7 min read
Threat modeling gives security and development teams a structured way to ask what could go wrong before an attacker answers the question for them. Using STRIDE as an example, this post explains how threat models complement penetration testing, why documenting uncomfortable risks improves security, and how teams can turn identified threats into explicit decisions to accept, mitigate, transfer, or avoid risk.
7 min read
template-bash is the private starter repository I maintain alongside Getting Started with Bash Engineering. It brings together patterns from adrctl, bashdeps, Bootstrap, mktext, bashlog, and related projects into an adaptable Bash project with explicit build, testing, documentation, dependency, release, and security boundaries. A versioned export is available free as the Bash Engineering Starter Kit.
7 min read
bashlog is a sourceable pure-Bash logging library built around predictable output, a small runtime boundary, and developer-controlled redaction. It keeps logs on standard error, adapts human versus logfmt rendering only to terminal presence, supports conventional severity levels and optional metadata, and treats explicitly selected redaction rules as a fail-closed output obligation.
10 min read
bashdeps centralizes a narrow but security-sensitive job: obtaining exact external artifacts, checking them against committed SHA-256 digests, optionally corroborating new acquisitions against upstream-published checksums, and placing the approved bytes where a repository expects them. Its companion manifest-manager CLI helps maintain those declarations without turning runtime synchronization into release discovery or a package manager.
14 min read
The Doxygen filters I wrote for Bash, AWK, and Python were never the goal by themselves. The larger goal was a consistent documentation structure across the languages I use while allowing each language to retain an appropriate native authoring style. PHP provided the useful final case: PHPDoc-style DocBlocks and Doxygen overlap closely enough that a carefully chosen common subset can be consumed directly, with no translation filter at all. The resulting standards now live together in a reusable coding_standards repository that projects can adopt explicitly and, when useful, materialize with bashdeps.
11 min read
Python already has docstrings, and Doxygen already understands Python, which made python-doxygen look as though it should be straightforward. The difficult part was reconciling Python-native PEP 257 and Sphinx-style documentation with Doxygen's own Python docstring behavior. In particular, Doxygen's native docstring mode treats the contents as preformatted text, preventing translated Doxygen commands from being interpreted structurally. python-doxygen keeps idiomatic Python as the maintained source, translates documentation only at the Doxygen boundary, and uses integration tests to verify that the generated documentation means what the source says.
11 min read
awk-doxygen brings structured Doxygen documentation to AWK without pretending AWK is C++ or attempting to parse the entire language. It documents functions, conventional locals, global state, and record-processing rules while detecting documentation drift and preserving AWK's distinctive execution model.
6 min read
bash-doxygen lets Bash projects use Doxygen without pretending Bash is C++ or attempting to parse every corner of the language. It translates explicitly documented Bash functions and variables into a small pseudo-C++ representation Doxygen can index, preserves familiar Doxygen commands, and can fail CI when documentation drifts away from the declarations it describes.
6 min read
mktext is a small Bash library for predictable, literal text substitution. It grew out of adrctl's need to support both modern braced macros and legacy adr-tools templates without growing a full template language. Callers own acquisition and transformation; mktext only renders. The result is a deterministic, dependency-light tool with configurable delimiters, caller-owned contexts, nonrecursive substitution, and a deliberately narrow scope.
4 min read
adrctl builds on the familiar interface of adr-tools while modernizing how Architecture Decision Records are created and managed. Distributed as a single shell script, adrctl adds flexible filename templates, reproducible builds, pinned and verified dependencies, extensive automated testing, and cryptographically attested releases while retaining the workflow and template syntax familiar to existing adr-tools users.
10 min read
Architecture Decision Records preserve the context behind important technical choices. They capture the constraints, alternatives, risks, and reasoning that may otherwise disappear when team members leave. This gives future teams enough knowledge to evaluate earlier decisions fairly rather than repeat them blindly. ADRs support better discernment before action, reduce institutional amnesia, and help prevent avoidable mistakes. They are practical tools for continuity, stewardship, and fewer incidents.
5 min read
Good tools adapt to the way people work instead of forcing people to adapt to the tool. This post introduces GitHub Project Digest, an open source utility that delivers personalized email summaries of GitHub Project work items, allowing team members to stay informed without constantly visiting a project board. Born from a practical need to make a household Scrum board more accessible, the project demonstrates how configurable GitHub queries and Jinja2 templates can generate role-specific digests that fit a wide variety of workflows. Along the way, it explores the design decisions that shaped the tool and the broader principle of bringing information to people instead of expecting people to seek it out.
11 min read
Could MegaLinter have helped prevent the July 2026 Hugging Face intrusion? Repository secret scanners probably would not have found credentials exposed from a running Kubernetes pod, but customized static-analysis and infrastructure-as-code checks may have detected some of the conditions that made the intrusion possible.
4 min read
A bootstrap tool that runs with administrative privileges must earn trust through testing, transparency, repeatable builds, and verifiable releases. The completed experiment demonstrates that disciplined engineering can make entirely AI-generated code practical, reliable, and intentionally boring.
5 min read
AI-generated code becomes more trustworthy when documentation, architecture decisions, modular interfaces, and explicit contracts constrain its development. By recording the reasoning behind the project, each interaction with an LLM can build upon a durable engineering context instead of relying on shifting assumptions.
5 min read
An experiment in building a practical bootstrap tool without manually writing a single line of code begins with clear constraints: the tool must work on minimal systems, require almost no setup, and remain reliable, safe, and predictable. Bash provides the foundation for turning a freshly installed system into a productive working environment.
1 min read
What happens when an AI writes every line of code, but engineering discipline remains firmly in human hands? This post explores an experiment to build a production-quality Bash tool using documentation-first design, architecture decision records, comprehensive testing, and rigorous review without manually writing code. The result demonstrates that trustworthy AI-generated software depends less on the model itself than on the engineering practices, constraints, and accountability surrounding it.
10 min read
The final part of this essay examines what happens when AI moves beyond learning from a person and begins representing them. Influence, imitation, and substitution are not morally equivalent. When a system appears to speak with a person's voice, style, judgment, or authority, the consent question becomes inseparable from identity, agency, and personhood.
9 min read
The second part of this essay asks what consent is really protecting. Legal permission may answer whether something can be done, but it cannot fully answer whether the action respects the person involved. As AI transforms writing, likenesses, voices, and other human artifacts into reusable material, consent becomes one way we resist reducing people to resources.
3 min read
Doxygen-style comments can do more than explain Bash scripts; they can become structured source material for generated help text. This post connects documentation, AI-assisted maintenance, and shell tooling, showing how explicit contracts and intent can reduce reinterpretation errors while making scripts easier for both humans and machines to use.
7 min read
The first part of this essay begins with a professional constraint: public LLMs were prohibited on federal projects because too many security and stewardship questions remained unanswered. What initially appeared to be a concern about data governance gradually reveals a deeper issue. Information matters because people are connected to it, and consent begins when we recognize that connection.
2 min read
This introduction frames the central questions behind the series: what does genuine consent mean when AI can collect, retain, imitate, synthesize, and represent human expression at scale? The series looks beyond ownership and legality to ask how consent protects dignity, agency, and personhood in an age when usefulness can too easily become entitlement.
8 min read
A critique of output-based developer metrics in AI-assisted development, especially measures like token usage, commits, or lines of code. The article argues that metrics often miss intent, judgment, mentorship, and risk prevention, and that documentation helps preserve the reasoning behind work that raw numbers cannot capture.
7 min read
The post argues that AI can be a useful tool for editing, research, and pressure-testing ideas, but leadership requires honesty about how AI was used and personal accountability for the final message. It draws a distinction between using AI to clarify one's own judgment and using AI-generated content to impersonate originality, framing the latter as ethically dubious and contrary to true leadership. Ultimately, the piece defines leadership as the risky, human work of thinking, deciding, creating, and treating others with honesty, respect, and dignity.
6 min read
The final part offers practical patterns for healthier collaboration, including bounded collaboration windows, protected specialist leverage, and clearer decisions about when work should be shared or individual. It treats pairing and mobbing as useful techniques when applied intentionally, rather than default atmospheres that consume the whole workday.
10 min read
Part five moves from critique to constructive practice, asking what healthier collaboration can look like. It presents organizational balance as mutual support among clients, leaders, and teams, emphasizing commercially viable systems that also protect trust, judgment, retention, and the human conditions required for excellent technical work.
9 min read
Part four frames misallocated talent as a business problem, not only a human concern. It argues that organizations waste expensive expertise when they treat senior engineers as interchangeable technical labor, and shows how shallow, interrupted collaboration can reduce architecture quality, security judgment, and the return on skilled professional work.
10 min read
Part three turns from human cost to productivity cost, challenging the assumption that constant collaboration produces better outcomes. It explains how continuous managed availability reduces deep-work capacity, increases context switching, and creates visible activity that may look productive while quietly weakening the quality of thought behind the work.
10 min read
Part two focuses on the human damage caused when senior engineers are placed in workflows that publicly flatten their expertise. It explores public diminishment, neurological load, bodily constraint, and the quiet humiliation that can occur when collaboration models suppress the very strengths organizations hired experienced people to provide.
5 min read
MegaLinter can be extended by the use of plugins which add a low-friction mechanism to define new descriptors and linters that meet your specific needs and requirements. I've written several plugins that are available as free, open-source software.
9 min read
The first part of this series examines how collaboration can become continuous managed availability, leaving engineers always visible, interruptible, and socially on-stage. It argues that deep technical work requires quiet, autonomy, and protected attention, and that organizations can harm people when they mistake constant participation for healthy teamwork.
8 min read
This article introduces continuous managed availability: a workplace pattern where collaboration becomes constant visibility, responsiveness, and interruption. It argues that healthy teamwork must remain a tool rather than an atmosphere, because mistaking synchronized participation for productivity can harm people, flatten expertise, and undermine the deep work engineering requires.
11 min read
A thoughtful argument for using polite language with AI even though machines do not need kindness. The essay distinguishes tools from persons, then explains how speech forms the speaker, making courtesy, gratitude, and accountability valuable habits even in interactions where no one on the other side can be harmed.
11 min read
Architecture Decision Records become more important when AI-assisted development accelerates code changes. This article explains how ADRs preserve intent, constrain machine-generated revisions, and give teams a durable way to understand why decisions were made, reducing the risk that repeated AI edits quietly drift away from the system's original purpose.
7 min read
A reflective essay on creativity, craft, and the unease created by generative AI. Through the lens of skilled trades, handmade objects, and rapidly changing tools, the piece asks what may be lost when human creative work is reduced to outputs, automation, and ever-faster production.
15 min read
Documentation matters more, not less, when AI is used to draft and revise code. This article argues that comments, explanations, and design notes preserve intent across repeated machine-mediated changes, helping teams prevent plausible but subtly wrong code from drifting away from the purpose it was meant to serve.
11 min read
A technical version of the LLM hallucination and delay problem, aimed at readers who work with AI tools more directly. It explains why standard chat models cannot process tasks asynchronously, why they may claim capabilities they lack, and how breaking requests into smaller, verifiable tasks reduces wasted time and confusion.
6 min read
A plain-language explanation of why chat-based LLMs do not keep working in the background after they respond. The article shows how promises like "I am still working on it" can mislead users, then offers practical guidance for keeping AI requests concrete, bounded, and honest.
7 min read
A walkthrough of running Renovate locally in Jenkins to manage dependency updates across many repositories while keeping sensitive infrastructure code off public GitHub. The post connects automation, Gitea, Jenkins, repository hygiene, and dependency management into a practical pattern for reducing maintenance noise without exposing private IaC.
10 min read
A technical walkthrough of running Ollama in a TrueNAS CORE jail on FreeBSD-based infrastructure. The post compares available home lab systems, explains why Docker-centric assumptions do not fit TrueNAS CORE, and explores the practical tradeoffs of CPU inference, jail configuration, and local LLM experimentation.
6 min read
A follow-up on using Scrum principles for household planning after the holidays. The article explains what changed, what stayed useful, and how short iterations, standups, planning sessions, and calendar blocks helped reduce misunderstandings, surface hidden blockers, and create shared accountability without sacrificing flexibility.
1 min read
A concise update on recent FOSS project improvements across GitHub repositories, including better SARIF uploads to DefectDojo, stronger automation, clearer documentation, and security-focused maintenance. The post gives readers a quick snapshot of active work, practical tooling improvements, and the ongoing effort to make small open source utilities more reliable and useful.
1 min read
A pointer to Wes Dean's Flexion article on security incident essentials and their role in mitigating major breaches. The post introduces incident response concepts for a broad audience, connecting designers, developers, sales teams, security engineers, and executives around shared preparation and clearer response practices.
10 min read
A practical guide to using Let's Encrypt SSL/TLS certificates with Mikrotik RouterOS devices. The post explains why RouterOS cannot run certbot directly, then walks through the surrounding certificate concepts, automation approach, and motivation for using trusted browser-recognized certificates on home network infrastructure.
10 min read
A personal look at using Scrum-style planning to make holiday time more intentional and restorative. The article adapts Agile ideas such as iteration, review, and flexible planning to household projects, showing how structured coordination can protect limited time without turning life into a rigid productivity exercise.
1 min read
A pointer to Wes Dean's Flexion article on tuning MegaLinter for better performance. The post frames performance tuning as a practical way to save time and money while keeping automated quality and security checks useful, sustainable, and less burdensome for development teams.
1 min read
A pointer to Wes Dean's Flexion article on MegaLinter tips and tricks. The post directs readers to practical ways of getting more value from MegaLinter, including improvements that can help teams strengthen consistency, quality, and DevSecOps workflows across repositories.
1 min read
A pointer to Wes Dean's Flexion guide for getting started with MegaLinter. The post directs readers to a step-by-step introduction for adding MegaLinter to a project, helping teams begin improving code quality, security checks, and consistency through practical DevSecOps automation.
1 min read
A pointer to Wes Dean's Flexion article on five practical ways MegaLinter improved DevSecOps work. The post highlights MegaLinter as a tool for making code quality, security checks, and workflow consistency easier to manage across projects, while directing readers to the original article for the full discussion.