Blog
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 3525 posts
#2026-03 765#english 592#culture 264#deep-dive 254#kubernetes 249#career 229#ai 219#llm 209#devops 196#2026-04 146#security 143#database 114#observability 113#communication 109#history 107#architecture 100#productivity 96#finance 88#economy 84#mindset 81#psychology 80#ai-papers 79#food 78#it 78#travel 78#deep-learning 77#japanese 77#networking 77#performance 72#business-travel 70#linux 70#gpu 69#ai-agent 66#cs-fundamentals 63#postgresql 61#rag 58#self-improvement 55#learning 53#mlops 53#python 52
Anatomy of npm Supply Chain Attacks — Defense Strategies for the Era When Even Red Hat Got Hit
Triggered by the June 2026 incident in which even official Red Hat Cloud Services npm packages were exposed to malicious code, this post dissects the types of npm supply chain attacks and lays out the defense stack organ
2026-06-12 · 17 min read #npm#supply-chain#security#devops#sigstoreCustomizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice
A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a
2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#securityKeycloak Observability — Metrics, Audit Logs, and Event-Driven Monitoring
A comprehensive guide to Keycloak observability: the event system and metrics endpoint, shipping events externally with the EventListener SPI, building Prometheus and Grafana dashboards, OpenTelemetry tracing, anomaly de
2026-06-12 · 13 min read #keycloak#observability#monitoring#prometheus#securityKeycloak 26 Architecture Deep Dive — Understanding Realms, Clients, and the Quarkus Runtime
A deep dive into the internal architecture of Keycloak 26.x. We cover the WildFly-to-Quarkus transition, the realm/client/role domain model, the authentication flow engine, kc.sh build optimization, and the new features
2026-06-12 · 16 min read #keycloak#sso#oidc#security#devopsFAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile
A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,
2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#securityZero Trust and Identity-Aware Proxy — Building the BeyondCorp Model Yourself ♪ Listenable
The perimeter is dead and identity-first security is the new default. This post walks through the core of the Google BeyondCorp papers and builds an Identity-Aware Proxy from scratch with oauth2-proxy and Keycloak. We co
2026-06-12 · 18 min read #zero-trust#iap#beyondcorp#oauth2-proxy#keycloakSPIFFE/SPIRE Workload Identity — Service-to-Service Authentication Without Secrets
SPIFFE/SPIRE is the answer to secret sprawl in the age of non-human identity. We cover SPIFFE IDs and SVIDs, the SPIRE server/agent architecture and attestation, hands-on Kubernetes deployment YAML, and automatic mTLS vi
2026-06-12 · 16 min read #spiffe#spire#mtls#workload-identity#kubernetesThe Hard Problem of Single Logout (SLO) — Designing Front-Channel and Back-Channel Logout
In SSO, logout is harder than login. This post covers the three-layer session model, how OIDC RP-Initiated/Front-Channel/Back-Channel Logout work and where they fail, the logout token JWT structure, the realistic failure
2026-06-12 · 17 min read #sso#oidc#saml#keycloak#logoutRefresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle
From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi
2026-06-12 · 16 min read #oauth2#session#keycloak#security#ssoPasskeys Enterprise Rollout Guide — From WebAuthn/FIDO2 to Keycloak Integration
In 2026, passwordless authentication is no longer an experiment but the emerging default. This post dissects the WebAuthn registration/authentication ceremonies and attestation, walks through Keycloak 26 passkeys configu
2026-06-12 · 17 min read #passkeys#webauthn#fido2#keycloak#securitySSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When ♪ Listenable
A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl
2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iamOAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE
A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token
2026-06-12 · 17 min read #oauth2#oidc#security#pkce#ssoDissecting Symantec SiteMinder Architecture — The Standard of Legacy Enterprise WebSSO
A deep dive into SiteMinder, the product that dominated enterprise WebSSO for over two decades. We dissect the Policy Server, Web Agent, SMSESSION cookie, the realm/rule/policy object model, and the security implications
2026-06-12 · 17 min read #siteminder#sso#iam#security#webssoDesigning the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era ♪ Listenable
The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio
2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architectureSAML 2.0 Deep Dive — Mastering Assertions, Bindings, and Metadata
A dissection of SAML 2.0 with real XML examples: the structure of the Assertion at its heart, the AuthnRequest/Response flow, SP-initiated vs IdP-initiated SSO, HTTP-Redirect/POST/Artifact bindings, metadata exchange, an
2026-06-12 · 13 min read #saml#sso#xml#security#iamKeycloak SPI Extension Development — From Custom Authenticators to EventListeners
A complete guide to developing Keycloak SPI (Service Provider Interface) extensions. We cover the Provider/ProviderFactory architecture, a full internal SMS OTP Authenticator implementation, a Kafka audit-log EventListen
2026-06-12 · 13 min read #keycloak#spi#java#security#devopsProperty-Based Testing in Practice — Catching the Bugs Examples Cannot
A practice-first guide to property-based testing (PBT), which catches the bugs that example-based tests miss. Covers the core concepts of properties, generators, and shrinking, a pattern catalog for discovering propertie
2026-06-12 · 17 min read #testing#property-based-testing#hypothesis#jqwik#fast-checkKeycloak Identity Brokering — From Social Login to External IdP Federation
A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute
2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokeringOAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.
2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservicesDesigning SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding
In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT
2026-06-12 · 16 min read #sso#saas#keycloak#oidc#saml