Certificate expiration is a team problem that keeps getting assigned to one person. We just shipped the tools to fix that.

GitHub felt more reliable when it was a pile of ruby on rails and a fistful of dreams.

Get your last 1 year SSL certificates now, while the gettin is good.

New post. AI code looks great in the diff and breaks on the first edge case. The instinct is to reverse-engineer the author's assumptions, but that approach is slow and usually wrong.

If you’re still treating cert renewals like a calendar reminder, March is gonna be spicy.

This is one of my favorite cybersecurity posts we've done. I dug into the data on MITM attacks and the threat model most of us worry about is basically fiction.

The ICE surge in Minnesota cost $280M, to detain 4k people of whom only 30 were accused of violent crimes. $9 million per capture of the "worst of the worst". Plus two citizens murdered. ~ Veterans for Peace

I keep seeing AI-generated diffs that are plausible and wrong in the most annoying ways: missing guards, cargo-cult hooks, swallowed promises. If your review is vibes, you’re gambling. Production has receipts.

My first published software was part of a level pack for Duke Nukem.

We wanted to understand how rugged English-Scots-Irish culture has shaped America. So we talked to three white South African billionaires at a sex party in the Bahamas.

BygoneSSL isn't theoretical. We found a valid certificate on our own domain, issued to someone we've never met. Getting it revoked was an experience.

“Go to sleep with itchy butt, wake up with stinky finger” This game was such a gem for teenage todd 🤣

It’s weird to see people who aren’t from Minnesota talking about Minnesota.

Jikipedia turns Epstein’s emails into an encyclopedia of the his powerful friends

📢 Attention Software Developers! The #EarlyBird ticket offer for NDC Toronto closes this Monday, Feb 16th 🇨🇦 Join @stevesanderson.bsky.social and 55 other industry experts for 4 days of learning, networking, and fun! Secure your spot 👉 ndctoronto.com

Your Speed Index is bad but the page looks fine? Lighthouse records a video of your page loading and scores how fast the viewport fills in. Not just the first pixel, the whole visual experience. requestmetrics.com/web-performa... #WebPerf

“Certificate automation” that ends at issuance is wishful thinking. CertKit Agent is issue, deploy, verify, plus the boring stuff like perms and restarts.

I want to have a test Windows Server/IIS Server to test integrations with @certkit.io. It doesn't need to save any state. Microsoft friends, what's the best way to do this?

I made a little software platform for people to keep track of what's in their home bar. hmu if you wanna try it out yourself. booz.bar/about/

Certbot exiting 0 is not success. If you’re not deploying everywhere and verifying a real TLS handshake, you didn’t automate anything.

Lighthouse’s “First Meaningful Paint” sounds important. It isn’t. It’s deprecated, misleading, and still confusing people into fixing the wrong stuff. Here’s what FMP actually was, why Google killed it, and what to watch instead. requestmetrics.com/web-performa... #webperf #corewebvitals

I’ve debugged this exact Safari error way too many times. It usually shows up after someone copies WKWebView code into a regular browser context and everything explodes. If this feels familiar, you’re not alone.

We spent years with rsync cron jobs and Ansible playbooks distributing certificates. Turns out we'd poorly reinvented centralized certificate management. Wrote about why CertBot's model breaks.

Unexpected end of input errors in production? Your code is fine. The server returned nothing when your JSON parser expected data. Empty responses, HTML error pages, truncated network calls. trackjs.com/javascript-e... #JavaScript #WebDev

Let's Encrypt is going to 45-day certificates by February 2028. Authorization reuse drops to 7 hours. This will expose every shop that thought they had automation but really just had a cron job.

The Brave Little Guillotine (2025)

Your hero image takes 5 seconds to show up? Users already hit the back button. That's Largest Contentful Paint killing your conversions and search rankings. Here's how to fix it: requestmetrics.com/web-performa... #WebPerf #CoreWebVitals

Firefox throws "undefined has no properties" when you destructure null or undefined. It's the least helpful error message of all browsers for this problem. What's happening and how to fix it: trackjs.com/javascript-e... #JavaScript #Firefox

New CertKit feature: applications with scoped API keys. Split your certificates by product or environment. If a key leaks, you're not revoking access to everything.

This is how CertKit handles DNS validation. You never give us credentials to your zone, we can only respond to challenges for domains you've explicitly delegated.

First Contentful Paint isn't about speed. It's about trust. Every millisecond of blank screen makes users wonder if your site is broken. Under 1.8 seconds tells them "I got you, content is coming." requestmetrics.com/blog/lightho... #WebPerf #CoreWebVitals

We published the CertKit roadmap. Unlike most company roadmaps, it's not vague promises about AI-powered synergies. It's a list of features with vote buttons. Tell us what you actually need. www.certkit.io/blog/what-sh... #CertificateManagement #PKI

Destructuring fails loud. That's actually good. Unlike dot notation that silently returns undefined, destructuring throws immediately when data is missing. Catches bugs faster. trackjs.com/javascript-e... #javascript #webdev

"Free certificates? For production?" Yes. Let's Encrypt uses the same encryption as that $500 EV cert. Chrome killed the green bar in 2018. Amazon, Netflix, and Walmart all use DV certs. Your objections are probably institutional habit, not evidence www.certkit.io/blog/should-... #PKI #WebSecurity

@bsky.app I am being “followed” by new 30 bots a day. I am more convinced everyday that this network is dead. What are you doing about it?

"Right side of assignment cannot be destructured" is Safari's way of saying you tried to destructure null or undefined. Chrome tells you which property failed. Safari makes you guess. trackjs.com/javascript-errors/right-side-of-assignment-cannot-be-destructured/ #javascript #webdev

Missing the viewport meta tag? Your mobile users are waiting an extra 300ms on every single tap. Browsers add that delay to check for double-tap zooming. One line of HTML fixes it. requestmetrics.com/blog/lightho... #WebPerf #SEO

DNS-01 validation requires changing TXT records on every certificate renewal. With 47-day lifetimes coming, that's going to hurt. DNS-PERSIST-01 fixes it: validate once, get certs forever. www.certkit.io/blog/dns-per... #ACME #PKI

Seeing a sudden spike of 404 errors for ads.txt, security.txt, and /.well-known/ files? It's probably @httparchive.org Almanac scanning with WebPageTest Not a bug, just bot noise. trackjs.com/javascript-e... #javascript #webdev

Most web servers ignore URL casing. But Node and Python don't. If /User/Profile and /user/profile are different routes in your app, our new "Preserve Casing" setting keeps them separate in your reports. requestmetrics.com/blog/product... #WebPerf #WebDev

Do you still need wildcard certificates? Wildcard vs SAN assumes certificates are painful to manage. But once you've automated for 47-day lifetimes, issuing 50 certs takes the same effort as one. The question shifts to security, not convenience. www.certkit.io/blog/do-you-... #PKI #WebSecurity

I'm working on a new idea for a conference talk, Everything you learned about SSL is deprecated. I'd love some feedback on it! gist.github.com/toddhgardner...

CertKit now supports multi-domain certificates. Mix wildcards with specific hostnames on a single cert. Also shipped: actual ACME error messages instead of "something went wrong" and non-sequential IDs to stop enumeration attacks. www.certkit.io/blog/certkit... #SSL #PKI

In 2015, only 40% of websites used HTTPS. Today it's 95%. The ACME protocol made that happen by automating certificate issuance. But it didn't solve certificate operations. That's still your problem. www.certkit.io/blog/how-acm... #ACME #PKI

The worst JavaScript errors are the ones you can't see. "Invalid or unexpected token" usually means invisible characters snuck into your code. Smart quotes from Slack, zero-width spaces, BOM markers. trackjs.com/javascript-e... #javascript #webdev

Just got our last certificate renewal email ever. All our products are now fully automated with CertKit. No more $144/year wildcard certs. No more renewal reminders. No more "your site will be vulnerable" scare tactics. Dogfooding feels so good. #SSL #PKI

The NSA recorded encrypted traffic for years, betting they'd eventually steal your private keys. With RSA key exchange, that worked. PFS broke their playbook. If you're still on TLS 1.2 without ECDHE, your traffic from 2019 might get decrypted tomorrow. www.certkit.io/blog/perfect... #TLS #PKI