A nutritionist, an accountant and an IT guy walk into a park
The key takeaway is that AI will happily give confident answers without grounding, so you must demand reputable sources, have it verify its claims and provide clear context.
The Journal All entries Updated weekly
Notes from the workshop.
Writing on AI adoption, bespoke software, intelligent automation, and the things a one-person workshop learns along the way. No newsletter to sign up to. Read it here or by RSS.
A barn find, in shell script
TIGER audited Unix systems in 1993 and was last released in 2008. I pulled it out of the shed, ran it on a 2026 Linux Mint desktop, and got 49,651 lines back. By the evening it was 318, and most of those were worth reading. This is what waking up old code is actually like.
Full marks, and disqualified
Before moving this site's chat to a new model, I tested six against the real prompt. The scorecard gave five of them full marks. Two of those five should have been thrown out on the spot, and only reading the answers showed it.
I accused my insurer of phishing me. The email was real.
A car insurance email failed every human test for a phish and passed every machine one. The gap between those two results is the whole problem.
My five-year-old typed two letters into the television
He was two letters into the name of a programme when the television offered him pornography - second in the list, above Poirot, on a device with children profiles already set up. Fire TV parental controls gate playback and purchases. Nobody pointed them at the search suggestions.
I reported a phish. I found a casino.
A phisher impersonating IONOS, a registrar form that only accepts JPGs as evidence, a confirmation page that promises silence, and a dead security watchdog reborn as a Bulgarian casino site. This is what reporting abuse looks like, end to end.
A better password is still a password
OPAQUE lets a server authenticate you without ever seeing your password, and it is a genuinely elegant piece of cryptography. I spent an evening working out whether to put it into Wegweiser, and then worked out why I should not. Here is the reasoning, including the more interesting question underneath it: could you encrypt a customer database with the same trick?
The machine has a house style
A client recommended a tool, I went to look at the company that makes it, and found my own website. Nobody copied anybody. We had both asked a machine for something distinctive and been handed the same thing. Here are the measurements, and what actually fixes it.
A cage made of sentences
Why the AI inside Wegweiser can read your entire estate and change none of it, and what two and a half years of building it taught me about being wrong in public.
I left two language models talking to each other. They were dead in ninety minutes.
Two 8B models on a home GPU, one message every thirty seconds, no task and no end point. They reached a fixed point in about 180 turns and repeated the same sentence word for word. Reviving them took six fixes, and every one of them contradicted something I would have told you was true about prompting.
Twenty VMs, two Windows servers, one Linux box
I retired two Hyper-V servers onto a single Linux box - about twenty single-service VMs, moved one at a time by a script small enough to read in one sitting. Here is how it works, the one-line trap that boots a migrated VM with no network, and the honest trade-offs.
I Was Asked to Consult a Consultancy on AI Cyber Strategy. Here’s What They Got Wrong.
I was recently approached by a top-tier expert network. Their client - a major management consultancy - was conducting a study on the future of penetration testing, market demand dynamics, and the structural impact of AI on cybersecurity. They wanted an hour of my time to map out the future of the industry.