The Edge Security And Logging Layer: Principles For A Gateway That Sits In Front Of Everything

Summary

The founding document. Three concrete problems converge — no real-time traffic visibility, a CloudWatch+Firehose pipeline that is expensive for what it delivers, and an AWS WAF that feels rent-like and over-complex — underpinned by a real fear: a client-side bug once caused runaway redirect traffic, and nothing at the edge would catch the next one before the bill did. The principles: substrate-independent; sits in front of everything; controllable and refactorable (owned code, LLM-engineerable); the best layer for each job. Plus the goal that names the posture: make the site genuinely hostile to malicious, buggy and wasteful traffic.

Key concepts

• The problem — blind spot + cost line + rent — the motivation, stated concretely
• Hostile to bad traffic — the easy-win blocks are this principle's first instalment
• The cost argument — qualitative until measured — the site holds that discipline

Key ideas

• The edge layer is insurance against self-inflicted cost explosions as much as against attackers.
• Rules handle the common case at the edge; the LLM handles the ambiguous case and improves the rules over time — never on the hot path.
• The naming bikeshed that ended with SG/Sentinel started here.

On this site

The problem section of the front page is this brief distilled.

Read the document