Security

Human authentication has a person in the loop: a password, a passkey, a push notification, an MFA prompt. Machine-to-machine (M2M) authentication does not. A batch job at 03:00, a payments service calling a ledger, a Kubernetes pod pulling a config — none of them can answer a challenge, and none of them should hold a password a human typed. The whole field is one question asked over and over: how does a workload prove which workload it is to another party, without a long-lived secret that can leak? This post is a map of the answers — the standards, what each one actually protects against, and how the identity providers and cloud hyperscalers implement them. Simple terms, diagrams, and code. ...

Row-Level Security is the one Postgres feature that fails silently. A wrong GRANT throws; a wrong RLS policy just returns the wrong rows — sometimes another tenant’s rows — and nothing in the database complains. Review catches the obvious mistakes and misses the structural ones, because the bug is usually a boolean that reads correctly and evaluates wrong. pgrls is a static analyzer for exactly that class of bug, and over the last couple of months I landed a few patches upstream. This is the write-up I wish I’d had going in. Two parts: first the map — what pgrls is and how it fits CI — then the contribution I care most about, an offline lint path that makes gating RLS in CI a zero-dependency step. ...

Sigstore removes the hardest part of code signing — long-lived key management — by binding signatures to short-lived certificates issued against OIDC identities, and recording every signing event in a public transparency log. npm ships Sigstore-backed provenance, PyPI accepts attestations, Kubernetes signs its releases with it. Official client libraries exist for Go, Python, Java, JavaScript, and Rust. .NET was the gap. sigstore-dotnet (docs, Sigstore.Net on NuGet) closes it with a fully managed implementation of the Sigstore client specification. This post covers what the protocol actually does on the wire, and why a native library — not a shelled-out CLI — is the right integration point. ...