Now

Pen testing, Q3, DC

It’s August. I don’t have anything of substance to write about, so here’s a couple short points instead:

• We’re currently running a pen test with an external contractor. They’re the best one we’ve worked with so far, and a number of legitimate liabilities have fallen out of it. I’ve spent the last few weeks shoring up the walls.

• My main macro project continues to be rebuilding our roles system. There’s been a lot of smaller distractions, and refactoring existing code to make what I’m envisioning possible has taken longer than I expected.

• I’ve acquired a new toy, a Leica Q3. I finally ordered one the week before prices were set to increase. Leicas are bad deals and I’m old enough now to know very definitively that new consumer products will never make you happy, but what the hell, I hadn’t bought anything substantial in a long time.

• I’m headed to Washington DC in a few weeks, the first time I’ll have ever visited the nation’s capital. I’ve heard mixed things, and honestly can’t say whether I’ll love or hate it.

• I’ve been playing way too much Elden Ring, a game I thought I’d hate like other FromSoft games, but which I now acknowledge is a masterpiece of both worldbuilding and gameplay design.

RBAC, Python

I’m in San Francisco.

I’m working on rebuilding Bridge’s RBAC (role-based access control) system, taking inspiration from Tailscale’s substantial write up on the subject, which seems to be the most contemporary thinking on the subject from practioners who also do a good job of it in their own product. Dozens of companies selling enterprise security solutions have strong opinions on the subject, but it doesn’t inspire much confidence when their own offerings are of middling quality.

I’ve been relearning Python to help build a River’s Python client library. The language’s been a mixed bag overall, but it’s been interesting diving into typing, asyncio, and tooling like Rye, none of which existed the last time I worked in the language.

I’m spending the month in Berlin, where I’m trying to run and write every day, and enjoy time in a place that’s less reminiscent of a zombie wasteland than my home city.

The next big project I’m tackling at work is Active Directory. That sounds about as fun as a root canal, but I take it as an interesting challenge. AD is a long in the tooth technology that’s still in use by many of the biggest players in the industry (we even used it at Stripe!). How can we integrate it in such a way that it gets big users what they need, produces as little code as possible and as few headaches for us, and maximizes the yield in leverage we get out of the effort. For example, it might involve ignoring the low level AD APIs and integrating SCIM instead, thereby buying us compatibility with other non-AD SCIM-based systems.

Blake and I continue work on our open source Postgres job queue, River, which I think is fair to say is the most full-featured in the Go ecosystem by some margin. There’s something incredibly satisfying about taking a project scoped to a known, fixed domain, and refinining its code over and over again until it’s perfect. Trying to handle every edge, and with attention to detail on every line of code.

I recently published Ruby gem that enables job insertion in Ruby, but for jobs to be worked in Go, which is something that I’d always wanted back at Heroku and Stripe. I wrote about my experience putting in type checking with Steep, and publishing RBS files for the project.

I’m in San Francisco, where inertia keeps me rooted.

Work on Crunchy Bridge continues. As part of filling out a self-evaluation last week I scanned every pull request I’ve issued over the last year, and I liked what I saw. What we’ve shipped during that time is above and beyond any org I’ve worked at before. Small teams, agile tech stacks, and lack of a culture of objection-for-objection’s-sake do wonders for productivity.

A few things I sent out the door recently:

• Multi-factor authentication, supporting WebAuthn (Yubikeys and biometric challenges like Touch ID) and TOTP (time-based one-time passwords). (Notes on getting this shipped quickly.)
• An asynchronous query runner that’s built to scale by taking advantage of Go’s parallelism, by storing results to S3 instead of Postgres, and which prunes its results regularly.
• Retired our use of Keycloak, which involved many smaller tasks like adopting a fancy new password hashing scheme.

Pre-lockdown, I’d gotten into the best shape of my life by baking exercise into my schedule with a daily run commute, fitness which I unfortunately let languish. Newly armed with a WeWork pass and gym membership (for the showers), I’m bringing it back. A straight shot from the mountain down Market St to Embarcadero – 50km/week if I keep it up.

Next month, Europe.

I’m back home in Calgary for the holidays, staring into the precipice of 2023 which between money markets, strife, and war is shaping up to be a formidable year.

At work, we’re aiming to build the best database-as-a-service in the world. I shipped more features over the last year than the previous five combined, and which were built into a robust stack that to this day has less tech debt than many two-week-old startups (I’m kind of proud of it, you might be able to tell). We have another aggressive roadmap for 2023, and I’ll be doing my best to make sure that we don’t slip.

I added a couple new sections to the site recently:

• Atoms: Short multimedia particles minus the stress of a social media platform (atom feed).
• Sequences: Periodic large format photos paired with prose. An older project, but one which I recently revived, flattened, and republished.

A few weeks before that I became somewhat enamored by the idea of Spring ‘83 and ended up writing a server implementation which is now in prod and hosts my board. I don’t think Twitter is being displaced anytime soon, but these indy web projects are great.

In 2023: write, move, visit France.

It’s 2020. Like for almost everyone else on Earth, COVID-19 is top-of-mind. I’m working from home, San Francisco is sheltering in place, and the future is a hugely uncertain time.

As bad as our present day situation is, an indefinite work from home policy has given me more flexibility and more energy in my day-to-day than I’ve ever had in my adult life, and I’m going to do my best not to waste it.

Some things I’m working on:

• Write every day, and try to so fluidly. Instead of agonizing over every word, get content down, revise, and revise again. Some projects:

  • A (roughly) weekly newsletter called Nanoglyph. I’m challenging myself to send at least 30 editions in 2020, and do so without compromising content quality. You should try subscribing.
  • A development log with notes on daily software discoveries and projects. Most entries will be of minor interest, but frequent enough to build writing cadence. For example.

• Meditate every day.