Pranjal Kumar

🧑🏻‍💻 Software Developer @BentleySystems
🏗️ Software Architecture | Scaling systems | 🙌🏻 6k+ LinkedIn
⚡ Sharing my learnings | No clickbait content

[Pranjal Kumar @PranjalKumar__]

@GergelyOrosz @hejelinnilsson Every Google tool exists because they hit scaling walls 5 years before anyone else. That’s both their advantage and their curse.

Borg before Kubernetes, Bigtable before DynamoDB, GFS before Apache HDFS. GOATed 🤯

[Pranjal Kumar @PranjalKumar__]

@mehulmpt Just simple UI tests in pipeline with @playwrightweb would have avoided this issue 🫠

[Pranjal Kumar @PranjalKumar__]

#Hiring

[Pranjal Kumar @PranjalKumar__]

#hiring My team is building and evolving iModel Cloud Sync Services, the distributed backend that ingests and transforms engineering data from heterogeneous sources and synchronizes it into the iTwin Platform.

This is not a traditional CRUD backend. We are solving architecture challenges around:
⏺︎ Distributed, event-driven processing
⏺︎ Durable workflow and state-machine orchestration
⏺︎ Idempotency, retries, locking, and conflict resolution
⏺︎ High-volume ETL and schema evolution
⏺︎ Kubernetes-based, multi-tenant cloud services
⏺︎ End-to-end tracing, diagnostics, and self-healing workflows
⏺︎ Reliability, scalability, performance, and cloud-cost governance

The technology landscape includes .Net, C#, Azure, Kubernetes, microservices, messaging systems, CI/CD, and modern observability tooling. The Principal role is hands-on and includes defining architectural direction, mentoring engineers, and influencing the long-term evolution of the platform

Links:
⏺︎ Principal Software Engineer: https://t.co/aRKOPxlMef
⏺︎ Senior Software Engineer: https://t.co/zwcz2pKqsG

These are hybrid roles (Pune / Kolkata) with competitive pay.
Reach out or DM me directly, especially if you'd like a Referral.

#Hiring #DistributedSystems #PrincipalEngineer #MessageQueues #BackendJobs #Kubernetes

[Pranjal Kumar @PranjalKumar__]

#hiring My team is building and evolving iModel Cloud Sync Services, the distributed backend that ingests and transforms engineering data from heterogeneous sources and synchronizes it into the iTwin Platform.

This is not a traditional CRUD backend. We are solving architecture challenges around:
⏺︎ Distributed, event-driven processing
⏺︎ Durable workflow and state-machine orchestration
⏺︎ Idempotency, retries, locking, and conflict resolution
⏺︎ High-volume ETL and schema evolution
⏺︎ Kubernetes-based, multi-tenant cloud services
⏺︎ End-to-end tracing, diagnostics, and self-healing workflows
⏺︎ Reliability, scalability, performance, and cloud-cost governance

The technology landscape includes .Net, C#, Azure, Kubernetes, microservices, messaging systems, CI/CD, and modern observability tooling. The Principal role is hands-on and includes defining architectural direction, mentoring engineers, and influencing the long-term evolution of the platform

Links:
⏺︎ Principal Software Engineer: https://t.co/aRKOPxlMef
⏺︎ Senior Software Engineer: https://t.co/zwcz2pKqsG

These are hybrid roles (Pune / Kolkata) with competitive pay.
Reach out or DM me directly, especially if you'd like a Referral.

#Hiring #DistributedSystems #PrincipalEngineer #MessageQueues #BackendJobs #Kubernetes

[Pranjal Kumar @PranjalKumar__]

The fix was to move the primary limit to authenticated identity, and keep IP-based throttling as a secondary signal for unauthenticated or high-risk flows. This preserved abuse protection without breaking legitimate traffic.

[Pranjal Kumar @PranjalKumar__]

A production incident taught me that a good-looking rate limit can still be wrong.

We had a rate limiter that looked fine in code and terrible in production.

[Pranjal Kumar @PranjalKumar__]

The rate limiter was seeing aggregate traffic and treating it like one abusive client. We were blocking the symptom, not the actual source of pressure.

[Pranjal Kumar @PranjalKumar__]

I came across Chrome’s DBSC while reading about session security, and the design is surprisingly elegant.

Chrome’s Device Bound Session Credentials (DBSC) is a clean example of how security should evolve: not by adding more friction, but by changing the trust model.

[Pranjal Kumar @PranjalKumar__]

We had a weird auth-bug:
Users were being logged out randomly, especially on slow networks or when they had the app open in multiple tabs.

#production_lessons

[Pranjal Kumar @PranjalKumar__]

Key-takeaway from this: refresh token rotation improves security, but it creates a concurrency problem. If you do not design for parallel requests, you will log out honest users.

[Pranjal Kumar @PranjalKumar__]

We had a weird auth-bug:
Users were being logged out randomly, especially on slow networks or when they had the app open in multiple tabs.

#production_lessons

[Pranjal Kumar @PranjalKumar__]

The real fix was to design for concurrency: add a small grace window for legitimate reuse, coordinate refresh on the client, and distinguish race conditions from true replay attacks.

[Pranjal Kumar @PranjalKumar__]

Deep-dive on DBSC here:
https://t.co/abH0LoPlsy

[Pranjal Kumar @PranjalKumar__]

I came across Chrome’s DBSC while reading about session security, and the design is surprisingly elegant.

Chrome’s Device Bound Session Credentials (DBSC) is a clean example of how security should evolve: not by adding more friction, but by changing the trust model.

[Pranjal Kumar @PranjalKumar__]

Story of AWS S3: "You don’t buy the fastest disk. You buy so many slow ones that they behave like a supercomputer" 💪🏻

[Pranjal Kumar @PranjalKumar__]

TPM is the part that makes this security model credible.
By keeping the private key in hardware-backed storage, it becomes much harder for malware or a stolen disk image to extract it and replay the session elsewhere.

On Windows this typically means TPM, on macOS the Secure Enclave, and on mobile devices similar hardware-backed keystores.

https://t.co/bHN8vNNlL3

[Pranjal Kumar @PranjalKumar__]

I came across Chrome’s DBSC while reading about session security, and the design is surprisingly elegant.

Chrome’s Device Bound Session Credentials (DBSC) is a clean example of how security should evolve: not by adding more friction, but by changing the trust model.

[Pranjal Kumar @PranjalKumar__]

Read more:
https://t.co/6QkGSwokLA