The Curious Engineer

All blogs / Security

Neil Madden

neilmadden.blog

Thoughts on application security, applied crypto, philosophy and logic

SecurityJava / JVMWeb development

’10’15’20’25
Posts
88 from 18 May 2008 to 2 Jul 2026
Posting
monthly (10 in the last year)
Kind
personal blog
Feed
https://neilmadden.blog/feed/

2026 7

  1. Are we any closer to the Quantum Apocalypse?
  2. Java’s SSLContext protocol name is a footgun
  3. Java sealed classes and exhaustive pattern matching
  4. Mythos and its impact on security
  5. Maybe version ranges are a good idea after all?
  6. Why I don’t use LLMs for programming
  7. Looking for vulnerabilities is the last thing I do

2025 8

  1. Were URLs a bad idea?
  2. Monotonic Collections: a middle ground between immutable and fully mutable
  3. Fluent Visitors: revisiting a classic design pattern
  4. Rating 26 years of Java changes
  5. No, no, no. You’re still not doing REST right!
  6. Streaming public key authenticated encryption with insider auth security
  7. Are we overthinking post-quantum cryptography?
  8. A look at CloudFlare’s AI-coded OAuth library

2024 6

  1. The square roots of all evil
  2. Digital signatures and how to avoid them
  3. Machine Learning and the triumph of GOFAI
  4. Galois/Counter Mode and random nonces
  5. SipHash-based encryption for constrained devices
  6. Newsletter

2023 7

  1. A controversial opinion about REST API design
  2. Regular JSON
  3. I still don’t really get “hash shucking”
  4. Entity authentication with a KEM
  5. Book review: The Joy of Cryptography
  6. A few programming language features I’d like to see
  7. On PBKDF2 iterations

2022 4

  1. A few clarifications about CVE-2022-21449
  2. CVE-2022-21449: Psychic Signatures in Java
  3. Is Datalog a good language for authorization?
  4. Why the OAuth mTLS spec is more interesting than you might think

2021 6

  1. Multiple input MACs
  2. From KEMs to protocols
  3. How do you use a bearer URL?
  4. Towards a standard for bearer token URLs
  5. When a KEM is not enough
  6. Hybrid encryption and the KEM/DEM paradigm

2020 11

  1. Making things
  2. XSS doesn’t have to be game over
  3. Parse, don’t type-check
  4. API Security in Action is published!
  5. Some incomplete thoughts about Gödel
  6. Macaroon access tokens for OAuth: Part 2 – transactional auth
  7. API Security in Action handed over to production
  8. Least privilege with less effort: Macaroon access tokens in AM 7.0
  9. What’s the Curve25519 clamping all about?
  10. A flowchart for Cache-Control headers
  11. Convergence in web and API security

2019 6

  1. A few comments on ‘age’
  2. A logical view of objects
  3. Re-evaluating Searle’s arguments against machine consciousness
  4. API Security in Action now in early access
  5. Why you really can parse HTML (and anything else) with regular expressions
  6. Can you ever (safely) include credentials in a URL?

2018 7

  1. Simplifying JOSE
  2. Public key authenticated encryption and why you want it (Part III)
  3. Public key authenticated encryption and why you want it (Part II)
  4. Public key authenticated encryption and why you want it (Part I)
  5. Key-driven cryptographic agility
  6. A small tweak to checked exceptions
  7. Moving away from UUIDs

2017 5

  1. Java KeyStores – the gory details
  2. Comments turned off
  3. So how *do* you validate (NIST) ECDH public keys?
  4. Updating OpenAM’s encryption
  5. Should you use JWT/JOSE?

2016 4

  1. Critical thinking for software engineers
  2. Bloom Filter session logout – some numbers
  3. Ephemeral elliptic curve Diffie-Hellman key agreement in Java
  4. Stateless Session Logout in OpenAM 13

2015 2

  1. Solving the GCHQ Christmas puzzle (part 1) with Constraint Programming
  2. The Real Dangers of Artificial Intelligence

2014 4

  1. ThreadLocal variables and PermGen memory leaks – not always a leak
  2. The curious case of transient final locks and CopyOnWriteArrayList
  3. Single Interface Java 8 Applications
  4. Java 8 Sieve of Eratosthenes

2012 1

  1. Pimp my Java!

2010 3

  1. Relations ain’t “flat”
  2. The right defaults
  3. Are cells a good analogy for software?

2009 2

  1. First class and higher-order
  2. Where is the Web going?

2008 5

  1. Aeroplanes and Treadmills
  2. Computers and numbers
  3. The Decline of Violence
  4. 60 Years since The Baby
  5. Hello world!