I write about software engineering, systems design, and things I find interesting.
CVSS is Lying to You
Is there any colour more beautiful than the bright crimson that greets you when you open a ‘security dashboard’ for the first time on a new project? Hundreds of ‘critical’ security vulnerabilities in a non-publicly-exposed environment that nobody cares to look at, and nobody cares to prioritise. Maybe if you bask in the glow long enough you’ll get some of those red light therapy skin rejuvenation effects, though I have not given it a try myself. ...
Asymmetry: Word of the Year 2026
Pre(r)amble I’ve been going down a bit of a rabbit hole of applying good wisdom from one topic to a seemingly completely unrelated topic, such as in my last article Unified Asset Delivery (UAD) using the concept of holons (shoutout Ken Wilber and Arthur Koestler) to describe idealistic delivery of Assets and define completeness of delivery and immutability. It’s a fun mental exercise, and actually it’s surprising how much innovation seems to come from doing exactly this. Take one good pattern from context A, stick it in context B, and suddenly you have something new and cool you can later turn into a subscription service and enshittify. ...
Stop Shipping Code: The Case for Unified Asset Delivery (UAD)
The last decade has been spent perfecting pipelines, versioning dependencies, containerising packages, codifying deployment environments, shifting left, and writing self-indulgent LinkedIn articles about it. Many teams and companies at large are in a much better state now, with repeatable builds, eradication of the “it works on my machine” excuse (at least on the surface), and deployment targets that are treated like software. We’ve essentially improved every individual component and made great strides in reducing friction in the process. Code, infrastructure, policy, pipeline - everything is better, we have beautiful, quick DevSecOps feedback loops that would (hopefully) make Dave Farley proud. ...