Blog

In Defense of Friction

Lessons from a Month of Vibe Coding with Copilot CLI

One of the greatest perks to working at GitHub is unlimited access to Copilot tokens, allowing me to vibe code as much as I want: 
 
 With my unlimited AI, I spent most of my holiday break vibe coding up small utilities and games that I’d wanted to work on before but never had the time to finish. 
 Here are a few lessons that a holiday season with irresponsible access to premium models…

How GitHub's Agentic Security Principles Make Our AI Agents as Secure as Possible

Self Advocacy at a Remote-First Company: How to Careermax

Over the past couple of years at GitHub, I’ve learned that nothing in corporate is handed to you; you should always be your own biggest advocate. Promotions, good projects, and visibility are only unlocked when you have eyes on you. As they say, only the squeaky wheel gets grease. 
 Getting visibility is never easy, but it can be even more difficult at a remote-first company where it’s harder…

How Reversible are Embeddings: Embedding Inversions and How to Protect your Data

I was recently asked to determine the sensitivity of embeddings generated from proprietary code. While it seemed natural to think that embeddings were one-way functions that could not be reversed, research revealed that substantial semantic leakage was possible—even if direct reconstruction was not. 
 Embeddings turn a token —a word, subword, or symbol— into a vector that encodes its semantic…

Prompt Injection is a Weakness, not a Vulnerability

Prompt injection is the most widely discussed emergent threat for Large Language Models (LLMs). But how should organizations approach tracking and prioritizing it? 
 In my opinion, instead of being a vulnerability in and of itself, prompt injection is a weakness that leads to other, more potent vulnerabilities. While it is true that prompt injection is undesirable, it doesn’t necessarily lead…

Secure Generative UIs with Grammar Constrained Decoding

LLMs are very powerful for generating arbitrary text, but they really shine when you ask them to generate structured output. One such use case is generating rich UIs and text. 
 It’s much easier to read the output of an LLM if it’s properly styled and interactive. Reading large blobs of text can get unwieldy, and adding styling and interactive elements dynamically makes the output much more…

Writing in the Age of AI: My AI-enabled Process for Writing

Is writing a dying art in the ChatGPT era? How I think about using AI in my writing and my AI-enabled process. 
 LLMs have decimated the role of a professional writer. We’ve seen layoffs among translators , journalists , paralegals; many job fields for which writing is the core responsibility have either been completely obviated or are on their way there in due course. Even as an engineer,…

Path to SOC Analyst: Breaking into Cybersecurity

This was originally drafted as a Google doc for a friend. 
 
 If you’re trying to break into cybersecurity with no previous cyber, engineering, or IT experience, the best way to break into the industry is as a SOC analyst. 
 SOC Analysts are cybersecurity analysts responsible for monitoring corporate networks for potential threats and intrusions. While certainly not an introductory IT/…

Being Intentional in 2024

I put on quite a bit of weight over COVID. Stuck in lockdown with little else to do, I quickly picked up a nasty habit of snacking. The cupboard and fridge were so accessible and readily stocked with all manner of tasty food. With nothing better to do, I would go grab a bite anytime I was hungry or bored or thirsty or anything. And of course, with all of this, I began to balloon in weight, despite…

Introduction to Natural Language Processing

A quick intro to the basic terminology and concepts in Natural Language Processing. 
 Token 
 A token is the smallest semantic subsection of a piece of text. For example, a word. 
 This is the smallest subdivision of a text that can be assigned meaning (any smaller units than a word, like individual letters, have no inherent meaning to them) 
 n- gram 
 An n- gram is a…

"for … in" vs "for … of" in JavaScript

TIL that for … in and for … of have different behaviors in JavaScript. 
 As a native Python developer, I had presumed that for … in in JavaScript would have a similar behavior to the equivalent in Python. However, they have very different behaviors. See below: 
 TLDR 
 
 
 
 JavaScript 
 Python 
 
 
 
 
 for (foo in []) 
 for i in range([]) 
…

Introduction to Adversarial AI

The following is a transcription of a talk I’ve given internally at GitHub. The talk, and slides , are about the basics of adversarial AI, and how it can be used to attack machine learning models. 
 Slides 
 
 Transcript 
 How do Machine Learning Systems work? 
 For the purposes of this talk/ blog post, we’re not going to go too in depth into the technical details of…

Implementing a Robust Digital Identity

Setting Secure Hashing Parameters for Password Hashing


 TLDR: As of May 2022, I’d recommend using Argon2Id with the parameters recommended in RFC 9106 
 When trying to select the right way to protect your user’s passwords and credentials, there’s two things we need to consider. Firstly, we need to choose the right algorithm, one that is cryptographically secure. Secondly, we need to se the right parameters for the given algorithm to make it…