Coding

Earlier this week, WitFoo and the University of Canterbury released 100 million labelled cybersecurity records to Hugging Face under Apache 2.0. Here's a three-prompt walk-through for putting it to work in a stack you already own (Grafana, Sentinel, Splunk, Elastic), using Empathetic Processing to translate, detect, and visualise across your own data.

After publishing The Nuclear Code Fork, smart engineers pushed back with reasonable objections: use mature projects, wait for stable releases, pin your versions, trust the process. Every one of those heuristics was right once. Here's why they're wrong now, with specifics from Log4j, Trivy, LiteLLM, and tj-actions.

We killed all 450 external dependencies in our analytics platform and brought every line of code in house. It took two days, ~305K tokens, and uncovered 14 vulnerabilities that were already sitting in our stack. Here's why we did it, what we found, and what it actually cost.

I built guardrails for the code, the architecture, and the security. I forgot to build guardrails for myself. After an eight-month megasprint rebuilding 10 years of work with Claude, I ended up on bedrest for a week. Turns out AI-assisted development is the most potent productivity drug ever created, and the dose that makes it medicine and the dose that makes it poison are closer together than you'd think.

In September, I burned through an entire GitHub Enterprise token allocation and barely noticed — the overages cost pennies. I rated that moment at 1,000:1. Value to cost. By February, I'm spending $2,000 a week on similar workflows. The ratio is now 600:1 and falling. The window isn't shut. But it's moving. Here's what I think is driving it, and what I'm planning for when it closes.

Eight years after writing "People > Machines," the thesis holds stronger than ever. AI-assisted development has turned the OODA loop into a double-edged sword: with solid devops practices, it creates virtuous cycles that compound quality at unprecedented speed. Without them, it amplifies technical debt into a death spiral. The microphone-next-to-the-speaker problem is real, and the human in the loop is the one who decides what gets amplified.

After six months of building WitFoo's analytics platform with Claude Code, I'm more convinced than ever that AI coding tools make experienced practitioners more valuable, not less. Claude is an extraordinary Warrior, but the Wizard's strategic vision, the Poet's search for meaning, and the hard-won knowledge of the WitFoo Way remain stubbornly, irreducibly human. The Foo has been upgraded. The Wit remains ours.

A companion to "Coding with Claude," this post covers the four-phase approach we used to prepare legacy code for AI-assisted development: documenting what exists, establishing standards, cleaning up the worst of the mess, and letting Claude build the bridge to next-generation code.

Six months of building production cybersecurity software with Claude Code. Prompt templates, testing strategies, and hard-won lessons from WitFoo's AI-driven development workflow.

I installed PyTorch 2.4 on Windows 11 with CUDA 12.5 and Flash Attention support. This is a record of how I did it.