My Battles With Technology

Welcome. My work explores a single, critical question: How do we master the tools of a complex digital world?

Whether it’s deploying a Kubernetes cluster, automating a workflow, or, most recently, partnering with artificial intelligence, my goal is the same: to move beyond simply using technology and toward directing it with strategy, wisdom, and insight.

I’ve codified my framework for this new era of work in my book, The Centaur’s Edge: A Practical Guide to Thriving in the Age of AI. It provides the mindset and practical exercises needed to turn AI from a mysterious force into a powerful partner.

This blog is my workshop for that ongoing journey. I’m glad you’ve joined me.

A terminal showing a forged proofbundle receipt, signed with an attacker's freshly generated key, printing CRYPTO: OK and exiting 0. Below it the same forged receipt is verified again with a trust policy and prints POLICY: FAIL, signer public key is NOT in allowed_issuers, exit 3.

A Forged Receipt That Verifies: Offline Evidence with proofbundle

A number travels further than the system that produced it. A CI job says a model scored 0.97 on a benchmark, and that 0.97 ends up in a Slack thread, a slide, a vendor questionnaire, an audit binder. By the third hop, nobody can say who produced it or whether it’s the same number the job printed. It’s a screenshot. The standard fix is a digital signature: the producer signs the result with a private key, and anyone holding the matching public key can check that the bytes haven’t changed and that the key holder signed them. Signing software artifacts is well understood by now; projects like Sigstore do it at scale. But most of that machinery assumes the person checking can reach the internet: a transparency log, a certificate authority, an identity provider. An auditor in a locked-down review room, or an incident responder archiving evidence for a year, may not have any of that. ...

A terminal showing ls crashes | wc -l returning 12165, then wuppiefuzz dedup reducing them to 10 unique clusters. Three clusters are highlighted in red: a 500 on POST /items, an incorrect response object, and a possible injection signature. The other seven are UnexpectedContent on every endpoint.

12,165 Crashes in 60 Seconds: Fuzzing a REST API with WuppieFuzz

Most REST APIs ship with two kinds of tests: unit tests that check functions in isolation, and integration tests that walk the happy path. “Create an item, read it back, delete it, get a 204.” Those tests are written by the same people who wrote the code, so they test the inputs those people expected. Nobody writes the test that sends a 65-character name, a quantity of 2^64, or a DELETE for an item that was never created, because nobody thought of it. ...

Two terminal panes side by side: a Go program using ygo prints a 96-byte update with sha256 7950d34c2dc30055, and a Node.js script using yjs 13.6.33 prints the same length and hash with identical_to_go=true

Same Bytes, Different Language: Testing ygo's Claim of Byte-for-Byte Yjs Compatibility

Every real-time collaborative editor has the same hard problem underneath it. Two people type into the same paragraph at the same moment, possibly while one of them is offline on a train, and when everything reconnects both screens have to end up showing exactly the same text without anyone’s edit vanishing. The family of data structures built to solve that is called a CRDT (Conflict-free Replicated Data Type): a structure designed so that copies of a document (called replicas) can accept edits independently and always merge to the same result, in any order, with no central referee deciding who wins. ...

Terminal output from a NEEDLE lab run: a fake agent exits 0 on a bead it lied about, NEEDLE re-runs the definition of done, the verification fails, a false close is detected, and a priority-0 Fix build bead is filed automatically

Boring on Purpose: Wrapping Coding Agents in NEEDLE's State Machine

The Rabbit Hole Generator gave me NEEDLE this week, and it lands right on a question I keep running into: once you let a coding agent run unattended, who decides whether it actually did the job? Most of the excitement around coding agents is about making them smarter. NEEDLE is interested in something much less glamorous. It assumes the agent is unpredictable, wraps it in a loop where every step around the agent is fixed and logged, and then refuses to take the agent’s word that it finished. I didn’t want to point a real AI model with its permission prompts switched off at anything, so I ran the whole thing against a fake agent: a 20-line shell script that succeeds, fails, hangs, and lies on cue. The lying one turned out to be the most interesting part. ...

Two oci-explorer score cards stacked. The top one is a busybox image with four 20-byte junk files attached and scores 9 out of 10, grade A. The bottom one is oci-explorer's own image, keylessly signed in CI and verified with cosign, and also scores 9 out of 10, grade A.

Grade A, Signed by Nobody: What oci-explorer's Supply Chain Score Actually Measures

Ask most teams what’s attached to the container image running in production and you’ll get an answer about their CI pipeline: “we sign it, we generate an SBOM, we attach provenance.” That’s a statement about what the pipeline tried to do. Whether the registry actually holds those things, linked to the right image, in a form the next tool can find, is a different question, and it’s surprisingly hard to answer in under a minute. ...