Recent content on Missives about mostly GCP related things
I’ve been looking for an excuse to get hands on with AI Agents (versus the function calling I’ve played with before ) . However I have concerns about the security issues with this so I’ve been having fun with LLMs, ADK & MCP to create an AI agentic demo that works locally without calling out to the internet. Why would I do this? Well not everyone can use the public cloud and as…
My biggest fault when coding was never adding in tests. Having found joy in coding again by vibe coding ( Whatever that actually means now?) it’s also actually made me a better coder in a number of ways but most importantly by forcing me to add tests. Yes I know you’re all judging me and saying “What you never did that?” Well only when I was made to! 😏 You see while vibe…
Frenemies often want to collaborate but there’s this underlying mistrust between them. This is where federated learning (FL) can help. FL enables collaborative training of robust ML & AI models across decentralized datasets without requiring the centralization of raw, private information. FL is what’s known as a Privacy enhanced technology ( PET) . It’s one of a number of…
Now that Google’s Gemini deep research is available for anyone to try I just wanted to take the opportunity to show how useful it is. I chose a topic for this post that I know enough about that I can craft prompts to produce the desired outcomes and sanity check the outputs. However if you are exploring a topic you aren’t so familiar with, it is just as useful as it does produce a list…
So as promised, here’s the rest of my journey of creating a cataloguing application by prompt driven development and crucially without resorting to taking over and writing any actual code myself. I stuck to using cursor ( with claude-3.5-sonnet ) prompting and cutting & pasting. Guiding when there were issues . I added an admin page since the first post on this exercise. And yes in less than…
About 15/20 years ago I thought about cataloguing our DVD collection and the solution I was leaning towards then was to pay some cub scouts to do that. Well it’s 2025 and my phone camera and Gemini 2.0 flash experimental solved the problem. I knew AI was going to have a direct effect on jobs but I didn’t think it would affect cub scouts earning a few pounds . This post was supposed to…
Image courtesy of imagen3 2024 has been wild when it comes to AI. There have been a lot of good products such as NotebookLM and Cursor ( the latter of which just snuck in to make the list!) to name my two standouts of the year. AI for good such as GenCast predicts weather and the risks of extreme conditions with state-of-the-art accuracy - Google DeepMind and AlphaFold . The latter was given…
As regular readers of my blogs already know, I have been using vscode with the continue plugin & local ollama models for code completion / dev type work with LLMs. I now wanted to use Cursor to take that up a level . My team had a hackathon recently where we used Cursor & Gemini and seeing how powerful it is in action I wanted to play with it more.
So as some of you may be aware I am a big fan of NotebookLM and with the addition of being able to create an Audio overview as well as use YouTube videos as source what was already good became even better. I’d tried the audio overview to create a podcast of what I have been working on in my day job. It really was very very good but I wanted to see if it could repeat the trick … tl;dr it does
I finally managed to read Miracleman the silver age after a ridiculously long wait for it to be published. After reading it, it got me thinking who is stronger, Miracleman or Superman. So I thought well lets see what GAI has to say and this would also gave me a chance to evaluate llama3.1 While I was at it. I admit this topic may not be as popular as asking what colour are apples but it did serve…
In this post I’m going to reflect on the mitigations section of the GAI is going well collection. In light of the very ambiguous proposed California regulation SB 1047 mitigations against adverse effects is more important than ever . Andrew Ng does an excellent job of explaining why this regulation is not great here:…
update 11 may 2025: A table comparing some more recent models is here Whenever a new LLM model is released so are the benchmark comparison charts. However these benchmark scores aren’t really an indication of how a model will perform for your use case and should be taken with a pinch of salt . Benchmarks often focus on specific tasks, like question answering or text summarization. These…
A colleague asked me about resilience strategies for LLM based applications (you can use LLM interchangeably with GAI in this post) which got me thinking that I’ve not seen much written about that . So here we are. I have touched tangentially on some aspects or DR in my posts on security and LLMs so I won’t repeat too much of that here. Similar to When you look at the security of LLM…
It’s been a never ending series of reports about the on going adverse outcomes related to the use of GAI whether deliberate attacks or just unfortunate side effects. Since I wrote GAI Is Going Well I’ve continued to indulge in my hobby of collecting articles related to the adverse effects of working with LLMs/GAI ( the distinction between the two is becoming more distinct so I am…
Being somewhat inspired by Molly White who writes Web3 is going great. I’ve been tracking the more hilarious and often quite alarming unintended ( or purposeful in some cases ) consequences of using LLMs for over a year now. There are folks looking for a quick fix , poorly if at all tested apps , and bad guys & good guys figuring out how to use it to their advantage or to protect their…
So continuing my series on LLMs for non ML experts I’m taking you on the journey from RAG to agents. RAG and agents are distinct but related approaches used to enhance the capabilities and outputs of large language models (LLMs). Retrieval-Augmented Generation (RAG) focuses on enriching the prompts used to interact with LLMs. It integrates relevant external knowledge retrieved from databases…
Continuing my LLMs for non ML experts this is a post on how I got to my dev env . I’ve been playing around with local models learning how to create RAG based applications by hosting models locally on my laptop and also on our home server ( Yes I still hug tin ). I thought it would be nice to walkthrough how I got to my set up and then how I intend to move to using AI studio ( in another…
In this post I’m exploring how to automate security & privacy testing as part of your MLOps pipeline when developing with LLMs. This post will help you to understand what is involved in implementing automated security & privacy tests as part of your MLOps pipeline. However If you are looking to actually implement an MLOPs pipeline with integrated security & privacy testing then I have linked…
I thought I’d take a break from my recent musing about LLMs hence this post which arose after reading a colleague’s analogy to explain some confidential computing concepts that inspired me to write a version of my own but with a different analogy ( Thanks to him indoors for the inspiration for that. !) If you’ve read any of my posts before you are aware that I enjoy trying to…
As with any technology new or old, understanding what the security & privacy threats are is an important first step to figuring out how to safely incorporate their use as part of any solution. The explosion of interest and use cases for LLM has already led to a number of well publicised security & privacy concerns. This post aims to discuss what I consider to be the top 10 privacy and security…
Understanding & supporting large language model based applications - a guide for IT professionals who are not machine learning (ML) experts Prompts, original words & editing: by Grace Mollison Text generation by ChatGPT Most Diagrams by Grace Mollison, other diagrams liberally borrowed & acknowledged Proof read by him indoors ( albeit reluctantly) Introduction Like many in my bubble I’ve…
I was a little obsessed with “The queue ” being a Brit it was hard not to be . The queue had to be paused a few times and pleas were made for people to not join the queue . The pausing of the queue got me thinking about high availability ( I had been thinking about this for my day job too ). But my thoughts didn’t stop there. I began thinking of the current world economic…
The industry I am in suffers from the buzzword jargon merry go round and there is a constant process of naming patterns and paradigms. I used to be a DBA so I have kept half an eye on the data ecosystem and what’s happening in that space. Unsurprisingly they are not avoiding the buzzword merry go round. I was particularly bemused by the term “data lake house” . I figured I…
If you are a developer or a security admin shifting left is a phrase you may have heard but what does it mean practically? Organisational and procedural change Incorporating a security first approach as part of your approach to development Incorporating security checks and gates as part of your development to production pipeline i.e incorporate security as early as possible. Getting Devs to think…
A slightly different type of post for a change which doesn’t involve talking about security! I haven’t used terraform in anger for a while. By this I mean creating a full config from a blankish page rather than updating ones I created before or using a framework to help build out an environment on Google Cloud. I had reason to create a config from scratch recently that involved GCS,…
So let’s assume you have put into practice all the guidance to protect your cloud compute resources . Defence in depth , mitigations against ransomware and unauthorised crypto mining and the myriad of other best practices provided by govts, NIST, and your cloud provider of choice . You’ve done everything you can and you have still been compromised. As I have said on numerous occasions…
I’ve discussed Ransomware Defence in Depth and in this post I’m discussing how to defend in depth against another pesky issue Unauthorized Cryptocurrency mining. Unauthorized cryptocurrency mining is alongside ransomware one of the major outcomes bad guys gaining access to your cloud resources are looking to achieve. I’m going to focus on Google Cloud as that is the Cloud I know…
Last year ( 2021) I managed to visit a number of castles in Wales. It got me thinking how much the medieval castles were designed with defence in depth and how similar it is to applying defence in depth when using Google Cloud. A medieval castle has layers of defences here’s a list of some of them ( and yes I am aware I have left some parts out but if this post entices you to learn more…
One of the key mantras from my day job is to meet customers where they are when working with them to start their journey to the cloud. Unfortunately this can sometimes lead to customers basically lifting & shifting their on-premises environment directly to the cloud and just stopping at that point. I read an article on the UK NCSC site ( I reference it below too) that gave me pause for thought…
So I finally decided I should put some words down about the approach to defending against ransomware attacks. Why you may ask when there’s been so much written about this topic? Basically because so much of the stuff that’s been written has been an opportunity for folks to push their products as the way to save you from this malaise yet they only ever give you half or not even that of…
In this post on thinking about security when coming from an on-premises world to the cloud I do focus on Google Cloud so some of the techniques I discuss may not easily map to your cloud of choice that aside the principles are pretty much the same . How is security in the cloud different? When addressing security concerns on-premises you are responsible for everything from the physical security of…
In my incredibly narrow and brief tour of auditing and enforcement policies for GKE I spoke about OPA and gatekeeper . In this post I am having a look at creating Gatekeeper policies . This however was going to entail me getting to grips with Rego! So what is Rego? To understand what Rego is you need to know what Open policy agent ( OPA ) is. I discussed it in my post but the key thing is…
Asking questions of past me has been fun but what I wanted to do next is see what future me might conceivably tweet next so a little machine learning fun was my next stop . This post like my first post in this series on having fun with my twitter feed is about showing you how easy it is to use GCP to help you have fun with your tweets in the simplest way possible ( ok laziest way !
I’ve been using Twitter for over 10 years now and I was thinking it would be cool to analyse my tweets over the years. It also would give me a new dataset that I could use when looking at data related stuff ( I find it easier to use data I actually care about when exploring data things). You can download your twitter archive so there is no need to use the twitter API to get hold of my data.
Admission controllers When enforcing policies in K8s (I am assuming that you are running an up to date version of k8s) and when I say k8s I will specifically be talking about GKE (but you knew that 😀) you use Admission controllers ( This shouldn’t be optional hence “use” with no qualifier!) . Admission controllers essentially provides a way to govern how the cluster is used by…
My top 5 things I wish GCP would shout louder about Ways to stop yourself deleting things you don’t want to delete. Project liens . This stops you accidentally deleting a project. My colleague @MrTrustor waxes lyrical about that here VM deletionProtection flag - this helps prevents the accidental deletion of a VM maybe you are running AD on an instance or perhaps you have a monitoring…
Please note that I have no association with any training companies or third parties linking through to this post. This post is freely available to help folks understand Google Cloud! For those of you who have been reading my GCP flowchart series over on medium the collection now lives here. This post contains all the ones that are still applicable at the time of writing that I posted on medium…
I will be blogging here for now. I’ve been posting at medium for a while but I needed to move somewhere where I had more control yet still minimised the operational overhead with managing a website. For the curious this site is created with Hugo and hosted with firebase . If you’re interested in using Cloud Storage then I’ve walked through using Hugo and GCS here