The Hidden Directive Gap
AI coding agents appear to unlock the promise of converting natural language to code; that's the whole value proposition of "vibe coding". B...
Srikanth Sastry
Personal blog — technology, programming, governance, and life.
Latest posts
Governance on AI: Mumble incoherently and carry a big stick
A flurry of bills, drafts, and executive orders on AI have dropped across the US and EU in the past couple of months. Take a closer look: al...
You Don't Have a Relationship with Your LLM. You Have Five.
This is happening to me often enough to where I need to understand it. It's not just me. I have heard this from my colleagues and friends as...
The Architecture Orphaning Problem with AI Agents
Spec-Driven Development (SDD) has become the new cool thing to try in AI-assisted software development. It has drawn apologists, critics, an...
The Guardrail Erosion Problem with AI Agents
We have all seen AI agents make 'mistakes' in ways that introduce bugs and then try to cover their tracks by deleting or updating the tests...
AI vs. Open Source, Part 3: The Constant Eyes
In his book The Cathedral and the Bazaar, Eric Raymond came up with Linus's Law: "Given enough eyeballs, all bugs are shallow."It has been h...
AI vs. Open Source, Part 2: The Hollow Commons
A previous post discussed how AI threatens the legal basis and enforcement of open source. Briefly, copyright makes licenses enforceable, an...
AI vs. Open Source, Part 1: The Empty Grant
The step function increase in AI's ability to generate code is looming over open source. What frontier models can do today is a warning shot...
SECURE Data Act: The dilution in pseudonymization
Disclaimer: I am not a lawyer, and this post is not advising any technical implementation in pursuit of any privacy regulation. The opinions...
Subsidiarity is not Hayek
I've been writing about directive governance and subsidiarity in software organizations. The objection I get is: "Isn't this just Hayek?"The...
Deliverance from Directive Governance
This is the third post in the series about directive governance. The first post diagnosed the problem with governance in the tech industry a...
The Suggestible Actor: A New Model for AI-Assisted Software Development
Every software system is designed around an assumption about its actors; the ones who use the system, and what drives their behavior. This a...
Tech Companies and Directive Governance: A Situationship
Most large tech companies operate top-down. Information flows up through a reporting chain. Decisions are made centrally. Directives flow ba...
Cargo Cult Governance
In the tech industry, we have been through a corporate rollercoaster in the last few years. First, it was the hiring mania during COVID, fol...
The grand flattening: AI Slop is just the next step
Reality is an entity of vast, irreducible complexity. It is far more than the human mind can grasp, yet we are forced to operate within it...
Defense in Depth vs Locality of Behavior
Defense-in-depth—borrowed from military and security strategy—means layering safeguards so that if one fails, another takes over (Cloudflare...
When Backward Compatibility Can Rescue a Leaky Abstraction
I ran into one of those delightful bugs that only show up in dynamic task generation of your data pipelines — the kind that teach you how a...
Const Refs vs. Raw Pointers: Fixing Shared Pointer Reads
Recently, I encountered a subtle performance issue while refactoring some C++ code. I was passing a std::shared_ptr by value into a funct...
Changing your Jekyll theme without losing your mind (or your content!)
After I moved my website from Wordpress to Jekyll, I hadn't changed the theme for nearly 5 years. When I finally decided to change the theme...
Cyclomatic Complexity: How Low Can You Go?
Ever spend 20 minutes trying to figure out why your bug fix or feature code isn't triggering or being executed — only to realize you missed...
TDD for Bug Fixes
I have seen way too many 'senior' engineers get bug fixing wrong. It is common to see an engineer sent a pull request titled "bug fix: <some...
Let Sleeping Engineers Lie: Why Your Alerts Should Match Your SEVs
At work, I had a customer team that aspired to be “customer first.” To them, that meant fixing issues before they became SEVs. That was all...
The Law of Demeter and unit tests
The Law of Demeter essentially says that each unit should only talk to its 'immediate friends' or 'immediate dependencies', and in spirit, i...
'Privatize' your classes for better unit testing
You service may be massive, but it's public API surface is pretty small; it has just a handful of APIs/endpoints. Everything else behind tho...
Tests should be isolated from each other; not coupled
Almost [by definition]({% post_url 2022-06-18-defining-unit-tests-two-schools-of-thought %}) unit tests should be isolated from its (externa...