Writing

Long-form notes on Go, infrastructure and the CNCF projects I work in, with the real code and the tradeoffs. Sometimes a career lesson too.

~/Writing

All tech golang infra opensource ideology security observability prometheus web3

2026

  1. Service-to-Service Auth From Scratch, and the Five Things That Bite You

    2026-04-15 · 11 min

    How internal microservices actually prove who they are to each other: OAuth2 client-credentials with Keycloak and OIDC, JWT validation via JWKS, and the clock-skew, key-rotation, and audience traps nobody warns you about.

    infrasecurity

2025

  1. Sister CVEs: Predicting the Vulnerabilities You Haven't Found Yet

    2025-06-24 · 8 min

    A scanner tells you which CVEs you have. We built a service that predicts the ones you probably also have but haven't found: ExploitDB co-occurrence mapping, Gemini for analysis, shipped as a Kubernetes microservice.

    securitytech

  2. What Hardening a Container Image Actually Removes

    2025-03-11 · 10 min

    Most CVEs in your container image aren't in your code. Hardening 12+ OSS images (including IronBank/DoD) taught me the real move: cut CVEs ~80% by removing packages you never used, not by patching.

    infrasecurity