Notes from software & security.
Field notes on the things that actually matter in software engineering and cybersecurity — explained plainly, updated as the ground shifts.
Speed Is a Feature: Treating Web Performance as an Engineering Discipline
Slow sites lose revenue quietly, and rarely through one bad decision. Core Web Vitals provide the yardstick, a performance budget enforced in CI provides the discipline, and real-user data tells the truth. A pragmatic adoption path for a small team.
Hardening a Linux Service the Boring Way: systemd Sandboxing and Least Privilege
Most real-world security lives in unglamorous configuration, not clever tooling. Here is a practical, defence-in-depth pass on a single Linux service using systemd sandboxing, least privilege, and the surrounding host basics.
Self-Hosting Open-Weight LLMs: When Local Beats a Hosted API
A senior, EU-aware look at when running an open-weight model on your own GPU or VPS genuinely beats a hosted API — data residency, sustained cost, latency, air-gapped needs — and the cases where it plainly does not.
Post-Quantum Cryptography Is Standardised: A Calm Migration Plan for Long-Lived Data
NIST finalised its first post-quantum standards in 2024. Here is what "harvest now, decrypt later" actually threatens, what changes for TLS and stored secrets, and how to migrate in calm, staged steps starting with an inventory.
The European Accessibility Act Is Live: A Working Engineer's Route to Conformance
Since 28 June 2025 the European Accessibility Act has treated digital accessibility as a condition of EU market access. Here is what it requires, where WCAG 2.2 AA and EN 301 549 fit, and a pragmatic path to conformance.
Passkeys in 2025-26: How Passwordless Login Actually Beats Phishing
Passkeys have moved from novelty to default across the major platforms. Here is a plain-language look at how the cryptography defeats phishing, and a practical adoption path for small businesses.
NIS2 and the EU Cyber Resilience Act: What They Actually Ask of You
Two EU laws now reshape how ordinary businesses and software makers handle cybersecurity. Here is a plain-language guide to who is in scope, when the deadlines land, and the concrete obligations you can start on today.
AI in the Software Lifecycle: Where It Genuinely Helps, and What It Quietly Breaks
LLM coding assistants are now part of most engineering teams, and they earn their place on the right tasks. But their output is untrusted input, and treating it otherwise introduces insecure code, prompt injection, and supply-chain risk. Here is an honest map of both.
Memory Safety and the Shift to Rust: A Pragmatic Guide for C/C++ Teams
Memory-safety bugs still account for the majority of serious vulnerabilities in large C/C++ codebases, and agencies like CISA now formally recommend memory-safe languages. Here is a measured look at what that means for teams who cannot simply rewrite everything.
Know What's in Your Software: Supply-Chain Security and SBOMs Before the CRA Deadline
Modern software is assembled from thousands of third-party parts you did not write. Here is why knowing their provenance now matters commercially, and what the EU Cyber Resilience Act will require of the products you ship.