Writing

Notes from building the broker: what the protocol work actually cost, and which parts I got wrong first.

• August 11, 2026

  The EU AI Act asks AI to identify itself. I checked 30 years of that experiment on my server.

  Article 50's transparency rules took effect on 2 August. They rest on self-declaration. On my logs, 57 percent of the traffic that self-declared as an AI crawler came from somewhere the vendor does not operate.

  #ai #security #webdev #devops

• August 1, 2026

  Deal-scoped PASETO: three things I got wrong about audience-bound tokens

  MCP requires servers to reject tokens that were not issued for them. What audience-bound credentials cost to ship in Go, including the part I have not fixed.

  #go #security #api #ai