Now

I’m in San Francisco, having recently returned from Rails World in Toronto, which was a lot of fun. Beyond that:

• I finished a massive access control refactor that builds out a more flexible RBAC (role-based access control) system for Bridge. It doesn’t sound much, but the roots of ACL run deep, and it ended up touching every important file in project, in the end taking me multiple months to fully complete.

• Next up is a billing system for metered storage use. Harder than it sounds on the face because you’re not just tracking storage, but storage over time. If someone stores 10 TB for most of the month but deletes every last byte before invoicing day, they should still be charged for about 10 TB. If someone spikes up to 10 TB for only a single day before deleting it all, they should be charged far less. Rather than charging per GB, you’re really charging per GB-hour.

• I’m trying, and mostly failing, to update this site more consistently. The notification came in to update this page on Oct 1st, and yet, sigh, I’m doing it on the 19th.

It’s September, although in California, it’s hard to notice.

I was in Washington DC last week for a company off-site, a once a year event where our team converges in one location. My first time in the city, I toured the length of the National Mall and its supremely iconic landmarks. At almost 40C and that incredible east coast humidity, it was a sweaty affair (but neat!).

Bridge is going well. We shipped a lot this past year, and gotten to a point where it’s quite a mature product. As always, our core competency is hosting Postgres, which implies stability, and to some extent being boring and predictable, but our platform and analytics teams are working on big, ambitious projects, so it feels like we’ve got a couple moonshots in flight.

Years in, our code is as clean and stable as any project I’ve ever seen of this age, and 100x better than many. I just ran our test suite on my underpowered, commodity laptop, and we’re sitting at 4237 tests running in 27.595s, which is great. Last week I pushed through a big test refactor (+41,168 LOC, −29,160) so that not only are all tests marked as pararallelizable, but all subtests of those tests too. We’re on Go 1.23 of course, and refactor regularly so that convention is strong and everything is in ship shape.

I’m not working on AI, and indeed may be the last person in San Francisco (and soon, the world?) who’s never typed anything into an AI prompt.

Pen testing, Q3, DC

It’s August. I don’t have anything of substance to write about, so here’s a couple short points instead:

• We’re currently running a pen test with an external contractor. They’re the best one we’ve worked with so far, and a number of legitimate liabilities have fallen out of it. I’ve spent the last few weeks shoring up the walls.

• My main macro project continues to be rebuilding our roles system. There’s been a lot of smaller distractions, and refactoring existing code to make what I’m envisioning possible has taken longer than I expected.

• I’ve acquired a new toy, a Leica Q3. I finally ordered one the week before prices were set to increase. Leicas are bad deals and I’m old enough now to know very definitively that new consumer products will never make you happy, but what the hell, I hadn’t bought anything substantial in a long time.

• I’m headed to Washington DC in a few weeks, the first time I’ll have ever visited the nation’s capital. I’ve heard mixed things, and honestly can’t say whether I’ll love or hate it.

• I’ve been playing way too much Elden Ring, a game I thought I’d hate like other FromSoft games, but which I now acknowledge is a masterpiece of both worldbuilding and gameplay design.

RBAC, Python

I’m in San Francisco.

I’m working on rebuilding Bridge’s RBAC (role-based access control) system, taking inspiration from Tailscale’s substantial write up on the subject, which seems to be the most contemporary thinking on the subject from practioners who also do a good job of it in their own product. Dozens of companies selling enterprise security solutions have strong opinions on the subject, but it doesn’t inspire much confidence when their own offerings are of middling quality.

I’ve been relearning Python to help build a River’s Python client library. The language’s been a mixed bag overall, but it’s been interesting diving into typing, asyncio, and tooling like Rye, none of which existed the last time I worked in the language.

I’m spending the month in Berlin, where I’m trying to run and write every day, and enjoy time in a place that’s less reminiscent of a zombie wasteland than my home city.

The next big project I’m tackling at work is Active Directory. That sounds about as fun as a root canal, but I take it as an interesting challenge. AD is a long in the tooth technology that’s still in use by many of the biggest players in the industry (we even used it at Stripe!). How can we integrate it in such a way that it gets big users what they need, produces as little code as possible and as few headaches for us, and maximizes the yield in leverage we get out of the effort. For example, it might involve ignoring the low level AD APIs and integrating SCIM instead, thereby buying us compatibility with other non-AD SCIM-based systems.

Blake and I continue work on our open source Postgres job queue, River, which I think is fair to say is the most full-featured in the Go ecosystem by some margin. There’s something incredibly satisfying about taking a project scoped to a known, fixed domain, and refinining its code over and over again until it’s perfect. Trying to handle every edge, and with attention to detail on every line of code.

I recently published Ruby gem that enables job insertion in Ruby, but for jobs to be worked in Go, which is something that I’d always wanted back at Heroku and Stripe. I wrote about my experience putting in type checking with Steep, and publishing RBS files for the project.

I’m in San Francisco, where inertia keeps me rooted.

Work on Crunchy Bridge continues. As part of filling out a self-evaluation last week I scanned every pull request I’ve issued over the last year, and I liked what I saw. What we’ve shipped during that time is above and beyond any org I’ve worked at before. Small teams, agile tech stacks, and lack of a culture of objection-for-objection’s-sake do wonders for productivity.

A few things I sent out the door recently:

• Multi-factor authentication, supporting WebAuthn (Yubikeys and biometric challenges like Touch ID) and TOTP (time-based one-time passwords). (Notes on getting this shipped quickly.)
• An asynchronous query runner that’s built to scale by taking advantage of Go’s parallelism, by storing results to S3 instead of Postgres, and which prunes its results regularly.
• Retired our use of Keycloak, which involved many smaller tasks like adopting a fancy new password hashing scheme.

Pre-lockdown, I’d gotten into the best shape of my life by baking exercise into my schedule with a daily run commute, fitness which I unfortunately let languish. Newly armed with a WeWork pass and gym membership (for the showers), I’m bringing it back. A straight shot from the mountain down Market St to Embarcadero – 50km/week if I keep it up.

Next month, Europe.

I’m back home in Calgary for the holidays, staring into the precipice of 2023 which between money markets, strife, and war is shaping up to be a formidable year.

At work, we’re aiming to build the best database-as-a-service in the world. I shipped more features over the last year than the previous five combined, and which were built into a robust stack that to this day has less tech debt than many two-week-old startups (I’m kind of proud of it, you might be able to tell). We have another aggressive roadmap for 2023, and I’ll be doing my best to make sure that we don’t slip.

I added a couple new sections to the site recently:

• Atoms: Short multimedia particles minus the stress of a social media platform (atom feed).
• Sequences: Periodic large format photos paired with prose. An older project, but one which I recently revived, flattened, and republished.

A few weeks before that I became somewhat enamored by the idea of Spring ‘83 and ended up writing a server implementation which is now in prod and hosts my board. I don’t think Twitter is being displaced anytime soon, but these indy web projects are great.

In 2023: write, move, visit France.

It’s 2020. Like for almost everyone else on Earth, COVID-19 is top-of-mind. I’m working from home, San Francisco is sheltering in place, and the future is a hugely uncertain time.

As bad as our present day situation is, an indefinite work from home policy has given me more flexibility and more energy in my day-to-day than I’ve ever had in my adult life, and I’m going to do my best not to waste it.

Some things I’m working on:

• Write every day, and try to so fluidly. Instead of agonizing over every word, get content down, revise, and revise again. Some projects:

  • A (roughly) weekly newsletter called Nanoglyph. I’m challenging myself to send at least 30 editions in 2020, and do so without compromising content quality. You should try subscribing.
  • A development log with notes on daily software discoveries and projects. Most entries will be of minor interest, but frequent enough to build writing cadence. For example.

• Meditate every day.

I’m in Calgary for the winter break. It’s the last day of 2019 and we’re on the precipice of a new decade.

Some things I’m working on:

• Writing a (roughly) weekly newsletter called Nanoglyph. I’m challenging myself to send at least 30 editions in 2020, and do so without compromising content quality. You should try subscribing.
• Write more, and more fluidly. Instead of agonizing over every word, get content down, revise, and revise again.
• The craft of software has landed on a plateau where big, complicated, fragile backend deployments that support slow, underwhelming, buggy frontend products is the norm. Find techniques and ideas to reverse this trend and boost their signal.
• Ran 1000 miles and did 42k pushups in 2019, do so again in 2020. Keep weight at ~150 lbs. Zero in on ~10% body fat.
• Reboot meditation practice. Did pretty well in 2018, but fell off the wagon completely in 2019. Aim for a couple 30 consecutive day runs.

I’m in Berlin.

A few points of focus:

• A photography project called Sequences as an experiment to promote the independent web.
• A tiny static site framework that encourages stability through writing build recipes in a compiled language instead of in untyped templates, or having them implied through file organization.
• Writing on topics like WebSockets (done), operable databases, and stability through data constraints.
• Nutrition and fitness: Leaner diet, run 1000 miles in 2019. Targeting <150 lbs. and ~10% body fat.

I’m in San Francisco, working on technology at Stripe.

A few points of focus:

• Meditating every day.
• Learning Rust, and using it to proof out resilient services that don’t need constant human attention.
• Exercising my attention muscle by putting in more periods of deep thought and intense non-maintenance work. I wake up early, and try to focus on only one thing at a time.