Senior software developer specializing in ColdFusion and BoxLang.
I am a senior software developer with extensive experience across the CFML ecosystem, from established tag-based ColdFusion applications to modern BoxLang. My professional focus is e-commerce integration: building and maintaining the connections between platforms such as Shopify, Amazon, eBay and Walmart, so that inventory, orders and fulfillment remain accurate across every sales channel.
I am also an active open-source contributor to the BoxLang ecosystem. I created boxlang-express, an Express.js-style web framework that fills a gap in the platform and powers this site. My other work includes modules for ActivityPub federation, GraphQL and passkey authentication, all of which are listed on the projects page.
I value well-defined systems, maintainable code and documentation that records not only how something works but why it was built that way. Outside of work, I enjoy science fiction and fantasy, and I train in calisthenics.
An open-source blogging platform with a composer built for writers: visual and Markdown editing, a server-rendered preview, paste-to-upload images, and drafts that survive closed tabs and crashes. It also covers what real apps need, from passkeys and CSRF to migrations, scheduled jobs, self-hosted analytics and Docker, all in readable code you can change.
boxlangHardened Docker containers (no published ports, capabilities dropped) can still reach the whole LAN, because bridge NAT lets them connect anywhere the host can. The fix on OrbStack/macOS is a helper container that reapplies DOCKER-USER egress rules every 15s. The rules block private ranges, OrbStack's 0.250.250.0/24 host range and all non-bridge IPv6, allow DNS to OrbStack's resolver, and stay above the ACCEPT OrbStack inserts on restart. Lesson: test effect, not existence.
dockerSide projects shouldn’t cost more than they have users. Here’s how I moved mine off a $75/mo hosting bill and onto Docker on my dev server: a Cloudflare Tunnel with no open ports, a trusted CF-Connecting-IP header, JVM memory sized from container limits, a deploy script that tests itself before it touches production, and encrypted off-site backups to R2. It’s not high availability. It’s a home server. But the bill is zero.
boxlangPasskeys replace passwords with a key pair kept on the user's device, so there's nothing reusable to phish or leak. This step-by-step guide adds them to a BoxLang app with bx-passkeys. You install the module, create the table and configure the relying party, then wire up four calls: registrationOptions(), register(), signInOptions() and verify(). It also covers the browser helper, listing and removing passkeys, testing with a fake authenticator, and a production checklist.
boxlangNovember means burning leftover time off on side projects. Feedhouse outgrew a $75/mo hosting bill it was never going to earn back, so everything now runs in Docker on my dev machine behind Cloudflare Tunnels. It’s faster, too, now that the database isn’t starving. And DismalThreads is back with a facelift after a launch nobody came to and more rewrites than I’d like to admit: Facebook for developers, minus the memes and the LinkedIn-ness.
boxlang