Selected works and long-form writing, with short dated posts in between.
The newest writing open on the desk, then the three before it
All essays08Certificate pinning narrows an app from trusting every CA on the device to trusting keys it names in advance. Nine certificates against an iOS 26.5 simulator show what each kind of pin stops and what it breaks; the rest is why the web gave pinning up, and how to rotate pins without locking out your own users.
7 states between a message being accepted and a result being submitted. A transport can vouch only for the ones it saw.
agents中文
237 additions of the base point: the most that any of the eight keys needed to be found by counting.
pki中文
Harsh can be faked. Precise can't.
philosophy中文
Essays that come in parts, read in order
All series01One CUDA kernel, a matrix transpose, rewritten one idea at a time: first correct, then coalesced, then tiled, then measured.
Things built, each with a log of what changed
All projects10A desktop Markdown editor where you type into the formatted page, and saving leaves every byte you did not touch exactly as it was.
A workbench that replays real Go crypto/tls handshakes step by step, with the bytes, the key schedule, the Go source that ran and the RFCs kept side by side.
Latest in the log: Eight CA keys that fit in one byte
A terminal tool that shows what every Claude Code, Codex, Pi and Cursor session on your machine used and cost, turn by turn, across several accounts.
Short and dated, lighter than an essay
All notes03Essays moved from /writing/ to /essays/ and projects from /works/ to /projects/. Every earlier address still leads to its page in one hop, and the feed keeps the moved pages' old item IDs, so readers are not shown them again.
The minutes on every page come from the page itself: words counted from the rendered text, code and math included, at 200 a minute, or Han characters at 400 a minute on Chinese pages.
The tree beside every page used to be built in the browser from an index of titles and links. It is now rendered with the page, from the same data as the index, so it can show a series' progress, a note's date and a project's status.
The last few things that changed here
The timeline38Every essay, newest first, numbered in the order it was published
Certificate pinning narrows an app from trusting every CA on the device to trusting keys it names in advance. Nine certificates against an iOS 26.5 simulator show what each kind of pin stops and what it breaks; the rest is why the web gave pinning up, and how to rotate pins without locking out your own users.
What it would take for one coding agent to hand work to another, from three tools I built and from the personal agents that got their own addresses this year: who a name points to, the chain of states hidden behind sent, authority that only narrows, and results you can check.
In October 2026, eight intermediate CA keys trusted by every major platform turned out to be numbers below 256. How certificates, key ceremonies and ECDSA fit together, worked by hand on a 19-point curve; how the weak keys got in; how the web shut them out; and the check that would have stopped it.
A reminder I set for myself, an essay scolding the young for their philosophy habit, and a message calling someone a “desperate illiterate.” I looked at the three of them together for a long time and came away without a conclusion.
Not ‘America loves Todoist.’ English-speaking professional strata, expensive labor, and ARR capital built a symptom market: micro-control for sale, responsibility sunk onto the self.
Rubber-band bounce, continuous corners, and one-handed MacBook open are not taste. They are damping ratios, G2 curvature, and rigid-body torque inequalities you can model.
From Emacs prefixes and vi modes to Spotlight, command palettes, and Cmd+K: why power users treat keybindings as a namespace, and how KeyCombiner turns that into a practice system.
What “no GPU required” actually covers, what each of the four browser labs deliberately cuts, and when you still need a real card and Nsight.
This site is English-first; some linked works (e.g. the CUDA course) also ship /zh/.
