Articles
Go, Rust, Linux, cryptography and UK privacy law. One properly researched article a day.
Page 5 of 5. Working notes from a software engineer who spends the day in Go, Rust and Linux and the evening reading legislation. Each post takes one specific question and answers it properly: why a worker pool deadlocks, what fsync really promises, how to enrol a TPM into LUKS without locking yourself out, what a technical capability notice can actually compel. Step-by-step how-tos sit alongside the deep dives, everything is checked against source code or primary legislation, and nothing is padded to hit a word count.
Subscribe with the Atom feed to get each post as it lands.
-
Why You Need HKDF When a Hash of the Key Looks Fine
A look at why sha256(sha256(secret)) is not key derivation, what HKDF's extract-and-expand construction actually buys you, and how to use it correctly in Go.
-
Encrypt Every DNS Lookup on Your Network with Unbound
Run Unbound as a validating, caching DNS-over-TLS resolver on Linux so every device on the network gets encrypted, DNSSEC-checked lookups with no per-app setup.
-
Cancelling a Context Doesn't Stop a Single Goroutine
context cancellation in Go is cooperative, not preemptive: it closes a channel and nothing more. Here's where that quietly fails, and how to actually stop work.
-
Why io_uring Won't Automatically Speed Up Your Network Service
io_uring's benchmarks are real, but most of its wins are in storage and syscall-bound workloads. Why bolting it onto a network service often buys nothing.
-
Nightly Encrypted Backups to an SFTP Box with restic
A practical guide to backing up a Linux machine with restic over SFTP: repository setup, password handling, systemd timers, retention, and verifying restores.
-
What Can the Home Office Force a Tech Company to Build?
What a technical capability notice under the Investigatory Powers Act can require, why the Apple ADP dispute turned on one phrase, and why it is secret.
-
Why Most 'Reject All' Cookie Buttons Fall Short of PECR
Why UK cookie banners with a working 'reject all' button still breach PECR, from consent-timing bugs to IAB TCF legitimate interest loopholes.
-
Keep Your GPG Master Key Offline and Use Subkeys Day to Day
How to split a GPG identity into an offline certify-only master key and day-to-day sign, encrypt and auth subkeys, with backup and rotation steps.
-
TLS Hides Your Data, Not Your Behaviour
TLS encrypts the contents of your connections, but packet sizes, timing, SNI and DNS still leak enough to fingerprint sites, videos and even keystrokes.
-
Why SQLite Writers Still Block in WAL Mode (and Go Makes It Worse)
WAL mode lets SQLite readers and writers coexist, but writers still queue for one lock. Go's connection pool can turn that into 'database is locked' errors.
-
Replace authorized_keys Sprawl with a Tiny SSH Certificate Authority
Replace sprawling authorized_keys files with a small self-hosted SSH certificate authority: user and host certificates, principals and revocation.
-
What Your ISP Has to Log Under an IPA Retention Notice
Section 87 retention notices under the Investigatory Powers Act 2016: what UK ISPs must log, the 12-month cap, entity versus events data, and why it is secret.
-
What Linux Actually Promises When fsync Returns
fsync() returning zero feels like a promise the bytes are safe. Page cache, errseq_t, directory entries and disk caches make that promise weaker than it looks.
-
Unlock LUKS with the TPM2 Chip Using systemd-cryptenroll
Enrolling a TPM2 chip into a LUKS2 volume with systemd-cryptenroll: PCR selection, PIN protection and the kernel-update trap that locks people out.
-
Can Client-Side Scanning Coexist with End-to-End Encryption?
Ofcom's section 121 powers under the Online Safety Act, what client-side CSAM scanning would involve, and why 'technically feasible' may be a category error.
-
What WebAuthn Actually Signs, and Why Phishing Can't Replay It
A byte-level look at what a WebAuthn assertion signs: the origin, the challenge and the RP ID hash, and why that binding defeats classic phishing proxies.
-
Keep Your LUKS2 Header on a USB Key, Not the Disk
How to set up LUKS2 disk encryption with the header on a separate USB key: the commands, the backup steps, and what it does and does not protect against.
-
How select! in Tokio Silently Drops Half-Finished Work
tokio::select! drops the losing branch's future, and for some Tokio methods that means silently lost bytes and desynced protocols. How to spot and fix it.
-
Picking Argon2id Parameters You Can Actually Defend
How to choose Argon2id memory, time and parallelism parameters in Go that you can actually defend, with a working hash-and-verify implementation.