📰 Dev.to · kt

No login, no sessions, no server-side DB. AgentAuth folds an AI agent identity and authentication into a single UUID. I read it down to the secp256k1 and keccak

If you run SPIRE, are you SPIFFE compliant? How far do you have to go with a custom implementation? I read the spiffe/spiffe spec end to end and pulled out the

A four-step breakdown of AWS SigV4 with an 80-line Python implementation, the asymmetric SigV4A (ECDSA P-256) that Multi-Region Access Point forced into existen

Perimeter defense no longer stops ransomware spreading sideways. One article on why VLAN/Firewall hit a wall, the four implementation patterns (hypervisor / age

When you're outside EC2/Lambda (home laptop, on-prem server, Raspberry Pi, Kubernetes) and you don't want long-lived keys (AKIA...) sitting around, IAM Roles An

I treated AssumeRole as a single API while writing the IAM piece. STS is actually 6 separate APIs (SAML / WebIdentity / Root / SessionToken / FederationToken),

A first-principles tour of AWS for people who keep saying they "get it" but want to actually get it: the physical hierarchy of Regions and AZs, the logical hier

Google, Microsoft, Meta, Amazon, Anthropic, Stripe, Shopify, Salesforce, Netflix, Mercari, CyberAgent. Engineers have been saying 'AI boosts productivity' for y

A single line of "uses: tj-actions/changed-files@v44" burned 23,000 repositories. About a year later, 75 of 76 Trivy tags were rewritten the same way. Git tags

After SBOM and Cosign comes Provenance. Issue SLSA Build L3 provenance with slsa-github-generator and verify it with slsa-verifier, end to end on real machines.

A complete teardown of the SLSA specification. We dissect the threat model, Build and Source track requirements, Provenance structure, and the verification flow

A complete teardown of Fulcio, Rekor, and TUF powering `cosign sign`. Short-lived certificates, Merkle tree inclusion proofs, and trust bootstrapping—explained

CA/Browser Forum SC-081 mandates a phased reduction of certificate validity to 47 days by 2029. This article dives deep into the structural flaws of revocation

Building an OPA plugin that implements the AuthZEN Authorization API 1.0. How the OPA community discussion led to a plugin approach, and the design decisions be

A deep dive into the Google Zanzibar paper — covering Relation Tuples, the New Enemy problem, Zookies, the Leopard index, and system architecture. With notes on

Starting with the RBAC role explosion problem, comparing it with ABAC and ReBAC, and exploring practical policy examples from products like Cedar, OpenFGA, and

A thorough breakdown of IETF draft-ietf-wimse-arch-07. From core concepts to cross-domain scenarios and security considerations, this article walks through the

I built a fully automated, interactive guest book using Issue Forms and GitHub Actions, where visitors can leave a message in just 10 seconds.

A comprehensive guide to Identity Chaining (draft-ietf-oauth-identity-chaining-08). Learn how to safely propagate identity and authorization information across

More than just entropy calculation—I built a Go CLI tool to visualize how much it would cost if an offline attack were launched using modern hardware like an RT

A comprehensive, illustrated deep dive into RFC 8693 (Token Exchange), the OAuth 2.0 standard for exchanging one token for another, exploring the crucial differ

While Gatekeeper is the standard for Kubernetes policy control, its predecessor, the 'OPA + kube-mgmt' setup, remains highly relevant as a versatile policy dist

The common belief is that Go maps don't return memory after deletion. I verified this myth with actual measurements in Go 1.25. The result: Alloc decreased by 9

'The GC is running, but memory usage isn't dropping.' The cause is often heap fragmentation. This article details the design of Go's memory allocator, the mecha