Posts

Short notes and links worth keeping, written down before I forget why they mattered. On .NET, Azure, and building with AI.

Treat gateways as hot‑swappable infrastructure, not permanent vendors. — OpenRouter joining forces with Stripe and Nvidia circling Hugging Face remind you that “API‑compatible” rarely equals operational portability. Separate three seams in production: routing (which model…
Treat paywall status as retrieval quality. — A system that ranks paywalled pages as top evidence will score well in offline benchmarks that only measure relevance and then fail when users click. Kagi’s new setting to hide paywalled links makes…
This is a supply-chain problem, not M&A theater. — If Nvidia does buy Hugging Face, a single corporate owner would concentrate control over model cards, weights, and community distribution. Treat those artifacts like build dependencies: mirror the…
A VM is not a security strategy for a tool-enabled agent. — Trail of Bits demonstrates kernel bugs, disclosed vulnerabilities, and multiple zero-days that let an agent escape VMs, so “put it in a VM” is a false boundary. Treat these agents like untrusted CI…
A green health check that never opens the real dependency is theater: it… — Loopback-only probes can pass while TLS pinning, browser visibility, or push endpoint failures still break users. For every critical dependency, add at least one probe that crosses the real socket…
A green test suite that stubs the network is a confidence illusion; require one… — The aiortc post shows the risk: loopback tests stayed green while certificate-pinning logic was wrong. Keep your fast fakes, but gate merges on a canary that performs a real network dial and asserts…
Provider-specific options vanish silently under multi-model wrappers; Sentry's… — The engineering fix is fine, but the design lesson is narrow: add provider-level, wire-oriented contract tests and a conformance suite for each model client before you build another abstraction…
Treat web citations as untrusted input. The Hanover Institute case shows… — Add provenance scoring, strict source allowlists you can audit, and immutable evidence snapshots alongside answers so you can see what the model actually used. If your system doesn't do those three…
Storage and recovery paths, not SQL or your ORM, are where SQLite surprises… — If you rely on SQLite for agent state, caches, edge services, or embedded workflows, add tests that exercise process restarts, interrupted checkpoints, and filesystem faults, not just query…
Model routers just graduated to strategic infrastructure. — With OpenRouter joining Stripe, a single routing layer now sits inside a payments giant, so teams should treat it like any other critical dependency and run one exit drill: can you move high-value…
A single frontend typo that generates 100,000 requests is an API design… — Backends must assume clients will misbehave: admission control at the gateway, request deduplication, and per-actor budgets stop one bad component or runaway agent loop from turning into a database…
DuckDB 2.0 matters less as a speed trump card and more as a local, reproducible… — Its server mode, VARIANT column support, and triggers let you keep analysis next to the codebase and the artifacts that matter, so you don’t have to invent a data platform the moment an AI feature…
Treat vendor-published system prompts as a dependency. — Now that Anthropic publishes Claude’s live system prompts you can stop blaming mysterious “model drift” for behavior changes and start tracing them to concrete text diffs. Diff prompts, pin failing…
SemVer stops being enough the moment bots and coding agents can push dependency… — Rust's decision to bake cargo-semver-checks into std's CI and Python's gap around reproducible builds both point to the same operational lesson: downstream compatibility testing and build…
Boring message-based designs win against clever multi-agent buses when systems… — ActivityPub’s success shows the survival value of plain HTTP, explicit inbox/outbox messages, and simple semantics: you can reason about reordering, idempotency, and who owns a dead-letter path. If…
Snapshot the outbound wire and treat provider adapters like protocol code so… — Sentry’s Gemini trace bug shows the failure mode clearly, when a refactor re-proxied a chat object and the create-time config was stripped so traces no longer recorded temperature, max tokens or…
Treat your frontend as an untrusted agent: enforce per-client throttles… — A recent React render-loop that fired 100k identical requests shows observability spotted it, but hard limits are what keep a single buggy UI from melting CPUs. The practical move is boring but…
If your approval flow requires the user to pause, switch devices, or survive a… — When sessions live as provider-sealed blobs or server-bound IDs, the approval step becomes a sticky-session bug: the next device or service cannot reconstruct what the agent saw or why it asked for…
Rewriting your stack in Go is unnecessary. — The real lesson from Google's Go pitch is that agents do best where the toolchain is boring: fast builds, deterministic formatting, legible dependency provenance, and cheap verification loops. You…
Feature flags stop being flexible tooling once agents write the code: each… — Treat flags like release scaffolding, not permanent knobs: require a short-lived release flag policy with an explicit owner, a hard expiry date, and deletion as part of the “done” checklist. If you…
If your agent needs memory or simple math, use ordinary software first: typed… — Wrapping every write or count through another LLM raises cost, leakage, prompt-injection surface, and hides selection bugs behind plausible-sounding “reasoning.” Give the LLM a verb: phrase results…
JetBrains putting IntelliJ’s Java/Kotlin intelligence on LSP means teams can… — Expect better completion, navigation, and lighter refactors, but remember LSP is a lossy boundary: project-model fidelity, complex cross-module refactors, and tight build-system integration will…
AI meeting bots are privileged integrations, not harmless productivity add-ons. — The tl;dv exposure shows a tool that can join calls, read calendars, store transcripts, and hand out join IDs in real time. Treat any agent that can access meetings like a production connector…
LLM-generated advisories can poison the feeds humans and automation trust, so… — The JFrog audit of fabricated SQLite CVEs shows plausible-sounding reports can travel into NVD and ADP pipelines and trigger scanners before anyone reproduces a PoC. Require vendor corroboration or a…
Treat CVE feeds as untrusted input once LLM slop enters the vulnerability… — The SQLite false-alarm episode shows how plausible-sounding, AI-generated advisories can get a critical score and then cascade into tickets, bot actions, and emergency work that wastes engineering…
Treat session portability as a dead assumption. — Modern providers intentionally tie session state to their browser, device, and anti-abuse context, so trying to export cookies or “hand over” a human session to an agent will be flaky at best and a…
Relying on moving sessions between browser, CLI, and remote runtimes is a… — Provider-sealed state, encrypted compaction, hidden searches and response IDs make a transcript a foreign key into someone else’s database, so copying cookies or blobs only creates fragile, opaque…
The SQLite CVE mess shows that the problem isn't finding more issues, it's… — If you plug LLMs or agentic scanners into triage without provenance, PoC verification steps, and configurable evidence thresholds, you will drown in plausible-sounding noise and waste analyst cycles…
Stacked PRs are a control surface for coding agents, not just a nicer way to… — If agents can generate multi-file changes faster than humans review them, stacks buy you blast-radius control and reversible rollout only when you enforce small layers, keep base branches pristine…
If you're building for resumable work and your answer is copying cookies or… — Earendil's writeup shows how provider-sealed blobs and server-side compaction turn a transcript into a foreign key rather than something the user can continue. Make resumable flows explicit…
Most production JSON bugs are not parse errors but semantic drift: dates that… — Test the contract by round-tripping schemas across your client and server runtimes — TypeScript, .NET, Java — and include any LLM/tools that generate or transform payloads, not just hand-checked…
Disabling a submit button solves the UI illusion, not the real failure mode… — The durable fix belongs on the server: make Node/Azure endpoints replay-safe with idempotency keys, small dedupe stores, and explicit outcome semantics (success, already-applied, retryable-failure)…
If agents, retries, and backfills can each trigger billing work, a “current… — Mutable counters conflate intent and effect—retries, backfills, and human fixes all increment counters and turn operational noise into customer charges. Treat billable facts as immutable events and…
Stacked pull requests make large AI-generated diffs human-reviewable by… — Treat each stack frame as a mini-change: keep it focused, run CI and require approvals per frame, and land frames sequentially so bisects and rollbacks are simple. This only pays off if you…
On a list like this the question is which step costs you money. — The usual arrangement is free to watch, paid to certify, so the credential is the upsell. Every entry here includes the badge and the certificate. Past 200 courses, weighted toward engineering: AI…
My read: the outage to worry about is sudden model inaccessibility driven by… — Run a model‑embargo game day: practice swapping providers and exercising graceful degradation. Treat provider switching as an operational dependency test, not a future legal abstraction — run it now…
My read is that the lesson from fake “Googlebot” hits is broader than SEO… — Teams still using UA allowlists, rate-limit bypasses, or “friendly crawler” flows are building rules that attackers trivially spoof. For Azure-hosted apps and APIs, verify crawlers out of band (IP…
Treating Postgres as a plain queue is why your workers stall and your vacuum… — The real mental model is “a queue running under MVCC”: rows are versioned, visibility lags, and deletes don't instantly free space. That changes the wiring — use SKIP LOCKED intentionally, keep tx…
My read: SQLite is the right default for local TypeScript agents — queryable… — But WAL mode is not magic concurrency dust: when you spawn many short-lived Node workers that open–query–close, WAL can briefly require exclusive locks and surface SQLITE_BUSY. The practical win is…
AI made writing features absurdly cheap; the bottleneck today is the lifetime… — For a small Azure/Node product those recurring costs dominate maintenance and risk, not line count. My read is AI should change what we add: delete surface area more aggressively than we ship it, and…
Treat public repos and docs as a shrinking, friction-prone input source. — Hosts like Codeberg formally refusing scraping are a sign this is a growing trend, so teams should not assume a frictionless commons. Focus on provenance and reciprocity: mirror important docs…
Claude Opus 5 is here. The most interesting upgrade isn’t speed or another… — A model that checks its own work, stays steady through complex tasks, and knows when to challenge an assumption could be far more valuable than one that simply answers faster. Curious to see how it…
Shipping an HTML artifact for AI evals beats another dashboards-first approach. — When teams are comparing prompts, models, and agent runs, a self-contained HTML report that bundles prompts, outputs, diffs, screenshots, latency, and cost is easier to version, share in PRs, and…
Just shipped a live demo of Healthie.NET — my open-source, watchdog-style… — NET. Interval-scheduled pulse checkers, a three-state model (healthy / suspicious / unhealthy), a zero-dependency Blazor dashboard, plus a Model Context Protocol server and AI-assisted diagnostics…
Claude Code just got scheduled tasks and this changes everything. — You can now set up recurring automations — think automated code reviews, dependency updates, test runs, and repo maintenance — all running on a schedule without you lifting a finger. This is the kind…
Shipped something I've been working on — Healthie. — NET, a lightweight health monitoring framework for .NET applications. It's built for ASP.NET Core and Blazor apps that need proper health checks without the overhead. Extensible, clean API, and easy…
Just found a game-changer for anyone building UIs with Claude Code. — The ui-ux-pro-max skill gives you access to 50 design styles, 21 color palettes, 50 font pairings, and 20 chart types — all baked into a single Claude skill. If you're tired of generic-looking…