Blog
The junior developer pipeline is collapsing, and the cause is not the thing everyone is blaming. Who is left when the greybeards retire.
A generated nested command would not compile, and the cause was a scaffolder handing every call the same key regardless of depth.
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
Refereeing the memory-safety retrofit argument from someone who ships framework code in both Rust and Go, and likes them for different reasons.
Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.
An export-control directive suspended my AI assistant mid-task, which is a useful lesson in what you are actually depending on.
Building an AI dungeon master to test a Go chat client, and the bug that kept resurrecting a goblin the player had definitively killed.
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
Generating a Go command from a shell script or a plain sentence, and the repair agent that has to make the result build before you see it.
The case for a head of engineering staying hands-on, written as a confession rather than a boast, because the compulsion is the problem.
Soapbox
go-tool-base
Pioneering
signing
Orienteering
Campfire