41554 blogs · [ { "id": "01a087ad-57ca-738c-869b-f40bbcdb4344", "title": "Are we any closer to the Quantum Apocalypse?", "url": "https://neilmadden.blog/2026/07/02/are-we-any-closer-to-the-quantum-apocalypse/", "published_at": "2026-07-02T11:25:26+00:00" }, { "id": "01a087ad-57ca-738c-869b-f40bbd4506c7", "title": "Java’s SSLContext protocol name is a footgun", "url": "https://neilmadden.blog/2026/06/23/javas-sslcontext-protocol-name-is-a-footgun/", "published_at": "2026-06-23T20:12:31+00:00" }, { "id": "01a087ad-57ca-738c-869b-f40bbe26d99f", "title": "Java sealed classes and exhaustive pattern matching", "url": "https://neilmadden.blog/2026/04/24/java-sealed-classes-and-exhaustive-pattern-matching/", "published_at": "2026-04-24T12:48:19+00:00" }, { "id": "01a087ad-57ca-738c-869b-f40bbe4d1ef2", "title": "Mythos and its impact on security", "url": "https://neilmadden.blog/2026/04/14/mythos-and-its-impact-on-security/", "published_at": "2026-04-14T11:01:56+00:00" }, { "id": "01a087ad-57ca-738c-869b-f40bbe837ecc", "title": "Maybe version ranges are a good idea after all?", "url": "https://neilmadden.blog/2026/03/19/maybe-version-ranges-are-a-good-idea-after-all/", "published_at": "2026-03-19T11:02:00+00:00" }, { "id": "01a087ad-57ca-738c-869b-f40bbed4f4be", "title": "Why I don’t use LLMs for programming", "url": "https://neilmadden.blog/2026/03/02/why-i-dont-use-llms-for-programming/", "published_at": "2026-03-02T11:15:38+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24c10040c", "title": "Looking for vulnerabilities is the last thing I do", "url": "https://neilmadden.blog/2026/02/20/looking-for-vulnerabilities-is-the-last-thing-i-do/", "published_at": "2026-02-20T11:06:02+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24c77f812", "title": "Were URLs a bad idea?", "url": "https://neilmadden.blog/2025/11/12/were-urls-a-bad-idea/", "published_at": "2025-11-12T15:56:30+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24cf846a5", "title": "Monotonic Collections: a middle ground between immutable and fully mutable", "url": "https://neilmadden.blog/2025/11/11/monotonic-collections-a-middle-ground-between-immutable-and-fully-mutable/", "published_at": "2025-11-11T19:07:27+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24d093184", "title": "Fluent Visitors: revisiting a classic design pattern", "url": "https://neilmadden.blog/2025/11/04/fluent-visitors-revisiting-a-classic-design-pattern/", "published_at": "2025-11-04T21:31:29+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24da37d71", "title": "Rating 26 years of Java changes", "url": "https://neilmadden.blog/2025/09/12/rating-26-years-of-java-changes/", "published_at": "2025-09-12T21:45:38+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24e18b9e0", "title": "No, no, no. You’re still not doing REST right!", "url": "https://neilmadden.blog/2025/07/09/no-no-no-youre-still-not-doing-rest-right/", "published_at": "2025-07-09T20:24:31+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24e537eb3", "title": "Streaming public key authenticated encryption with insider auth security", "url": "https://neilmadden.blog/2025/07/02/streaming-public-key-authenticated-encryption-with-insider-auth-security/", "published_at": "2025-07-02T18:10:55+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24ee86850", "title": "Are we overthinking post-quantum cryptography?", "url": "https://neilmadden.blog/2025/06/20/are-we-overthinking-post-quantum-cryptography/", "published_at": "2025-06-20T15:37:43+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24fc8de63", "title": "A look at CloudFlare’s AI-coded OAuth library", "url": "https://neilmadden.blog/2025/06/06/a-look-at-cloudflares-ai-coded-oauth-library/", "published_at": "2025-06-06T16:11:14+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee24ff05aab", "title": "The square roots of all evil", "url": "https://neilmadden.blog/2024/12/03/the-square-roots-of-all-evil/", "published_at": "2024-12-03T12:27:18+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee2504dbf91", "title": "Digital signatures and how to avoid them", "url": "https://neilmadden.blog/2024/09/18/digital-signatures-and-how-to-avoid-them/", "published_at": "2024-09-18T19:52:19+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee250f96ed4", "title": "Machine Learning and the triumph of GOFAI", "url": "https://neilmadden.blog/2024/06/30/machine-learning-and-the-triumph-of-gofai/", "published_at": "2024-06-30T08:46:59+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee2512baf64", "title": "Galois/Counter Mode and random nonces", "url": "https://neilmadden.blog/2024/05/23/galois-counter-mode-and-random-nonces/", "published_at": "2024-05-23T20:24:47+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee251aee548", "title": "SipHash-based encryption for constrained devices", "url": "https://neilmadden.blog/2024/05/06/siphash-based-encryption-for-constrained-devices/", "published_at": "2024-05-06T18:18:22+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee251bebc15", "title": "Newsletter", "url": "https://neilmadden.blog/2024/01/06/newsletter/", "published_at": "2024-01-06T10:18:54+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee252b0842c", "title": "A controversial opinion about REST API design", "url": "https://neilmadden.blog/2023/11/02/a-controversial-opinion-about-rest-api-design/", "published_at": "2023-11-02T08:48:01+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee25372fc24", "title": "Regular JSON", "url": "https://neilmadden.blog/2023/05/31/regular-json/", "published_at": "2023-05-31T13:28:53+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee253d94211", "title": "I still don’t really get “hash shucking”", "url": "https://neilmadden.blog/2023/04/27/i-still-dont-really-get-hash-shucking/", "published_at": "2023-04-27T11:13:36+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee2548646c1", "title": "Entity authentication with a KEM", "url": "https://neilmadden.blog/2023/04/20/entity-authentication-with-a-kem/", "published_at": "2023-04-20T13:05:46+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee254d6e9fb", "title": "Book review: The Joy of Cryptography", "url": "https://neilmadden.blog/2023/02/16/book-review-the-joy-of-cryptography/", "published_at": "2023-02-16T11:37:25+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee2558c86a4", "title": "A few programming language features I’d like to see", "url": "https://neilmadden.blog/2023/01/18/a-few-programming-language-features-id-like-to-see/", "published_at": "2023-01-18T00:04:16+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee2560dce47", "title": "On PBKDF2 iterations", "url": "https://neilmadden.blog/2023/01/09/on-pbkdf2-iterations/", "published_at": "2023-01-09T12:45:58+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee256612535", "title": "A few clarifications about CVE-2022-21449", "url": "https://neilmadden.blog/2022/04/25/a-few-clarifications-about-cve-2022-21449/", "published_at": "2022-04-25T20:03:58+00:00" }, { "id": "01a087ad-57cb-70d6-9a75-0ee25719d35b", "title": "CVE-2022-21449: Psychic Signatures in Java", "url": "https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/", "published_at": "2022-04-19T20:10:00+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b89c3162a", "title": "Is Datalog a good language for authorization?", "url": "https://neilmadden.blog/2022/02/19/is-datalog-a-good-language-for-authorization/", "published_at": "2022-02-19T17:00:00+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b89c98f95", "title": "Why the OAuth mTLS spec is more interesting than you might think", "url": "https://neilmadden.blog/2022/01/20/why-the-oauth-mtls-spec-is-more-interesting-than-you-might-think/", "published_at": "2022-01-20T14:48:40+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8abafd90", "title": "Multiple input MACs", "url": "https://neilmadden.blog/2021/10/27/multiple-input-macs/", "published_at": "2021-10-27T16:25:35+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8b729a11", "title": "From KEMs to protocols", "url": "https://neilmadden.blog/2021/04/08/from-kems-to-protocols/", "published_at": "2021-04-08T13:56:56+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8bac85a2", "title": "How do you use a bearer URL?", "url": "https://neilmadden.blog/2021/03/24/how-do-you-use-a-bearer-url/", "published_at": "2021-03-24T15:43:08+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8c3a5d97", "title": "Towards a standard for bearer token URLs", "url": "https://neilmadden.blog/2021/03/20/towards-a-standard-for-bearer-token-urls/", "published_at": "2021-03-20T10:57:23+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8d13ea44", "title": "When a KEM is not enough", "url": "https://neilmadden.blog/2021/02/16/when-a-kem-is-not-enough/", "published_at": "2021-02-16T13:14:46+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8d2b1294", "title": "Hybrid encryption and the KEM/DEM paradigm", "url": "https://neilmadden.blog/2021/01/22/hybrid-encryption-and-the-kem-dem-paradigm/", "published_at": "2021-01-22T14:29:47+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8d5e7f6b", "title": "Making things", "url": "https://neilmadden.blog/2020/12/29/making-things/", "published_at": "2020-12-29T17:45:21+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8d6c45d8", "title": "XSS doesn’t have to be game over", "url": "https://neilmadden.blog/2020/12/10/xss-doesnt-have-to-be-game-over/", "published_at": "2020-12-10T13:01:46+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8d9a29f0", "title": "Parse, don’t type-check", "url": "https://neilmadden.blog/2020/11/25/parse-dont-type-check/", "published_at": "2020-11-25T14:56:44+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8e1cba6f", "title": "API Security in Action is published!", "url": "https://neilmadden.blog/2020/11/20/api-security-in-action-is-published/", "published_at": "2020-11-20T21:29:20+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8ef4d064", "title": "Some incomplete thoughts about Gödel", "url": "https://neilmadden.blog/2020/11/17/some-incomplete-thoughts-about-godel/", "published_at": "2020-11-17T11:32:06+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b8fb0d13b", "title": "Macaroon access tokens for OAuth: Part 2 – transactional auth", "url": "https://neilmadden.blog/2020/09/09/macaroon-access-tokens-for-oauth-part-2-transactional-auth/", "published_at": "2020-09-09T15:49:55+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b90174872", "title": "API Security in Action handed over to production", "url": "https://neilmadden.blog/2020/08/05/api-security-in-action-handed-over-to-production/", "published_at": "2020-08-05T08:42:02+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b905a5f53", "title": "Least privilege with less effort: Macaroon access tokens in AM 7.0", "url": "https://neilmadden.blog/2020/07/29/least-privilege-with-less-effort-macaroon-access-tokens-in-am-7-0/", "published_at": "2020-07-29T17:20:58+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b913792d1", "title": "What’s the Curve25519 clamping all about?", "url": "https://neilmadden.blog/2020/05/28/whats-the-curve25519-clamping-all-about/", "published_at": "2020-05-28T08:28:11+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b91c7238c", "title": "A flowchart for Cache-Control headers", "url": "https://neilmadden.blog/2020/05/18/a-flowchart-for-cache-control-headers/", "published_at": "2020-05-18T21:58:15+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b928a8645", "title": "Convergence in web and API security", "url": "https://neilmadden.blog/2020/05/10/convergence-in-web-and-api-security/", "published_at": "2020-05-10T17:57:36+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b936457ff", "title": "A few comments on ‘age’", "url": "https://neilmadden.blog/2019/12/30/a-few-comments-on-age/", "published_at": "2019-12-30T10:30:07+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b93f4abaa", "title": "A logical view of objects", "url": "https://neilmadden.blog/2019/11/09/a-logical-view-of-objects/", "published_at": "2019-11-09T21:12:31+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b94aeb6d4", "title": "Re-evaluating Searle’s arguments against machine consciousness", "url": "https://neilmadden.blog/2019/08/19/re-evaluating-searles-arguments-against-machine-consciousness/", "published_at": "2019-08-19T16:00:11+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b951a5d0c", "title": "API Security in Action now in early access", "url": "https://neilmadden.blog/2019/06/13/api-security-in-action-now-in-early-access/", "published_at": "2019-06-13T10:53:06+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b95a1fd76", "title": "Why you really can parse HTML (and anything else) with regular expressions", "url": "https://neilmadden.blog/2019/02/24/why-you-really-can-parse-html-and-anything-else-with-regular-expressions/", "published_at": "2019-02-24T15:02:32+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b9614d9c5", "title": "Can you ever (safely) include credentials in a URL?", "url": "https://neilmadden.blog/2019/01/16/can-you-ever-safely-include-credentials-in-a-url/", "published_at": "2019-01-16T15:50:00+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b96ba469c", "title": "Simplifying JOSE", "url": "https://neilmadden.blog/2018/12/16/simplifying-jose/", "published_at": "2018-12-16T17:26:34+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b976d1315", "title": "Public key authenticated encryption and why you want it (Part III)", "url": "https://neilmadden.blog/2018/12/14/public-key-authenticated-encryption-and-why-you-want-it-part-iii/", "published_at": "2018-12-14T20:04:58+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b9853985c", "title": "Public key authenticated encryption and why you want it (Part II)", "url": "https://neilmadden.blog/2018/11/26/public-key-authenticated-encryption-and-why-you-want-it-part-ii/", "published_at": "2018-11-26T18:06:13+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b9952fa7e", "title": "Public key authenticated encryption and why you want it (Part I)", "url": "https://neilmadden.blog/2018/11/14/public-key-authenticated-encryption-and-why-you-want-it-part-i/", "published_at": "2018-11-14T11:50:04+00:00" }, { "id": "01a0bb99-e0bb-70ef-840d-cf9b996ae4ba", "title": "Key-driven cryptographic agility", "url": "https://neilmadden.blog/2018/09/30/key-driven-cryptographic-agility/", "published_at": "2018-09-30T07:25:06+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eac8c872a", "title": "A small tweak to checked exceptions", "url": "https://neilmadden.blog/2018/09/24/a-small-tweak-to-checked-exceptions/", "published_at": "2018-09-24T20:16:53+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eaca0529a", "title": "Moving away from UUIDs", "url": "https://neilmadden.blog/2018/08/30/moving-away-from-uuids/", "published_at": "2018-08-30T09:44:35+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5ead30263d", "title": "Java KeyStores – the gory details", "url": "https://neilmadden.blog/2017/11/17/java-keystores-the-gory-details/", "published_at": "2017-11-17T19:00:20+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eae0f5fde", "title": "Comments turned off", "url": "https://neilmadden.blog/2017/05/18/comments-turned-off/", "published_at": "2017-05-18T13:58:06+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eae6ba3ec", "title": "So how *do* you validate (NIST) ECDH public keys?", "url": "https://neilmadden.blog/2017/05/17/so-how-do-you-validate-nist-ecdh-public-keys/", "published_at": "2017-05-17T16:41:54+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eaf0d50e7", "title": "Updating OpenAM’s encryption", "url": "https://neilmadden.blog/2017/03/27/updating-openams-encryption/", "published_at": "2017-03-27T15:33:05+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eaf48e90b", "title": "Should you use JWT/JOSE?", "url": "https://neilmadden.blog/2017/03/15/should-you-use-jwt-jose/", "published_at": "2017-03-15T13:25:53+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eaf61b015", "title": "Critical thinking for software engineers", "url": "https://neilmadden.blog/2016/09/13/critical-thinking-for-software-engineers/", "published_at": "2016-09-13T15:00:00+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eafb6862d", "title": "Bloom Filter session logout – some numbers", "url": "https://neilmadden.blog/2016/06/06/bloom-filter-session-logout-some-numbers/", "published_at": "2016-06-06T10:29:32+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eafbe0c61", "title": "Ephemeral elliptic curve Diffie-Hellman key agreement in Java", "url": "https://neilmadden.blog/2016/05/20/ephemeral-elliptic-curve-diffie-hellman-key-agreement-in-java/", "published_at": "2016-05-20T09:57:07+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb089d437", "title": "Stateless Session Logout in OpenAM 13", "url": "https://neilmadden.blog/2016/02/25/stateless-session-logout-in-openam-13/", "published_at": "2016-02-25T01:26:55+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb08d4923", "title": "Solving the GCHQ Christmas puzzle (part 1) with Constraint Programming", "url": "https://neilmadden.blog/2015/12/15/solving-the-gchq-christmas-puzzle-part-1-with-constraint-programming/", "published_at": "2015-12-15T20:19:00+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb0f2eba0", "title": "The Real Dangers of Artificial Intelligence", "url": "https://neilmadden.blog/2015/07/08/the-real-dangers-of-artificial-intelligence/", "published_at": "2015-07-08T21:39:12+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb17e0ace", "title": "ThreadLocal variables and PermGen memory leaks – not always a leak", "url": "https://neilmadden.blog/2014/07/21/threadlocal-variables-and-permgen-memory-leaks-not-always-a-leak/", "published_at": "2014-07-21T14:10:00+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb1ea2d53", "title": "The curious case of transient final locks and CopyOnWriteArrayList", "url": "https://neilmadden.blog/2014/07/17/the-curious-case-of-transient-final-locks-and-copyonwritearraylist/", "published_at": "2014-07-17T13:03:04+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb226d1c5", "title": "Single Interface Java 8 Applications", "url": "https://neilmadden.blog/2014/04/03/single-interface-java-8-applications/", "published_at": "2014-04-03T10:06:19+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb2cfd23b", "title": "Java 8 Sieve of Eratosthenes", "url": "https://neilmadden.blog/2014/01/30/java-8-sieve-of-eratosthenes/", "published_at": "2014-01-30T19:55:22+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb30f2278", "title": "Pimp my Java!", "url": "https://neilmadden.blog/2012/06/03/pimp-my-java/", "published_at": "2012-06-03T20:35:08+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb3d56220", "title": "Relations ain’t “flat”", "url": "https://neilmadden.blog/2010/08/31/relations-aint-flat/", "published_at": "2010-08-31T10:57:39+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb43983b0", "title": "The right defaults", "url": "https://neilmadden.blog/2010/03/15/the-right-defaults/", "published_at": "2010-03-15T11:49:51+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb493b682", "title": "Are cells a good analogy for software?", "url": "https://neilmadden.blog/2010/01/08/are-cells-a-good-analogy-for-software/", "published_at": "2010-01-08T15:37:00+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb50b5ca6", "title": "First class and higher-order", "url": "https://neilmadden.blog/2009/12/17/first-class-and-higher-order/", "published_at": "2009-12-17T15:58:21+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb601a18b", "title": "Where is the Web going?", "url": "https://neilmadden.blog/2009/08/24/where-is-the-web-going/", "published_at": "2009-08-24T01:46:46+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb6c49b47", "title": "Aeroplanes and Treadmills", "url": "https://neilmadden.blog/2008/09/08/aeroplanes-and-treadmills/", "published_at": "2008-09-08T14:49:17+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb6c91a1f", "title": "Computers and numbers", "url": "https://neilmadden.blog/2008/08/07/computers-and-numbers/", "published_at": "2008-08-07T11:42:50+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb75e02b4", "title": "The Decline of Violence", "url": "https://neilmadden.blog/2008/08/06/the-decline-of-violence/", "published_at": "2008-08-06T16:30:00+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb8400a67", "title": "60 Years since The Baby", "url": "https://neilmadden.blog/2008/06/21/60-years-since-the-baby/", "published_at": "2008-06-21T12:48:29+00:00" }, { "id": "01a0bba0-be63-70bd-8791-4a5eb896a70c", "title": "Hello world!", "url": "https://neilmadden.blog/2008/05/18/hello-world/", "published_at": "2008-05-18T03:40:03+00:00" } ] posts Claim your blog

Back to neilmadden.blog

Blog · corpus.blog/blogs/neilmadden.blog/posts

neilmadden.blog

neilmadden.blog

2026

Are we any closer to the Quantum Apocalypse?original ↗

2 Jul 2026

Java’s SSLContext protocol name is a footgun original ↗

23 Jun 2026

Java sealed classes and exhaustive pattern matching original ↗

24 Apr 2026

Mythos and its impact on security original ↗

14 Apr 2026

Maybe version ranges are a good idea after all?original ↗

19 Mar 2026

Why I don’t use LLMs for programming original ↗

2 Mar 2026

Looking for vulnerabilities is the last thing I do original ↗

20 Feb 2026

2025

Were URLs a bad idea?original ↗

12 Nov 2025

Monotonic Collections: a middle ground between immutable and fully mutable original ↗

11 Nov 2025

Fluent Visitors: revisiting a classic design pattern original ↗

4 Nov 2025

Rating 26 years of Java changes original ↗

12 Sept 2025

No, no, no. You’re still not doing REST right!original ↗

9 Jul 2025

Streaming public key authenticated encryption with insider auth security original ↗

2 Jul 2025

Are we overthinking post-quantum cryptography?original ↗

20 Jun 2025

A look at CloudFlare’s AI-coded OAuth library original ↗

6 Jun 2025

2024

The square roots of all evil original ↗

3 Dec 2024

Digital signatures and how to avoid them original ↗

18 Sept 2024

Machine Learning and the triumph of GOFAI original ↗

30 Jun 2024

Galois/Counter Mode and random nonces original ↗

23 May 2024

SipHash-based encryption for constrained devices original ↗

6 May 2024

Newsletter original ↗

6 Jan 2024

2023

A controversial opinion about REST API design original ↗

2 Nov 2023

Regular JSON original ↗

31 May 2023

I still don’t really get “hash shucking”original ↗

27 Apr 2023

Entity authentication with a KEM original ↗

20 Apr 2023

Book review: The Joy of Cryptography original ↗

16 Feb 2023

A few programming language features I’d like to see original ↗

18 Jan 2023

On PBKDF2 iterations original ↗

9 Jan 2023

2022

A few clarifications about CVE-2022-21449 original ↗

25 Apr 2022

CVE-2022-21449: Psychic Signatures in Java original ↗

19 Apr 2022

Is Datalog a good language for authorization?original ↗

19 Feb 2022

Why the OAuth mTLS spec is more interesting than you might think original ↗

20 Jan 2022

2021

Multiple input MACs original ↗

27 Oct 2021

From KEMs to protocols original ↗

8 Apr 2021

How do you use a bearer URL?original ↗

24 Mar 2021

Towards a standard for bearer token URLs original ↗

20 Mar 2021

When a KEM is not enough original ↗

16 Feb 2021

Hybrid encryption and the KEM/DEM paradigm original ↗

22 Jan 2021

2020

Making things original ↗

29 Dec 2020

XSS doesn’t have to be game over original ↗

10 Dec 2020

Parse, don’t type-check original ↗

25 Nov 2020

API Security in Action is published!original ↗

20 Nov 2020

Some incomplete thoughts about Gödel original ↗

17 Nov 2020

Macaroon access tokens for OAuth: Part 2 – transactional auth original ↗

9 Sept 2020

API Security in Action handed over to production original ↗

5 Aug 2020

Least privilege with less effort: Macaroon access tokens in AM 7.0 original ↗

29 Jul 2020

What’s the Curve25519 clamping all about?original ↗

28 May 2020

A flowchart for Cache-Control headers original ↗

18 May 2020

Convergence in web and API security original ↗

10 May 2020

2019

A few comments on ‘age’original ↗

30 Dec 2019

A logical view of objects original ↗

9 Nov 2019

Re-evaluating Searle’s arguments against machine consciousness original ↗

19 Aug 2019

API Security in Action now in early access original ↗

13 Jun 2019

Why you really can parse HTML (and anything else) with regular expressions original ↗

24 Feb 2019

Can you ever (safely) include credentials in a URL?original ↗

16 Jan 2019

2018

Simplifying JOSE original ↗

16 Dec 2018

Public key authenticated encryption and why you want it (Part III)original ↗

14 Dec 2018

Public key authenticated encryption and why you want it (Part II)original ↗

26 Nov 2018

Public key authenticated encryption and why you want it (Part I)original ↗

14 Nov 2018

Key-driven cryptographic agility original ↗

30 Sept 2018

A small tweak to checked exceptions original ↗

24 Sept 2018

Moving away from UUIDs original ↗

30 Aug 2018

2017

Java KeyStores – the gory details original ↗

17 Nov 2017

Comments turned off original ↗

18 May 2017

So how *do* you validate (NIST) ECDH public keys?original ↗

17 May 2017

Updating OpenAM’s encryption original ↗

27 Mar 2017

Should you use JWT/JOSE?original ↗

15 Mar 2017

2016

Critical thinking for software engineers original ↗

13 Sept 2016

Bloom Filter session logout – some numbers original ↗

6 Jun 2016

Ephemeral elliptic curve Diffie-Hellman key agreement in Java original ↗

20 May 2016

Stateless Session Logout in OpenAM 13 original ↗

25 Feb 2016

2015

Solving the GCHQ Christmas puzzle (part 1) with Constraint Programming original ↗

15 Dec 2015

The Real Dangers of Artificial Intelligence original ↗

8 Jul 2015

2014

ThreadLocal variables and PermGen memory leaks – not always a leak original ↗

21 Jul 2014

The curious case of transient final locks and CopyOnWriteArrayList original ↗

17 Jul 2014

Single Interface Java 8 Applications original ↗

3 Apr 2014

Java 8 Sieve of Eratosthenes original ↗

30 Jan 2014

2012

Pimp my Java!original ↗

3 Jun 2012

2010

Relations ain’t “flat”original ↗

31 Aug 2010

The right defaults original ↗

15 Mar 2010

Are cells a good analogy for software?original ↗

8 Jan 2010

2009

First class and higher-order original ↗

17 Dec 2009

Where is the Web going?original ↗

24 Aug 2009

2008

Aeroplanes and Treadmills original ↗

8 Sept 2008

Computers and numbers original ↗

7 Aug 2008

The Decline of Violence original ↗

6 Aug 2008

60 Years since The Baby original ↗

21 Jun 2008

Hello world!original ↗

18 May 2008