Blog
Notes on where our products stand, and what we think about day to day.
The biggest change was that typing journal entries into the accounting software one line at a time went to zero. Well over a thousand entries a year, once typed by hand, now come out as a CSV in the format the software imports. The travel policy we never had got written too.
I assumed the world had got that much worse. It had not: the same two items had been on the list for eight days. The arrangement looked at each day's publications with no memory of what had already been sent. Repetition, unlike an omission, does not look like a failing, so nobody flags it.
Measured, it needs not one support when stood upright. The shape was fine and my reading was not wrong either. What was wrong was that the page carried only a picture of the part in use. We added one picture — the orientation it is printed in — rather than a sentence.
Building to the measured size solves it — except that material shrinks as it cools, so the finished dimension is settled by the printing environment. And making dimensions specifiable makes useless specifications possible too. Possible to make and fit to use turned out to be different questions.
Attachments inflate by about a third in transit, so 33 MB gets rejected at the far end — while your sent folder still says it went. Switching to download links fixed that, and brought an unexpected side effect: the separate email carrying the password became unnecessary.
One week came to 4,959 attempts from 30 sources — roughly 700 a day. Over sixty per cent hunt for the same file. What is being hunted is not a vulnerability but the things you left behind and never deleted.
Relevance is decided by what you actually run, and recalling that every time is the part nobody sustains. We list it once, hand it over, and have the day's disclosures cross-checked against it every morning — with a one-line reason required even for the items ruled out.
The vulnerabilities disclosed on 21 October 2026 trigger upstream of your own code, which means the mere fact that PHP is running puts you in scope. One form, and what you have to defend becomes the whole server.
A Russian word turned up in one of the drafts. And not only Russian. Then replies started arriving with two stray letters sitting at the top… (laughs). We use Claude from Anthropic for the response side, so this may just be Claude's character.
On 21 October 2026, two vulnerabilities turned up in PHP that allow unauthenticated code execution. Seeing the news, the first thing I did was tell our AI what I had seen and ask whether we were OK. What came back was a prioritised list, and from there all I did was answer “yes” to each item. It was over in tens of minutes — night and day compared with administering servers myself.
I wake up to one more product designed, the remaining pre-launch work listed, and the security check already done. The whole mechanism is just “every day at this hour, do this” — but it means the day starts with progress on the table rather than from nothing. Here are the seven jobs we currently have running.
The posts here are drafted by an AI, and people hear that and assume the whole thing is generated. It is not. Choosing the topic, deciding what there is to say and publishing it are all mine; the AI absorbs the labour. A human blog, made drastically more efficient.
Japanese is the only language I speak. Machine translation lowered the entrance but left me stuck at the exit: I had no way to inspect my own sentences in a language I cannot read. What AI changed was turning “this might not come across” into a problem I can actually work on.