Engineering
Nobody sets out to build a distributed system. What people build is a service with a database, and then they solve six problems in a row, each of which has an obvious solution, and eighteen months later they are running a distributed system with none of the design properties of one.
Engineering
Nobody sets out to run Kafka because they wanted to run Kafka.
Engineering
Picking an IAM platform is not a decision you get to revisit cheaply. Once user identities, sessions, and every downstream integration are wired against a specific provider, migrating away is closer to a re-platforming project than a configuration change. That's exactly why this is worth evaluating
Engineering
OAuth 2.0 is old enough to drive. The ecosystem is mature, the libraries are good, and every security review in the industry prefers it.
Engineering
Over eleven days, an attacker tried 4.2 million passwords against 380,000 accounts at a company I'll leave unnamed. They got into 1,900 of them. The pattern was textbook credential stuffing: one attempt per account, rotating residential proxies, human-plausible timing, user agents drawn from a reali
Engineering
The first time I watched this happen, the postmortem took four hours and produced one useful sentence.
Engineering
There is a line in a thousand codebases that reads roughly like this:
Engineering
Ask an engineering team what a login costs and you'll usually get a pause, then a question back: cost in what sense?
Engineering
You click a button. The page flickers through a couple of redirects. You're logged in.
Engineering
A team I worked with had a dashboard they were proud of. Login p50: 84ms. Login p99: 210ms. Both well inside budget, both green for months.
Engineering
Most WebAuthn explanations stop at the conceptual level: a keypair is created, the private key stays on the device, the server verifies a signature. That's correct, and it's roughly a tenth of what you need to implement a relying party without introducing a vulnerability.
Engineering
The argument against opaque tokens takes about four seconds to make and it's the reason most teams never seriously consider them: "A network call on every request? No thanks."