Archive
1046 posts · Page 35 of 88. ← Blog
A reasoning model thinks harder on its own — but you can spend test-time compute on top of any model, reasoning or not, to squeeze out more accuracy. Generate many answers and vote. Generate many and pick the best with a verifier. Search a tree of reasoning steps, pruning the bad branches. These techniques share one shape — do more work at inference, then choose well — and understanding them turns test-time compute from a model property into a toolkit you control.
A reasoning model thinks harder on its own — but you can spend test-time compute on top of any model to squeeze out more accuracy. Generate many answers and vote. Generate many and pick the best with a verifier. Search a tree of reasoning steps. These techniques share one shape: do more work, then choose well.
An agentic coding tool that lives in your terminal, reads and edits your real codebase, runs commands, and works through multi-step tasks — not an autocomplete, but a collaborator you delegate to.
The opener to a Claude Code series: what an agentic, terminal-native coding tool actually is — it takes a goal and executes multi-step work on your real codebase, with permissions keeping you in control — and the mental model that makes it click.
Part software engineer, part consultant, part product manager — the forward deployed engineer works inside the customer's world to turn a hard problem into working software, then carries what they learn back to the product.
The opener to a forward deployed engineering series: the FDE role as a blend of engineer, consultant, and product manager — embedded at the customer, building real software against a vague problem, then carrying the learnings back to the product.
The opening post of a hands-on series for builders: what it means to systematically stress-test an AI system — model, prompts, retrieval, tools, and guardrails — to surface its failures before adversaries or ordinary users do, how that differs from pentesting and robustness testing, and the frameworks and ethics that keep the work rigorous.
The opener to a defensive AI red-teaming series: stress-testing AI systems (models + prompts + RAG + tools + guardrails) to find failures before adversaries do — how it differs from pentesting, the frameworks (OWASP GenAI, MITRE ATLAS, NIST AI 100-2), and ethical rules of engagement.
The opening post of "The Software Architect's Path" — demystifying the role by separating what architecture actually is (the decisions that are hard to reverse) from day-to-day coding, and arguing for the hands-on architect over the ivory-tower one.
The opener to an architect series: what architecture actually is (the significant, hard-to-change decisions), the architect's real responsibilities, the hands-on architect-who-codes model vs the ivory tower, and the myths worth discarding.
The first post in a practical series on code review — what the practice is actually for, what it is not, and why treating it as a collaboration rather than a gate is what makes it worth the time it costs.
The opener to a code-review series: what review is actually for — catching defects early, better design, knowledge sharing, collective ownership — and what it isn't (gatekeeping, style bikeshedding), plus the healthy team norms that make it work.
The opening post of a DevSecOps series — how security stops being a gate at the end of delivery and becomes an automated, shared responsibility built into every stage of the pipeline.
The opener to a DevSecOps series: building security into the delivery lifecycle instead of bolting it on — shift-left (and shift-right), security as everyone's job, the CI/CD pipeline as the enforcement point, and the automated controls the series wires up.
Why APIs became the primary attack surface, how API risk differs from classic web-app risk, and the OWASP API Security Top 10 framework this series builds on.
The opener to an API security series: why APIs are the primary attack surface, the OWASP API Security Top 10 (BOLA, broken auth, BFLA, SSRF, misconfiguration, inventory…), how API security differs from web-app security, and how to threat-model an API.
The opening post of a series on designing APIs people actually enjoy using — why an API is a contract and a product, the qualities that separate a good one from a bad one, and why the contract should exist before a single line of implementation.
The opener to an API design series: an API is a contract and a product whose users are developers — the qualities that matter (consistency, evolvability, hard-to-misuse), API-first vs code-first, the interface/implementation boundary, and the paradigms you'll weigh.
A repeatable method for designing systems and acing the design interview — clarify requirements, estimate on the back of an envelope, pin down the API and data model, then work high-level to deep-dive to bottleneck, always naming the trade-off.
The opener to a system-design series: a repeatable method rather than a grab-bag of components — clarifying functional vs non-functional requirements, back-of-the-envelope estimation with the latency numbers every engineer should know, and the trade-off-driven design flow.
Turning the four functions of the NIST AI Risk Management Framework — GOVERN, MAP, MEASURE, MANAGE — into something an engineering team can actually run: a risk taxonomy for LLM apps, a versioned risk register in code, and the eval hooks that keep MEASURE honest.
Make the NIST AI Risk Management Framework actionable: the Govern/Map/Measure/Manage functions in your own words, a risk taxonomy for LLM apps, and a versioned risk register (YAML/Python) capturing per-use-case risks, likelihood/impact, mitigations, and owners.
Why LLM and agent applications open a genuinely new attack surface, the mental models to reason about it (OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF), and how to threat-model an AI system before you write a line of defensive code.
The opener to a series on securing LLM and agent systems: why AI apps have a new attack surface (instructions and data share one channel, tools grant real power), the OWASP Top 10 for LLM Applications, MITRE ATLAS, and how to threat-model an AI system.