet Historian) “Opinion?

Why resource binding alone is not enough # v09 binds each access token to a named API at mint time.

Why a generic access token is not enough # v08 replaced the shared JWT_SECRET with RS256 + JWKS.

Why verify-only apps shouldn’t hold the signing key # v07 added OpenID Connect on top of v06’s split architecture.

A deliberate pause # v07 is in the repo.

Why v06 is not enough # v06 split the authorization server from the resource server and taught token validation across process boundaries.

Why a second validation mode # v06 split the authorization server from the resource server and taught the default way a separate resource server trusts a token it never issued: introspection (Mode A).

Why v05’s single process is not the finish line # v05 closed the refresh loop: short-lived access tokens, silent renewal via grant_type=refresh_token, and a protected GET /api/me.

Why v04 was not the finish line # v04 closed the loop through a protected API: the client app stores an access_token, calls GET /api/me with Authorization: Bearer …, and shows a profile page.

Why v03 was not the finish line # v03 closed the authorization half of OAuth: state for CSRF, PKCE for code interception, and POST /token to mint an access_token.

Why v02 needed a fix # v02 closed the login CSRF hole.

Why v01 needed a fix # v01 got the Authorization Code redirect working, but it deliberately left out OAuth state.

A preamble # What is my motivation behind this # Andromeda has been working on creating a comprehensive solution around Agents.

A problem in production # A couple of days ago, our stack saw a massive rise in WAL.

Previous Post: A naive implementation of file-based storage It was impossible to not come across B-Trees or any of the variants (B+Trees) if I had to implement a database.

The Broken Ear is the first book with a preconceived plot.

Previous Post: YetiDB: an academic exercise We have a basic implementation of four interfaces— Record.

Over the last couple of years I have seen protobufs being used not only as a means to serialize and deserialize data for transport over network but also as a means to implement a type system, business logic, version control, storage schema, and what not.

Goecha-La was my first trek.

Day 0: Preparing for Udupi # 24th December, 2022 I rode all the way from my house to Mittal’s, where we both dismantled and packed our bicycles with bubble wrap, duct tape, some cardboard, and Styrofoam.

Every week at farmer’s market She sets her bench with jars for sale Blueberry jam on a blue tarp Come rain or shine or snow or hail.

It feels strange to write a retrospective of the year that was after one-and-a-half months of 2022.

A writer trembles in a coat that’s too thin On frosty platform that's foggy and dim.

“I don’t think you can backpack in that condition,” Nitesh, my seasoned backpacker friend warned me.

My troubled mind wanders—lost in a troubled state; My peace is the apathy for future outcomes— Apathy for the future is so hard to inculcate.

Due to an oversight by my Hotel’s manager, I had no reservation to Guwahati.

Dawa came to see me off for one last time in the morning.

In the next two days, Dawa took me to three villages—Chug, Sangti and Thembang.

Dawa slept till 10:00 am.

That morning I was contacted by the Sumo driver.

Jang is mostly known for its military check-post and Nuranang Falls.

For the next one-and-a-half days I walked around Tawang and visited a number of places while spending time with the kids at my hotel.

I woke up quite early that day to catch a glimpse of the morning sun.

The three markets in Tawang are closed on three different days—Old Market on Tuesday, Nehru Market on Wednesday, and New Market on Thursday.

Journey from Tezpur to Tawang # During this pandemic, the authorities are not allowing more than five passengers in a shared Sumo.

Tezpur (and its district Sonitpur) is a place known for its association to the myth of Banasura.

Planning a trip amidst COVID-19 # COVID-19 and its aftermath posed one of the biggest problems in planning a trip this year.

Have they abandoned this parking lot?

I see a white hare, it’s tuft floating there Traversing over blues.

Stranger, would you fetch me please my bowl for alms.

Hills beyond a hill, indefinite until Brownish landscape meets with the sky.

You’ve been out for a couple of seconds You are a slimy drip, you are still.

“Here comes Mr.

Click here to download a pdf version of this play.

Halt o’ kind men, in suit, in pursuit.

The genesis of this project came from my desire to publish my writings separately.

Two weeks ago I started an experiment.

The day they finally hid Jonathan Bakshi in a box And lowered him behind a church that was marked orthodox, Although he wasn’t one, that I can say For I have known him for years, maybe months and even days.

You are not made of nouns— Not the one gifted properly when you were welcomed into this world, Not the ones of convenience by those that saw you grow up, Not the ones of ridicule for some couldn’t stand your presence, Not the ones of adoration by those who