Posts

You wake up. It’s dark. Somewhere a fan is humming. Your eyes adjust. You’re in a container. Metal walls, a few small windows, and through them: stars. Just stars. No Earth anywhere. There’s a note taped to the wall: “You have everything you need to survive. Nothing goes in, nothing goes out. Good luck.” I bring this thought experiment up when I’m in the right mood with friends. It sounds like science fiction. What it actually does is strip away the thing most of us never question: the assumption that there is an “outside” that absorbs our mistakes and refills our supplies. ...

I write a lot about Kubernetes. I run it daily. I genuinely like it. So it might surprise you that I spend a fair amount of time talking people out of it. Here is the reality I keep walking into. A small team, a single product, a roadmap full of real features to build, and someone has decided the first milestone is a Kubernetes cluster. Three nodes minimum, etcd, a CNI, an ingress controller, cert-manager, a monitoring stack. Weeks of work before a single customer sees anything. Everyone nods along, because this is just how serious infrastructure looks in 2026. ...

Here is the payoff before the work: I plug in my YubiKey in the morning, type one PIN, and the rest of the day my authentication just happens. SSH to a server, no password. Sign a git commit, no passphrase. Pull a secret out of pass, just touch the key. One physical thing sits in a USB port and the friction is gone. Getting there cost me about three evenings of swearing at gpg-agent. Now that it runs, going back feels unthinkable. ...

I used KeePass for years. Then 1Password. Then Bitwarden. All decent tools, but every one of them felt like too much. Too much UI, too many features, too much friction to wire into the way I actually work. Every time I reached for a password I was reaching across an app boundary, and that small interruption added up. Then I found pass. It does exactly what the name promises: it stores passwords. I want to walk you through it the way I learned it, starting with the one command that hooked me, then adding layers until you can see my full setup. ...

GPG is one of those tools everyone keeps meaning to learn and never does. The docs are a wall of text, the terminology is its own dialect, and the error messages are cryptic in both senses of the word. I put it off for years myself. The thing is, you keep bumping into it. GPG sits under pass, under signed git commits, under encrypted email, under verifying that the binary you just downloaded is the one the maintainer actually shipped. If you care about owning your security instead of trusting a vendor to handle it for you, you end up here eventually. ...