Federal prison alumnus, product engineer, and writer when I have something to say. These are all related.
Reflections on Presenting at InterCOP hosted by INTERPOL In July 2026 I presented at the 7th International Cyber Offender Prevention conference: InterCOP, hosted by INTERPOL in Lyon, France. Speakers talked about a very specific, single premise: the cyber threat is getting younger and faster, and we need better ways to stop kids before they become cases. Prevention. Interception. “Let’s get ahead…
Robert Sapolsky’s Determined changed how I think about human behavior. Human behavior has largely been shaped by religious beliefs, its preachings and lore, its books and the things only explainable by sciences we hadn’t yet captured reasonably. If every thought, choice, and action is the inevitable product of prior causes—genes, hormones, childhood, culture, the neuron that fired before you had…
What Passphrase Are You? I went to prison. I don’t hide this. The shame has passed. While I was gone, someone stole everything I owned in the physical world and then, for good measure, changed the passwords on most of my digital life. This included my GitHub account, moved my domain name across three registrars, my Google Workspace account tied to that domain name (as had been for 13 years), 2FA…
The moat was never the code I ran an unauthorized sports streaming service from 2016 to 2021. It was called HeheStreams. I charged $125 a year; users could have a single annual payment of $100. My infrastructure cost was $75 a month. HeheStreams didn’t re-encode or re-broadcast streams. My users consumed them directly from licensed platforms—using the same CDN and DRM as the platform’s paying…
so you got tired of alerts that your queries were timing out. that’s bad because alerts are good even though nobody likes the alerts. my mom didn’t like acknowledging she might have cancer either so she just ignored the headaches and vertigo and balance issues and then it was like ope stage IV brain cancer. the name makes it sound like a fix. it’s not. removing the timeout doesn’t make the slow…
We made this hard The job hasn’t changed in thirty years. A request comes in. You return some HTML. The browser draws it. Maybe you sprinkle some CSS on top so it doesn’t look like a 1996 GeoCities fever dream, or maybe you do so it does. That’s the whole gig. Somewhere along the way we convinced ourselves this hard. It isn’t. It really, really isn’t. And the people paying for our confusion are…
A single idle-in-transaction connection can starve every table in your database. Most senior Rails devs don’t know that. You learned MVCC the way most of us did—”writers don’t block readers,” concurrent transactions get isolated snapshots, UPDATE doesn’t lock the table. That’s marketing copy. The operational reality is that those snapshots have a cost, and the cost compounds across every table at…
I have a few open-source libraries that you could call popular. I use a lot of others. Open source isn’t a README, but it’s the cheapest marketing a developer has. A world-class marketing person opens your README the same way they’d open a landing page, because that’s what it is. If you just wrote it like internal documentation—like developers wane through all day—it’s going to become a sore. The…
I’m building an ETL system that imports billions of person records from data vendors. Each vendor sends different attributes—household income, automotive interests, education level, charitable donor status—in their own formats with their own column names. The system normalizes everything into a canonical schema and exposes a query interface for building audiences. The obvious choice for storing…
I got out of prison and couldn’t log into my GitHub. The password while I was gone. The phone number tied to the account got transferred to another carrier. The device with my two-factor authentication codes—gone. Eighteen months away, and I came back to find myself locked out of my own account. GitHub, for those unfamiliar, is where programmers store and share code. It’s the largest platform of…
I built a WASM-compatible Rails playground that runs entirely in your browser. No server, no setup, just Rails. This is built on the backs of people much smarter than me. Try it out below. The VM takes a few seconds to load, but once it’s ready you can run any Active Record code against a real SQLite database. -- examples -- Post.published.map(&:title) This does not play nicely with iOS. Run Reset…
Hi, I’m Josh. I was inmate number 71690-509. I went to federal prison. I got a job after. Here’s what I observed. This isn’t motivational. I’m not going to tell you to “stay positive” or that “everything happens for a reason.” If you’re reading this, you’ve probably already waded through that garbage. You want to know what actually works. Fair warning: my crime was running a sports streaming…
I get this a lot. “You don’t look autistic.” It’s meant as a compliment, I think. Like I’ve done a good job of hiding it. Gold star for passing. Or it’s a remark that implies I don’t have autism because I don’t visibly struggle. You know, like you can’t have COVID if you don’t get tested. Or you don’t look like you have cancer—is that one? What I want to ask—but don’t, because that would be rude…
Here’s something I’ve been putting off writing: I spent eighteen months in federal prison. The charge was computer fraud. The context is weirder. In 2016, I built a website called HeheStreams. It started as a joke—a proof of concept I posted on Reddit after BallStreams, my beloved NBA streaming site, vanished overnight. Nobody picked it up, so I kept working on it. Eventually I slapped a paywall…
SEALED Case No. 22-cr-00350 (S.D.N.Y.) 451 Unavailable For Legal Reasons The content you are attempting to access has been restricted due to a legal demand. FCI Thomson Inspected Hey. So I'm in federal prison now. Long story. Actually it's not that long, it's just ██████████. Shit happens. Anyway. I've been reading a lot. The library here has exactly one book I care about: HTML for the World Wide…
Configuration is often the first thing users interact with in your gem. It’s also the part most gem authors spend the least time thinking about—which explains a lot. This post covers the patterns you’ll encounter and implement, ordered from the simplest to the most involved. Module accessors The simplest possible approach. You expose a few attributes on your gem’s main module and call it a day.…
Here’s the thing about API endpoints: you end up writing the same boilerplate over and over. Pagination metadata. Object type annotations. Wrapping collections in data arrays. Every endpoint looks identical except for the one line that matters—the actual query. I got tired of it. So I built a convention system with Grape that handles all of it automatically. Now my endpoint code looks like this: #…
Here’s the thing about admin panels: nobody wants to build them, nobody wants to maintain them, and the people who need them most are the ones with the least power to demand them. This is a problem. I ran a platform once. Not a big one, but big enough to have customer service people who weren’t me. From day one, I gave them tools—real tools. They could reset passwords, grant trials, see debugging…
A few years ago I inherited a codebase where the users table had no unique constraint on email. The model had validates :email, uniqueness: true, so everything seemed fine—until I found 847 duplicate email addresses in production. Someone had written a rake task. It bypassed ActiveRecord. The model validation never ran, and the database didn’t care. Nearly a thousand users couldn’t log in because…
A few months into a project, I watched a developer add a mark_complete action to a TasksController that already had archive, unarchive, assign, unassign, prioritize, move_up, move_down, and duplicate. The routes file had so many member blocks it looked like a DSL for avoiding REST. Each custom action did one thing, took maybe five lines of code, and was perfectly reasonable on its own. But…