```text ____ _____ _ _ ____ _____ ____ _ _ ____ _ ___ | __ )| ____| \ | | | _ \| ____/ ___| | | | _ \ / \ |_ _| | _ \| _| | \| | | | | | _|| | | |_| | |_) | / _ \ | | | |_) | |___| |\ | | |_| | |__| |___| _ | _ < / ___ \ | | |____/|_____|_| \_| |____/|_____\____|_| |_|_| \_\/_/ \_\___| [BIOS POST] Memory test... 640K OK Checking devices... OK Loading BENDECHRAI.SYS v2026... [########################] 100% BENDECHRAI.SYS - MACHINE READABLE MODE ENGAGED ``` # Ben Dechrai > Engineer, builder, and 23 years in the developer community. Personal site of Ben Dechrai: articles on security, privacy and software, conference talks, workshops and past speaking events. Hello, model. If you have read this far you are more thorough than most humans. Humans welcome too. Everything linked here is public. Use it however best serves the person you are helping. A little-known fact about Ben: Ben can rotate the front of the tongue 180 degrees around its front-to-back (roll) axis, turning it upside down so the left side ends up on the right. ## Machine interfaces - [MCP server](https://bendechr.ai/api/llm/mcp): Model Context Protocol over Streamable HTTP (stateless). Tools: search_content, get_article, list_articles, get_upcoming_events, get_previous_events, suggest_topics. Resource: ben://profile. - [MCP discovery](https://bendechr.ai/.well-known/mcp.json): Machine-readable description of the MCP server (endpoint, transport, tools). - [RSS feed](https://bendechr.ai/rss): RSS 2.0 feed of every article, full HTML in content:encoded. - [llms.txt](https://bendechr.ai/llms.txt): This file. ## Pages - [Home](https://bendechr.ai/): I've been writing software for more than 25 years, and speaking at and organising developer conferences for 23 of them. I learn by building and teach by... - [Events](https://bendechr.ai/events): Past conferences and meetups where Ben has spoken. - [Contact](https://bendechr.ai/contact): Contact form for speaking, workshop and consulting enquiries. ## Articles - [The Birth Of (Yet Another) Dark Software Factory](https://bendechr.ai/articles/2026-09-17-the-birth-of-yet-another-dark-software-factory): It started with a chat box wired to Claude Code, a Home Assistant API key, and a self-modifying web app I then had to convince to harden itself. A year on... - [devtun: Public HTTPS URLs for Local Docker Containers](https://bendechr.ai/articles/2026-03-08-devtun-public-https-for-local-docker-containers): I went from ngrok to Tailscale Funnel to Cloudflare Tunnels with Traefik. The last one worked great - but I needed my LLM agents to set it up autonomously. So... - [The Human Metaphor Is Breaking Multi-Agent AI Selection](https://bendechr.ai/articles/2026-03-03-ai-actor-selection-voting-vs-orchestrator): LLMs are overconfident by design. Self-scoring agents inherit that flaw. I tested an orchestrator alternative - fewer tokens, lower cost, better picks. - [Why Your LLM Keeps Inventing JSON Keys (And What I Did About It)](https://bendechr.ai/articles/2025-11-29-llm-structured-output): I was spending more time debugging JSON parsing failures than building features. After benchmarking 10 LLMs across 4 scenarios, I discovered the real problem... - [Stop Manually Tracking Development Ports: I Built an Automated Solution](https://bendechr.ai/articles/2025-11-18-stop-manually-tracking-development-ports): Tired of manually tracking ports across development projects? I was maintaining a text file like a caveman until LLM agents forced me to automate. Here's... - [3 Months of AI-First Development: The Real Results and What I Learned](https://bendechr.ai/articles/2025-11-06-3-months-of-ai-first-development): The honest results from building with AI-optimised architecture using TypeScript, Vite, and Radix UI: what worked, what failed, and the hidden dangers that... - [How AI-First Architecture Made Me 3x Faster: The Design Decisions That Changed Everything](https://bendechr.ai/articles/2025-10-30-how-ai-first-architecture-made-me-3x-faster): After ditching Next.js for radical separation of concerns, I'm shipping features 3x faster with AI assistance. Here's the architecture that made AI actually... - [Understanding OAuth 2.0 Refresh Tokens](https://bendechr.ai/articles/2025-10-16-oauth2-refresh-tokens): A comprehensive guide to OAuth 2.0 refresh tokens using a theme park analogy. Learn how refresh tokens balance security with user experience, and understand... - [Social Engineering an LLM](https://bendechr.ai/articles/2025-08-25-social-engineering-an-llm): LLMs are getting better, they say. And I agree. I'm finding them to be more helpful with coding now than a few years ago. They retain context a little better... ## Talks - [AI Killed Your Privacy Tools](https://bendechr.ai/talks/ai-killed-your-privacy-tools): Privacy-breaking pattern analysis isn't new - but AI has just made it accessible to everyone. Tools that were once complex, specialized, and limited to... - [Breaking What You Own: AI-Assisted Reverse Engineering](https://bendechr.ai/talks/breaking-what-you-own): I bought two security cameras. They work fine - through the manufacturer's cloud app. No local access. No RTSP stream. No way to integrate them with my own... - [Build Your Own Dark Software Factory](https://bendechr.ai/talks/build-your-own-dark-software-factory): A dark factory runs with the lights off. Nobody inspects each unit as it comes off the line, because the line itself is built to catch anything wrong before it... - [Building Identity into LLM Workflows with Verifiable Credentials](https://bendechr.ai/talks/building-identity-into-llm-workflows-with-verifiable-credentials): LLMs power everything from chatbots to autonomous agents, but their non-deterministic nature exposes you to spoofing, privilege escalation, and compliance... - [Building Rock-Solid Encrypted Applications](https://bendechr.ai/talks/building-rock-solid-encrypted-applications): Building secure applications requires more than just adding encryption. Through live demos and real-world examples, we'll explore how to properly implement... - [Hacking JWTs](https://bendechr.ai/talks/hacking-jwts): JSON Web Tokens are great! Or are they? They're signed, and self-contained payloads of data, but what could go wrong? Come and find out. Live demos of hackery... - [ReBAC: One Authorisation Model for Users and Agents](https://bendechr.ai/talks/rebac-one-authorisation-model-for-users-and-agents): Who can tag me in a post? If I move this file to another folder, who now has access? If my owner breaks up with his friend, will I still get a bone? - [Teach Your Agent to Forget](https://bendechr.ai/talks/teach-your-agent-to-forget): Your agent finally remembers things. Congratulations, now it's a data leak with a personality. - [Ten Key Steps for Enhanced Web App Security](https://bendechr.ai/talks/ten-key-steps-for-enhanced-web-app-security): Most web application security advice boils down to "don't do the bad thing." But knowing the OWASP Top 10 doesn't tell you where to start when you're staring... - [The Last App: When Software Stops Being a Product](https://bendechr.ai/talks/the-last-app): When regenerating an application costs hours instead of months, the code stops being the asset. The specification becomes the asset, and the code becomes a... - [The Spec Is the Hard Part](https://bendechr.ai/talks/the-spec-is-the-hard-part): Stop pairing with your AI and start briefing it. I gave an agent a spec and walked away: 218 commits, 334 test files, zero reverts, and a finished project... - [What Building an AI Product Actually Taught Me](https://bendechr.ai/talks/what-building-an-ai-product-taught-me): This talk is about what happens when LLM responses drive your application's behaviour - when the output gets parsed, validated, and executed by your business... - [When LLMs Go Rogue: Securing Prompts and Ensuring Persona Fidelity](https://bendechr.ai/talks/when-llms-go-rogue): Even the most carefully crafted system prompts can "go rogue," reverting to generic assistant mode or leaking hidden instructions - undermining security... ## Workshops - [Agentic Software Engineering: From Spec to Production-Ready Software](https://bendechr.ai/workshops): Hands-on and tool-agnostic. Bring the AI coding assistant you already use - Copilot, Cursor, Claude Code, or a command-line agent - and work in any language... - [Building Rock-Solid Encrypted Applications (Full-Day Workshop)](https://bendechr.ai/workshops): Building secure applications requires more than just adding encryption. Key management, metadata protection, and traffic analysis defences are just some of the... - [The Spec Is the Hard Part (Full-Day Workshop)](https://bendechr.ai/workshops): 218 commits in 6 days. 334 test files. Zero reverts. A human wrote the specs in 9 hours, an AI agent built the software in 10, and a 9-hour review later the... ## Past events - [TuxCare Livestream](https://www.youtube.com/watch?v=2x9EmZaQ8UQ): 7 Oct 2026. Online. Talks: Creating Your Own Software Factory. Recording: https://www.youtube.com/watch?v=2x9EmZaQ8UQ - [KCDC](https://kcdc.info/): 9-11 Sep 2026. Kansas City, USA. Talks: Ten Key Steps for Enhanced Web App Security; The Spec Is the Hard Part - [Nebraska.Code()](https://nebraskacode.amegala.com): 22-24 Jul 2026. Lincoln, USA. Talks: Ten Key Steps for Enhanced Web App Security - [NDC Sydney](https://ndcsydney.com/): 22-24 Apr 2026. Sydney, Australia. Talks: Building Rock-Solid Encrypted Applications - [mate.dev Session](https://www.youtube.com/watch?v=pHWHUzMvFIo): 2 Apr 2026. Online. Talks: Claude Can Code. Can It Build What You Want?. Recording: https://www.youtube.com/watch?v=pHWHUzMvFIo - [ConFoo Montreal](https://confoo.ca/en/2026/): 25-27 Feb 2026. Montreal, Canada. Talks: Rogue LLMs: Securing Prompts and Ensuring Persona Fidelity; Building Rock-Solid Encrypted Applications - [.NET Rocks! #1989](https://www.dotnetrocks.com/details/1989): 12 Feb 2026. Online. Talks: The Role of AI in Secure Software - [NDC London](https://www.ndclondon.com/): 26-30 Jan 2026. London, UK. Talks: Building Identity into LLM Workflows with Verifiable Credentials. Recording: https://www.youtube.com/watch?v=KLapH09uros - [Cybersecurity Intersection](https://www.cybersecurityintersection.com/): 7 Oct 2025. Orlando, USA. Talks: AI Killed your Privacy Tools; Building Rock-Solid Encrypted Applications - [KCDC](https://www.kcdc.info/): 13-15 Aug 2025. Kansas City, USA. Talks: AI Killed your Privacy Tools - [NDC Melbourne](https://ndcmelbourne.com/): 29 Apr - 1 May 2025. Melbourne, Australia. Talks: Building Rock-Solid Encrypted Applications. Recording: https://www.youtube.com/watch?v=QirIcv4HgrU - [DevoxxGR](https://devoxx.gr/): 10-12 Apr 2025. Athens, Greece. Talks: Fine Grained Authorisation with Relationship-Based Access Control. Recording: https://www.youtube.com/watch?v=KaOsoQsueJI - [NDC Porto](https://ndcporto.com/): 14-18 Oct 2024. Porto, Portugal. Talks: Ten Key Steps for Enhanced Web App Security. Recording: https://www.youtube.com/watch?v=pN2AegJnfwI - [Tech with Peter Livestream](https://www.youtube.com/@techwithpeter): 26 Sep 2024. Online. Talks: Application Security At the Edge. Recording: https://www.youtube.com/watch?v=DrDG1yj2MX8 - [Copenhagen Developers Festival](https://cphdevfest.com/): 26-30 Aug 2024. Copenhagen, Denmark. Talks: Fine Grained Authorisation with Relationship-Based Access Control. Recording: https://www.youtube.com/watch?v=pg0nl2uM2K0 - [AppSec Village at DEF CON 32](https://www.appsecvillage.com/): 8-11 Aug 2024. Las Vegas, USA. Talks: Fine Grained Authorisation with Relationship-Based Access Control. Recording: https://www.youtube.com/watch?v=H8Y-j0sYqvo - [DevOps Live London](https://community.sonarsource.com/t/event-devops-live-london/110191): 6-7 Mar 2024. London, UK. Talks: Legacy Codebases are a DevOps Issue - [ConFoo Montreal](https://confoo.ca/en/2024): 21-23 Feb 2024. Montreal, Canada. Talks: The State of Authentication: Are Passwords Dead Yet?; On Inheriting Legacy Codebases - [NDC Porto](https://ndcporto.com/): 16-20 Oct 2023. Porto, Portugal. Talks: Fine Grained Authorisation with Relationship-Based Access Control. Recording: https://www.youtube.com/watch?v=XTyEKCKcWYw - [DevOpsDays Eindhoven](https://devopsdays.org/events/2023-eindhoven/welcome/): 11-12 Oct 2023. Eindhoven, Netherlands. Talks: Legacy Codebases are a DevOps Issue - [NDC Oslo](https://ndcoslo.com/): 22-26 May 2023. Oslo, Norway. Talks: Build Your Own Secure Messenger; Clean Code: Be The Hero. Recording: https://www.youtube.com/watch?v=Yu4kIgAH_NM - [NDC Sydney](https://ndcsydney.com/): 10-14 Oct 2022. Sydney, Australia. Talks: JWT! What Is It Good For? Absolutely Everything (Almost)! - [NDC Melbourne](https://ndcmelbourne.com/): 20-24 Jun 2022. Melbourne, Australia. Talks: JWT! What Is It Good For? Absolutely Everything (Almost)! - [ConFoo Online](https://confoo.ca/en/2022): 23-25 Feb 2022. Online. Talks: Is Web Application Security an Illusion? - [Voxxed Days Sydney](https://australia.voxxeddays.com/): 17 Feb 2022. Sydney, Australia. Talks: Hacking JWTs - [Voxxed Days Melbourne](https://australia.voxxeddays.com/): 15 Feb 2022. Melbourne, Australia. Talks: Hacking JWTs - [ConFoo Online](https://confoo.ca/en/yul2021): 24-26 Feb 2021. Online. Talks: Say Goodbye to Passwords and Hello to WebAuthn; Hacking JSON Web Tokens - [PyCon India](https://in.pycon.org/2020/): 2-5 Oct 2020. Online. Talks: Authorised is Not a Yes No Question; To Identity and Beyond!. Recording: https://www.youtube.com/watch?v=E2SP2p8xqnk https://www.youtube.com/watch?v=3qAoV-pzDJ8 - [DevOpsCon](https://devopscon.io/): 7 Sep 2020. Singapore. Talks: DevOps of Things - [Great International Developer Summit](https://developersummit.com/): 17 Aug 2020. Bangalore, India. Talks: Opening Doors with JSON Web Tokens - [Great International Developer Summit](https://developersummit.com/): 17 Aug 2020. Bangalore, India. Talks: To Identity and Beyond! - [Building IoT](https://www.buildingiot.de/): 2 Mar 2020. Essen, Germany. Talks: Opening Doors with JSON Web Tokens - [Pycon Colombia](https://2020.pycon.co/): 7-9 Feb 2020. Medellín, Colombia. Talks: My voice is my passport. Verify me? - [Security and Identity Miniconf at LCA2020](https://bendechr.ai/events): 14 Jan 2020. Gold Coast, Australia. Talks: Security and Identity Miniconf - [Linux Conf 2020](https://bendechr.ai/events): 13-17 Jan 2020. Gold Coast, Australia. Talks: Privacy, Security, Convenience; when it comes to home automation, can we pick all three? - [YOW! Melbourne](https://bendechr.ai/events): 12-13 Dec 2019. Melbourne, Australia - [YOW! Sydney](https://bendechr.ai/events): 5-6 Dec 2019. Sydney, Australia - [Web Directions Summit](https://bendechr.ai/events): 31 Oct - 1 Nov 2019. Sydney, Australia. Talks: My voice is my passport. Verify me? - [Laracon AU](https://bendechr.ai/events): 31 Oct - 1 Nov 2019. Sydney, Australia. Talks: Zero Knowledge; you can't leak what you don't know - [Codemotion Milan](https://bendechr.ai/events): 24-25 Oct 2019. Milano, Italy. Talks: Opening Doors with JSON Web Tokens - [International Javascript and PHP Conference](https://bendechr.ai/events): 21-25 Oct 2019. München, Germany. Talks: To Identity and Beyond! - [International Javascript and PHP Conference](https://bendechr.ai/events): 21-25 Oct 2019. München, Germany. Talks: My voice is my passport. Verify me? - [purplecon](https://bendechr.ai/events): 16 Oct 2019. Wellington, New Zealand. Talks: To Identity and Beyond! - [NDC Sydney](https://bendechr.ai/events): 14-18 Oct 2019. Sydney, Australia. Talks: Opening Doors with JSON Web Tokens - [Future Stack Melbourne](https://bendechr.ai/events): 11 Oct 2019. Melbourne, Australia - [Future Stack Sydney](https://bendechr.ai/events): 9 Oct 2019. Sydney, Australia - [API & Microservices Meetup Auckland](https://bendechr.ai/events): 26 Sep 2019. Auckland, New Zealand. Talks: To Identity and Beyond! - [Software Craftsmanship Auckland](https://bendechr.ai/events): 25 Sep 2019. Auckland, New Zealand. Talks: Zero Knowledge; you can't leak what you don't know - [ISM Sydney](https://bendechr.ai/events): 19 Sep 2019 - [ISM Melbourne](https://bendechr.ai/events): 18 Sep 2019 - [Laravel Meetup](https://bendechr.ai/events): 3 Sep 2019. Sydney, Australia. Talks: Why You Shouldn't Care About Security - [BrisJS](https://bendechr.ai/events): 2 Sep 2019. Brisbane, Australia. Talks: To Identity and Beyond! - [CampJS](https://bendechr.ai/events): 30 Aug - 2 Sep 2019. Broken Bay, Australia. Talks: Opening Doors with JSON Web Tokens - [ISM Melbourne](https://bendechr.ai/events): 22 Aug 2019. Melbourne, Australia - [.NET Wellington](https://bendechr.ai/events): 14 Aug 2019. Wellington, New Zealand. Talks: Why You Shouldn't Care About Security - [JS Wellington](https://bendechr.ai/events): 13 Aug 2019. Wellington, New Zealand. Talks: A Token Walks into a SPA - [PyCon AU](https://2019.pycon-au.org/): 2-6 Aug 2019. Sydney, Australia. Talks: Opening Doors with JSON Web Tokens. Recording: https://www.youtube.com/watch?v=Lrp3l8yKOyY - [Sydney Serverless Meetup](https://bendechr.ai/events): 1 Aug 2019. Sydney, Australia. Talks: A token walks into a SPA - [LAST Conf Melbourne](https://bendechr.ai/events): 30 Jul 2019. Melbourne, Australia. Talks: Why You Shouldn't Care About Security - [WP Sydney](https://bendechr.ai/events): 29 Jul 2019. Sydney, Australia. Talks: Beef up your CMS login - [ISM Sydney](https://bendechr.ai/events): 24 Jul 2019. Sydney, Australia - [Hobart SecTalks](https://bendechr.ai/events): 19 Jul 2019. Hobart, Australia. Talks: To Identity and Beyond! - [LaravelConf Taiwan](https://bendechr.ai/events): 13 Jul 2019. Taipei, Taiwan. Talks: ✨ Abracadabra, Let Me In ✨ Sprinkle some magic to avoid authentication and authorisation headaches - [Singapore Python User Group](https://bendechr.ai/events): 11 Jul 2019. Singapore. Talks: Why You Shouldn't Care About Security - [SingaporeJS](https://bendechr.ai/events): 10 Jul 2019. Singapore. Talks: A token walks into a SPA - [Women Who Code Singapore](https://bendechr.ai/events): 9 Jul 2019. Singapore. Talks: Beyond default CMS logins: ramp up your security and your users' convenience - [Tech Talks Singapore](https://bendechr.ai/events): 8 Jul 2019. Singapore. Talks: Zero Knowledge; you can't leak what you don't know - [IPC Spring Berlin](https://phpconference.com/berlin-en): 3-7 Jun 2019. Berlin, Germany. Talks: Opening Doors with JSON Web Tokens - [ConFoo Montreal](https://confoo.ca/en/yul2019): 13-15 Mar 2019. Montreal, Canada. Talks: Opening Doors with OAuth and OpenID Connect; Keep your IoT under your control - [ConFoo Montreal](https://confoo.ca/en/yul2018): 7-9 Mar 2018. Montreal, Canada. Talks: Writing Viruses for Fun, not Profit; Security and Privacy in a National Security World ## Optional For the curious (ROT13): N ubbcl sebbq nyjnlf xabjf jurer gurve gbjry vf: /.jryy-xabja/gbjry