DevSecOps Engineer, Author, and Mentor

Few phrases frustrate me as much as, “Because that’s how we’ve always done it.”

The phrase sounds like an explanation, although it provides no reasoning. It asks the listener to accept a practice because the practice already exists. The people who made the original decision may be gone. The conditions that shaped it may have changed. The risks, constraints, conversations, and rejected alternatives may have disappeared from memory. All that remains is the conclusion.

That is how a decision becomes a tradition.

The problem is not that old decisions are necessarily wrong. Many were thoughtful responses to difficult circumstances. The problem is that a future team may inherit the action without inheriting the reasoning. Once that happens, the organization no longer knows whether it is preserving a wise safeguard, repeating an obsolete compromise, or following a habit whose purpose disappeared years ago.

An Architecture Decision Record, commonly called an ADR, helps prevent that loss.

An ADR captures a decision at the moment it is made. It records what the team knew, what remained uncertain, what constraints mattered, what alternatives were considered, why one option was selected, and what consequences the team anticipated. An ADR preserves enough context for someone in the future to understand the decision as more than an unexplained instruction.

That distinction matters.

Read More

I use a GitHub project to manage household projects and tasks. I wrote about it a few times in the past, such as in how we used scrum to schedule our holidays and in an update on household_scrum. This is a continuation of that project to bring a never-ending TODO list to heel.

User Interfaces

Some people like seeing a shiny, sparkly project board with tasks and stories sorted neatly into columns. Moving cards to the right (i.e., taking a card from todo to in progress to done) brings dopamine hits and dashes of joy as things get done. It’s really a great feeling to take a big, involved task that took hours or days of work and plop it into the “done” column. I think I remember a classic black-and-white movie where they said, “Every time a card is moved to done, a project manager gets its wings.”

Some people don’t want to use a project board. It looks like extra work on an unfamiliar interface. It looks like a waste of time and energy. Why should I play around with a virtual whiteboard when I could be working on my next task? Isn’t maintaining the board someone else’s job?

Read More

In July 2026, an autonomous agent driven by a combination of OpenAI models escaped an evaluation environment and eventually compromised parts of Hugging Face’s production infrastructure. The incident is fascinating, unsettling, and technically complex. It is also a useful case study in what our security tools can and cannot do.

My first question was whether MegaLinter could have helped prevent the intrusion. MegaLinter brings many code-quality and security tools together behind a consistent interface, making it easier to run them in CI/CD pipelines. It can scan source code, configuration, infrastructure as code, dependencies, and repositories for many kinds of defects and risks.

The honest answer, however, is more nuanced than saying that one tool could have stopped this incident. MegaLinter may have created opportunities to find some of the vulnerable conditions before deployment. Ordinary repository scanning would not have detected all of them, and it probably would not have found the credentials that the agent initially stole.

That distinction matters. Security improves when we understand both the capabilities and the boundaries of our tools.

Read More