June 2025
- The AI Paradox: Why Building Software is Both Easier and Riskier Than Ever
I've been building with computer vision and ML since before it was cool, and I use these tools daily. When my middle child announced they were majoring in computer engineering, I didn't panic about automation taking…
- Lawyers Think Like Security Engineers. AI Treats Them Like Secretaries
Part of the "AI Skill Liquidity" series
- How Let's Encrypt Changed Everything
I advised Let's Encrypt from its early days, watching it transform the security foundation of the web. Most think it won by offering free certificates. That's dead wrong.
- WebPKI Market Analysis: Mozilla Telemetry vs Certificate Transparency Data
In the past, I've written about how to measure the WebPKI, and from time to time I post brief updates on how the market is evolving.
- Conway's Law Is Dying
I've been thinking about Conway's Law, the idea that organizations "ship their org chart." The seams are most visible in big tech. Google, for example, once offered nearly a dozen messaging apps instead of a single…
- What Does CPA Canada Have to Do With the WebPKI Anyway?
When we discuss the WebPKI, we naturally focus on Certificate Authorities (CAs), browser root programs, and the standards established by the CA/Browser Forum. Yet for these standards to carry real weight, they must be…
- The WebPKI's Moral Hazard Problem: When Those Who Decide Don't Pay the Price
TL;DR: Root programs, facing user loss, prioritize safety, while major CAs, with browsers, shape WebPKI rules. Most CAs, risking distrust or customers, seek leniency, shifting risks to billions of voiceless relying…
- From Mandate to Maybe: The Quiet Unwinding of Federal Cybersecurity Policy
Why the 2025 Amendments to EO 14144 Walked Back Progress on PQC, SBOMs, and Enforcement, Even as the Products to Support Them Have Become Real.
- Why CP and CPSs Matter More Than You Think
I've been in the PKI space for a long time, and I'll be honest, digging through Certificate Policies (CPs) and Certification Practice Statements (CPSs) is far from my favorite task. But as tedious as they can be, these…