Short form
Ideas
Short thoughts I'm still working through. Some of these will eventually grow into full articles.
2 August 2026
Security controls should fail loudly.
A control that fails silently is worse than no control at all, because it gives you the confidence of protection without the substance of it. If an admission webhook times out and defaults to allow, that's a decision someone made, usually to avoid blocking deploys during an outage. It's a reasonable decision. But it should show up somewhere other than a debug log nobody reads until after the incident. If a control can fail, the failure needs a first-class signal: a metric, an alert, a page. Not a footnote.
18 July 2026
Observability isn't the same thing as logging.
Logging tells you what a system said about itself. Observability is being able to ask a question you didn't anticipate and get an answer from data you already collected. Most "observability" platforms are just log aggregation with a search bar, and most incidents I've worked involved someone realizing, mid-fire, that the question they needed to ask had no corresponding field. You don't find that gap by writing more logs. You find it by trying to answer questions you haven't asked yet, before you need to.
30 June 2026
The cloud didn't remove infrastructure. It abstracted it.
"Serverless" and "managed" are marketing words for "someone else owns the failure modes you used to own, and you no longer get to see them." That's a fine trade a lot of the time. But teams that stop thinking about infrastructure because the cloud provider is "handling it" are usually the same teams surprised by a cold start, a throttling limit, or a regional outage they had no runbook for. Abstraction moves the complexity. It doesn't delete it.
22 May 2026
The problem with calling everything "best practice".
"Best practice" is a phrase that ends conversations instead of starting them. It's shorthand for "someone smart, somewhere, in a context I haven't checked, did this and it worked." That's not nothing, but it's not a substitute for asking whether the same trade-offs apply here. Most of the infrastructure decisions I've regretted weren't wrong on their merits. They were right for a company at a different scale, with a different threat model, doing a different thing.
11 April 2026
Prevention and detection answer different questions.
Prevention answers: did this happen? Detection answers: is this happening, and what does it look like when it does? Teams that only invest in prevention can tell you an attack was stopped, but not what the attack tried to do, how many times, or from where. That's a strange kind of blindness to be comfortable with: it treats the absence of a bad outcome as the absence of useful information, when it's often the opposite.