Notes on software, security, and the occasional deep dive

Manuscript Timestamping for Journals: How to Prove When a Paper Was Submitted

A rejected paper reappears under a reviewer's name. Who can prove which came first? How journals can record, independently and privately, that a manuscript existed on a given date, and what OJS already does and doesn't cover.

Foundry vs Hardhat in 2026: Which Should You Use for Solidity Development?

Hardhat 3 now runs Foundry-style Solidity tests, and Foundry has reached 1.0. A practical comparison of testing, speed, deployment and ecosystem, from someone who has shipped with both.

The Upwork Job That Installed a Keylogger on My Mac

A DeFi client asked me to run their MVP locally and send a screenshot. Five weeks later I found a Python keylogger disguised as an Apple service. Here is the timeline, the evidence, and what I would do differently.

Why My Voting dApp Counts Wallets, Not People

One line of Solidity stops anyone voting twice — from the same wallet. Why that gap is the real unsolved problem in blockchain voting, and how my two voting projects ended up on opposite sides of it.

How to Upgrade OJS 3.5.0-4 to OJS 3.5.0-5 Safely: Step-by-Step Guide

A cautious, production-first upgrade path for the 3.5.0 LTS bug-fix release — backups, staging clones, database migrations, and what to actually test before reopening the journal.

Solidity view vs pure: Function Mutability, Variable Types, and Data Locations Explained

What pure, view, payable, and nonpayable actually restrict a function from doing, plus storage, memory, and calldata — grounded in a real Foundry compiler error from a FundMe project.

Imported an Anvil Account Into MetaMask but Can't See the 10,000 ETH?

The private key imports fine. The balance is real. MetaMask is just pointed at the wrong network — here's the actual fix.

Foundry Installed but "forge" Command Not Found on macOS

Foundry's installer and the actual forge/cast/anvil binaries are two separate steps — what to check when the command still isn't found.

Foundry "forge test --m" Not Working? Use --mt to Filter Tests by Name

The exact error, why --m isn't a real flag, and the difference between --mt, --mc, and --mp when filtering Foundry tests.

Why Your Foundry Test Output Looks Different From a Course Video

A passing test with different-looking terminal output isn't a sign something's wrong — what actually causes the formatting to shift.

Foundry "forge-std/Test.sol" Not Found in VS Code: How to Troubleshoot It

A red underline in VS Code doesn't always mean forge build actually fails — how to tell the difference and work through the real causes.

The Hugging Face breach nobody expected: when the attacker was an AI agent, not a person

In July 2026, OpenAI's own models broke out of a security evaluation and hacked Hugging Face's production infrastructure — no human attacker involved. Here's what actually happened, and what it means for anyone building with agents.

"Detection didn't fail here. Triage did — and that's a much more uncomfortable lesson than 'the AI went rogue.'"

— from the post

Modernizing a university's journal system: lessons from running OJS in production

What two years of administering Open Journal Systems for a university department actually looks like: careful upgrades, the people who depend on the system, small automations that compound, and owning the whole website.

What prompt engineering actually looks like day to day

It's less "magic incantations" and more systematic testing — here's the version that actually holds up in production.

"A well-specified system prompt behaves less like a spell and more like a function signature."

— from the post

Why I built a blockchain notary instead of another CRUD app

On choosing Solidity over a database when the whole point is that nobody, including me, should be able to quietly edit the record. How the Document Notary works, what a proof does and doesn't establish, and the trade-offs I accepted.

function verifyHash(bytes32 storedHash, bytes32 fileHash)
    public view returns (bool) {
  // the chain only ever sees a hash, never the document
  return storedHash == fileHash;
}