Writing

The fears people raise about AI chatbots, which ones are real, which mostly aren't, and how I build one so the real ones can't do much damage.

Usually not first. What a pen test actually is, when a contract or your own web app genuinely needs one, and what my read-only audit does instead.

Yes, a working demo, often in an afternoon. What the AI builders' own documentation says stays your job, and where a paid build still earns its fee.

The error page usually says where it broke. What each message means, the two-minute checks to run first, and why a lapsed domain is the one to fear.

An unmanaged VPS makes everything above the hardware your job, backups included. What the hosts' own documents say, and what to ask before paying for managed.

You get two working days to fix a failed answer before you pay again. What fails small businesses since April 2026, and what to check before you apply.

The browser warning is rarely a hack. Four usual causes, how to tell which one you have in two minutes, and why certificates now expire far more often.

Two different questions get asked in the same words. A box in the office is nearly always the wrong answer now. A server somewhere else is a different matter.

Most small businesses run something important on a spreadsheet. Here is the point where it stops working, what a build costs, and when I say don't.

Forty questions from somebody's procurement team. Which ones an audit can answer with evidence, which need a document, and why "no" is the safe answer.

Most sites I look after were built by somebody else. What I need before I can say yes, what I check first, and when I say it is not worth keeping.

Before I harden anything, I find out what is on the box. The commands I run first, the three piles it all falls into, and why the file on disk lies.

My security audit is read-only on purpose. What that constraint buys you, what it costs me, and the four things a Windows machine will not tell anybody.

Website maintenance is the vaguest phrase in this industry. Here is every line of what I charge for, what each one means, and the four things it does not include.

I built a nightly backup for every app on my server. The backup was the easy part. Finding out what had never been in one took the rest of the day.

Google Play stopped accepting updates to one of my apps on 31 August. I found out on 8 September, from a line of grey text under a heading I had scrolled past twice.

I moved a server to a different switch. It vanished, and the three tools I reached for to find out why all reported success while telling me nothing true.

My own audit said one of six sites had no security headers. It had them all along, and the fix I was about to write would have skipped the pages that matter.

A red banner said the nightly backups were failing. They were not. I wrote the wrong conclusion down first, and the things worth fixing were not in it.

It applied every security update it was given and booted into none of them. Three Important kernel advisories sat installed while everything reported green.

Two client companies, one portal, and a database file each instead of a tenant_id column. The bill arrives at the seams, and it is worth paying.

Making a local assistant useful in a regulated field. Four prompt attempts that failed on measurement, one in five citations invented, and two gates in code.

A local model 3.5x faster than the setup it would replace. Then it obeyed an instruction hidden in a text file, eight runs out of eight, silently.

My assistant kept 97 notes about my work and swore it had never heard of any of it. The store was keyed by working directory, and I started elsewhere.

It reads your files, watches your systems and writes you a briefing every morning. On hardware you own, with nothing open to the internet.

A UI rewrite deleted one status element. The startup code that wrote to it still ran first, threw immediately, and the app never said a word about it.

Nobody got in. I still didn't like what a month of authentication logs on the server I administer had to say, and the fix that mattered took about four minutes.

One flag guarded both "can see every client" and "can create logins". Splitting it into two questions took an afternoon. Noticing it took a year.

Looking for the record is not the same as reading it. A substring match gave a green tick to `+all` and to `p=none`. Record present, protection absent.

An endpoint that worked fine in testing started returning 502s in production. The response was a quarter of a gigabyte, and most of it was photographs.

The rule came from breaking a working config with no way back. It costs three lines and it has saved me more times than I would like to admit in public.