Welcome to John Turner's Blog

Professional headshot of John Turner, a cybersecurity professional with 15+ years of experience

I build security tools and open source infrastructure. Right now I'm working on trust registries for AI agents, Bitcoin/Pubky tooling, and browser extensions for real-time analysis. By day I lead product security at Bose — by night I write Rust and ship side projects.

This is where I share what I'm building, document lessons learned, and explore the intersection of security, privacy, and practical software engineering.

3goodsources — Trust Registry for AI Agents (Rust/MCP): A cryptographically-signed trust registry that helps AI agents identify reliable information sources. Built with Rust and the Model Context Protocol (MCP), it provides provenance tracking and supports multiple registry backends (GitHub, Git, filesystem). When an AI agent needs to know which sources to trust, 3goodsources delivers ranked, verifiable recommendations. Trust infrastructure for the AI agent ecosystem.

Selected Projects

A focused look at the security and AI-agent infrastructure I'm building:

  • 3goodsources — Trust registry for AI agents (Rust/MCP)
  • cclink — Claude Code session continuity across restarts (Rust)
  • arbstr — LLM routing proxy with Bitcoin inference settlement (Rust)
  • cipherpost — Accountless encrypted bulletin for cryptographic material handoff
  • blindjoin — Privacy-preserving join primitive for identity-safe record matching
  • ... and more projects

Recent Blog Post

more eyes: Open Is Not the Same as Looked At more eyes is a set of sourced, versioned notes. Each one takes a common claim about software or bitcoin custody, states what evidence would support it, and reads the public record against that. Seven notes so far, on custody, multisig, releases, packages, confidential AI, and fallbacks. CC BY 4.0, and corrections are wanted. Published November 2, 2026

Explore my projects, read about my experience, or get in touch.