First Light

In the field since 2018, I've watched a lot of software break. Mostly not from clever attacks. Mostly from neglect — a dependency nobody owned, an assumption nobody wrote down, a shortcut that cost a quarter to undo.

So this is a log: notes on the work I keep coming back to — building things that last.

What I mean by "lasts"

Durability isn't the same as being bulletproof on day one. The systems I admire were still legible three years and four engineers later. You could change them without holding your breath.

That legibility is a security property. Most of the worst vulnerabilities I've found lived in the parts of the codebase nobody understood anymore.

What goes here

Field notes from two practices:

• Security & craft — threat models, post-incident reading, making a system you can reason about.
• The body & the trail — long miles.

No grand schedule. When something's worth writing down, it lands here.