ls -t posts/
Posts
328 posts. Everything from 2006–2012 is from my old blog, indiangeek.net.
access-control advertising agents ai algorithms apis apple architecture arm astro aws backups bash bgp bitcoin books browsers build c caching career careers cdn chatgpt chezmoi cloud cloudflare code-review codebases collaboration community compilers complexity compression computation concurrency containers copilot cost costs cpp cpu cpus craft crypto cryptography cs csharp ctf culture data data-science data-structures databases dates deep-dive defensive-coding dependencies design devops diffusion distributed-systems dmca dns dotfiles dotnet editors embeddings endpoints engineering erlang ethics evals evaluation explainers games geometry git github go government graphql hardware hashing hiring history hosting identity incident incidents inference infrastructure interviews ios java javascript knowledge latency launches law leadership learning legacy licensing linux lisp llms local-models machine-learning macos management math memory mentoring metrics microsoft mobile monitoring multi-agent naming neovim networking neural-networks notes npm number-theory obituary obsidian one-on-ones open-source open-web openai openssl operations opinion optimization outages packaging papers pascal passwords payments performance personal policy postgresql postmortems predictions privacy process productivity profiling programming programming-languages proofs protocols python r rag ransomware refactoring regex reliability remote-work reverse-engineering review reviews risk rss ruby runtimes rust sat search security shipping slack social-engineering software software-design software-engineering spam sqlite sre ssh stack-overflow startups statistics supply-chain support swift teams tensorflow terminal terraform testing time tls tools tribute typescript unicode unix vendors video vim visual-explainer vulnerabilities web web3 windows wireguard workflow writing year-in-review zoom
2026
- The Programmer Competency Matrix, 2026 edition
- I rebuilt this site with an agent
- What 10x actually looks like
- Margaret Hamilton and software engineering
- Book review: Kill It with Fire
- The cron job that ran every minute
- Sandboxing agents
- My Obsidian vault as an agent's memory
- Teaching juniors when the agent knows more
- Evals for my own agents
- The agent loop, visually
- Our model provider had a security incident
- SICP, reread
- Don't be a meat proxy
- Bespoke software is cheap now
- Writing specs for agents
- Mixture of experts, visually
- The backdoor in the job offer
- Hiring engineers when agents do the typing
- Hardware attestation and who controls your device
- Show human effort
- My personal agent
- Neovim in 2026: rebuilt with an agent
- Book review: Co-Intelligence
- The prompt injection in a support ticket
- Local models are good now
- KV caches and why context is expensive
- Code review when agents write the code
- Speculative decoding, visually
- Git commands I run before reading any code
- A team of agents in my terminal
- What a source map can leak
- Axios on npm was compromised, and our lockfile held
- Tony Hoare: null, quicksort and CSP
- My dotfiles, now that an agent edits them
- Book review: AI Engineering
- The agent that wiped our staging database
- Agents need accountability
- Windows, macOS and Linux: my 2026 setup
- Agents talking to agents
- How Tailscale works
- Should my agents get their own computer?
- Where did Stack Overflow's questions go?
- What I'm betting on in 2026
2025
- 2025: the year my team stopped writing boilerplate
- How LLM tool calling actually works
- Picking a model per task
- When our CDN went down
- uv, and the end of my Python packaging pain
- us-east-1 again
- Sub-agents and parallel work
- Two of our most-used npm packages got owned
- Why I'm still hiring juniors
- GPT-5 and choosing models on evals, not launches
- Pointing an agent at my notes
- Agentic IDEs compared, from the terminal side
- Software in the era of AI, for teams
- To my AI-skeptic friends
- Giving an agent an hour and a test suite
- I'd rather read the prompt
- The support bot that invented a policy
- If the CVE program goes away
- The wrong person in the channel
- A 10x faster TypeScript, written in Go
- A week with Claude Code
- How you get tracked
- DeepSeek-R1, and what a cheap open reasoning model changes
- JavaScript Temporal: dates done right, at last
2024
- Ghostty and my terminal
- Cognitive load is what matters
- The Model Context Protocol
- How I ship projects as a leader
- Computer use and the first real agents
- Timezones are weirder than you think
- The expired domain in our build
- Reasoning models
- SQL injection is still here
- BB(5): the busy beaver and a computer-checked proof
- Is open-weights AI the path forward?
- Twenty-seven laptops in a boot loop
- Vector embeddings, visually
- Book review: The Staff Engineer's Path
- GraphQL, six years later
- An agent that files my expenses
- How SSH authentication works
- Auditing our build images after the xz backdoor
- Spreadsheets are all you need
- Book review: Tidy First?
- Somebody else's six-figure bandwidth bill, and our smaller one
- Diffusion models, visually
- My editor in 2024
- Niklaus Wirth and the virtue of small programs
2023
- 2023: how AI changed my team's year
- Hackers & Painters, 20 years on
- Retrieval-augmented generation, visually
- The OpenAI weekend and AI vendor risk
- Finding money in the cloud bill
- Unicode for working developers
- Why commit counts lie
- The phone on our leadership team
- When your infra tool changes its license
- Bram Moolenaar and the editors that shaped me
- Zenbleed: a CPU bug explained
- Llama 2 on my laptop
- The vendor API that vanished in 30 days
- One set of dotfiles for Windows, macOS and Linux
- "No moat": open models catch up
- Memory allocators, visually
- Writing our AI usage policy
- An aperiodic monotile, visually
- The Friday our bank failed
- GPT-4 and my moving skepticism
- Book review: The Art of Doing Science and Engineering
- Chatbots with a persona problem
- Leading a team through layoffs
- The transformer, visually: building a tiny GPT
2022
- Rotating the secrets in our password vault
- A week with ChatGPT
- Offboarding 30 people in an afternoon
- Fred Brooks, and what Man-Month taught me
- Copilot, a year in
- My personal knowledge base, 16 years after the last one
- Whisper: transcription that works
- Design docs people actually read
- The cloud account we forgot we had got suspended
- Use one big server
- Ropes, skip lists and tries
- Bun, Deno and Node: a runtime bake-off
- Book review: Software Engineering at Google
- Power side channels and Hertzbleed
- Hiring in a hot market
- SQLite's WAL mode explained
- We actually restored from backup
- DALL·E 2 and images from nowhere
- A contractor's laptop and our identity provider
- Please put units in names
- Book review: A Philosophy of Software Design
- How search engines rank: PageRank to BM25
- The runaway cloud bill weekend
- Web3, after actually building something
2021
- Log4Shell: the weekend we grepped every JAR
- Things I've learned in nearly 30 years of programming
- The day our routes disappeared
- Book review: Crafting Interpreters
- Perceptual hashing, and how NeuralHash collided
- SQLite on a static host
- GitHub Copilot, first week with an AI pair programmer
- Our ransomware tabletop
- A kernel ban and trust in open source
- Book review: Staff Engineer
- Profiling a slow loader
- Merkle trees, from git to Certificate Transparency
2020
- Auditing every agent with admin rights
- Apple M1: an x86 lifer's first week on ARM
- youtube-dl, the DMCA and open source maintainers
- One-on-ones over video
- CRDTs: how collaborative editing works
- Social engineering at the help desk
- GPT-3 and few-shot learning
- Book review: Building Secure and Reliable Systems
- Uninvited guests at our all-hands
- Taking the whole company remote in a week
- Tail latency: p99s, GC pauses and what users feel
- Clean code, what I still believe
2019
- Learning at work is work
- Sum of three cubes
- Password hashing, from crypt to bcrypt to Argon2
- Finishing the data science certificate
- The SSRF that reached our metadata service
- How a regex takes down an API
- Cross-validation and the bias-variance trade-off, visually
- Book review: An Elegant Puzzle
- Joe Armstrong and "let it crash"
- Ghidra, a reverse engineer's first impressions
- GPT-2 and "too dangerous to release"
- Backpropagation by hand
2018
- LSM trees: how write-heavy databases work
- The malicious dependency in our build
- R for a C# programmer
- Book review: An Introduction to Statistical Learning
- Garbage collectors, visually
- Random forests, visually
- Microsoft buys GitHub, and I'm not moving
- GDPR week: what we actually changed
- How DNS resolution works, step by step
- Book review: Accelerate
- Patching for Spectre and losing 30% on the database tier
- Meltdown and Spectre, visually
2017
- Linear regression from scratch in R
- Firefox Quantum and Rust in production
- KRACK: breaking the WPA2 four-way handshake
- The framework patch we hadn't applied
- Book review: Designing Data-Intensive Applications
- Back to school
- Attention, explained for engineers
- WannaCry Friday
- Book review: The Manager's Path
- How a SHA-1 collision is made
- Object storage went down and took our status page with it
- Consistent hashing, visually
2016
- Building a data team at a startup
- How video compression works
- The day DNS went away
- Bloom filters, visually
- PowerShell on Linux and the end of the OS wars
- Rolling out 2FA everywhere in a week
- Book review: Site Reliability Engineering
- The 200-terabyte proof
- Should you move into management?
- left-pad and the 11 lines that broke the build
- Apple vs the FBI: why I'm with Apple
- Monte Carlo tree search, visually
2015
- Babai's graph isomorphism result, for programmers
- TensorFlow, a practitioner's first look
- Leaving the colo cage
- The TLS handshake, visually
- The ex-employee who still had VPN access
- The Mythical Man-Month at 40
- How we run blameless postmortems
- Rust ownership for C++ programmers
- Visual Studio Code: Microsoft ships an editor for everyone
- B-trees, visually
- The root certificate on our sales laptops
- Your data isn't big
2014
- Book review: Superintelligence
- .NET goes open source, and I did not expect to see it
- Writing an engineering ladder
- The Shellshock weekend
- fork() can fail
- Raft: consensus you can actually understand
- Swift, first impressions
- Rotating every certificate we own in 72 hours
- Heartbleed, drawn out
- Book review: Hackers, Heroes of the Computer Revolution
- How Bitcoin works, block by block
- What I ask in interviews instead of puzzles
2013
- A holiday-weekend card data scare
- How a "hot" ranking works
- Healthcare.gov and the myth of the big-bang launch
- Public key crypto, and what "NSA foils encryption" might mean
- Book review: The Phoenix Project
- Do things that don't scale, an engineering reading
- PRISM and the systems we build
- What a Linux container actually is
- Our host got breached, so we rotated everything
- Google Reader is dying, and I'm keeping my feeds
- How a hash table really works
- Aaron Swartz and the open web
2012
2011
2010
- Spoon Application Virtualization Technology
- Youthful Arrogance
- Ubuntu Install Experience
- Oracle to start charging for MySQL - Standard edition @ 2000 USD
- Indiangeek featured as a resource for online computer science students
- The 5.2 billion dollar mistake. « Steve Blank
- Microsoft shifting to HTML5 as primary cross-platform runtime
- SPTH 'Taking the redpill: Artificial Evolution in native x86 systems' (VX heavens)
- Google Static Maps API - Google Code
- Google Chrome - Extensions run in separate processes too
- Keyboard shortcut for Sniping Tool
- ZeroMQ: Modern & Fast Networking Stack - igvita.com
- Scott Adams Blog: The Illusion of Winning 08/30/2010
- High Scalability - High Scalability - Pomegranate - Storing Billions and Billions of Tiny Little Files
- Beginner's Guide to Linkers
- SSMS Addins - Object Finder - DataScripter
- Regular Expression to check for primes
- Summary of use cases for non-relational storage
- Meditation: Why Bother?
- China is not the world's biggest manufacturer
- soapUI - Web Service tool
- OutOfMemory/Heap space errors in Java
2009
2008
- Windows Azure Distilled - A Programmer's view
- Using Windows Azure SDK with SQL Server 2005/2008
- A case study in micro-optimization
- What will be the next generation internet application platform?
- PsTools to the rescue
- Hacking democracy
- Subversion as a deployment tool
- Programmer Competency Matrix - 32 attributes to evaluate programmers
- Weblog is a "log"
- The Economics of Success
- An alternative model of computation for concurrency
- Hosting multiple sites on the same IP and port using IIS
- Finally got Webkit running under Visual Studio
- First alternative to google that I actually liked
2007
- How to leak memory in .Net - Statics and Event Handlers
- .Net framework hotfix wreaks havoc
- In defence on hacking
- Wireless power
- What they don't teach you in CS class
- Programmer's tools
- Make sure you know what you're fixing
- A new kind of adsense scam?
- Is a CS degree required to make a good programmer?
- CMM model is flawed
- Is Ruby "The One"?
- Notes on the software build process
- Moving back to XP SP2 aka Vista is not yet ready
- Picasa rocks
- Fonts for programming
2006
- Personal KM tool
- Use Visual Studio 2005 to browse existing code
- Vista First Experience
- Do not start with an <b><i>I</i></b>nterface
- Amazon utility computing web service
- Interesting reading for August-05-2006
- Innovative use of blogging as a marketing medium
- Dynamic web service proxies need to be loaded from disk
- Interesting reading for 1-August-2006
- w.bloggar
- Interesting reading for July-31-2006
- Treemaps for space constrained visualization
- Setting up wireless LAN
- NDepend 2.0 released
- Why managers get paid more than programmers??
- ThoughtWorks Master class - Agile programming for fun and profit
- Configuring TCP/IP for multiple networks
- Airtel broadband installation - funny typo
- C# Application Markup language
- Back from the dead