Weeknotes no.4 – the art of saying no 🛑

2026-07-19

this week i attended käpsele innovation festival here in freiburg. käpsele is a word from south-western germany for a clever person, someone with a smart mind. apart from the self-realization of most panelists that germany is over-engineering the future with compliance, research, and paperwork, and therefore hindering progress, one interesting learning was the growing number of businesses running on outdated systems. those weird linux and windows machines that were once set up with some legacy corporate software by external providers, that probably no longer exist. it’s the “never touch a running system” mentality that’s becoming a growing cybersecurity concern. one might argue that “always touch a running system” could be a better approach.

in our engineering principles (which are long overdue for a rewrite) at work we once wrote:

All of our projects and services must be actively maintained (dependency and platform updates as well as security and CVE fixes) or need to be reevaluated and eventually turned off.

dead code is dangerous code. if you don’t know what you have running in production, how are you supposed to protect it? and similarly if you don’t touch or update it, how are you supposed to patch it?

in an era, where everyone can vibe-code themselves hyper-specific personal (web) apps, this is gonna create such a lovely avalanche of problems and security holes.

developers and engineers will need to learn the art of saying NO to slop feature requests, vibe coded apps, and other stuff that folks will come up with.

i am not per se against ai-written code; i am a heavy user and tinkerer myself. however, speed and inexperience shouldn’t outweigh quality and security.

if you don’t know what you’re doing, don’t do it.
if you don’t know what you’re running, don’t run it.
if you don’t know what you’re building, don’t build it.

🙏🏼

links, tools, and articles

• on a similar note i found this lovely article about the dissonance of LLM usage and the resulting flood of PRs from agents: The LLM Critics Are Right. I Use LLMs Anyway.
• i discovered radar on github, which looks like a nice more interactive k9s alternative
• spent some time optimizing my local terminal setup
  • a simple fix means it now starts up wayyyy faster
  • loving the use of herdr along with pi
  • the moshi app also works so well with both of them
    • to make the SSH process a bit more secure i also set up a key on my yubikey
• mozilla published the state of open source website
  • key learning: the competitive frontier has shifted to the “agentic harness”: – value is moving up from model weights to the orchestration, memory, and write-permission layers that sit above the model
• interesting article and stats: SQLite Is All You Need
• tiles seems like an interesting concept connecting local llms with at proto: Own your AI with local models and open protocols
• @kepano posted an interesting graphic adapting the pace layers idea to modern software

FYI, the rss feed to this blog now also serves the full article (just like the at proto/standard.site entry).