iiinova — where your digital self keeps evolving

When correctness and trust matter, leaning on well-established libraries is usually the better choice, even if that means stepping outside the usual stack. As a bonus, picking up a new language again turns out to be a very welcome detour. #BuildInPublic #DNS #Rust

051

My main takeaway is that reimplementing core Internet protocols in high-level languages can be interesting and educational, but often leads to unreliable results.

120

This gives me parallel batch queries, fresh results, DNSSEC validation, support for legacy SPF records, and accurate TTL metadata, all without reimplementing low-level DNS behavior myself.

120

I step back and explore an alternative. After spending a few hours learning Rust and its approach to memory management, I wrote my first code wrapping libunbound, a widely used DNS resolver. It is clear that this solution would not have been as approachable without AI support.

120

The tree walk gets confused by zone delegation. What I expect to be a four-hour fix turns into a much deeper problem and several weeks of work. It becomes clear that this is not just a flawed implementation. The underlying model is wrong.

100

That leads me to implement a DNS tree walk in Node.js. Initially, the solution looks promising. Then a single DNS query changes everything. My algorithm reports a record as absent when it clearly exists.

100

For setup guidance and alerts, I rely on DNS records and metadata that have not been cached, so I can observe changes as they actually happen. Node.js’ native DNS APIs seem sufficient at first. To get fresh answers, however, I need to identify the closest DNS server myself.

100

Fränz Friederes @fraenz.frieder.es · 16/10/2025

Building an email monitoring SaaS, I need uncached, fresh DNS data using Node.js. Over time, I realize that the entire approach is flawed.

Screenshot of a DNS record detail view, showing the TXT DMARC record value, the exact TTL, DNSSEC validation status, and the time range during which the record was observed.

151

I see why, it‘s introducing the leaking issue. On the other hand, I don‘t want to introduce passwords in the first place. To me, 2FA would only be applicable to magic link auth which kind of breaks the multi factor idea with „two things I have.“ Also, it’s more the user needs to learn.

100

Fränz Friederes @fraenz.frieder.es · 16/10/2025

Thank‘s for the hint about the spec mention! I would never have thought they would recommend a hack like providing „plausible imaginary values“ as credential ids for mitigation. What do you mean by distinct auth flow? Do you consider non-res keys 2fa-only?

100

How do we solve this securely, without introducing #WebAuthn in a way that weakens the login flow? Would love to hear how others are approaching this problem.

000

If we return credential IDs based on an email address, we leak whether an account exists for that email. That’s introducing an account-enumeration risk when implementing a new authentication method that is supposed to strengthen security. Many providers seem to accept it.

200

One open question: How should we handle non-residential credentials (like security keys) in a passwordless login flow? These credentials need a credential ID created during setup. But to fetch that ID, we first need to identify the user e.g. by email.

100

Nordic.js @nordicjs.com · 02/10/2025

Inspired by a #NordicJS talk on #Passkeys, I started implementing them for my passwordless SaaS. While working through the database schema and complex server logic, I noticed that key parts of the login flow are still under debate.

100

Reposted by Fränz Friederes

We’re going live! Couldn’t make it to Stockholm? Don’t worry, you can still join #NordicJS from wherever you are. Tune in to our livestream today and catch all the talks, inspiration, and JavaScript magic in real time. 👉 nordicjs.com/live

0144

Fränz Friederes @fraenz.frieder.es · 25/07/2025

Actually, I was also rooting for a DNS issue rather than a cyber attack 👀

000

Serverless doesn’t mean no servers. It means no servers I need to manage. It shifts responsibility to experts, so I can focus on what I do best: building the product. #BuildInPublic #Serverless

020

Serverless (for me, AWS Lambda) lets me draw a clear boundary: Code is my responsibility. The OS, hardware, and network security? Amazon’s. It’s not a shortcut, it’s a conscious tradeoff.

100

As a solo dev, I can’t stay on top of every CVE, kernel patch, or OS-level exploit. Owning the full stack means signing up for a 24/7 job in security and ops, on top of product, support, and everything else.

100

Yes, #serverless still runs on servers. The difference? They’re not mine to worry about.

Diagram titled “My responsibilities with a serverless stack” showing a vertical stack of labeled boxes. Only “Application code” is left unmarked, indicating it’s the developer’s responsibility. The other layers “Operating system,” “Virtualization,” “Physical hardware,” and “Data center access control” are each crossed out, illustrating that these are not managed by the developer when using a serverless setup.

This is Rocky a.k.a. Klenge Miiss

A black-gray British Shorthair sitting on a wooden deck chaire outside in the garden.

010

Find a Veteran by searching the Bletchley Park Roll of Honour, which lists all those believed to have worked in signals intelligence during World War Two.

Hosting an Enigma simulator for over a decade now, it felt natural to put a portion of @cryptii.com’s ad revenue toward a brick in Pamela’s name: Brick B2:64 on the Codebreakers’ Wall. Find out more about Pamela Downing and Bletchley Park here: www.bletchleypark.org.uk/roll-of-hon...

bletchleypark.org.uk

Roll of Honour

020

Like many at Bletchley, her contributions went unrecognised for decades. I first came across Pamela’s name earlier this year, while asking which names were still missing from the Codebreakers’ Wall at Bletchley Park.

100

She worked in the “Netz” room, handling raw Enigma signals, and later as a Modified Typex operator decoding messages using keys discovered by the Bombe, a unique electro-mechanical cryptanalysis machine.

100

From 1941 to 1945, Pamela served in Hut 6 and Block D(6), where intercepted German Army and Air Force messages were processed.

100

7,500 women helped end WWII at Bletchley Park. Pamela Downing was one of them. I wanted her name on the wall.

Pamela Downing 20 years © morganfourman.com

252

Oh, I thought this was a joke but now I see it, too! It's actually done really well!

010

This setup delivers the best of both worlds: - Fast joins and cache-friendly indexes - Opaque, secure public IDs with great DX No need to compromise. #BuildInPublic #Postgres

031

So I split responsibilities: - `privateId`: a sequential `bigserial`, used only for db internal references - `id`: a prefixed Nano ID like `us_msny03yjrocv`, used everywhere else The prefix (e.g. us_, ag_, dn_) reveals the entity type. The rest is short, unambiguous, and random.

Postgres' `bigserial` is compact, fast, and plenty large. But it leaks row counts and makes your API vulnerable to ID enumeration. UUIDs solve that, but they’re bulky, slow to index, and annoying to select or copy.

Sequential IDs are faster. UUIDs are safer. I wanted both speed and security, so I picked both.

Screenshot of a database table showing team data with two ID columns: privateId, a sequential number, and id, a prefixed Nano ID like tm_imswzl4d93om used externally. The table includes names like Alice, Bob, and Wierk, and is ordered by privateId.

So I scrapped it. Stripe now owns pricing, plans, usage limits, and trials. I use Stripe’s dashboard as my UI. My app listens to webhooks, copies limits once, and stays out of the way. #BuildInPublic #Stripe

010

I realized: “Will I still remember how this sync works in 6 months?” Pricing changes, trial lengths, feature flags, it was all getting too rigid, too fast. And if it’s too complex, I’ll stop touching it. That’s a problem.

100

At first, I was excited. I started designing my own pricing, product, and subscription tables, everything modeled neatly in my database. But then I paused.

100

After a year of building my SaaS, I finally integrated Stripe for self-service subscriptions. I almost overengineered billing before ever charging anyone.

Screenshot of Stripe’s product metadata editor, showing plan limits such as data retention days, max active domains, and email volume for a SaaS subscription.

100

Ah, got it. I‘m of no help, though.

000

Fränz Friederes @fraenz.frieder.es · 08/07/2025

Wait, you wanna pay money but are waiting for approval by support?

100

It’s the same when a customer asks you something in person: even if you know the answer, pausing for a second, taking time to think, makes it feel so much more thoughtful to them. Now I'm actually wondering, if I should include a delay in mutation requests 🙈