Blog
Hundreds of malicious package versions across three ecosystems, and the uncomfortable fact that installing one runs arbitrary code.
Ten years on from taking the name: the Boy Scout Rule scales from a function to a team, because it is about intention rather than size.
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
The junior developer pipeline is collapsing, and the cause is not the thing everyone is blaming. Who is left when the greybeards retire.
A generated nested command would not compile, and the cause was a scaffolder handing every call the same key regardless of depth.
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
Refereeing the memory-safety retrofit argument from someone who ships framework code in both Rust and Go, and likes them for different reasons.
Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.
An export-control directive suspended my AI assistant mid-task, which is a useful lesson in what you are actually depending on.
Building an AI dungeon master to test a Go chat client, and the bug that kept resurrecting a goblin the player had definitively killed.
Soapbox
Campfire
go-tool-base
signing
Orienteering
Pioneering
