GitHub Actions OIDC to AWS: Build a Narrow Trust Policy
Replace long-lived AWS credentials in GitHub Actions with OIDC, but lock the IAM role trust policy to the right audience, subject, branch, and environment.
The Orthogonal blog
Notes on software, AI, and systems.
Source-based guides and practical explanations for people who build with technology. Explore the ideas, inspect the evidence, and understand the trade-offs.
Recently published
Latest articles
Kubernetes Secrets Are Not Encrypted by Default: What to Fix First
Kubernetes Secrets are not a complete secret-management plan. Check RBAC, Pod creation rights, volume mounts, and at-rest encryption before trusting them with credentials.
Python Requests Timeouts and Retries: Stop Hanging API Jobs
A practical Requests session for scheduled API clients: connect/read timeouts, safe retries, backoff, status handling, and JSON checks.
Docker Compose Secrets: Stop Passing Passwords as Environment Variables
A practical guide to moving Docker Compose passwords out of environment variables and into per-service secret files with a small rotation plan.
Muse vs. Amazon: The Shopping Gatekeeper Thesis and META’s 2x Case
Muse could change who shapes the shopping shortlist. A source-based look at Amazon's defenses, information asymmetry, and the earnings required for a five-year META doubling scenario.
GitHub Artifact Attestations: Verify Build Provenance Before You Deploy
GitHub artifact attestations connect release artifacts to signed build provenance. Here is how to generate them and verify the right identity.
Explore the blog
Find your next topic
AI and developer workflows
Agents, coding tools, and the limits behind the launch claims.
Open guideSecurity and privacy
Authentication, data boundaries, and checks you can inspect.
Open guideDevOps and homelabs
Delivery pipelines, self-hosting, storage, and recovery.
Open guideAPIs and data engineering
Data sources, Python workflows, and financial-data limitations.
Open guideRead in depth
Selected guides
SSH Server Hardening in 2026: A Version-Aware sshd_config Guide
A version-aware SSH rollout with a tested login and recovery route.
Read field noteyfinance 1.6.0: Practical Python Stock Data, Live Streaming, and Equity Screening
Source-checked Python examples and the boundaries of offline testing.
Read field noteBrowser Fingerprinting Defenses in 2026: Options and Limits
Browser privacy controls, their trade-offs, and what a fingerprinting test cannot prove.
Read field noteSupporting projects
Tools from the blog
Optional utilities, not a requirement for reading or following a guide.
Images
QuickShrink
Compress and convert images before publishing or sharing them.
Read the introductionDeveloper utilities
HashForge
Generate and compare hashes for text or files.
Read the introductionDeveloper utilities
RegexLab
Test and debug regular expressions against sample text.
Read the introductionFollow or discuss
RSS updates. Practical discussion.
Follow published guides in your feed reader, or ask a build question in the moderated onsite community. Email updates are not enabled. Free tools need no account or subscription.