On building software, working with AI, and figuring things out in public.
I cracked a document password in half a second. It was a national ID number. If your business protects sensitive files this way, so can anyone else — here's the maths, and the two choices you actually have.
The 5.6 rollout made Sol the default for every job, and Sol is more literal and more willing to grind than 5.5 was. If you're building on Codex, that quietly turns routine work into your most expensive work. Here's what changed, what to stop doing, and what to change in your setup.
OpenAI shipped a new model family last week. I drove it the way I'd driven the old one for months, and it quietly spent a week and a half of my life building things nobody asked for. Two lessons: a new model is an unproven hire, and the fact that you have to relearn how to work with your tools twice a year is a genuinely rubbish deal that the vendors have decided is your problem, not theirs.
I don't get good work out of an AI coding agent by prompting it more cleverly. I get it by building rails the agent can't skip, and then discovering, repeatedly, that the rails were wrong. A CISO's account of the security check that had never once worked, the guard that cried wolf until I ignored it, and what it takes to make an agent review its own output before it hands it back.
The thing my AI agent gets wrong most often isn't logic, it's editing a file it never actually read. One of the many rules I have for it is to read the file first, this session, before it changes anything, and not let it just promise it did.
In The Uncomfortable Parts I said I was dependent on companies I can't influence. A single government memo this month proved the dependency goes deeper than I'd written: even the companies I depend on are themselves at the mercy of states and suppliers they can't influence either.
An AI agent writes a large share of the code I ship. It's fast, it's competent, and it's wrong often enough that I never let it merge its own work. A solo founder's case for keeping a human on the gate, and the controls that make it safe to hand a machine the keyboard.
The reason most of the problems in 'The Uncomfortable Parts' stay unresolved is structural: courts, regulators and legislators move on a timescale measured in years, and AI moves on one measured in model generations. The institutions we'd normally rely on to sort this out are running a race they've already lost.
I am trying a shorter, more technical Friday post alongside the longer essays earlier in the week. First up: the one line I put at the top of every shell script because silent failures are almost always worse than loud ones.
The most expensive bugs are not always the ones that crash. They are the ones where the system says everything is fine after the thing you rely on has quietly stopped doing its job.
AI is taking the entry-level work that used to train juniors in knowledge-work professions, and the response from those industries — though more substantial than I'd assumed — isn't yet anywhere near the scale of the displacement. A look at the data, and an honest take from someone sitting on the comfortable side of the age split.
A former CISO's approach to AI-assisted development: trust nothing, verify everything, and build the plumbing before you need it.
The specific costs of AI-assisted development that I benefit from and haven't resolved: displacement, dependency, training data, energy, and code quality.
How a neurodivergent developer designed an entire CI and automation infrastructure around the way his brain actually works, not the way it should.
On building software with AI-assisted development, taking the training data criticism seriously, and why governance matters more than enthusiasm.
No spam, no algorithms. Just an email when I publish something new.