Artificial Intelligence (AI)

After publishing The Nuclear Code Fork, smart engineers pushed back with reasonable objections: use mature projects, wait for stable releases, pin your versions, trust the process. Every one of those heuristics was right once. Here's why they're wrong now, with specifics from Log4j, Trivy, LiteLLM, and tj-actions.

We killed all 450 external dependencies in our analytics platform and brought every line of code in house. It took two days, ~305K tokens, and uncovered 14 vulnerabilities that were already sitting in our stack. Here's why we did it, what we found, and what it actually cost.

In November 1998, a terrified young sailor stepped onto the flight deck of the USS Kitty Hawk during night operations and had to make a hard choice under impossible pressure. Twenty-seven years later, the tech industry could use that same lesson.

A new framework for planning projects that blends AI token costs with human labor rates, breaking work into classes of effort where cost, speed and quality can be optimized across every sub-task.

You cannot accelerate a process to supersonic speeds if it barely works at five miles per hour. Applying Anthropic's 4D Framework for AI Fluency to cybersecurity automation reveals that all four D's (Delegation, Description, Discernment, Diligence) fail when built on the same siloed, philosophy-free foundations that have plagued SECOPS for decades. The consequences in our field are uniquely severe: the AI can't go to prison when it gets it wrong.

I built guardrails for the code, the architecture, and the security. I forgot to build guardrails for myself. After an eight-month megasprint rebuilding 10 years of work with Claude, I ended up on bedrest for a week. Turns out AI-assisted development is the most potent productivity drug ever created, and the dose that makes it medicine and the dose that makes it poison are closer together than you'd think.

In September, I burned through an entire GitHub Enterprise token allocation and barely noticed — the overages cost pennies. I rated that moment at 1,000:1. Value to cost. By February, I'm spending $2,000 a week on similar workflows. The ratio is now 600:1 and falling. The window isn't shut. But it's moving. Here's what I think is driving it, and what I'm planning for when it closes.

Eight years after writing "People > Machines," the thesis holds stronger than ever. AI-assisted development has turned the OODA loop into a double-edged sword: with solid devops practices, it creates virtuous cycles that compound quality at unprecedented speed. Without them, it amplifies technical debt into a death spiral. The microphone-next-to-the-speaker problem is real, and the human in the loop is the one who decides what gets amplified.

After six months of building WitFoo's analytics platform with Claude Code, I'm more convinced than ever that AI coding tools make experienced practitioners more valuable, not less. Claude is an extraordinary Warrior, but the Wizard's strategic vision, the Poet's search for meaning, and the hard-won knowledge of the WitFoo Way remain stubbornly, irreducibly human. The Foo has been upgraded. The Wit remains ours.

A companion to "Coding with Claude," this post covers the four-phase approach we used to prepare legacy code for AI-assisted development: documenting what exists, establishing standards, cleaning up the worst of the mess, and letting Claude build the bridge to next-generation code.