2026
- The WebPKI's Unmanaged Software Supply Chain
Why software inherits more WebPKI trust than it needs, without browser protections.
- Trusted Everywhere, Impact Everywhere
WebPKI certificate concentration, reliance, sovereign trust, historical CA incidents, and the quantum transition.
- The Private Key Was Four
Eight eMudhra CA keys were small enough to guess. eMudhra had cryptographic proof in June 2025 that something was wrong, kept the weak keys in service, and no other layer of WebPKI oversight was positioned to catch it.
- Rejection Is Not a Verdict
Rejection feels like a judgment, but most decisions depend on timing, context, incentives, and variables you cannot see. Learn from what you control without treating every no as a verdict.
- The Amnesia Cycle and Why AI Is Turning Developers Back Into Testers
AI is shifting developers from producing code to judging generated output, reviving the testing skills and independent quality judgment the industry spent decades automating away.
- Hurst University
Raising capable children means treating family life as an education in judgment, competence, and independence, with graduation measured by the ability to build a future.
- From Periodic Audit to Continuous Assurance
Periodic audits cannot keep pace with changing systems. Two companion essays examine why assurance evidence fails and how AI may finally make continuous reasoning practical.
- From Chains to Trees
The WebPKI's cryptographic graph and governance hierarchy are different structures. Classical and post-quantum trust both depend on understanding the gap between them.
- The Status Quo Outlived Its Status
Security failures accumulate in the seams between coherent systems. The same ownership gaps explain why institutions preserve a status quo after its assumptions expire.
- Why FIPS 140 Means Running Old Code
FIPS 140 validation can improve key isolation while forcing organizations to run opaque, outdated cryptographic software. Public validation data can turn labels into better security questions.
- The Certification Ends Where the Code Begins
Certification records explain what evaluators examined, not whether the surrounding firmware behaves as assumed. Assurance must connect the paper trail to evidence from the code that shipped.
- Steve Jobs, AI, and the Problem of Analysis Without Ownership
AI makes analysis abundant, but judgment still comes from owning decisions and living with their consequences. The best systems should connect analysis, action, verification, and learning.
- The Breaker, the Priest, and the Philosopher
Trusted security judgment is usually earned through contact with failure. A taxonomy of the builders, breakers, advocates, and institutional thinkers shaped by those lessons.
- The Prompt Is an Argument
A useful prompt is an argument that carries its load-bearing premise into the model's decision environment. Leave that premise out and the system will invent one.
- The Prompt Is the Meaning
Why textualism, original public meaning, and AI governance all turn on the same uncomfortable fact: intent does not travel unless it becomes part of the record.
- A CA That Produces Evidence, Not Promises
In my last post I argued that high-assurance systems should stop asking to be trusted on the basis of institutional promises and start producing verifiable runtime evidence about what actually happened. This post is the…
- A CA Built for the Threat Model We Actually Have
This builds on earlier posts on what attestation actually proves, what confidential computing is and isn't, and an honest accounting of the problems with the current generation of TEEs. None of those problems go away…
- The First AI-Built Zero-Day Is Not the Interesting Part
In the mid 90s I worked at a company called Cybersafe. Today it would get labeled an IAM/SSO vendor. What we actually built was a first-generation security platform: Kerberos, password management, PKI-based MFA, key…
- AI Is Not Why They Are Cutting (Yet)
Back in 2000, the rule of thumb at Microsoft was that each employee needed to average roughly \$600K in top-line revenue. Inflation adjusted, that is about \$1.1M to \$1.2M today. Microsoft was a high-margin software…
- Smaller, Provable, and on Hardware You Own and Operate
Dino Dai Zovi made an argument recently that I want to build on.
- The Illusion of Constant Acceleration
Spend enough time around AI right now and you start to get the feeling that everything is speeding up, all the time.
- Confidential Computing's Inconvenient Truth
This is part of a series on confidential computing. See also: Confidential Computing: What It Is, What It Isn't, and How to Think About It for practical deployment guidance, and Why Nobody Can Verify What Booted Your…
- What Is Confidential Computing, What It Isn't, and How to Think About It
Confidential computing is the most important security technology that most organizations deploying it do not fully understand.
- Why Nobody Can Verify What Booted Your Server
There is no public database of known-good TPM measurements. There never has been.
- We Built It With Slide Rules. Then We Forgot How.
My father's path from a subsistence farm to the early space program shows how technical knowledge is built, transmitted, and lost, and why simplicity and institutional memory still matter.
- The WebPKI and Client Authentication Are at a Crossroads
The CA/Browser Forum is having its first serious conversation about whether publicly trusted client authentication certificates deserve their own Baseline Requirements. Nick France kicked off the discussion on the public…
- Introducing the WebPKI Observatory
For as long as I have been in this industry, the WebPKI compliance conversation has run on impressions. People with long memories and regular conference attendance have built up a picture of which CAs are well-run, which…
- Signed, Auditable, Offline-Tolerant, PQ Secure QR Codes
Signed, Auditable, Offline-Tolerant, PQ Secure QR Codes
- When Compliance Records Become the Only Honest Signal
I've been spending a lot of time lately building Systematic Reasoning with my long-time friend Vishal. The core premise is straightforward. Organizations reveal their true operational character through how they design to…
- The Signal They Chose to Ignore
Two prior posts worked through the statistics of the SB 6346 sign-in data. In the first I established the methodology and the finding. After applying a birthday-corrected collision test to separate organic participation…
- Duplicates Are Not the Problem
The Washington House is now arguing that the sign-in dataset for SB 6346 is unreliable because it contains duplicate names. The claim is simple. If the same name appears more than once, you cannot trust the totals.
- Teach to the Median, Punish the Variance
Mass education optimizes for consistency and treats variance as a cost. Children outside the median need room to build agency, judgment, and a future suited to their strengths.
- The Data Doesn't Support the Narrative
SB 6346 would create Washington's first personal income tax in nearly a century. A 9.9% rate on income above \$1 million, projected at \$3.4 billion annually, it passed the Senate 27-22 on party lines and is now in the…
- When Building Gets Cheap, Distribution Becomes Destiny
"Distribution is the new moat." You can find some version of that sentence in almost any startup discussion from the last year. It circulates as a take, gets liked, gets reshared, and then gets reproduced by someone else…
- Domain Control Validation Grew Up. It Only Took Thirty Years.
Let's Encrypt announced <a href="https://letsencrypt.org/2026/02/18/dns-persist-01" data-type="link" data-id="https://letsencrypt.org/2026/02/18/dns-persist-01">DNS-PERSIST-01</a> support this week. That is worth noting…
- Disdain or Design?
Washington State is not in the middle of a single policy dispute.
- You're Not Outsourcing Infrastructure. You're Outsourcing Capability.
Chamath posted this week: "Is on-premise the new cloud? I'm beginning to think yes. It's the only way for companies to not blow themselves up and have some semblance of capability in an AI world." Jason Fried dropped a…
- Agents Are More Like Humans Than Workloads. Here's Why That Matters for Identity.
This is a long one. But as a great man once said, forgive the length, I didn't have time to write a short one.
- "A Few Hours" and the Slow Erosion of Auditable Commitments
There's a pattern that plays out across every regulated industry. Requirements increase. Complexity compounds. The people responsible for compliance realize they can't keep up with manual processes. So instead of…
- The Housing Affordability Crisis
Recently, I was talking to one of my kids, now in university, about why housing feels so out of reach here in Washington. He asked the simple question so many young people are asking: Why is it so expensive to just have…
- Intuition Comes Last
Intuition is not the opposite of analysis. It is compressed experience that becomes trustworthy only after deliberate reasoning has been practiced long enough.