{"@attributes":{"version":"2.0"},"channel":{"title":"stern.ca","link":"https:\/\/stern.ca\/","description":"Recent content on stern.ca","generator":"Hugo","language":"en-us","lastBuildDate":"Mon, 25 May 2026 12:00:00 -0300","item":[{"title":"go-authzen: a Go library for the OpenID AuthZEN wire protocol","link":"https:\/\/stern.ca\/posts\/2026-05-25-go-authzen\/","pubDate":"Mon, 25 May 2026 12:00:00 -0300","guid":"https:\/\/stern.ca\/posts\/2026-05-25-go-authzen\/","description":"

OpenID AuthZEN 1.0<\/a>\nwent Final on 2026-01-11. It’s a small, focused spec: the wire protocol\nbetween a Policy Enforcement Point (the bit of your app that asks “can\nthis user do this?”) and a Policy Decision Point (the bit that answers).\nFour endpoint families \u2014 a single evaluation, a batch evaluations call,\nand three “search” variants (which subjects can do this? which resources\ncan this subject touch? which actions can this subject perform?) \u2014 plus\na \/.well-known\/authzen-configuration<\/code> metadata document. That’s the\nwhole surface.<\/p>"},{"title":"plane-forge-bridge: bidirectional issue sync for Plane and Forgejo","link":"https:\/\/stern.ca\/posts\/2026-05-24-plane-forge-bridge\/","pubDate":"Sun, 24 May 2026 12:00:00 -0300","guid":"https:\/\/stern.ca\/posts\/2026-05-24-plane-forge-bridge\/","description":"

Plane<\/a> is a self-hostable project tracker \u2014 the open-source bit of it ships under AGPL and the company makes its money on a Commercial Edition plus a handful of paid integrations. Two of those paid integrations are the GitHub and GitLab connectors that keep issues and PRs in sync with your tracker. They live in a closed-source service called silo<\/strong>, distributed as a binary out of artifacts.plane.so<\/code> and not present in the makeplane\/plane<\/a> repo at all.<\/p>"},{"title":"fj-bellows: ephemeral cloud runners for Forgejo Actions","link":"https:\/\/stern.ca\/posts\/2026-05-23-fj-bellows\/","pubDate":"Sat, 23 May 2026 12:00:00 -0300","guid":"https:\/\/stern.ca\/posts\/2026-05-23-fj-bellows\/","description":"

If you self-host Forgejo Actions today, your options for runners come down to three:<\/p>\n

    \n
  1. Always-on VMs<\/strong> \u2014 fast job pickup, but you pay for idle CPU 24\/7 and jobs share state.<\/li>\n
  2. GitHub-hosted-style autoscaling fleets<\/strong> \u2014 solves the cost problem, but you usually reach for something Kubernetes-shaped to get there.<\/li>\n
  3. Local runners installed alongside Forgejo itself<\/strong> \u2014 easy and free, but they share state between jobs, don’t isolate well, and your Forgejo box ends up doing CI work it shouldn’t.<\/li>\n<\/ol>\n

    I wanted a fourth option for my own homelab: small enough to read in an afternoon, single-binary, one ephemeral cloud VM per job<\/strong>, and clever enough to fill the paid billing hour before tearing things down. So I wrote fj-bellows<\/code>.<\/p>"},{"title":"About","link":"https:\/\/stern.ca\/about\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/stern.ca\/about\/","description":"

    I’m a senior security engineer at AWS, working on internal authorization\nand insider risk in the Access Management Systems organization.<\/p>\n

    Two decades in internet security before AWS: anti-spam at IronPort and\nCisco (founding member of Cisco TRAC), Passive DNS at\nFarsight Security<\/a> where I invented\nNewly Observed Domains, intrusion detection at\nTigera<\/a>, asset attribution at\nSecurityScorecard<\/a>, and threat\nintelligence integrations at DomainTools<\/a>.\nCo-chair stints at M3AAWG (Technical Committee) and MAAWG (Botnet\nSubcommittee). BCS Honours and an abandoned PhD in adversarial\nclassification from Dalhousie.<\/p>"}]}}