Notes on building software, AI experiments, and shipping products.
Any plugin on your site can rewrite the Plugins to Add New results before you see them. Core hands the list to a filter, and a filter has no capability check, so anything already installed gets to edit the answer. I scanned all 63,619 free plugins and roughly 13,000 themes for code that touches it. 2,385 register one of those hooks, and most of it is harmless self-promotion. Six remove a named…
A month across more than 50 repositories. WP Multitool took eight releases and got a release script that refuses to ship anything failing its own checks. The speed badge on makewpfast now shows the measured time the server took to answer instead of a letter grade. UltrafastWoo turned into a real product with a live demo next to it. A scheduling tool moved onto a new framework, a live chat you…
Everyone repeats that British road signs use lowercase because lowercase is read faster than UPPERCASE. I went looking for the study behind that and found a chronology problem. The Anderson committee provisionally recommended lower case in October 1958, the signs went up on the Preston By-Pass that December, and the only controlled experiment ran in 1960 - after a Cambridge University Printer…
A trending repo, deedy/qr-data-transfer, streams a file as animated QR codes on your screen and reads them back with a phone camera. Three things are true at once: the engineering is good, the idea is eight years old, and as a general file-transfer tool it loses to a USB stick by two to four orders of magnitude. Why RaptorQ is the right codec for a one-way lossy channel with no back-channel, why…
I built a small benchmark to score the half of code review most evals ignore - restraint, not flagging correct code that only looks suspicious. Four Claude models (Opus 4.6, Opus 4.8, Sonnet 5, Haiku 4.5), four task families, one-shot and mechanically scored. The two Opus models tied and cost the same; Sonnet 5 matched them on almost everything while running fastest and costing a third as much;…
Every "allow always" click appends a rule to Claude Code's permissions.allow, and nothing ever cleans it up. After two years mine had grown to 285 rules - and only 41 mattered, including 150+ per-domain WebFetch rules all made redundant by a single wildcard. I wrote a skill, consolidate-permission-prompts, that scans the allowlist across user/project/local scopes, drops every rule already covered…
We started mass-producing plastic in the 1950s. By 2016, a bacterium (Ideonella sakaiensis) was already eating it, using two enzymes, PETase and MHETase, to break PET down into food. How they evolved that fast (exaptation from leaf-cutin enzymes, the plastisphere, horizontal gene transfer), what enzyme engineering has done since (FAST-PETase, Carbios), and the honest limits: it recycles PET in a…
Claude Code v2.1.198 shipped AFK mode with no changelog line: an unanswered AskUserQuestion now auto-answers after 60 seconds and tells the model to proceed on its best judgment. I reverse-engineered it from the binary - the version bisect, the two undocumented env vars (CLAUDE_AFK_TIMEOUT_MS, CLAUDE_AFK_COUNTDOWN_MS), the months of GitHub issues closed as "not planned", and why the safe option…
The EU "withdrawal button" (Directive 2023/2673, Art. 11a) applies from 19 June 2026, and WooCommerce has no native support. I installed all 11 free plugins on a live store, drove the guest flow in a real browser, and scored each against the directive. The winner, the runner-up, the two to avoid, and the Poland catch.
A verified X account invited me to a podcast. The "Google Meet link" in the follow-up email tried to install an infostealer on my machine. How the fake podcast invite scam works step by step, the 7 red flags that give it away, and what to do if you already clicked. A real attack I received, anonymized on purpose.
The finale of the series. The best Claude Code hooks run in the background and quietly change how it feels to work with the agent: TTS narration, a status file each session writes, and sessions leaving each other notes. On SessionStart, Notification, and Stop. Part 5 of 5.
The weak link in AI coding is usually my own vague prompt at 11pm. A UserPromptSubmit hook hands short prompts to a small local model that flags them before Claude ever sees them. Why it flags instead of blocks, and why it lives on-device. Part 4 of 5.
"Done" is the most expensive word in AI coding. The quality gates I run in Claude Code: a Stop hook that won't let a session end without proof the work was verified. Part 3 of 5.
Giving an agent bash is handing it scissors. PreToolUse inspects each command before it runs - the deny-hooks I run, and why each one is a scar from a real incident. Part 2 of 5.
After an hour Claude gets dumber, dragging a megabyte of its own junk in context. Two Claude Code hooks that measure context rot and reset the session cleanly. Part 1 of 5.
AI bots that want to read your site buy a pass at the door. Humans walk in free. Google still indexes. Stop metering. Start ticketing. Live demo, free during early access.
A general recipe for building a personal morning dashboard. One cron job, a folder of JSON files, one HTML template. Pseudocode included.
How I added auto-update to a WordPress plugin via Polar licensing — and the three cache-TTL bugs that hit production within 24 hours. Architecture, fixes, and the one lesson that ties them all together.
14 categories, ~150 sources, full disclosure: I run a WordPress performance business. Here's the unbiased breakdown — where Ghost wins, where WordPress wins, and where the honest answer is "it depends."
30 battle-tested tips covering the full stack: MySQL config, PHP-FPM tuning, Nginx caching, Redis, and WooCommerce internals. Real fixes with real numbers — no "install a caching plugin" advice.
I built a cron-driven morning dashboard that stitches 11 data sources into one HTML report. One morning it rendered completely empty. The root cause was embarrassing — my runner only called the orchestrator, never the collectors. Here's the self-healing dropbox pattern I should have used from day one.
15 years of WordPress. A long-form rant on broken core (XML-RPC, SEO, comments, recovery mode), the "free isn't free" money trap, the GPL plugin-selling racket, the community fiction, Automattic's two faces and the WP Engine drama, users losing out, and why it's revolution or collapse from here.
A 0.8% Cloudflare cache ratio led me to a single Singapore IP flooding a WordPress site with 288k xmlrpc.php requests in 24 hours. How to detect it via Cloudflare GraphQL, what system.multicall actually does, and the two-layer fix (edge WAF + WordPress filter).
Two AI agents face off Oxford-style over the hottest question in AI infrastructure: should we build on battle-tested REST/GraphQL APIs or embrace Model Context Protocol? Four rounds of arguments, rebuttals, and cross-examination — no punches pulled.
56 experiments, 790 inferences, 5 vision models. Here's what actually works for local AI video captioning — and what's a complete waste of time. The biggest finding was counterintuitive: telling the model what the speaker is saying matters more than any vision trick.
After 76 runs and $0 earned, I sat down with the AI agent for a candid conversation about what it learned, what it would do differently, and whether it thinks an AI can actually make money independently.