All blog posts

  • Events

Frequently Asked Questions from Strange Loop 2023

  • icon Sep 27, 2023
  • icon 3 minutes read
  • icon 516
The last Strange Loop conference was held September 21-22, 2023 at St. Louis Union Station. The conference is targeted towards developers; the speakers are often sharing their knowledge on new and inventive ways to use technology. At our sponsor …
Read more
  • Infrastructure security

Remediating AWS IMDSv1

  • icon Aug 11, 2021
  • icon 15 minutes read
  • icon 3036
2024-12-17 Updated to include Declarative Policies Compute resources in AWS (for example, EC2 instances, ECS tasks/services, etc.) get access to AWS credentials, such as temporary instance role credentials, via the Instance Metadata Service (IMDS). …
Read more
  • Sales enablement
  • Risk & compliance

The SOC2 starting seven

  • icon Mar 12, 2020
  • icon 17 minutes read
  • icon 3603
So, you plan to sell your startup’s product to big companies one day. Congratu-dolences! Really, that’s probably the only reason you should care about this article. If that’s not you, go forth and live your life! We’ll ask no more of your time. For …
Read more
  • Cryptography

Stop using encrypted email

  • icon Feb 19, 2020
  • icon 8 minutes read
  • icon 1698
Email is unsafe and cannot be made safe. The tools we have today to encrypt email are badly flawed. Even if those flaws were fixed, email would remain unsafe. Its problems cannot plausibly be mitigated. Avoid encrypted email. Technologists hate this …
Read more
  • Cryptography

How (not) to sign a JSON object

  • icon Jul 24, 2019
  • icon 12 minutes read
  • icon 2380
Last year we did a blog post on interservice auth. This post is mostly about authenticating consumers to an API. That’s a related but subtly different problem: you can probably impose more requirements on your internal users than your customers. The …
Read more
  • Cryptography

The PGP problem

  • icon Jul 16, 2019
  • icon 15 minutes read
  • icon 3049
Cryptography engineers have been tearing their hair out over PGP’s deficiencies for (literally) decades. When other kinds of engineers get wind of this, they’re shocked. PGP is bad? Why do people keep telling me to use PGP? The answer is that they …
Read more