Making Software on Tales about Software Engineering

This is a post about my travel to Cornwall for Agile on the Beach, a fantastic conference.

Apologies for the tardiness, when I started this set of posts, I squarely aimed to do this once a week.

It’s been a busy few weeks in security.

This week we’re linking together links that give a bit of a picture of some stuttering in the AI world.

A slightly delayed episode of the weakly link.

This week we have a look at the current chaos.

This week it gets all too depressing.

This week we’re looking at zero days, zero reason for wearing Meta Glasses, zero reason to like AI slop.

This week we’re looking at how some of the traditional thinking on security (detect it, patch it, monitor it) is no longer quite cutting it.

This weak we’re looking at supply chains.

This week we’re looking at the impact of drugs on viruses, drugs on AI models, drug-addled bot behaviour and how the mainstream is catching up with AI Agent concerns.

This week, we’re having a bit of a wild west theme to the GenAI related links.

This was the week when the autonomous AI bots went a bit crazy and decided to burn tokens on social media.

It’s been a busy week, hasn’t it.

This week’s installment of my LinkBlog covers old tech that is new, operational tech that is secure, observability that is not expensive and a series of vulnerabilities for us to snigger at, then take a breath and take seriously.

My post is a little late this week as I went away with the scouts.

Like any blog post at New Year’s, we’ll be looking to the future.

To those who celebrate the festivals either end of the last 7 days of the year: Happy <insert here>!

This week we’re looking through a mix of security and AI once more.

Let’s start this week with many happy returns for Let’s Encrypt!

This week, we’re talking about React4shell.

This week is an odd mixture about sandworms, supply chains and basically how everything is broken anyway.

This week there have been some interesting bugs.

This week’s edition of the weakly link has got some fire in it: First on the menu we’ve got a report that tries to tell us that if there’s an AI bubble, that’s a good thing: The AI Wildfire Is Coming.

This post is a mixture of AppSec, vibe coding and cryptography.

Every week I come across some interesting, ridiculous or astounding content related to security and tech around software engineering.

Have you ever wondered how hard it is to make an AI talk to an API?

BSides Newcastle is probably one the most anarchic of the BSides I’ve been to so far.

I’m on the plane returning from a Scan Agile conference that was just joyful.

In January 2024, my comfortable tenure at Equal Experts came to an end and I went from 6 years of being a Java/Scala/AppSec consultant to being a head of engineering at a Middle Eastern fintech.

Have you ever struggled to find time for a workshop or a decent conversation?

I.

This post is all about sustainablity.

Sheffield is the city of steel, and at the heart of it lies a lovely university building - the Owen building that hosted the North’s premier hacker con And I had been accepted to talk at SteelCon about AppSec and Agile and who wouldn’t want to drive over…

After the fantastic experience of speaking at Agile on the Beach 2023 a year before, I was back for more agile.

Once again, I’m sat at Schipol Airport typing up my thoughts about a few days of refreshing Dutch DevOps Goodness!

Following a quip on LinkedIn about the introduction of Recall in Copilot+ and Kevin Beaumont’s great piece about why this is a really bad idea from a security point of view, I got thinking: This is dystopian techno-fascism Kevin posited a disconnect in Mi…

Many conferences have a hallway track, I loved that Agile Manchester had a jigsaw track.

When I stumbled across a post that an encryption library offers a potential backdoor to SSH connectivity on Good Friday, my first thought was: why is it always on a Friday that these things drop?

Peter Drucker said “What gets measured, gets managed”.

About two months ago I stumbled across a great YouTube video of a talk by Charity Majors called Compliance standards should be modern development practices.

Last year was exciting, it was my first time going to a DevOps Enterprise Summit and meeting Gene Kim was very cool.

After the glimmer of hope on day 3 I was quite optimistic for the day 4 puzzle.

My experimentation with LLMs on day 1 and day 2 of Advent of Code was a bit frustrating.

After day 1 of Advent of Code was only partially successful, I thought I would change my approach.

So it is that time of the year again.

I describe myself as an Agile Fundamentalist because I really like the ideas of the Agile manifesto, and I also confidently state that I am an AppSec snooper, because in my day job I tend to look at other people’s code, logs and systems and break them.

After BSides Lancs and Leeds, Newcastle was my third BSides, both of the year and ever.

As I stare at my laptop after an intense few days at 44CON, I reflect on the experience.

I am wearing my Equal Experts hoodie.