ARCHIVE · EVERY PIECE
Writing
Hand-written pieces about things that actually happened: a defect found, the measurement that exposed it, what changed afterwards. The canonical home is here, the copies live elsewhere.
Node 22.22 runs TypeScript. Ubuntu's Node 22.22 doesn't.
Type stripping has been on by default since Node 22.18. On my Ubuntu server, the tests that import .ts files failed while CI passed on the same major version. The version was fine. The build was not.
A week of green runs, and the pipeline was waiting for me
The magazine pipeline ran every morning for a week and reported success every time. It had produced nothing since the first of the month, because it was parked at a gate only I can open, and none of my alarms treats that as a state worth reporting.
A hash-based CSP has no room for a syntax highlighter
My Content Security Policy allows scripts by exact hash and nothing else. That works right up until a Markdown plugin decides to colour your code with inline styles, and then you find out what the policy actually costs.
I pentested my own AI hub and shipped the method, not the map
A read-only audit of my own observability stack, run like an engagement. Almost every serious thing it found was inside a defence I had written hours earlier, and the worst one was inside the proofs I use to show the defences work.
Cross-posting to dev.to without giving away your SEO
The canonical tag is not the hard part. The hard part is that your site has to exist, and be dated, before the copy does. I got that order wrong once and the mirror ended up seven days older than the original.
I let every AI crawler in. A month later I cannot tell you how many people read me
Cloudflare congratulated me on 33,561 pageviews. The free plan does not separate humans from bots, and I invited the bots myself. Here is what I actually measured, and the counter I wrote to stop guessing.
My quality gate wasn't strict. It was dead.
An LLM-as-a-judge gate failed every content PR for weeks. It looked like a high bar. It was a 400 from the API, and the error message only named half the problem.
A permissive robots.txt is not a licence
I audited ten sources my scraper had been reading for a month. Two passed. The one that let every crawler in granted me nothing, and the one that blocked bots would have been fine.
Guaranteed JSON from Claude, and the five parsers I deleted to get it
I had five functions whose only job was repairing JSON that Claude had just written. Forcing a single tool with tool_choice made the parsing the API's problem instead of mine, and one PR deleted all five. The surprise came after launch.
I made my portfolio site audit its own security headers, live, in front of you
A portfolio card that runs a same-origin HEAD request to audit its own security headers live, and why the real CSP has to live in two places.
Thirteen PRs in one afternoon, and the boring rule that made it possible
I planned six changes and expected to finish two. Six hours later thirteen were live, and the thing that kept it upright was not the speed.