Bookmarks

The world’s most valuable assets are stored on rows of servers in giant, anonymous buildings. And they can be stolen.

How to discount your expectations

A blog about software craft and quality

How imprecise UI animations erode trust in product

Welcome to Summer Workshop 2026.

We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?

“Books make me so mad.” That’s what my friend, who used to work part-time as a mover, told me when he learned that my husband and I found a new place to live and I had a lot of books that I needed …

Why & how we rewrote Bun from Zig to Rust

Jarred Sumner has been promising this blog post (since May 9th) about his Zig to Rust rewrite of Bun for significantly longer than it took him to finish the rewrite. …

Spotlight’s search window is incremental and ranks search results across many domains. How this works in practice, and why it may not be ideal when searching for files.

Better structured concurrency for go

We built and released conc, an open-source library that makes it easier and safer to write concurrent code in Go.

Atomic, transaction-safe job queueing for Go applications. Backed by PostgreSQL and built to scale. River provides fast, reliable background job processing for Go applications.

Patterns and Techniques for Writing High-Performance Applications with Go

As is the case for many people working in the security industry, the last few months of my life have been focused on dealing with people wanting to use LLMs everywhere. From an enterprise security perspective that’s not an inherent problem - what’s more of a problem is that people want those agents to have access to resources like their calendar and email and so on, and now we have somewhat non-deterministic agents that seem very enthusiastic to achieve what you asked whether that’s a good idea or not, and we’re combining this with credentials that give them access to sensitive data, and leaving those credentials on disk where they can be committed into git repos or exfiltrated to some other service to make use of them on the agent’s behalf or well just any other number of things, at which point your CEO’s email is suddenly readable by everyone and you’re having a bad day.

When you log into a service you’re given an authentication token. Each further request to the site includes that token, allowing the server to figure out who you are and ensuring that you have access to your data. Depending on site policy, this token may either be stored in memory (and so vanish if you restart your browser) or disk. The token is the proof of your identity. As far as the site is concerned, anyone with your token is you.

This is a guest post by Mateusz Maćkowski and Marek Grzelak, co-maintainers of cot.rs and speakers at Rustikon 2026. You can watch their full talk here. In the very beginning, all we wanted to do w