At the Linear London launch a dev with an iPhone Duo is showing off @t3dotcodes and telling me: “I had trouble with Claude Code yesterday and figured I’ll give T3 a go. It BLEW MY MIND. I’m hooked.” He’s now gotten 2 more devs download it Hot damn @theo it’s spreading

Happening everywhere: “The evidence indicates links to a financially motivated cybercriminal threat actor group that aims to sell tokens from unauthorized access to LLMs to illicit routing gateways, known as "LLMJacking" “ Any service storing AI keys is attacked nonstop

Hear me out: We hated "waterfall" because after Big Upfront Planning, implementation took FOREVER, and by the time we were done, the plan was out of date But with AI, implementation is rapid (100x faster, or more, than before) So Big Upfront Planning can now make sense?

People tend to realize @Steve_Yegge was right 6-12 months later. Once I figured this out, I listen to him when he says stuff. Like this: "Having a fit brain will be a key differentiator in the new era. Just do more of [writing], every day, to get in shape and stay in shape."

@GergelyOrosz is right. From my pov there are two reasons to write your own stuff, even if it's a struggle. First, it's fitness training for your brain. If you struggle to write, your brain is flabby. Having a fit brain will be a key differentiator in the new era. And second, we would all rather read your "bad" writing than polished AI writing. Trust me on this one. We can spot even one sentence of AI writing and it stinks. Your bad writing is fine. Just do more of it, every day, to get in shape and stay in shape.

From a security engineer, on the AI threat landscape: "I actually don't think it's right that defense is going to get a lot harder because of AI. Most of these breaches, if there's already a security program in place at all that follows the kind of things that companies claim to be doing in SOC 2s or in other certifications, will provide the defense in depth to prevent these breaches from having any meaningful impact on their environments." I hate to say it, but Binance had every single on of these certifications, and got popped open, attackers stealing the largest-ever sum, $6B. I don't think the "traditional" secutity industry realized how bad things are. SOC2 does not protect you from zero days (that abliterated AI agents can and do find), nor from abliterated AI agents getting inside your trust boundary. In a few years I'm sure we'll have the certifications that mandate how to continioulsy scan your own systems with (abliterated?) models, red-teaming; and continiously monitor your live metrics (to spot anythig suspicious); and have near-realtime patching of CVEs (also surely with AI); and that MIGHT be enough But it's putting your hand in the sand assuming that pre-AI security posture will work just fine... unless it's secutity posture that is formally proven to work (see: cryptography)

These security certifications are less than useless in this new AI agent world of security threats. What’s the certification checking that you’re obsessed with monitoring realtime; run agents analyzing all your realtime metrics; and your posture is “paranoid” on things like latency increases if services, attempts to access systems that have no business of accessing etc?

Friendly advice: avoid vendors kicking their competitors in public when they’re down. Outages will happen to the best of them, what matters is how they respond to theirs and how transparent they are with customers IMO

Fuck around and find out. When Railway was breached on 21 Oct, Northflank dunked on them and urged people to migrate over to them because of that breach. 9 days they got hacked, the same way. Zero sympathy: instead of securing you were busy dunking

Made the previously paid article "Becoming a better writer" free. I see too many devs writing low quality slop with AI. Hopefully this helps those of you who want to share more of your own experiences, using your own words - we need more of these!

After the PHP2Shell vulnerability, every site of mine is being scanned so damn much for "index.php" (none are PHP) Just great, and already dreading what happens if/when there's a vulnerability in the OS or web framework they use

I'm starting to sense a divide in the tech industry: - People thriving on autonomy who are reinventing how they work and what tools they use with AI: LOTS of work, but they're enjoying it and getting very efficient - People used to being mentored / trained / or simply told what to do and how. Frustrated with the lack of guidance from management on what to do with AI; also frustrated by seeing some of their peers thriving; increasingly bitter about AI and the state of the industry, as a whole Neither group seems to be aware that there's another group, or have empathy for the other group

"When the going gets tough, the tough get going." It's a saying that comes to my mind when I get close to giving up on something new/difficult/different Found myself using it a lot more, recently. Just because my old routines no longer work as well, and I'm trying new ones

Correct. We're getting the biggest "bug bash" in human history, probably what would have been ~40 years' worth of disclosures and CVEs in existing software, compressed in ~2. What the industry needs is fixers, and new (faster) ways to fix!

Staff engineers need to connect technical choices to user needs and economics, then test their assumptions instead of waiting for product to resolve the ambiguity for them. @Lethain with @GergelyOrosz on @Pragmatic_Eng

Also, on social media, received a lot of pushback on two areas: 1. "Why ban AI writing?" --> doing so turned out to be a wonderful decision. A few people still submitted AI writing, and it was woeful to try and read, we gave up on all of them. 2. "Why not allow anonymous essays?" --> Not allowing also turned out to be a good decision. No anonymity means we did not have to do fact-checking. A few people submitted anonymous, still: it's hard to tell if those are made up or real, and the author also cannot publish it, given they don't want association with it. A lot of people wrote about their side projects, not their company: which worked great as well! Essays feel honest, and also inspiring (for anyone looking for inspiration on how to make the most out of this technology change wave!)