The Journal All entries Updated weekly
Writing on AI adoption, bespoke software, intelligent automation, and the things a one-person workshop learns along the way. No newsletter to sign up to. Read it here or by RSS.
For 20 months a Colombian bank has emailed me a stranger's finances: every card transaction, her statements, her loan papers. I tried every channel I could find to report it. One human replied, and wanted my passport number.
Every AI session starts with amnesia and a training cutoff. For six months a memory palace has filled the gap across every project I run, and this week Milla Jovovich's latest release made it better. A field report, and a love letter.
No email, no warning, no reason. One evening my GitHub account stopped existing, and every automation built on it failed within the minute. This is what broke, what I still do not know, and how my own Gitea carried the load.
Two unauthenticated RCEs in PHP itself, rated 9.2 and reaching back to version 5.4. The fix is out, probing has started, and the flaw sits underneath every line of application code. What happened, and the remediation order that works.
Two synthetic co-hosts, one verification pipeline, and why every episode is also a demo. If your business has words, it can have voices.
I spent a day reading the AI security papers that matter, with primary sources open rather than vendor summaries. Prompt injection is structural, most defences collapse under adaptive attack, and what survives is architecture.
In July Anthropic checked my ID and approved me for security work on my own code within the hour. Three months on, Claude still flags me for writing a gitleaks config, and my bug reports go to a bot.
The key takeaway is that AI will happily give confident answers without grounding, so you must demand reputable sources, have it verify its claims and provide clear context.
TIGER audited Unix systems in 1993 and was last released in 2008. I pulled it out of the shed, ran it on a 2026 Linux Mint desktop, and got 49,651 lines back. By the evening it was 318, and most of those were worth reading. This is what waking up old code is actually like.
Before moving this site's chat to a new model, I tested six against the real prompt. The scorecard gave five of them full marks. Two of those five should have been thrown out on the spot, and only reading the answers showed it.
A car insurance email failed every human test for a phish and passed every machine one. The gap between those two results is the whole problem.
He was two letters into the name of a programme when the television offered him pornography - second in the list, above Poirot, on a device with children profiles already set up. Fire TV parental controls gate playback and purchases. Nobody pointed them at the search suggestions.
