Sign in

Justin Richer

@justin.richer.org
187 followers 42 following 32 posts

Security architect, musician, author, game designer, and otherwise boring guy. Opinions are not facts.

PostsRepliesMedia
Justin Richer @justin.richer.org · 29/09/2026
The authorization code in OAuth 2 needs to get back to the client, but what if you can't read a URL on the return? I think we can use HKDF and a bit of copy-and-paste to get by. justinsecurity.medium.com/out-of-band-...
justinsecurity.medium.com
Out-of-Band Authorization Codes
The authorization code flow of OAuth 2 (and by extension, OpenID Connect) is designed around one key assumption: on the way back from the…
000
Reposted by Justin Richer
M Meerkat @kackbro.bsky.social · 22/09/2026
Elizabeth Warren Is Correct.......
671391506
Reposted by Justin Richer
Robert Reich @rbreich.bsky.social · 20/09/2026
For those who have forgotten the past 40 years: Tax cuts for the rich ...don’t trickle down Boosting military spending ...doesn’t bring peace Slashing regulations ...doesn’t create jobs Folks, we’ve seen this all before.
352160655289
Justin Richer @justin.richer.org · 16/09/2026
"Gym Bro" is out. Now they're "Gymothies"
000
Reposted by Justin Richer
Puff the Magic Hater @mskellymhayes.bsky.social · 12/09/2026
It's not about "fairness in women's sports" any more than it was about "ethics in gaming journalism."
22037431
Justin Richer @justin.richer.org · 03/09/2026
I just implemented my own left-pad function for key processing. I find this need particularly hilarious given the history of left-pad functions.
Do you know the tragedy of left-pad the wise?
000
Reposted by Justin Richer
Tim Cappalli @timcappalli.me · 29/08/2026
meatproxy.me 💀
meatproxy.me
Don't be a Meat Proxy.
You have a brain. Use it. Someone thinks you might be forwarding AI answers and calling it work.
151
Justin Richer @justin.richer.org · 28/08/2026
Curl has added experimental support for HTTP Message Signatures (RFC9421) in the next release! daniel.haxx.se/blog/2026/07...
daniel.haxx.se
HTTP Message Signatures with curl
The recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them. Message Signatures The specification describes this as a mechanis...
020
Reposted by Justin Richer
Ross Johnson @rosserford.bsky.social · 26/08/2026
We’re going to hear about how everyone loved Dolly, and that feels true. But it’s good to remember, and to her credit, that she was attacked for her AIDS activism, her vaccine advocacy, her LGBTQ+ support and even, more recently, for her reading initiatives. She ALWAYS stood firm when it mattered.
326301916760
Justin Richer @justin.richer.org · 25/08/2026
hot take: you can't pretend to be humble with "this isn't my area of expertise" when you immediately follow by fighting with the actual experts in the area.
000
Reposted by Justin Richer
Qasim Rashid, Esq. @qasimrashid.com · 26/07/2026
Mitch McConnell hasn’t been seen or heard from in 6 weeks(!) in the hospital. Yet he still has a job, still getting paid, and getting unlimited world class healthcare. The man who voted against a living wage, against universal healthcare, and against guaranteed paid leave—is now getting all three.
1152220687394
Reposted by Justin Richer
Dr. Jeroen W.P. Wijnendaele @drdragases.bsky.social · 27/07/2026
Good grief, this hits home.
324138014874
Reposted by Justin Richer
Brett Meiselas @bmeiselas.bsky.social · 24/07/2026
lots of reporters suddenly worried about slipping into communism but strangely f*cking quiet about slipping into fascism
677235345736
Reposted by Justin Richer
Larry Mitchell @drlarrymitchell.bsky.social · 14/07/2026
The two ICE agents who murdered a civilian in Biddeford, Maine today. Let's make them famous.
891104326616
Reposted by Justin Richer
65yearcitizen @usa24freedom.bsky.social · 02/07/2026
520133525449
Reposted by Justin Richer
Robert Reich @rbreich.bsky.social · 28/06/2026
Just 10 people have already poured $617 MILLION into this year’s midterm elections. In the entire 2008 presidential cycle, the last election before Citizens United, total billionaire spending was $16 million. This is not sustainable. We need to get Big Money out of our democracy.
27794593342
Reposted by Justin Richer
The Cola Corporation @cola.baby · 22/06/2026
“Librarians are harming our children by exposing them to sexuality when they are way too young.” No, you’re thinking of youth pastors.
16768401161
Reposted by Justin Richer
สุพรรณิกาทร์ Supanika Ordoñez @spiraledu.bsky.social · 19/06/2026
Just a reminder that the US Woman’s team has won the World Cup four times already.
187107461818
Reposted by Justin Richer
Mark Hamill @markhamillofficial.bsky.social · 05/06/2026
Dozey Don went to the trouble of actually creating a chart to compare the length of the Reflecting Pool to the height of 3 various skyscrapers, for some reason known only to him. Towering over ALL of them is, of course, the #EPSTEIN_Files. #TheMidtermsCantComeSoonEnough
907161574339
Reposted by Justin Richer
Aletheia S.R. @aletheia225.bsky.social · 29/05/2026
ICE was "supposedly" created to protect the country from terrorism, and it turns out that ICE is the terrorists. Foreign interference, and ICE must end. It's a corrupt institution.
18956481456
Reposted by Justin Richer
Richard Esplin @esplinr.bsky.social · 19/05/2026
I'm excited to be part of an event with @justin.richer.org next week. I learn so much every time I talk with him! We're going to discuss identity architecture that support zero trust: VCs, NHI, GNAP, SPIFFE and more. You can join us and have your own questions answered: www.dock.io/live-event-c...
dock.io
Live Event - Can we really have Zero Trust with a federated identity architecture?
We'll be bringing Justin Richer (MongoDB) for a live discussion with Richard Esplin (Dock Labs) and Agne Caunt (Dock Labs) about whether traditional perimeter-based approaches are fundamentally incomp...
012
Justin Richer @justin.richer.org · 11/05/2026
Today in "why is this so broken", I am emailing myself files between two laptops who are sitting next to each other on the same desk, on the same network, with the same person (me) running them.
020
Reposted by Justin Richer
💞Sabrina💞 @sabrinarina.bsky.social · 08/05/2026
Seeing people talking about Alabama & Tennessee like they won a sports game instead of acknowledging that disenfranchising millions of voters on the side of human rights comes with life & death consequences to our most vulnerable populations is absolutely disgusting.
1039990
Reposted by Justin Richer
Laurie Ulster @floobish.bsky.social · 12/04/2026
Octavia E. Butler, 1998:
From EARTHSEED: THE BOOKS OF THE LIVING

Choose your leaders

with wisdom and forethought.

To be led by a coward

is to be controlled

by all that the coward fears.
To be led by a fool


is to be led

by the opportunists

who control the fool.

To be led by a thief

is to offer up

your most precious treasures

to be stolen.
To be led by a liar


is to ask

to be told lies.

To be led by a tyrant

is to sell yourself

and those you love

into slavery.
25197463666
Reposted by Justin Richer
cliffdubya.bsky.social @cliffdubya.bsky.social · 31/03/2026
These are social media messages from Trump.
661065440
Reposted by Justin Richer
Joyce Park @troutgirl.bsky.social · 27/03/2026
I love OAuth and I hate OAuth.
183
Reposted by Justin Richer
Mrs. Betty Bowers @mrsbettybowers.bsky.social · 28/03/2026
To whoever did this at the #NoKings in Boston: Thank you.❤️ It made me tear up. And we must to be reminded of needless damage to humanity that results directly from the careless, bellicose bluster coming from the Pentagon and White House.
6664013611488
Reposted by Justin Richer
marohgr.bsky.social @marohgr.bsky.social · 25/01/2026
www.theatlantic.com/ideas/2026/0...
theatlantic.com
Yes, It’s Fascism
Until recently, I thought it a term best avoided. But now, the resemblances are too many and too strong to deny.
3471154
Reposted by Justin Richer
Merriam-Webster @merriam-webster.com · 15/12/2025
Merriam-Webster’s human editors have chosen ‘slop’ as the 2025 Word of the Year.
357238407191
Justin Richer @justin.richer.org · 12/12/2025
A new small update to mkjwk.org, thanks to some folks from the community. A couple small bugs were fixed, plus you can now copy and save a key configuration as a URL that you can pass around. This doesn't copy your key values, but it does set all the generator's parameters.
mkjwk.org
mkjwk - JSON Web Key Generator
000
Reposted by Justin Richer
Desert Bus for Hope 🚌 #DB2026 OCTOBER 23rd @desertbus.org · 05/12/2025
All righty, we got the all clear this time. Follow Dan as he explores the "cost" of a Desert Bus:
youtube.com
What's the "Cost" of a Desert Bus?
YouTube video by Folding Ideas
340469
Justin Richer @justin.richer.org · 16/11/2025
Wooo, I won some dice! Maybe I'll try that dungeons and dragons thing I keep hearing about.
030
Reposted by Justin Richer
Chad Kohalyk @chadkoh.com · 05/11/2025
"There's a there there." #ietf124 Lots of enthusiasm and positivity (and advice from experienced folks) for forming an #atproto WG at @ietf.org We had 130 people on the stream and a very active chat. Great job @bnewbold.net and @dholms.xyz and everyone else. Thank you all for showing up! 👏
side by side screens of the audience and the moderators at the IETF meeting in Montreal
26011
Reposted by Justin Richer
SwiftOnSecurity @swiftonsecurity.com · 04/11/2025
How do you end up confused and wildly variable about your disposition towards a President... in their second term? Come on brah Brah ur killin me here Ur killin us
31174
Reposted by Justin Richer
NPR @npr.org · 25/09/2025
Thousands of years before Jimmy Kimmel and Stephen Colbert got under President Trump's skin, ancient Greek and Roman poets and philosophers paid a heavy price for displeasing heads of state.
n.pr
What Kimmel and Colbert can learn from ancient comedians who ticked off their leaders
Thousands of years before Jimmy Kimmel and Stephen Colbert got under President Trump's skin, ancient Greek and Roman poets and philosophers paid a heavy price for displeasing heads of state.
1823845
Justin Richer @justin.richer.org · 19/08/2025
Dear literally every company but mostly Zoom right now: I do not want your AI chatbot, and I especially do not want it taking up 1/3 of my window space to the detriment of everything I use your app for. I don't want tips for icebreakers, I want to have my meeting.
020
Reposted by Justin Richer
Jon Cooper @joncooper-us.bsky.social · 14/08/2025
👇👇
753200377290
Reposted by Justin Richer
Alexandria Ocasio-Cortez @aoc.bsky.social · 04/07/2025
Freedom from kings. Freedom from fascism. Power to the people forever. ♥️ Happy Independence Day 🇺🇸
999587389053
Reposted by Justin Richer
George Takei @georgetakei.bsky.social · 04/07/2025
Can’t make this up.
3079358419325
Reposted by Justin Richer
Raider @iwillnotbesilenced.bsky.social · 03/07/2025
This must end now! Everyone needs to hit the streets and fight back ✊ It’s only going to get worse 🤬
134483443579
Justin Richer @justin.richer.org · 02/07/2025
Welp, don't think this is going to be very useful.
030
Justin Richer @justin.richer.org · 01/07/2025
In case you missed it, I've recently joined @mongodb.bsky.social www.linkedin.com/feed/update/...
linkedin.com
A bit of exciting news that I can finally share - I've joined MongoDB! | Justin Richer
A bit of exciting news that I can finally share - I've joined MongoDB! Now you might be thinking what I did at first -- why a database company? I mean, it's a pretty cool database, and I'v...
030
Reposted by Justin Richer
Chris Plummer @chrisplummer.bsky.social · 28/06/2025
The year is 2025. There is a nationwide recall on rice, one of the most popular commodities on Earth. You grab your phone and click a link to learn more. Your risk will be revealed after you endure 479 HTTP transactions loaded from 126 IP addresses homed in 8 countries landing 207 cookies.
(yes, all of those numbers are real)
433095
Justin Richer @justin.richer.org · 05/06/2025
I'm going to start saying that MCP stands for "MCP Common Proxy", following the great tradition of GNU and WINE.
021
Reposted by Justin Richer
CJ @108karuna.bsky.social · 24/05/2025
121590447
Justin Richer @justin.richer.org · 21/05/2025
I just released a new version of my HTTP Signatures library for Java, which fixed up a couple small bugs and added the core test cases from the RFC: central.sonatype.com/artifact/io....
central.sonatype.com
Maven Central: io.bspk:httpsig:1.0.0
Discover httpsig in the io.bspk namespace. Explore metadata, contributors, the Maven POM file, and more.
000
Justin Richer @justin.richer.org · 15/05/2025
Defining security for MCP has been raising a lot of questions and discussions, and I think one of the most important ones is clarity around how the two sides of the MCP proxy relate from a security perspective. justinsecurity.medium.com/tangled-toke...
justinsecurity.medium.com
Tangled Tokens and Authorized Agents
Right now, many folks are excited about the prospect of agentic AI: intelligent computer systems that can access your stuff and do useful…
001
Reposted by Justin Richer
Brian Galle @bdgesq.bsky.social · 02/05/2025
Which federal crime did the President commit with this statement? Was it 26 usc 7217, which prohibits the President or his aides from directing any tax enforcement action? Or was it 26 usc 6103, which prohibits any government official from disclosing an ongoing tax proceeding? Maybe both!
532366710