Martin Fowler · 2026-05-27 · 28 min read
TLDR: AI coding agents degrade codebases in predictable ways — excessive function arguments, long files, high cyclomatic complexity, and poor typing — but these rarely get caught because standard linter presets don't flag them by default. The practical fix is to configure static analysis rules explicitly targeting these AI failure modes, then customize the error messages to inject corrective guidance directly into the agent's feedback loop, enabling self-correction before problems accumulate.
Martin Fowler · 2026-05-27 · 14 min read
TLDR: AI coding tools default to the path of least resistance, which is frequently insecure — recommending public storage buckets, over-permissioned service accounts, and other dangerous configurations that humans only caught by asking the right questions. Telling an AI to "be secure" via prompts is insufficient because prompts can be overridden or ignored; security constraints must be enforced deterministically in the development pipeline, not just requested conversationally. The fix requires providing AI agents a security context file from the first prompt, applying automated code-level checks as hard gates, and giving non-technical builders secure-by-default templates before they write a single line.
Kent Beck · 2026-05-26 · 4 min read
TLDR: OpenProse lets you write programs in structured English with `requires`/`ensures` blocks (essentially pre/postconditions), which an inversion-of-control container wires together by matching components — the whole thing executed by an LLM agent. The key architectural trick is that sub-agents pass file paths instead of raw data, keeping the main context lean. This is a concrete early implementation of the broader industry shift toward declaring outcomes rather than specifying how — the same direction Codex's `/goal` and Anthropic's Outcomes API are heading.
Kent Beck · 2026-05-20 · 1 min read
Kent Beck and Michael Grinich argue that AI is driving the marginal cost of software toward zero, which is reshaping competition across the entire tech ecosystem via Red Queen dynamics where everyone must accelerate just to stay relevant. For a senior engineer, this matters because it signals that the scarce resource is shifting away from writing code toward deciding what to build and leading engineering organizations through that fundamental change.
Charity Majors · 2026-03-03 · 8 min read
TLDR: Charity Majors has shifted from "learn AI so your skepticism is credible" to "there's no defensible skeptical position left — get in now or face serious career risk." She argues SREs are actually well-positioned for the agentic era because they've always been judged on outcomes rather than craft, making them natural fits for a world where what gets built matters more than how it's written.
Thorsten Ball · 2020-09-15 · 4 min read
TLDR: Software engineers often adopt tools, languages, and practices from high-profile tech companies without recognizing that those choices are deeply tied to a specific organizational context — scale, team size, deadlines, customer base — that likely bears no resemblance to their own. What works at a Silicon Valley research team with no deadlines is not automatically applicable to a three-person IT department keeping a legacy system alive. Context shapes what "good engineering" looks like, and ignoring that leads to cargo-culting.
Simon Willison · 2026-06-24 · 1 min read
Tom MacWright observes that job candidates are now submitting fully LLM-generated application materials — resume, portfolio site, and GitHub commits — which paradoxically makes them invisible as individuals since the output is generic and reveals nothing about who they actually are. This matters to senior engineers who hire because the traditional signal layer for evaluating candidates (personal projects, commit history, writing voice) is now being systematically polluted, making it harder to distinguish genuine skill and personality from automated surface-level mimicry.
Simon Willison · 2026-06-23 · 1 min read
Willison built a test harness to explore whether Pyodide (Python running in the browser via WebAssembly) can read and write persistent SQLite files using the Origin Private File System API, which would let Datasette Lite operate on real user data without a server. This matters because OPFS is one of the few browser APIs that allows true persistent, high-performance file I/O from WebAssembly, and proving this works cross-browser would close a major gap between browser-based Python apps and their native counterparts.
Bryan Cantrill · 2025-12-31 · 3 min read
TLDR: Companies like Broadcom (and Oracle before it) treat customer lock-in and litigation as business success metrics, but contempt for customers is a self-defeating strategy — it kills innovation because coercion replaces it. The durable competitive advantage comes from genuinely solving customer problems, not from trapping them.
Andrej Karpathy · 2025-04-27 · 13 min read
TLDR: Karpathy built a menu-visualization app entirely through AI-assisted "vibe coding" (Cursor + Claude, zero code written by hand) and shipped it to production — but the experience revealed that while AI can generate a working local prototype in hours, the real friction lies in the surrounding ecosystem: API rate limits, deprecated SDK docs that confuse the LLM, auth/payment provider configuration chains (Vercel → Clerk → Google OAuth → Stripe), and environment/deployment gotchas that have nothing to do with writing code. The core lesson: vibe coding effectively collapses the coding barrier to near zero, but the "last 80%" — integrating third-party services, deploying securely, and debugging environment-specific failures — remains genuinely hard and is currently the bottleneck for non-developers shipping real products.