F15hb0wn Blog Entries

In 2003 at the Naval Postgraduate School, the Blaster worm taught me hard lessons about patch windows, perimeter assumptions, and the laptops that walk in from outside. With Anthropic's release of Mythos, we're about to relive a version of that August, compressed and supercharged. Here's the guidance I gave my team and what I wish I'd known in Monterey.

After publishing The Nuclear Code Fork, smart engineers pushed back with reasonable objections: use mature projects, wait for stable releases, pin your versions, trust the process. Every one of those heuristics was right once. Here's why they're wrong now, with specifics from Log4j, Trivy, LiteLLM, and tj-actions.

We killed all 450 external dependencies in our analytics platform and brought every line of code in house. It took two days, ~305K tokens, and uncovered 14 vulnerabilities that were already sitting in our stack. Here's why we did it, what we found, and what it actually cost.

In November 1998, a terrified young sailor stepped onto the flight deck of the USS Kitty Hawk during night operations and had to make a hard choice under impossible pressure. Twenty-seven years later, the tech industry could use that same lesson.

A new framework for planning projects that blends AI token costs with human labor rates, breaking work into classes of effort where cost, speed and quality can be optimized across every sub-task.

I anticipated most of the challenges of moving to New Zealand. Immigration, housing, saying goodbyes. What I didn't anticipate was how exhausting it would be to relearn space, time and standards. When seasons run backwards, Mondays happen twice, and you find yourself whispering 'I miss inches' in bed, the cumulative toll is real. Fortunately, wonder makes a good coping mechanism

You cannot accelerate a process to supersonic speeds if it barely works at five miles per hour. Applying Anthropic's 4D Framework for AI Fluency to cybersecurity automation reveals that all four D's (Delegation, Description, Discernment, Diligence) fail when built on the same siloed, philosophy-free foundations that have plagued SECOPS for decades. The consequences in our field are uniquely severe: the AI can't go to prison when it gets it wrong.

I built guardrails for the code, the architecture, and the security. I forgot to build guardrails for myself. After an eight-month megasprint rebuilding 10 years of work with Claude, I ended up on bedrest for a week. Turns out AI-assisted development is the most potent productivity drug ever created, and the dose that makes it medicine and the dose that makes it poison are closer together than you'd think.

In September, I burned through an entire GitHub Enterprise token allocation and barely noticed — the overages cost pennies. I rated that moment at 1,000:1. Value to cost. By February, I'm spending $2,000 a week on similar workflows. The ratio is now 600:1 and falling. The window isn't shut. But it's moving. Here's what I think is driving it, and what I'm planning for when it closes.

Eight years after writing "People > Machines," the thesis holds stronger than ever. AI-assisted development has turned the OODA loop into a double-edged sword: with solid devops practices, it creates virtuous cycles that compound quality at unprecedented speed. Without them, it amplifies technical debt into a death spiral. The microphone-next-to-the-speaker problem is real, and the human in the loop is the one who decides what gets amplified.