Writing
Practical writing on software engineering, security, AI, and the industry around them.
From CakePHP to Laravel
Replacing a legacy CakePHP supply chain application with Laravel and React: separating business domains, rebuilding the schema history, and moving public routes to ULIDs.
All posts
Resource requests are load-bearing
Fifteen pods used roughly 1.4 GB without declaring requests. How that distorts scheduling, increases eviction risk, and changes how I size workloads.
Never set a Redis memory limit equal to its maxmemory
Twelve OOMKills in a row on an instance configured to evict. The eviction policy was fine. It just never got a turn.
One public IPv4 for the whole cluster
Workers with no public address of their own, and a default route that reads correctly on a whiteboard and fails silently on the wire.
Capability scoping for agent tools
Handing an agent one broad tool and a polite note about what not to do is a deny-list, and it inherits every problem deny-lists have.
Who is the agent acting for?
An agent answering with the wrong customer’s data does not look like a failure. It looks like it worked.
LLMs are good at code you can verify, and bad at code you cannot
Generated code arrives with no uncertainty attached, whether or not any of it was warranted. The reader supplies the confidence.
When Letters Lie: Analyzing a Typical IDN Homograph Attack
A client forwarded a suspicious security update email. The domain looked right. Character by character, it was not.
Owning your dependency supply chain
Auditing a dependency tells you about the version you read. It says nothing about the one being published tonight.
Migrating email from one server to another with ImapSync and Docker
A Docker command for copying mail between IMAP servers with ImapSync, including folder mapping.