$ ls ~/posts

posts

How to Deprecate a CPAN Module
#Perl#CPAN

How to Deprecate a CPAN Module

Deprecating a module on CPAN is not as simple as pushing a button, so let’s run through what’s actually involved and what you can do if you’d simply like to hand the module off to someone else. The key thing to know here is that to deprecate a module you have to upload a deprecated version. This may …

· 5 min read
Claude Code: Anatomy of a Misfeature
#LLM#security

Claude Code: Anatomy of a Misfeature

On Canada Day (July 1), 2026, Anthropic shipped a surprising “easter egg” to users of Claude Code: 2.1.198 includes an efficiency bypass which allows agents to continue on without being blocked on direction from a human. This misfeature completely evaded mention in the changelog as well as the docs. I asked …

· 30 min read
The dot claude Attack Surface
#security#LLM

The dot claude Attack Surface

You won’t find anything nefarious in most .claude directories — but how do you know until you look? Trusting a cloned repo enables its Claude Code hooks with no further prompts, now and every session after. Here’s what that decision covers and how to narrow it.

· 3 min read
Keeping it Really Local
#open source#Perl

Keeping it Really Local

I worried that writing about an open issue in Dave Cross’s App::HTTPThis might have annoyed him. Instead he merged my patch, found a better solution, and blogged about taking the module to version 1.0.

· 1 min read
Keep It Local
#security#networking

Keep It Local

127.0.0.1 keeps a dev server reachable only from my own machine; 0.0.0.0 opens it up on every network interface. Let’s look at how to bind clodhopper, air, Python’s built-in file server, and http_this so that they don’t broadcast your resources to the world.

· 3 min read
On Hopping Claudes
#LLM

On Hopping Claudes

I vibe-coded a dashboard for hopping Claudes. It allows me to see which of my agents are working, stalled, or waiting on me. Under the hood it captures each agent’s hook events into a local SQLite database.

· 3 min read
On GitHub Issues as Untrusted Input
#LLM#security

On GitHub Issues as Untrusted Input

A GitHub issue is a handy source of truth for kicking off an agent workflow. On a public repo, every input on that issue is untrusted, and a quick scan of the comments may not catch what’s hidden before you flip your agent into YOLO mode and wander off.

· 3 min read
What the Duck Is Up with Trail Running?
#running#My Mind is Racing

What the Duck Is Up with Trail Running?

As I add races to My Mind is Racing, the trail and ultra races keep standing out for how cleverly they’re named — lots of wordplay and dark humour. I’ve never run a proper trail race myself, but I’ve put together a list of the best-named ones to get your racing calendar started.

· 4 min read
Better Bots via Hooks
#LLM#Git

Better Bots via Hooks

Getting an AI agent to follow every repo convention through AGENT.md files and skill instructions can be a slog, and it won’t always comply. A git pre-commit hook enforces the rules for you — no commits to main, no committing files that shouldn’t change, and tidying and linting before anything lands.

· 2 min read