It started with a misconfigured CI runner. A developer had a Jenkins pipeline building Docker images. The container ran as root. A dependency had a known RCE vulnerability. When the exploit landed, the attacker had root inside the container, and because that process was root, they also had root on the host. They pivoted to the secrets store, grabbed credentials, and spent three weeks inside the network before anyone noticed. ...
This post continues “The Centaur’s Toolkit” series on practical human-AI collaboration in technical work. The error showed up in production on a Wednesday afternoon. sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) SSL SYSCALL error: EOF detected I knew this error. Or thought I did. Stack Overflow had dozens of answers: upgrade psycopg2, check your SSL certificates, adjust your connection timeout. I’d even hit this error two years earlier on a different project, and the fix had been a connection pool configuration change. ...
This is Part 6 of “The Centaur’s Toolkit” series, where we explore practical strategies for human-AI collaboration in technical work. Nobody likes writing documentation. I’ve never met a developer who wakes up excited to document their code. We know it’s important. We know future-us will be grateful. We still procrastinate until the last possible moment, then write the bare minimum. This isn’t a character flaw. It’s a rational response to incentives. Documentation takes time, provides no immediate feedback, and often becomes outdated before anyone reads it. The effort-to-reward ratio feels terrible. ...
This is Part 5 of “The Centaur’s Toolkit” series, where we explore practical strategies for human-AI collaboration in technical work. A new AI coding tool launches every week. Actually, that’s an understatement. Multiple tools launch every week, each promising to revolutionize your workflow. Each one has a Twitter thread explaining why it’s better than what you’re using now. If you tried to evaluate every new tool, you’d never write any code. ...
This is Part 4 of “The Centaur’s Toolkit” series, where we explore practical strategies for human-AI collaboration in technical work. Code review is one of those practices everyone agrees is important and almost nobody enjoys. You’re deep in your own work when a PR notification arrives. You context-switch, try to understand someone else’s mental model, and attempt to provide useful feedback before the next interruption hits. It’s mentally draining. And honestly, most reviews end up being superficial because thorough review takes time nobody has. ...