Erwan Joly

I own a shelf of sealed Pokémon product. Sixty-odd items - booster boxes, elite trainer boxes, premium collections, a few Pokémon Center exclusives from Japan - and over the last couple of years the shelf has quietly become worth more than some of the furniture it stands near. Which means it belongs on the contents insurance, and contents insurance has a very specific idea of what “owning” something means. An insurer doesn’t want your enthusiasm. They want, per item: what it is, what it’s worth now, and photographs. Notably absent: what you paid. Insurance is about replacement value, and a box that cost $60 at retail and sells for $300 today is a $300 box. A list and a folder of pictures. If the shelf burns, that folder is the claim. ...

I’ve spent the last year on WealthRelay, a valuation API: portfolios, trades, instrument prices, returns, currency conversion, all behind GraphQL. It has the problem every B2B API has at the start. The first customer doesn’t exist yet, and until one does, every design decision is a guess about what the API is for. So I became the first customer. I collect things - sealed Pokémon product mostly, which I track in Collectr - and the collectibles that have genuinely behaved like an asset class these last couple of years are POP MART blind boxes. A set is twelve figures. One of them is the secret, which you can’t see through the box, and which sells on eBay for a multiple of its siblings. People buy whole cases to complete sets, trade their duplicates, and argue about what their shelf is worth. Every tracker I found answered that with a checklist. None of them treated the shelf as what it is: a portfolio, with a cost basis, a market value and a return. ...

I’ve been working on WealthRelay, an API venture I built from the ashes of my old MarketRacoon code, pivoting what used to be a consumer portfolio tracker into a B2B solution. Somewhere along the way I had to admit something uncomfortable: I was using cron wrong. Not “wrong flag” wrong - conceptually wrong. The tell: fortnightly The feature that forced the realization was recurring schedules: automated deposits, loan repayments, interest runs. And the single most requested shape for those is the one banks use for mortgages: fortnightly. ...

Prefer to watch? This post is also a 6-minute animated video, narrated by a raccoon with a candlestick tail: Ask anyone what risk means and you’ll get something close to the textbook definition: the probability of a harmful event occurring, combined with the severity of its consequences. That’s the risk of security audits, insurance, aviation. By that definition a Ponzi scheme is high risk - decent probability of total loss, maximum severity. And the S&P 500 - five hundred of the most regulated, audited, litigated-against companies on earth, wrapped in one of the most supervised products in existence - reads as pretty safe. ...

In 2022, Microsoft Research published “Pre-hijacking Attacks on Web User Accounts” at USENIX Security. It surveyed 75 popular services and found that roughly 47% were vulnerable to one or more variants of account pre-hijacking, a class of attack that lets an adversary gain persistent access to an account the victim hasn’t created yet. The paper is excellent. But the way the industry absorbed it has created a new problem: the two main variants get lumped together under the same label, triaged as if they’re the same threat, and dismissed or accepted for the wrong reasons. ...

Versions: @rjsf/core v6.6.2 is the current stable release. v5 was a major breaking change from v3/v4 - the validator prop became required and the validator was extracted into @rjsf/validator-ajv8. The code in this article targets v5+. @graphql-codegen/cli v5 is current and the config format shown is compatible. Internal tooling is where good architecture goes to die. Every backfill, every data-correction operation, every admin action ends up with the same choice: write a one-off form, use the GraphQL playground, or write a script. The first option takes hours and is immediately outdated. The second only works if you let engineers near production data. The third requires a developer every time. ...

This approach is based on Nigel Sampson’s post on GraphQL validation metadata, extended with a recursive validation middleware and a codegen pipeline for the frontend. Versions: HotChocolate v16.2.0 is the current stable release. The TypeInterceptor and DirectiveType APIs shown here have been stable since v12 and are unchanged through v16. v15+ dropped .NET 6/7 support - .NET 8 or later is required. The middleware syntax uses C# 12 primary constructors; see the note in that section if you are on an older SDK. ...