Skip to content

Blog entries

  • 14 min read

PHP2Shell: The Internet Wasn't Broken. Something Underneath It Was.

There is something fascinating, and slightly unsettling, about the way the internet works. We tend to picture it as an enormous collection of independent systems, millions of websites spread across thousands of hosting providers and cloud platforms, built by countless developers using an almost endless combination of technologies. It feels distributed and resilient, and in many ways it is. Yet underneath all that diversity, a remarkable number of systems lean on the same few components, pieces of software that have quietly done their work for decades while we built ever more sophisticated things on top of them. Most days nobody gives them a thought. Then something happens that reminds us how much we depend on them.

  • 3 min read

When Did My Script Become an Agent?

There is a Python file on my homelab that started out as maybe forty lines whose entire job was to sort log entries into two piles. It has since acquired a tool list, a retry loop, and what I can only describe as opinions. At no point did I sit down and decide to build an agent. I just kept adding things on Tuesday evenings, and then one day I realised I could no longer predict what it would do before I ran it.

  • 4 min read

Time was a filter

Perhaps we have forgotten that some things are supposed to take time. There is a line about the Ents in The Lord of the Rings that has stayed with me for years. Treebeard explains that Old Entish is a slow language, and then adds the part that actually matters, which is that "we never say anything unless it is worth taking a long time to say." There is something almost absurdly incompatible with the AI age in that idea.

  • 4 min read

Slower than planned

Last night I ran Midnattsloppet. Ten kilometres through Södermalm, in August, surrounded by thousands of people who all seemed to have prepared better than I had. I had not run more than six kilometres in a year. I had not trained. I went in with a plan, and the plan was to go slow.

I went slower than the plan.

It's not about the model

There is a particular kind of satisfaction in watching a model load. The layers march across the terminal one at a time as llama.cpp offloads them to the GPU, the numbers climb, and then comes the line that tells you how much VRAM is left over. I remember sitting in front of that line the first evening the second card was in the machine. Two Radeon AI PRO R9700, sixty four gigabytes of VRAM between them, and llama.cpp reporting [XX.X] GB for the weights of a thirty billion parameter coder model at four bit quantization. Room to spare, I thought. The hard part is over. Everything from here is just usage.

Two hundred and thirty times a minute

AI is fantastic. Genuinely, without irony. We have all been handed the ability to vibe-code every idea we have ever had in the shower, and we are using it enthusiastically. I have a folder on my machine called "projects" that would be more honestly named "the graveyard", and inside it sit at least four tools that do roughly the same thing, written within a month of each other, by me, for me, because on each of those four evenings I was completely certain that this time I had finally figured it out.

I never run out of Iideas. I run out of time.

I've come to realize that my greatest strength and one of my biggest weaknesses are probably the same thing.

I'm endlessly curious. I get excited by ideas, I enjoy solving problems, and I genuinely love learning new things. When something catches my interest, I don't just want to understand it. I want to build it, improve it, and see how far it can go.

I've Been Thinking a Lot About Waiting

I've been thinking a lot about waiting lately. Not the dramatic kind. The ordinary kind. Waiting for a build to finish. Waiting for someone in procurement to decide whether a tool I needed last month can be approved this month. Waiting for a security review. Waiting for legal. Waiting for a meeting to start because everyone is still hunting for the HDMI cable. Waiting for a colleague to come back from holiday, because of course the one answer I need is locked inside their head and nowhere else. Waiting because somebody marked an email High Importance, apparently unaware that Outlook still has no button labelled "ignore until tomorrow, this is not actually important."

  • 3 min read

Is AI killing the industry, or are we just out of breath?

Open any feed for five minutes and you will find them. AI is killing search. AI is killing junior developers. AI is killing the call center, the copywriter, the stock photo, the four year degree, the company you worked at last summer. The headlines arrive faster than the things they claim are dying, which is its own kind of clue.

I have started to wonder what we actually mean when we say killing.

I Built a Local LLM Benchmark Harness, and It Mostly Started as an Argument With My GPU

For a while now I have had the same nagging question that I suspect a lot of people in security and IT have been quietly circling. Which local model is actually good enough for the work I do, and what does "good enough" even mean once you stop hand waving? Not the leaderboard scores, not the demos where someone asks a model to write a haiku about Kubernetes, but the actual workloads. Reading a log. Spotting a brute force that turns into a successful login. Writing an incident report without quietly inventing a threat actor that never existed.