Writing
Notes from systems meeting real devices.
Notes on payment systems, device software, transaction uncertainty, platform design, and the emerging role of AI in commerce. I write from the questions that appear in real operating conditions.
APPROVED, DECLINED, UNKNOWN: designing honest transaction status
A host can approve a payment while the terminal still shows UNKNOWN. That third state is not a bug — it's the whole point.
Reading EMV BER-TLV without a spec sheet
A short field guide to the structure that carries every EMV response — tags, lengths, primitives, constructed nesting — with a live parser.
Contactless CVM: floor limits after 2024
The contactless-with-CVM threshold quietly moved in most European markets during 2024. What the practical implications look like.
MPoC (Mobile PIN on COTS): security assumptions and gaps
PCI's MPoC standard formalises PIN entry on off-the-shelf phones. The assumptions worth challenging in an integration review.
The three golden rules of honest financial terminals
Terminal firmware breaks in patterns. Three rules would eliminate about half of the incidents I've been paged for.
Terminal telemetry: what to log, what to drop
The temptation is to log everything. The practical answer is more like ten fields, plus a mechanism for turning on more when you need them.
SoftPOS: reading card data without a magstripe
SoftPOS acceptance has passed the novelty stage. What the integration realities look like now that the certifications are stable.
EMV kernel updates: navigating certification
Kernel updates arrive with regularity, and each one triggers a certification cycle. What actually goes wrong.
The disappearing signature: chip-and-PIN in North America
Signature-based card verification in the US is quietly winding down. The remaining edge cases are worth planning around.
Terminal firmware upgrades: the field replacement problem
Pushing firmware to a fleet is easy in a lab and hard in the field. What actually goes wrong at scale.