Bitware Labs / Notebook
Working notes, written while the work is still fresh. Mostly infrastructure, security and long-running AI, the unglamorous middle of the job, which is where the interesting parts live.
AI generates software that works when you click around in Chrome. It does not build software hardened for the open internet. With attackers piping nmap, ffuf, and headless browsers straight through LLM analysis loops, finding that one missed detail takes minutes, not days.
In 1997 a guy in production handed me a CD with Red Hat 4.1. Two weeks later a quiet Linux box replaced our crashing NT 4 server. Thirty years on, I run zero Windows machines and have zero headaches.
A vibecoder says "add a button". A developer says which view, what it reads, what it writes, what happens when the call fails and who is allowed to click it. Same tool, same model, entirely different software.
Our agent has been modifying herself since March, and filing change requests against her own source since May. We kept the log. What she asks for is not what the frightening version of this story predicts.
Our agent\'s memory scored 15% on LongMemEval against a field sitting at 64-71%. Fixing it took finding three silent bugs, discarding four confident improvements that made it worse, and catching a measurement error that nearly became the headline.
We predicted that append-only memory drowns by month three. Then we measured. Almost nothing failed the way we expected, and none of it announced itself.
Soft 404s, add_header inheritance, ten-year cache headers on unversioned files, and a gzip_types line that is commented out in the shipped config. All four were live on this very domain.
The contact form on this site does not call mail(). It speaks SMTP to loopback by hand, because the php-fpm AppArmor profile will not exec sendmail, and that turned out to be the better design.
An agent that only appends is an agent that eventually drowns. Consolidation is the part everyone skips, and it is the part that decides whether the thing still works in month six.
Ten peers, one address plan, no overlay control plane. What we run, what we deliberately left out, and the two mistakes that cost us an afternoon each.
Why Plastic Fantastic scores candidates instead of walking a decision tree, how the evidence is weighted, and why it will name PVC without ever asking you to set it on fire.
Not snobbery. A hosting policy is a security boundary, and the plugin model puts the boundary in the wrong place, on the other side of code we did not write and cannot audit.
Correspondence
Commissions, collaborations, or a quiet hello. The person you write to is the person who does the work, and I reply within two working days.