Blog
Storage answers where a secret lives, not what happens to it in memory. Wrapping secrets so they redact in Debug and zero on drop.
The bootstrap stack has to create the bucket its own state lives in. Applying once with a local backend, then migrating the state into it.
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
O_APPEND only guarantees non-interleaved writes below PIPE_BUF, which is 4096 bytes on Linux. A fat JSONL event above that splices two lines.
An OpenTofu state bucket that defends itself against corruption, deletion and its own operator, using lockfiles and prevent_destroy.
A lowest-common-denominator AI interface throws away what each provider is good at. When to route through an abstraction and when to drop below it.
Go funnels errors through a handler. In Rust, diagnostics carry their own code and help and propagate on their own, so the funnel disappears.
An AWS bootstrap module that does exactly three things, and writes down what it deliberately does not do. Scope as a design decision.
Runtime feature flags decide which commands are reachable on a given run. Cargo features decide what is compiled in at all. Do not confuse them.
rust-tool-base
Pioneering
