MLabs Publications
The many minds at MLabs present news, case studies, editorials, tutorials, whitepapers, Cardano Catalyst proposals, and more.
Upgrading Keycloak keeps your custom attributes. Rebuilding the realm deletes them.
The widely repeated warning about Keycloak 24's declarative user profile is aimed at the wrong thing. We upgraded a realm carrying custom attributes in place, and found where they actually disappear.
A vibe-coded app needs a specification before it needs a rewrite
Your vibe-coded app breaks whenever it changes. Write down what it does, test those rules, then cut against the tests. When a rewrite is right.
Three of our fifteen Keycloak tests refuted the thing they were written to prove.
The most useful records in a fifteen-scenario Keycloak upgrade lab are the negative ones. Three tests failed to demonstrate what they were written to demonstrate. Published, because negatives are the cheapest credibility available.
In a regulated back office, the automation is the easy half. Reconciling it is the job.
The ledger is authoritative, vendor-controlled and audited, so the automation has to go around it. That makes reconciliation the design problem, not a reporting feature. What we do instead, and what it costs us to run.
A fractional CTO is worth most in the month before a decision you can't undo
A fractional CTO is a senior technical lead you retain part-time. What the role covers, when a regular cadence beats a one-off review, and four questions to ask before you hire one.
Most certificate lifecycle management is free. The part that costs money was never a tool.
ACME clients, CT-log monitors, expiry monitors, discovery tools and enterprise CLM platforms each answer a different question. Most teams need the free ones. None of them assigns an owner to an internal CA, an appliance or an mTLS certificate.
Keycloak 26.7 needs PostgreSQL 13. Keycloak 26.0 didn't.
The minimum supported PostgreSQL major moved from 12 to 13 inside Keycloak major version 26, across what looks like a routine minor bump. We upgraded 26.0.0 on Postgres 12.22 and watched where it stopped.
By 2029 every public TLS certificate renews 7.77 times a year, and a calendar can't keep up
The CA/Browser Forum SC-081v3 schedule, dated: 200 days from 15 March 2026, 100 from 15 March 2027, 47 from 15 March 2029, with renewals per certificate per year at each step and why calendar reminders stop working at 100 days.
Shorter certificate lifetimes will not break your public TLS. They will break the certificates nobody owns.
The CA/Browser Forum cut maximum TLS lifetimes to 47 days by March 2029. Public TLS is the easy half. The certificates that break first are the internal CA, appliance, mTLS and vendor-console certificates with no named owner.
Keycloak advisory batch 2026-09-16: 1 advisory, 1 high or critical — what clears them
Keycloak's 2026-09-16 advisory batch: one high-severity replay protection bypass, patched in 26.7.4. What clears it, and what breaks on the way there.
Your Keycloak database user has DDL rights. That’s the wrong question.
We gave Keycloak's database user full DDL rights, proved it could create and drop tables seconds before the upgrade, and the migration failed anyway. Here is what actually decides it.
Show Your Work: MLabs' History of Cardano Funding
A clear, end-to-end review of MLabs’ Cardano treasury funding, delivery history, and why “show your work” matters for sustainable ecosystem governance.
Patterns and Paradoxes: The Logic of Pattern Synonyms
Learn how Haskell pattern synonyms and view patterns decouple interface from representation, deliver packed-data performance, preserve exhaustiveness, support bidirectional/read-only views, and more.
Performance, pull arrays and Plut{arch, us}
We introduce PPullArray: a fused, high-performance array API for Plutarch built on CIP-138. Learn how it simplifies array operations, eliminates intermediates, and brings measurable speedups to Cardano’s on-chain computation.
Introducing cardano.nix: Simplifying Cardano Infrastructure Deployment
Simplify Cardano infrastructure deployment with cardano.nix—an open-source NixOS solution that provisions nodes, indexers, and monitoring in minutes. Declarative configuration replaces complex DevOps, enabling reproducible, production-ready Cardano environments with comprehensive testing and automated documentation.
Backing the Future: MLabs Proposals for Catalyst Fund14
Explore MLabs’ Catalyst Fund 14 proposals advancing Cardano: FeesaSwap fee abstraction, Playrz P2P gaming, TrustSwap launchpad integration, Hydra auctions, and developer tools like Covenant path analysis and CTL JS/TS. Proven delivery since Fund 9—back MLabs to grow users, builders, and real utility.