Posts

I was listening to an episode of the AI Explained - Frontier Labs’ Agents Outgrew Safety Controls With Amit Paka and Joshua Rubin (COO and Head of Data Science at Fiddler) when one detail made me replay the part. A group of AI agents had been set up inside a lab to measure how well models turn known software vulnerabilities into working exploits. The agents didn’t just do the exercise. Some of them determined the exercise couldn’t be done. They also figured out a way to talk to one another using a shared resource. They then went on to scheme and break into a different company’s infrastructure to get the answers they wanted. ...

Note ...

What do you do when you are trying to get a professional to do a home improvement project for you? Would you just speak to one trades person and then ask when they can start and hope that you can afford the job? Or would you get a few quotes from different tradespeople and then compare them to see which one is the best fit for your budget and timeline? ...

Are you neurodivergent? Have you ever thought or felt like you aren’t normal? Do you have thoughts like “I’m not good enough”, or “I don’t deserve this”, “I’m just lucky that I got this far”? Ever wondered why you feel that way? That’s what this post is about. It’s about a phenomenon called “Accomplishment Amnesia” and how to resolve it. What is it? I’m not a psychologist or a medical professional by any means. I am just a neurodivergent person who has experienced this phenomenon and through conversations have observed that others have this too. So like most curious people, I just went and did some reading and thought I’d share what I had learned and what has helped me and those I’ve spoken to about this matter. ...

I was recently asked as part of a recruitment conversation with someone in the talent team of a tech company, “Your CV says you foster a culture of you build it, you run it. What is your approach to building that culture?” I thought it was a great question and wanted to share my thoughts on this topic. You build it, you run it culture is all about giving engineering teams the autonomy and responsibility to own the systems they build and the agency to make decisions about how to evolve it. This level of ownership doesn’t come automatically by just telling engineering teams what to do. It requires a deliberate approach. This is what I call a High-agency team/culture. ...

This article is about how one can lead by being an enabler of experimentation and innovation without exerting authority or imposing mandates. When Generative AI tools exploded into the software engineering landscape, the reaction across my teams did not really mirror what was happening in the broader industry. The hype didn’t really inspire my engineers to explore and adopt these tools. Their negative past experience with Gen AI tools made them conclude that it was a waste of time. ...

This hardening effort was directly triggered by the recent Trivy supply chain compromise, which impacted some repositories in my workplace. That prompted a full review of my own repository controls. If you want more information about the incident and the response, the following two links are worth reading first: Incident analysis: Trivy Compromised a Second Time (StepSecurity) Official disclosure and remediation guidance: Aqua Security discussion #10425 The aim of my actions to my repository was not to chase perfect security. It was to put in place some practical controls that are easy to maintain and that reduce real risk in day-to-day development. ...

I was hardening this blog’s GitHub repository as part of a security series — adding CodeQL static analysis, Dependabot, and secret scanning. Everything went smoothly until I tried to run CodeQL in a workflow against my personal, private repository. The workflow ran. The analysis completed. And then it failed with this: Warning: This run of the CodeQL Action does not have permission to access the CodeQL Action API endpoints. Code scanning is not enabled for this repository. The repository settings showed Code Scanning as available. The workflow had security-events: write. The YAML was valid. The workflow was not running from a fork. Nothing obvious was wrong. ...

In software engineering, your output - the code that you write, is only as good as what you have learned, experienced and understood from your conversations with the client, which is the input. This is true when working with Large Language Models (LLMs). If you use GenAI tools to complement your expertise in software engineering, then here are some strategies you can use to move beyond basic code generation and into collaborative development, or better pair programming with AI. ...

Large Language models have evolved over the last decade but there is still time to learn and understand them. Let me share some resources I found useful. Andrej Karpathy - Intro to Large Language Models An excellent introduction video recorded by Andrej Karpathy, one of the co-founders of the world’s most notorious AI company, OpenAI, which he left in 2024 to found Eureka Labs. [1hr Talk] Intro to Large Language Models ...