Posts

What Happens When Someone Asks Your API for Everything at Once?

A client had been bulk-loading data straight into the database with SQL, to speed up onboarding new customers. It’s a reasonable instinct, SQL is fast and easily repeatable with minimal effort, but writing directly to the database skips the permission checks, validation and auditing the application does for you. So I suggested our platform’s built-in REST API instead, and built them a Postman collection to try it. Somewhere in the testing they sent off a couple of requests with no page size on them, and the development server ran out of memory and fell over. Then it did it again.

Sunday, August 16, 2026 | 4 minutes Read

Turning a 232-Page Manual Into Something an AI Could Use

Late last year, I spent a couple of days getting a manual into a shape an AI could use. The language it described wasn’t new, and I wasn’t changing it. It was for a legacy scripting language that had been running workflow and event logic for over a decade. It was also thoroughly documented: a 232-page technical guide, cataloguing a couple of hundred built-in functions, each with its parameters and an example. For once, the problem wasn’t that nobody had written the rules down. The problem was that the 232 pages had been written for humans, and the thing that needed to read them this time was an AI.

Sunday, August 9, 2026 | 5 minutes Read

The Tyranny of the Default

This term was coined by Steve Gibson on his Security Now podcast many years ago. Steve realised that most people will never touch or change the default settings/options that come with any software. As part of delivering custom software solutions to our customers, this is something I think about fairly often, as the choices we make, while we give our customers levers to pull, rarely get changed. I tripped over this last week in a slightly different situation while investigating for a customer what static analysis and CVE detection was in place for their application. We use GitHub for almost all of our projects and have a mature, well-worn CI pipeline (the thing that builds the application and runs checks and tests when new code is pushed). But for this customer, we host it in their Bitbucket repository.

Monday, July 27, 2026 | 4 minutes Read

Millions a Month to Save $600,000 a Year

I was drinking my coffee last night and reading about Curative, the US health insurer whose CEO has been talking up how much of their operation now runs on AI agents. One line stood out and stopped me. They’re spending millions of dollars a month on AI, and the headline they’re celebrating is cancelling a $600,000-a-year Salesforce contract because they vibe-coded their own CRM. Saving $600k a year is a good day. It just looks a bit different sitting next to a bill climbing into the millions a month, and it got me thinking about what actually gets counted when a story like this gets shared.

Wednesday, July 22, 2026 | 7 minutes Read

The process was running. The system was dead.

A couple of weeks ago, one of the systems we built and support stopped doing its job for about 42 hours, and almost nothing looked wrong while it happened. It’s a document-processing system: documents arrive by email; an AI step reads the PDFs and turns them into structured data; our application validates and processes them; and the results flow out to the customer’s system of record. They’d not long gone live and were steadily onboarding new clients, so the volume was climbing week on week. Over a weekend, the scheduled processing simply stopped. The web application stayed up; the Java process never fell over; and every check watching it kept reporting the service as healthy. No crash, no alert. It only surfaced because someone noticed documents weren’t coming through, not because anything told us.

Monday, July 20, 2026 | 7 minutes Read

Our AI Bill Went From About $120 a Month to at Least $2,000

California just gave every one of its state agencies access to Claude at half price, and extended the same deal down to local councils and cities. As an arrangement it’s hard to fault - cheaper AI for public servants, training included, one place to buy it through instead of forty. If I ran a government I’d probably take it too. But the number I keep coming back to isn’t the discount. It’s what it costs to leave, once a whole government has quietly built its work around a single vendor.

Monday, July 13, 2026 | 5 minutes Read

The Sovereignty Question Just Got a Compliance Date

A new whole-of-government cloud policy came into effect on Wednesday, and outside of Canberra I’m not sure many people noticed. The DTA’s Cloud Policy took effect on 1 July, and it lands alongside the updated AI-in-government policy, where the first mandatory requirements kicked in on 15 June and the rest arrive by December. Worth being precise about scope: this is a Commonwealth policy, so it binds federal (non-corporate Commonwealth) entities, not the states - though I’d be surprised if the states don’t drift the same way over time. If you don’t work with government you can be forgiven for scrolling past all of it. If you do, the thing worth paying attention to is a bit subtle: a question that has been a comfortable think-piece for years just turned into an audit item.

Thursday, July 9, 2026 | 4 minutes Read

Never Trust Your Caller

A couple of weeks ago a security researcher published an excellent write-up of how they could have hijacked every live camera feed of the FIFA World Cup. There was no clever exploit involved. They registered as a football agent on FIFA’s public portal, which quietly added their account to the same Microsoft Entra tenant that runs FIFA’s internal platforms. When they browsed to the internal streaming system, the front end correctly showed them an access denied page. The backend, on the other hand, served everything they asked for - including the ingest URLs and stream keys for every camera at every match. Their own summary of the impact: they could have rickrolled the World Cup final.

Saturday, July 4, 2026 | 4 minutes Read

Build vs Buy Didn't Get Easier. The Bill Just Moved.

A survey did the rounds last week — Retool surveyed a few hundred people who build internal software, and a third of them responded saying they’d already replaced a SaaS tool with something they’d built themselves. This is worth taking with a grain of salt, it’s a company that sells a build-your-own-tools platform asking builders if they like building tools. But the direction matches what I’m seeing and reading, and more neutral voices are saying the same thing. The advent of AI (LLMs specifically) has made “build it in a week” feel real, so the build-vs-buy question is open again.

Thursday, July 2, 2026 | 3 minutes Read

My First Public Talk — What Actually Stuck With Me

I gave my first public talk a few weeks ago. Then I spent four days proving my own point — not on the AI, on the slides. It was at the Adelaide Azure User Group. Thanks to Simon Cook from Encode Talent for the introduction and nudge to speak, and to Sam Fernando for running it. I dragged my coworker Simeon from Biz Hub along for the ride. The talk was about practical AI implementation in enterprise environments. The central theme was simple: the AI model is usually the easy part. Everything around it is where the real work happens.

Friday, June 12, 2026 | 3 minutes Read

Can a 2-Digit MFA Code Really Be More Secure Than 6?

I had an interesting chat with a co-worker a couple of weeks ago about Microsoft’s move to use a 2-digit MFA prompt instead of the traditional 6-digit time-based code. At first glance, that sounds like a downgrade; fewer digits must mean weaker security, right? But the truth is, the mechanism behind it is very different. Email codes and “magic links” Many applications send a one-time code or magic link to your email. While convenient, this is only as secure as your email account. If an attacker already has access to your inbox, they can trivially intercept those links and reset your password.

Wednesday, April 15, 2026 | 3 minutes Read

APIs Don't Fail Loudly Enough

When enterprise integrations fail, they rarely fail cleanly. We inherited a system syncing financial data between a property development platform and our database. On paper, it “worked”. In reality, it was quietly dropping records and skipping certain transaction types. This is the worst kind of failure: no outage, no alert, just silent data loss over time. The bigger problem: there was no architecture or process documentation explaining how the sync worked — or was supposed to work.

Friday, April 10, 2026 | 2 minutes Read