Skip to main content

Shipping products

Log entries on this topic, newest first.

  1. Decision recordDevices at the edge

    Panel passwords are sealed to the host that uses them

    A secret that one process uses should be readable by that process alone. The decision record for the administrator passwords of access-control panels: write-only entry, a fresh AES-GCM key per secret wrapped with RSA-OAEP under the connector host's key, opened in memory only, one escrow export and then a key nobody can export, a TPM tier that excludes escrow, and why machine-scope DPAPI and the web runtime's key ring were the wrong tools.

    8 min read

  2. Field noteDevices at the edge

    Talking to door controllers: what ISAPI teaches about typed outcomes

    A boolean cannot carry what an access-control panel answers. Three measured facts (a failed write with HTTP 200 and no status, an acknowledged write that changed nothing, a reused digest nonce the panel refused) turned a 27-member interface whose every write returned a boolean into a closed set of typed outcomes, a classification order, a read-back rule and a fresh challenge per request; asking which way a door fails added a deadline on anything that unlocks one.

    9 min read

  3. Decision recordRealtime transports

    SignalR between a cloud and its sites

    A hub that pushes changes from a cloud to on-premises sites is a security boundary and a lifecycle problem: who may connect, what each connection hears, how long an admission holds, and how a client comes back after the server closes it. The design note: a service-client policy, a group per tenant, a fifteen-second sweep with the same check requests get, and a client that starts itself again because automatic reconnect does not follow a server-side Abort.

    8 min read

  4. Decision recordRealtime transports

    Server-Sent Events in ASP.NET Core 10, and when to pick them over SignalR

    When a server talks and a client listens for the length of one request, Server-Sent Events is the right transport: plain HTTP, one direction, a text protocol a proxy carries and a browser reconnects by itself. .NET 10 made it a first-class result. The parts that bite are on the client: the protocol has rules, and some servers decide per response whether to answer with JSON or with a stream.

    7 min read

  5. Website

    polovnjak.net

    A calculator for the cost of importing a used car into Serbia and Bosnia and Herzegovina: customs, VAT, homologation and first registration, in five languages.

    • Static pages · Cloudflare Pages and Functions · Turnstile
    • polovnjak.net
  6. Open source

    Osirion.Blazor

    An open source component library and Markdown CMS for Blazor, built to render completely under static server-side rendering. This site runs on it.

    • .NET 9 and 10 · Blazor static SSR · Markdig
    • NuGet
    • Source
  7. Mobile game

    Sunbird

    A one-tap flying game on Google Play. Everyone flies the same course each day, and every flight can be replayed exactly.

    • JavaScript · Canvas 2D · Capacitor · .NET · Azure Cosmos DB
    • Google Play