Codifying a Bash Style Guide as ShellCheck Plugins
A style guide is just text. An enforced check is a tool that catches mistakes.
binary.phile
Musings, mostly on technology.
Latest posts
Adding a Plugin System to ShellCheck
I wanted shellcheck to catch a class of mistakes it wasn’t designed to catch — conventions specific to my bash style. Naming rules. Quoting under IFS=$'\n'; set -o noglob. Docstring shape. Things upstream would (rightly) never accept as core checks, because they’re house rules, not bash mistakes.
Cockburn Use Cases Guide
A practical reference for writing use cases per Alistair Cockburn’s Writing Effective Use Cases (2001). Template, goal levels, and step-writing guidelines distilled for software teams that want to capture behavior without designing the UI.
Shostack Threat Modeling Guide
A practical guide to threat modeling principles, extracted from Adam Shostack’s Threat Modeling: Designing for Security (2014).
It’s Been Eight Years Since NIST Said to Stop Rotating Passwords
In June 2017, NIST published SP 800-63B Rev 3 and told the world to stop requiring periodic password changes. Eight years later, most organizations still do it. In August 2025, NIST published Rev 4 and upgraded that guidance from “you should stop” to “you must stop.”
Why 95% Utilization Feels Broken: A Queue Demo, Three Review Rounds, and a Better Model
A queue at 95% target load is mathematically stable. A dashboard says fine. Watch it run and your gut says broken. That gap is where queuing intuition fails.
Two Rules for Readable Density
Most readability advice resists mechanical checking. “Use good names.” “Keep functions short.” You need the whole function, maybe the whole module, to evaluate those. These two rules you can check by reading a single line. The examples are in Go, but the rules apply to any language with nested expressions.
Bash Style Guide
Bash Style Guide
Breadcrumbs for Humans and AI: How Pattern Docs Guide Developers to Correct Code
A backend returns 200 OK with a JSON error body when downloads fail. This may seem unexpected at first. 200 indicates success. Arguably this is a protocol adherence issue, but it remains. Every new developer that works on downloads must learn this—one way or another. Every code review catches someone checking response.ok. The knowledge exists—in some developers’ heads.
The G/I Cycle: How Specific Deductions Beat ‘Try Harder’
You write something with AI. It’s 70% right. Now what?