Writing · Nº 041065 essays
The writing
Ideas from inside the work. Explore technology, entrepreneurship, and the practice of building things that last.
30 essays found · Page 1 of 3
Clear filtersEngineeringHow to Rate-Limit Real-Time ConnectionsHTTP rate limits do not cover WebSockets. Rate-limit real-time connections at connect, per message, and per subscription, or one client can flood your whole server.StrategyDo You Need a Penetration Test to Sell to Enterprise?A penetration test report is often a faster, cheaper enterprise credential than SOC 2. Here is when you need a pentest to sell and what buyers actually want from it.EngineeringIs AI-Generated Code a Security Risk?AI-generated code is a security risk in specific, predictable ways. Here is what actually goes wrong, what the fear gets wrong, and how to ship it safely.EngineeringHow to Manage Secrets Without a Cloud VendorHow to manage secrets and environment variables without a cloud vendor: keep API keys and credentials secure on infrastructure you own, without a hosted vault bill.OperatingHow to Automate Employee Offboarding SecurelyAutomate employee offboarding to revoke access, reclaim accounts, and preserve records the moment someone leaves. Manual offboarding is how ex-employees keep access.EngineeringAuthorize Every Real-Time Subscription, Not Just the MessageReal-time authorization belongs at subscribe time, per channel, re-checked on reconnect. Client-side filtering is not security. Here is how to authorize subscriptions.StrategyBuild a Trust Center Before Enterprise Buyers AskA trust center answers enterprise security questions before buyers ask them. Here is what to put in a trust center for an AI product and why it shortens every deal.EngineeringLeast Privilege for AI Automation IntegrationsAn AI workflow with full access to every system is a breach waiting to happen. Here is how to apply least privilege so automation can only touch what it needs.EngineeringTurn On Automatic Security Updates on Your VPSUnattended security updates are the highest-leverage thing you can automate on a self-hosted Linux VPS. Here is how to set them up without breaking your apps.Engineeringfail2ban vs Cloudflare for Brute-Force Protectionfail2ban vs Cloudflare for stopping brute-force attacks on a self-hosted server. They protect different layers, and the right answer is usually to run both.EngineeringHow to Configure a UFW Firewall on a VPSConfigure a UFW firewall on a self-hosted VPS the right way: default deny, allow only what you serve, and keep your database off the public internet for good.EngineeringHow to Secure WebSocket Connections in ProductionWebSocket security fails when you authorize only at connect time. Here is how to secure WebSocket connections with per-message auth, token handling, and rate limits.