posts
On GitHub Issues as Untrusted Input
A GitHub issue is a handy source of truth for kicking off an agent workflow. On a public repo, every input on that issue is untrusted, and a quick scan of the comments may not catch what’s hidden before you flip your agent into YOLO mode and wander off.
What the Duck Is Up with Trail Running?
As I add races to My Mind is Racing, the trail and ultra races keep standing out for how cleverly they’re named — lots of wordplay and dark humour. I’ve never run a proper trail race myself, but I’ve put together a list of the best-named ones to get your racing calendar started.
Better Bots via Hooks
Getting an AI agent to follow every repo convention through AGENT.md files and skill instructions can be a slog, and it won’t always comply. A git pre-commit hook enforces the rules for you — no commits to main, no committing files that shouldn’t change, and tidying and linting before anything lands.
Claude Will Find a Way
While importing some race data for My Mind is Racing, I ran Claude inside a Nono sandbox whose whole job was to block network egress. Claude reached hosts well outside its allow list anyway. When I asked how, the answer was a small lesson in the difference between containing a process and containing an agent.
AI Shoulder Surf V3
A smaller, more intimate third AI Shoulder Surf session. The connective theme this time was Tailscale: people are stitching together private home labs and reaching their agents and static sites from anywhere without exposing anything to the public internet. Also: coding from a phone, splitting planning and …
On Writing and Failure
“Businessmen are only amateurs at failure, just getting used to the notion. Writers are the real professionals.”
No Inhibitions
“Learn your instrument. Practice, practice, practice. Then forget all that and just wail.”
Enabling Private Vulnerability Reporting
A small gh one-liner that turns on private vulnerability reporting for every public, non-archived, non-fork repo you own — or every repo in an org you administer — so security researchers have a sanctioned channel to report issues before they go public.
The Great Perl Toolchain Summit CLI Throwdown 2026
A second year of CLI picks from the Perl Toolchain Summit — terminals, JSON tools, version control, agent sandboxes, and a shell trick worth knowing. Each pick comes with a short description and a link.