Essays & Guides

Writing worth keeping

The Username That Ate the Password: Argon2id, NIST SP 800-63B-4, and Storing Passwords in 2026 Between July and October 2024, an Okta login path accepted any password for some users, because bcrypt reads only the first 72 bytes of its input and a long username … Research 24 min read The Primary Key That Knew What Time It Was: UUIDv7, RFC 9562, and Choosing Identifiers That Age Well RFC 9562 replaced the 2005 UUID specification in May 2024 and added UUIDv7: a 48-bit Unix millisecond timestamp followed by random bits, so identifiers sort by creation … Research 28 min read The Login Link Landed in Spam: SPF, DKIM, DMARC, and the Year DMARC Became a Standard If your product signs people in with a one-time code or a magic link, email is part of your authentication system, and three DNS records decide whether that email … Research 30 min read The Instruction Was in the Ticket: Designing LLM Agents That Survive Prompt Injection EchoLeak, the GitHub MCP leak, and the Supabase support-ticket exfiltration all had the same shape: an agent read text an attacker wrote, and that text chose the agent's … Research 27 min read The Token That Published the Worm: Trusted Publishing, Sigstore, and Provenance After Shai-Hulud Shai-Hulud did not exploit npm. It read publish tokens out of developers' .npmrc files and environment variables, used them to push poisoned versions of the victims' … Research 27 min read The Certificate Nobody Renewed: 47-Day TLS, ACME Renewal Information, and the End of Revocation as a Safety Net The 200-day certificate limit has been in force since 15 March 2026. The 100-day limit arrives on 15 March 2027 and the 47-day limit two years after that, with … Engineering 26 min read

The Series

Ai Weekly

Five global stories and five from home, every week.

Latest issue

June 2026

May 2026

April 2026