About
Not All Who Wander Are Trusted is about the infrastructure behind digital trust: identity, PKI, authentication, authorization, secrets, cloud security and the distributed systems that somehow have to make all of it work.
I’m Vlad Barosan. I’m a software engineer (nowdays known also as Member of the Technical Staff) who has spent much of my career building large-scale cloud and security infrastructure. My background leading teams and projects across Google Cloud, Microsoft Azure and more recently Snowflake with work ranging from PKI and workload identity to DNS, networking, DDoS protection, key management and security infrastructure.
I’ve worked on systems issuing billions of certificates, distributed stateful infrastructure serving enormous amounts of production traffic and many systems where just doing the business logic turns out to be the beginning of the problem rather than the end of it.
If you, like me, are interested in:
Which security practices meaningfully reduce risk and which are mostly theory.
How to build security infrastructure that remains understandable and operable after the person who designed it leaves the room (or the company).
then, this this publication is for you. I started it because a lot of security writing falls into one of two categories: introductory explanations that stop just when things get interesting or highly specialized material and I think there is space in between.
What you’ll find here
Articles are the longer pieces: architecture, deep dives, lessons from operating real systems and my arguments/thoughts about how security infrastructure should be designed.
Bytes are smaller. One idea, observation, failure mode, useful explanation or thing that has been bothering me enough to write down.
The Brief is my periodic look at what has changed across identity, PKI, cloud security, and security infrastructure and, more importantly, what I think is actually worth paying attention to.
A note on opinions
Everything here is written in a personal capacity.
I’ll try to distinguish facts from opinions, link to primary sources whenever practical, correct mistakes when I make them and explain why I believe something rather than hiding behind “best practices.” Disagreement is welcome. Particularly the interesting kind.
Contact
Found an error? Disagree with something? Have an interesting security-infrastructure problem or paper I should read?
Get in touch.
