MLabs Publications
The many minds at MLabs present news, case studies, editorials, tutorials, whitepapers, Cardano Catalyst proposals, and more.
A fractional CTO is worth most in the month before a decision you can't undo
A fractional CTO is a senior technical lead you retain part-time. What the role covers, when a regular cadence beats a one-off review, and four questions to ask before you hire one.
Most certificate lifecycle management is free. The part that costs money was never a tool.
ACME clients, CT-log monitors, expiry monitors, discovery tools and enterprise CLM platforms each answer a different question. Most teams need the free ones. None of them assigns an owner to an internal CA, an appliance or an mTLS certificate.
Keycloak 26.7 needs PostgreSQL 13. Keycloak 26.0 didn't.
The minimum supported PostgreSQL major moved from 12 to 13 inside Keycloak major version 26, across what looks like a routine minor bump. We upgraded 26.0.0 on Postgres 12.22 and watched where it stopped.
By 2029 every public TLS certificate renews 7.77 times a year, and a calendar can't keep up
The CA/Browser Forum SC-081v3 schedule, dated: 200 days from 15 March 2026, 100 from 15 March 2027, 47 from 15 March 2029, with renewals per certificate per year at each step and why calendar reminders stop working at 100 days.
Shorter certificate lifetimes will not break your public TLS. They will break the certificates nobody owns.
The CA/Browser Forum cut maximum TLS lifetimes to 47 days by March 2029. Public TLS is the easy half. The certificates that break first are the internal CA, appliance, mTLS and vendor-console certificates with no named owner.
Keycloak advisory batch 2026-09-16: 1 advisory, 1 high or critical — what clears them
Keycloak's 2026-09-16 advisory batch: one high-severity replay protection bypass, patched in 26.7.4. What clears it, and what breaks on the way there.
Your Keycloak database user has DDL rights. That’s the wrong question.
We gave Keycloak's database user full DDL rights, proved it could create and drop tables seconds before the upgrade, and the migration failed anyway. Here is what actually decides it.
Show Your Work: MLabs' History of Cardano Funding
A clear, end-to-end review of MLabs’ Cardano treasury funding, delivery history, and why “show your work” matters for sustainable ecosystem governance.
Patterns and Paradoxes: The Logic of Pattern Synonyms
Learn how Haskell pattern synonyms and view patterns decouple interface from representation, deliver packed-data performance, preserve exhaustiveness, support bidirectional/read-only views, and more.
Performance, pull arrays and Plut{arch, us}
We introduce PPullArray: a fused, high-performance array API for Plutarch built on CIP-138. Learn how it simplifies array operations, eliminates intermediates, and brings measurable speedups to Cardano’s on-chain computation.
Introducing cardano.nix: Simplifying Cardano Infrastructure Deployment
Simplify Cardano infrastructure deployment with cardano.nix—an open-source NixOS solution that provisions nodes, indexers, and monitoring in minutes. Declarative configuration replaces complex DevOps, enabling reproducible, production-ready Cardano environments with comprehensive testing and automated documentation.
Backing the Future: MLabs Proposals for Catalyst Fund14
Explore MLabs’ Catalyst Fund 14 proposals advancing Cardano: FeesaSwap fee abstraction, Playrz P2P gaming, TrustSwap launchpad integration, Hydra auctions, and developer tools like Covenant path analysis and CTL JS/TS. Proven delivery since Fund 9—back MLabs to grow users, builders, and real utility.
MLabs & Catalyst: A Proven History of Delivery
Since Fund 7, MLabs has shipped core Cardano tooling totaling 30+ successfully completed projects: the Yielding Transaction Pattern library, Plutarch, robust test suites, Covenant research, and more. Explore the proof of delivery and what’s next in Fund 14.
From Bugs to Breakthroughs: Auditing Cardano Smart Contracts
In this post, we unpack how Cardano smart contracts go wrong and why audits are key to preventing hard-to-fix or irreversible issues. Learn eUTxO-specific pitfalls like multiple satisfaction, plus what to prepare so an audit surfaces real issues fast.
Fast Findings with SWAR and the FFI: The Good, the Bad, and the Inefficient
In this post, we compare three ways to find the first matching byte in an ASCII sequence—naive loops, SWAR (SIMD Within A Register) techniques, and the C memchr via Haskell’s FFI. You’ll learn how each performs in real benchmarks, where FFI can deliver 50× speedups, and why overhead can erase those gains in certain workloads.
Our Performance is massiv: Getting the Most Out of Your Hardware in Haskell
In this post, we explore how to write high-performance Haskell code using multi-dimensional arrays—comparing vector and massiv across clarity, parallelism, and raw speed. You'll learn how array layout, indexing strategies, and stencil-based computation can unlock massive performance gains by leveraging modern hardware more effectively.
First Know Thyself: Understanding String Matching Performance With ASCII
In this post, we explore the performance characteristics of string matching in ASCII text, comparing brute force, Boyer-Moore-Horspool, and DAWG-based approaches. You'll learn how benchmarking, algorithmic analysis, and practical implementation tradeoffs intersect—revealing when optimizations help, when they hurt, and how understanding your tools leads to better real-world performance.