Weekly notes

How I Find Problems to Solve as a Staff Engineer

Good reminder about how much more collaborative work gets with experience and trust. It’s not about building what I think the business needs but about listening, hearing, setting aside personal preferences and wanting to understand what others are going through day to day.

Listen
Talk about problems
Wait
Wait some more
When I have an idea, share it
Get feedback and listen
Implement or write a spec that can be implemented by someone else

Book: More Everything Forever by Adam Becker

Wherein a small group of people with lots of money read a few science fiction books growing up and have some profoundly weird views about the present and the future that are being inflicted on everyone.

AI will save us
Our biggest problem is AI might not save us (alignment)
Nanobots will save us
We’ll be able to upload our brains to the internet and live forever
We’ll be able to bring people back from the dead by feeding their writings into a chatbot
There will be trillions of us living in space on great big space ships
All of this really starts to happen in the next 5-10y starting with AI
Climate change isn’t a problem because in the future we’ll be living in space
We should live on Mars because that’ll be great
We can burn the billions living in the present in service to the trillion trillion trillion people that will be living in space in the future
Longtermism, effective altruism … :shivers:
Seems like a weird cult, and
Billionaires are really bad

Misconfiguration Spotlight: Securing the EC2 Instance Metadata Service

Server side request forgery vulnerability for applications running on ec2. IMDSv2 would be a good version of the service to migrate to.

Parse, don’t validate

I like the idea of packing more information into our data model and being thoughtful about where the responsibility for handling None values lands. Ideally it’s at the edge of the system when data is being parsed into domain objects used in the system.

Kidcameo by Jeff Woods

A website Jeff built to produce custom colouring books for families. Love the origin story and the backstage information about how the system works. Lots of ai.

How Cloudflare enforces engineering standards using AI

Cloudflare is release a bunch of documents around where they use agents in their sdlc. Here they describe a engineering codex filled with rfc style documents describing how they design and build applications. The codex is used by spec and code reviewers as well as team members who are also working in the system.

Internal agent use @ Honeycomb

There are a couple of links for this one.

Some ideas here:

Velocity of change increased
Number of bugs increased (this puts a load on the team by increased number of incidents)
Not all experiments at using ai bear fruit (team members are still backed away from automating some things)
Ai made tiny fixes easier which delayed people taking a wider system view and refactoring
Good practices must be in place for any of this to work (testing, monitoring, canary deployments, feature flags, fast builds)
They have a code bot and a review bot
Use mcp to give agents the tools and knowledge we have
The multiplier is real but may not be the same for everyone

My Thoughts on the Bun Rust Rewrite

Can’t say I love the way Jarred interacted with the Zig community as Andrew describes it. Gross reference to Peter Thiel and some sort of ycominator like thing he might be running to churn out his own protoges?

Are you team A or team B?

CI pipeline logics, unless it is incredibly simple, should probably go into shell scripts for testability outside CI infrastructure which is often hard.

# good

steps:
- run: ./scripts/build.sh
- run: ./scripts/deploy.sh

# bad

steps:
- run: |
    cd project
    mvn package
    cp target/project.war dist/
    docker build Dockerfile
    docker tag ...
    docker push
    etc.

The former is much more easily tested locally.

The Grug Brained Developer

Fantastic and weird hard learnings over a career of software development. A few of my favourites:

complexity bad
testing
- test first meh
- units ok but lots of churn
- e2e good but expensive to run and hard to debug
- integrations are the sweetspot
- mocks suck (they hide feedback in unfortunate ways sometimes)
- refactoring without understanding why a thing works the way it does mostly fails
- microservices suck lol
- repetition is ok sometimes
- locality of behaviour > separation of concerns (sometimes it’s better to have code all in the one place vs many abstractions and indirection to get at the lines of code that do a thing)
- logging is important
  - when you branch (step into a function, major if-thens, etc.)
  - stamp a request ids when you enter a new process
  - dynamic log level
  - per user context
- frontend is hella complicated (unnecessarily)
- apis should be designed based on usage by the application (not strictly domain objects)

How do programming languages impact token efficiency and correctness?

Less of a correlation between static vs dynamic languages and task performance in an llm. Token efficiency is measured in this paper. Python and javascript are at the top of the pack of languages tested (20-30 or so) but rust, go, and java aren’t that far behind …

What can we learn from that time Homer Simpson designed a car?

Look for the problems not solutions during user interviews. What might sound great for 1 person could be a terrible idea for others. Start by understanding how people are using a thing and where they’re having less of a good time or where there might be something missing. This process often takes time.

They Said It Would Cost $54 Million. We Said “No Thanks.”

Alberta gov’t assembles a small team of good product leaders, stakeholders, and engineers and they build a useful application faster and much cheaper than their standard procurement process would have using llms.

They had a ton of video of how the work was currently being done with an old, limited application that gpt was able to review to determine requirements and workflows.

Eventually in this process some non-technical people starting making requests for enhancements by submitting proof of concept experiments also written by llm.

Coding

Hand-write (~paragraph) a CONCEPT.md — the theoretical Hacker News title, my project thesis, some scattered constraints

Pair with ultra code fable “Flesh out CONCEPT.md, what’s ambiguous, ask me questions, what are dimensions I’m not > considering, what API keys do you need…”

Pair with ultra code fable (or codex sol max) “Convert to TECH_PLAN.md, here’s how much I’m willing to spend, host on > …, here’s some API keys …”

Then I will literally just prompt “Build and verify TECH_PLAN.md” and over the next 4-48 hours I’ll let it build everything out.

and …

95%+ of the code is written in that first mega build run. I don’t think folks appreciate how much shifting left is the secret weapon against codebase slop (i.e. SlopCodeBench). Like step (4) really is binary here — there’s no pairing or even reading what the terminal agent says. If the output is wrong, I throw it completely away and add constraints to the CONCEPT.md. For many vibe coders out there, the first build prompt writes 5% of the code and I think that actually underlies most of their issues.

He learns what he can from the result without getting attached to any output …

I read the code a little bit. Often the shape (i.e. file tree) and entry points. If there’s some core algorithm, I’ll ask for a .html explainer rather than digging through the source. If I do end up digging into the code, it’s because I suspect some sort of “cheating” in the implementation.

I don’t think any of these experiments are against existing codebases.

The outcome of these projects is often an insight or the answer to the what-if question. Rarely does it make sense for me to share the code or even the app URL. Instead I typically consider the entire loop and its artifacts ephemeral and just share the insight on X or with a blog post.

No concern about any societal issues with this stuff at all.

Research / learning

See hot new research paper on X

Skim the abstract, throw the full text into Claude/Codex, “build an interactive playground artifact to explain what’s > novel here, I’m a technical person who already knows …, I’m less familiar with …”.

Play with the .html file

Ask some follow-up questions that generate an updated .html file, go to (3)

Cost

Claude Code Max 20x ($200/mo)

ChatGPT Pro 20x ($200/mo)

Google AI Pro ($20/mo) — a handy AI family plan with GSuite benefits

Modal, Railway, Netlify ($20-500+/mo) — for hosting or running experiments