The forge we deserve
Thinking beyond GitHub
Tao Bojlén
Software engineering, philosophy, and security.
Latest posts
Announcing: Parrot.garden
Repeat your stuff.
Just one more prompt
Agentic coding is addictive
New Notes RSS feed
Hello, dear RSS subscriber, I've added a new RSS feed for short notes, passing thoughts, and interesting links worth sharing. To avoid spamming you, this main feed will contain only my own blog posts going forward. No more link posts here! If you're interested in this new feed, it's available here . - Tao
The Normie Loop
On using your time with AI tools wisely
Everything changes, and nothing changes
Best practices remain remarkably static
Introducing RSS-O-Matic
Generate RSS feeds for any site or newsletter
On Burnout
It's been four months since I left my job at a startup. I say "left", but it was somewhat involuntary: I had worn myself down so much that I couldn't continue. In hindsight, my approach to work looks more like an addiction. The first sign was when, after a long day at an offsite, a colleague asked me about my interests outside of work and I didn't have a response. A later, more severe sign was…
How to get hired at a startup
Our industry is in a weird place right now. Social media is full of software engineers sharing their struggles getting hired (or even getting an interview). There are reports of excellent engineers struggling to find a new role for six months or more. At the same time, employers are lamenting the dearth of talented candidates. It seems that hiring has gotten harder for them, too. How can these two…
The AI Outrage Machine
A few weeks ago outrage gathered around an "AI actress" called Tilly Norwood, an avatar being pitched to talent agencies as the future of acting. The character was created by Particle6, a UK production company, and everyone hated it. The extensive media coverage, endless think pieces, and condemnations from unions were all predictable. The outcry was far louder and more impactful than its object.…
Chesterton's Fence is no more
AI-generated code is invalidating this engineering principle.
The best productivity system that's ever existed
Stop overcomplicating task management
Column- and row-oriented databases
The relational databases that many software engineers are most familiar with, e.g. Postgres or MySQL, are row-oriented : they store data row-by-row. For a given row, its columns are stored next to each other on disk. This means that fetching all the data from a row is fast. visit_id ip duration browser 1 1.2.3.4 100 chrome 2 2.3.4.5 5 firefox 3 3.4.5.6 30 firefox However, for some queries over…
Bloom filters
Bloom filters are a data structure that can quickly answer whether an element is a member of a set. Because they are probabilistic, they tell you whether an element is maybe in a set, or definitely not in a set. At their core, Bloom filters work by hashing elements and storing these hashes. Because hash functions map a large input space to a fixed-size output space, the set of hashes is much…
Don't filter in Django's qet_queryset
Default scopes will make you suffer
"The right tool for the job"
Engineering principles that say something
npm install is curl | bash
Remote code execution as a feature
A web of trust for npm
A path towards better supply-chain security
Literature review: Routing attacks on Tor
Routing attacks on Tor occur when an adversary attempts to influence the route a Tor circuit takes in order to improve their chances of intercepting traffic. In January of this year, I wrote a literature review on this topic that I'm sharing here: PDF link . Abstract: The anonymity network Tor is vulnerable to end-to-end correlation attacks, and fingerprinting attacks of encrypted traffic are…
Reasons not to use Telegram
Telegram defaults to unencrypted chats, so your messages are stored in plaintext on their servers. If you don't want them to read your messages, you have to manually enable Secret Chats -- but these don't work for groups and require users to be online at the same time. A 2017 usability study found that many users thought they were using secure, encrypted chats when they were in fact sending all…
Feel-good security in ProtonMail
ProtonMail is one of the most popular security-focused email providers. Because email is not a particularly secure protocol, things like end-to-end encryption have to be bolted on top. To ensure interoperatiblity, an email provider must be able to send unencrypted messages to recipients who haven't dived into the painful world of PGP. ProtonMail handles this quite well. Emails are stored encrypted…
On mixing plaintext and encrypted messages
Several security-focused messaging apps give users the ability to choose between two modes: unencrypted chats, or end-to-end encrypted ones that might lack certain features. This is an anti-pattern when it comes to usable security, and it brings some risks that are rarely discussed. There are several different implementations of this mixing and matching of secure and insecure communications. Some…
Running ElasticSearch in podman on Fedora 32
Jump the to the tl;dr. So you just updated to Fedora 32, sat down to work, and realized that Docker wasn't working. Maybe at this point you vaguely remembered hearing about something called CgroupsV2 being a thing in Fedora 32, and maybe also something about Docker not playing nice with CgroupsV2 . You kick yourself for a moment but decide that this is a good opportunity to get to grips with…
Books I enjoyed in 2019
I'm not one of those people who constantly has their head buried in a book -- one of those at heightened risk of falling down a manhole because they are reading while walking instead of looking in front of them. A part of the reason is that I tend to gravitate towards denser books -- the type of book that feels Important, and that might prompt impressed nods when I bring it up to my philosopher…
fediverse.space awarded NGI Zero grant
My project fediverse.space is an interactive map of the fediverse. The fediverse, or "federated universe", is the set of social media servers, hosted by individuals across the globe, forming a libre and more democratic alternative to traditional social media. I'm proud to say that this project was recently awarded a grant from the NGI Zero Discovery project. NGI Zero Discovery, funded by the…
Self and Lack Thereof: On Kierkegaard and Capitalism
How Kierkegaard predicted normcore