Jack Poller, NetFoundry’s VP Product Marketing, kicked off a six-part microsegmentation series with the gap that nobody in the space likes to say out loud.

An Omdia survey of 352 security decision-makers found that:

• 99% of organizations are implementing or planning microsegmentation, and
• only 9% had protected more than 80% of their critical systems.

Half of them had been through a lateral-movement attack in the previous year, which is the exact thing microsegmentation is supposed to stop.

Here’s the article: The Microsegmentation Trap: Why 99% Are Planning It and Only 9% Protect Their Critical Systems.

Jack argues that the conventional playbook is the problem: Discover every flow, model the policy for the whole environment, simulate, then enforce. Each phase gates the next, and phase one never finishes because reality collides with your best laid plans:

• Applications talk to more things than anyone documented and
• dependencies shift while you’re charting them.

In the end, your initiative languishes in discovery for quarters and the crown jewels stay exactly as exposed as they were on day one.

The proposed fix? Turn the order upside down! Protect the single most critical asset first, one workload at a time, starting now.

Of course, this approach works only if enforcement stops depending on network location. As long as policy is based on IP ranges and zones, you’re back to needing the full topology before you can trust a rule. If you base policy on cryptographic identity, you can wrap one asset in tight policy today without having mapped what’s around it.

Once again, Jack’s article is here: The Microsegmentation Trap: Why 99% Are Planning It and Only 9% Protect Their Critical Systems.

The post 99% of orgs are PLANNING microsegmentation, but only 9% have followed through appeared first on Global Nerdy.

I’m just sayin’: if you’re trying to promote AI as a beneficial thing, maybe the whole Terminator 2 motif is something you might want to avoid. Those AIs, Arnie’s T-800 excluded, were not our friends!

In the meantime, let’s enjoy the classic line from that film:

The post How NOT to promote an AI initiative appeared first on Global Nerdy.

• John F. Kennedy Center for the Performing Arts, often called “The Kennedy Center”
• The U.S. Institute of Peace
• The Department of War
• Palm Beach International Airport
• TrumpRx, a prescription drug website
• Passes for national parks
• Trump Accounts
• Renaming the Gulf of Mexico and Lake Ontario
• Trump-class battleships and F-47 fighter plane

…and the list goes on.

And now the idiocy meaningless renaming has come to tech:

The executive order, titled INAUGURATING THE ERA OF SUPER INTELLIGENCE, basically declares that “AI”, a term that we’ve been using since 1955 when John McCarthy coined it, should now be referred to as “Super Intelligence” or “SI” in executive-branch communications.

It says that agencies of the federal executive branch must use the new terms in official correspondence, public communications, websites, reports, policy documents and other non-statutory documents. Thankfully (because it would mean a lot of pointless work otherwise), existing regulations, presidential actions, contracts, grants and historical documents don’t have to be changed.

It also means that any content I make aimed at a U.S. government buyers or techies (especially tutorials, presentations, and documentation) will need to include the “SI” terms for both practical (for example, search terms) and political (“We call it ‘SI’ here, son.”). I’m already not looking forward to this.

For now, “SI” means exactly what “artificial intelligence” already means under 15 U.S.C. § 9401(3).; only the name has changed.

Sometime in the next 60 days, Michael Kratsios, the Director of the White House Office of Science and Technology Policy (OSTP), will have to propose legislative language for a federal definition of SI. It’ll have to say whether that definition should modify or replace the statutory definition of AI, and include any conforming amendments and follow-on executive actions. If such changes are made, expect them to be dumb.

Unsurprisingly, it didn’t take long for the first kiss-ass to use the term in Trump’s presence:

The post Trump’s executive order to rebrand “AI” as “SI” appeared first on Global Nerdy.

Last Friday, NetFoundry’s CEO Galeal Zino appeared on the weekly live YouTube show Super Cyber Friday, hosted by tech journalist David Spark.

Super Cyber Friday is about cybersecurity practitioners and vendors, and every episode has a title that follows a “Hacking [Topic]” format. This particular episode’s title is Hacking Microsegmentation for Machine Workloads, and features:

• Galeal Zino, NetFoundry CEO (and my boss’ boss, and therefore the best damned skip-level in the world)
• Howard Holton, Founder and Principal Counsel at Phronia Counsel, an independent technology analyst and advisory firm

If you’re wondering what microsegmentation is, here’s the short version:

Microsegmentation is the practice of carving your network into tiny zones so that when something gets compromised (and something will), the damage stays in one small room instead of spreading through the whole house.

Everyone agrees it’s a good idea, almost nobody enjoys doing it, and few actually do it. It’s the brushing and flossing of cybersecurity.

Before the notes, some disclosure

You should know:

• I do developer advocacy work at NetFoundry in exchange for money, health insurance, and to convince people I’m more than just an accordion-playing reprobate.
• Once again, Galeal is my boss’s boss. And he’s a great boss’ boss!
• NetFoundry sponsored this episode.

Feel free to apply the appropriate amount of skepticism to this writeup, but keep in mind that this episode features both a CEO who builds security stuff with an analyst who’s had to live with the results. The episode’s a little more blunt than your typical PR piece.

The tl;dr

C’mon, this article isn’t that long! But still, if you want a very quick summary, here it is…

“Early microsegmentation sucked so bad…”

Howard set the tone in the first minute, when David asked for his microsegmentation pet peeve (0:08):

“Early microsegmentation sucked so bad that it’s hard to get people to listen when you talk about microsegmentation.”

For the record, Howard is a big microsegmentation fan. What drives him (and us at NetFoundry too) up the wall is the feedback he hears most often: “Nope, we did that before, we’re not doing it again.” People tell him it was too complicated and a waste of money. He hates that feedback because, in his words, “it’s just wrong.”

Later in the show (7:25), he explained how early rollouts earned that reputation. Teams would get frustrated during the discovery stage, put some segments in place, and then cause an outage by blocking something that only ran once every 30 days and that nobody had planned for. After that happened a few times, they’d shelf whatever microsegmentation tool they were using. His summary: “Complexity always bites you in the ass.”

If you’ve ever been anywhere near a rollout like that, you probably just winced. The problem wasn’t the idea. Least privilege and blast-radius reduction are good ideas! The problem was that vendors tried to implement them with the tools that just happened to be conveniently lying around: IP addresses, subnets, VLANs, and firewalls.

When an audience member asked whether application-level or network-level microsegmentation is more effective, Galeal didn’t mince words (9:05):

“Network-level is DOA: dead on arrival. It’s an oxymoron to begin with… It’s spilled milk, and you can’t put it back in the bottle. If you’re going to try and use IP addresses, VLANs, and firewalls to do ‘microseg,’ good luck to you. It’s not going to happen.”

That’s coming from someone who’s been doing network engineering for 30 years. Here’s the core problem, especially for machines: an IP address tells you where something is, not what it is. In a world of containers, autoscaling, and serverless functions, the IP address your billing service has this morning might belong to something completely different by the time lunch rolls around. Writing security policy against IP addresses is like keeping track of your friends by remembering which seats they sat in the last time you all went to the movies. Or, as Galeal put it later in the show (35:10), “IP addresses are not identities.”

Howard then described what happens when you try to brute-force it anyway (10:03):

“Microsegmentation and segmentation are not the same thing… If you’re like, ‘Well, I’m going to create 437 subnets in my network and I’m going to create 300 VLANs and I’m going to turn on host-based firewalls,’ you’ve just created a nightmare that no one is ever going to be able to manage after you. And you have failed job number one, which is make sure that the next person can be as successful as you are.”

“Make sure that the next person can be as successful as you are.” I want that on a poster, and not just for network engineers. It applies to code, documentation, and pretty much anything you build that someone else will inherit.

And if you try to do it the classic way regardless, making your firewalls enforce all that traffic between your services? According to Galeal (29:48), that’s the first lesson you’ll learn: “You will melt your firewalls.”

Credentials aren’t identity

My favorite moment in the episode came from an audience question. Sierra Montgomery asked (11:05):

“If a compromised workload acquires valid credentials and begins behaving like a legitimate service, what signal does your microsegmentation architecture use to distinguish legitimate machine-to-machine communication from lateral movement?”

Galeal’s answer was one word: Attestation. His reasoning: a credential doesn’t prove whether Howard, David, or an AI agent should have it. Credentials, he said, are “necessary but not sufficient.”

Explaining bearer tokens is something that goes back to my first article for Auth0, which was also my “take-home assignment” in the job interview process. The concept always needed the most careful explaining, even though the name told you everything: whoever bears the token gets the access. The token doesn’t know or care who’s holding it. It’s more like cash than a credit card.

That’s fine as long as you know where the token is. The trouble starts when you don’t. A credential proves that something possesses a secret. It doesn’t prove that the thing should have that secret, and it says nothing about whether the machine presenting it is in the state it’s supposed to be in. Attestation fills that gap: it’s verifiable evidence that the workload is what it claims to be, and that it’s running where and how it’s supposed to.

Take the pwning like a champ

At a DEF CON party a long time ago, a few friends and I came up with a joke talk title for the following year’s edition of the conference: “Security is for lightweights. Take the pwning like a champ.”

But behind the joke was an important idea: every boxer gets hit. What makes a champ isn’t never getting punched; it’s being able to take the punch and stay on your feet. Security works the same way. Sooner or later, one of your credentials is going to end up in the wrong hands, whether it’s through a phished password, a leaked API key, or a token that got copied out of a log file. Back then, planning on getting pwned was a punchline. These days, it’s a design principle, and it’s exactly where Galeal starts.

The DEF CON joke came to my mind when an audience member asked how a platform can alert on a compromised token moving laterally (16:06). Galeal’s answer was in the spirit of “Take the pwning like a champ”: Assume that tokens will be compromised, and design your system so that a token by itself doesn’t grant access.

If your architecture opens the door and grants network reachability before it verifies identity, an ill-gotten token can be a starting point to explore your network. The “Take the pwning like a champ” approach that NetFoundry takes verifies identity first and uses policies to spells out which identities can talk to which services. A stolen token doesn’t open any new doors, because the path the attacker wants isn’t accessible to them.

AI agents are chaos monkeys nobody scheduled

History time! If you were a developer around the time the iPad came out, you might remember Chaos Monkey, Netflix’s tool designed to randomly shut down servers in production. The idea behind it could be summarized as “The random shutdowns will continue until resiliency improves”. Netflix’s dev teams were forced to build in such a way that their systems would survive failure. It’s a brilliant (if sadistic) idea, and it works because Netflix chose to unleash it deliberately, with rules.

This isn’t all too different from a pattern Galeal described (28:56): taking an AI agent and saying, “Hey, cool. Here’s some API keys. Here’s the internet. Here’s some enterprise resources. Go do something useful.”

Howard’s response: “I see that like 40 times a week.” That’s a chaos monkey too, except nobody scheduled it, nobody wrote the rules, and it will explain its reasoning very confidently afterward.

My last job prior to my current Developer Advocate gig at NetFoundry was optimizing an MCP server, so this isn’t a hand-wavey “some customer has this issue” thing to me. Every tool or function you expose through an MCP server is something an agent can decide to call, whenever it wants, for reasons you didn’t anticipate. Its network traffic doesn’t follow a script.

When an audience member asked how to segment an AI agent whose needed connections change with each task, Howard’s advice was (27:27):

“If you try to design something that is entirely flexible, what you’re going to end up with is opening yourself up for AI chaos in your network… If you do it the other way around and hope that your microsegmentation tool set is going to keep up with your AI, you’re basically saying, ‘I want microseg to follow my chaos monkey.’ Do it the other way around. Use microsegmentation to restrict the chaos monkey.”

Galeal’s answer to the same question (26:43) supplies the other half: The old bag of tricks isn’t going to work on agentic flows. Treat agents as identities, define a graph of what each one can talk to and under what conditions, and have the visibility and enforcement to make sure they stay on that graph.

That’s the right mental model. An AI agent isn’t a human employee sitting behind your SSO portal, and it isn’t a cron job that does the same thing at the same time every night. It’s a whole new thing.

As Howard put it later in the show, it isn’t another application, and it doesn’t act like a human either. It needs boundaries defined up front, including things like:

• A specific identity,
• ashort list of things it’s allowed to reach, and i
• solation that travels with it whether it’s running in AWS, on bare metal, or in an OT facility.

What this looks like if you write code

Time for me to put my work hat on for a minute. The table above mentions “an identity-driven overlay” enforced “inside the application,” which is a mouthful, so here’s what it means in practice.

OpenZiti is the open source zero trust networking platform that NetFoundry builds, and one of the things it lets you do is embed zero trust directly into your application with an SDK. Your app gets its own cryptographic identity, and it can only reach the services that policy says it’s allowed to reach. On the other side, services don’t need open inbound ports at all, so there’s nothing sitting on the network for an attacker to scan, probe, or point a stolen token at.

Galeal’s “kill switch” (more on that below) gets pretty concrete here too: if an identity is compromised, you revoke it or change the policy, and its paths go away. No firewall surgery required.

If you want to try it yourself, the docs and quickstarts are at openziti.io.

What do you tell the board?

Near the end, David read an audience question: Which metric best shows leadership that microsegmentation is working? Galeal boiled his answer down to three questions (39:11):

1. The graph: Can you answer the question “What identity can talk to what identity, according to what policy?” (Note that he said identity, not IP address.)
2. The kill switch: When something unexpected happens, where’s the kill switch that lets you deal with it without compromising uptime, human safety, or business continuity?
3. Centralized governance: How much of all this can you see and govern from one place, instead of going to a bunch of different environments and firewalls?

Then Howard put on his gloves (41:27): “I couldn’t disagree more.” Speaking as a CISO, he said:

“What my board said 10, 15 years ago was, ‘We better never get hacked.’… Today they say, ‘How bad will it be?’ That is their question to me. That is the question they want me to answer in every board meeting they invite me to.”

My answer would be “Take the pwning like a champ”.

David pointed out that the two answers aren’t really in conflict: Galeal was describing what you measure for yourself and your security team, and Howard was describing what you tell the board. Galeal agreed. Howard then explained why the board version has to be so compressed (43:29):

“I get one slide as a CISO… I get like five minutes… I make that one slide tell them how I’m spending money to make it less bad than the last time they gave me money.”

Ah, the dreaded “You get one, and only one, slide” directive for board meeting presentations. Replace “board” with “VP of Engineering” or “whoever approves your budget,” and it’s still excellent advice.

My takeaway

If I had to boil the whole episode down to one idea, it wouldn’t be about AI, firewalls, or attestation. It would be Howard’s “job number one”: make sure the next person can be as successful as you are.

Galeal landed in the same place from a different direction. When David asked why he started NetFoundry (24:00), he said that after years of beating his head against walls like microsegmentation, he wanted to tilt the playing field so that the next person who has to solve these problems doesn’t have to.

That’s the real case against building microsegmentation out of subnets and VLANs. Even if you get it working, you’ve built something nobody else can understand, let alone maintain.

A policy that says “the billing service can talk to the orders database, and the AI agent can talk to these three APIs and nothing else” is something the next person can read, reason about, and change without breaking everything. And when some of the things doing the talking are AI agents that nobody can fully predict, that kind of clarity is what keeps the chaos monkey in its cage.

Go watch the episode, and if you’re a developer who wants to see what identity-first networking looks like from the inside, take OpenZiti for a test drive!

The post Super Cyber Friday: “Hacking Microsegmentation for Machine Workloads” (or: Stop Trying to Treat AI Agents Like 1998 VLANs) appeared first on Global Nerdy.

You can also use the text below when explaining the concepts; feel free to “copy, paste, and adjust to taste”:

North-south crosses the boundary of your environment. A browser hitting your web tier, an API call from outside, your service calling a third party. Up and down the diagram, in and out.

East-west stays inside. Web tier to app tier, app tier to database, service to service, pod to pod. Sideways across the diagram, and it typically never touches your perimeter controls at all.

The entire traditional security stack is pointed at north-south. Firewall, WAF, load balancer, the DMZ, the VPN concentrator, most of the alerting.

East-west traditionally get an implicit pass, because it’s inside, and inside was assumed to be fine. If this were true, we wouldn’t have expressions like “It was an inside job!”

An attacker who phishes a laptop or pops a container has already cleared every north-south control. From that point on they’re moving east-west, which is the direction that typically has the least in the way. The initial breach is usually small. The blast radius is what turns it into an incident, and the blast radius is all east-west.

That’s the gap microsegmentation exists to close: putting authorization on the connections between your own workloads, not just on the ones crossing your perimeter.

The post North/south vs. east/west (or: Where the security budget goes vs. where the attacker *actually* moves) appeared first on Global Nerdy.

you sent a message, but it can’t be qualified at this time for offensiveness

There’s a hate-speech classifier on the path every message takes, and it’s been waiting for a classifier to talk to. On the September 18 Ziti TV episode, I got curious about it and went down the “How do I get this thing to work?” rabbit hole. It turned out to be a nice tour of how OpenZiti authorization actually works!

Here’s the fun part. The first thing you notice is that the classifier URL has no instance prefix, while every other service name in the demo is scoped. That looked like the answer, but it wasn’t.Prepare tags the Appetizer’s own identity with an unprefixed classifier-clients attribute, deliberately, in a file where everything else goes through scopedName. The dial side was built with one shared classifier in mind rather than one per instance. The URL is right as written.

What’s left to build is the network side: the service and a dial policy. The application was always correct, and it’s been accurately reporting that it couldn’t reach something that wasn’t there yet.

In the end, the fix was a service and two policies, and (yay!) no changes to the code at all.

I’ve posted a preliminary (but complete) walkthrough as a repo here. It’ll be posted in a more official place (that is, a NetFoundry page) as an article and supporting scripts and files in the OpenZiti Test Kitchen on GitHub.

In the exercise, you add a real classifier (a RoBERTa model fine-tuned on OffensEval tweets) and host it as a dark service. By the end you have two processes talking by service name, with ss -ltn showing nothing listening inside the classifier container while the controller shows it actively hosting. Then you take access away with one policy change and watch the caller get “not found” for a service that’s running perfectly well three feet away.

The exercise shouldn’t take longer than a half hour, and it all runs in Docker containers, which means you don’t need Python, Go, or even the ziti CLI installed locally. I wrote it for people new to OpenZiti, with the diagnosis reasoning spelled out rather than just the commands, since that part transfers to debugging your own dials.

A few things I’d have liked to know going in, which I haven’t seen written down elsewhere:

• Flask’s built-in dev server can’t host a ziti service. The bind succeeds and a terminator registers, but it never accepts. werkzeug polls the listening fd through selectors, and a ziti fd isn’t pollable that way. Callers see EOF and the Python side logs nothing. waitress works, and it’s what the SDK’s own Flask sample uses.
• The SDK enumerates services at startup and doesn’t re-check per dial, so a service created after your process starts stays invisible until it refreshes.

Thanks to Clint for the Appetizer, which is a genuinely good teaching demo, and for co-hosting the episode this came from.

This is the first in a series! I’m turning Ziti TV episodes into standalone repos people can work through on their own. Episodes: https://www.youtube.com/@OpenZiti/streams

Issues and PRs welcome, especially if you hit something the troubleshooting section misses. Help make it better!

Once again, the repo is here: https://github.com/AccordionGuy/openziti-appetizer-classifier

The post The first in a new walkthrough series: Add a working classifier to the Appetizer and host it as a dark service! appeared first on Global Nerdy.

If David Heinemeier Hansson’s opening keynote at Rails World 2026 felt like “the most confusing funeral I’ve ever experienced,” Aaron Patterson’s closing keynote was the raucous Irish wake that brought the corpse back to life, handed it a pint, and told everyone to get back to their laptops once they’ve sobered up.

The tl;dr table

To appreciate how thoroughly Aaron answered DHH, lI put together a table comparing the two keynotes:

A tale of two keynotes

“Your AI has not made this promise to you.

There is no ‘As-If Rule’ for your English.

I am not going to concede my destiny to AI.

I’m going to keep reading my code, and I hope that you will too.

Get in loser, we’re going programming.”

— Aaron Patterson (@tenderlove), Rails World 2026 Closing Keynote

The contrast between the two bookends of Rails World 2026 couldn’t have been more stark. It was a clash of two diametrically opposed philosophies.

The opening keynote gave us an embittered, insulated tech executive treating code as disposable corporate slop…

…and for the closing keynote, we got a loveable systems hacker who reminded us why software craftsmanship mattered in the first place:

The Parody: “Aaron XP” and the curse of the slop grenade

Aaron stepped on stage in Austin and wasted zero time skewering DHH’s opening theatrics.

If you watched the video of DHH’s keynote (remember to turn the volume down a little, he’s still deep in his “Al Pacino yelling” phase), you know about breathless obsession with his Linux distro Omarchy, bragging about driving install times down from three minutes to nine seconds, and treating it like the Second Coming of Computing. I half expected him to borrow the line from Deadpool and Wolverine and declare himself Linux Jesus (and hey, it still might happen).

https://www.youtube.com/shorts/IQc4FVQXkJU

Aaron opened with his own “major announcement”: Not to be outdone, he too had vibe-coded his own Linux distribution, Aaron XP!

“It installs in 100 milliseconds. It’s very important for me to get the install time down because I’m doing that constantly. Wake up in the morning, install my OS. Get some coffee, install my OS. Upgrade Chrome, reinstall the OS… I think it’s ironic to make a joke about the financial crisis and then encourage everybody to generate a whole bunch of Rust code without reading it. I’m going to start selling insurance on technical debt, so come see me afterwards.”

Then came the jab that sent ripples across the room: “slop grenades”.

For anyone tracking the broader industry discourse, the phrase wasn’t just a casual joke; it was a direct nod to Aaron’s ultimate boss (and my former ultimate boss), Shopify CEO Tobi Lütke. A year ago, Lütke made headlines with his sweeping “all-in on AI coding” proclamations, hyping how agentic workflows would supercharge engineering output across Shopify.

Lütke recently took to social media to vent about the grim byproduct of unbridled vibe coding: the “slop grenade”. It’s the result of a developer casually tossing an AI-generated, 2,000-line pull request that took three minutes to generate over the cubicle wall, expecting a human colleague to spend three agonizing hours reviewing it for edge-case horrors.

Aaron leaned right into the irony on stage:

“I know everybody here loves using AI. I do too. I love using AI to make slop grenades, it’s great… But I want to take a poll of the audience here: How many of you like receiving slop grenades?”

In a hall packed with hundreds of engineers, exactly two or three hesitant hands went up in the front row.

The message was undeniable: Generating unchecked tokens is cheap, addictive, and fun for the sender; dealing with the resulting fallout is an asymmetric tax levied on everyone else.

Aaron’s core technical thesis: The “As-If” Rule and why we read code

Where DHH’s talk was a seemingly never-ending, increasingly ranty (and of course, scream-y) collection of Silicon Valley buzzwords, vague analogies about 19th-century Danish portraiture, and unchecked hubris, Aaron gave a masterclass on the mechanics of compilers and runtime semantics.

He grounded his talk in a foundational concept from systems architecture: the “As-If” Rule. In C++ and language runtimes, a compiler is permitted to make any transformation, inline any method, eliminate allocations, or reorder execution, provided that the observable behavior remains strictly identical to the code the programmer wrote.

Aaron walked the audience through the real work being done by the Ruby core and infrastructure teams:

1. Parallel execution with ractors: How Ractor-local garbage collection in Ruby 4.1 eliminates singleton GC bottlenecks by giving each Ractor its own isolated heap.
2. Interpreter inlining: How Ruby 4.0 inlines method initializations into call sites, stripping stack frames to make object allocations 70% faster without even touching a JIT.
3. ZJIT and abstract interpretation: How ZJIT’s high-level intermediate representation (HIR) simulates execution, using algebraic substitution and dead-code elimination to turn a 1,000-allocation Rack loop into just 8 allocations.

Why did this matter? Because of the punchline Aaron delivered at the one-hour mark.

Proponents of vibe coding argue that AI agents are “just another compiler”, and that since you don’t inspect the assembly generated by LLVM or GCC, you shouldn’t care about inspecting the Rust or TypeScript spit out by Claude or GPT.

Aaron obliterated that comparison in two sentences:

“The compiler made a promise to you: the As-If Rule. Whatever it does, the behavior that you can observe matches the code that you wrote. And everything that I showed you in this presentation shows you what it costs to keep that promise.

Your AI has not made this promise to you. There is no As-If Rule for your English.”

There’s no contract when you write ambiguous English prompts into a model, nor is there any mathematical proof of correctness. There’s no guarantee of invariant preservation.

Simply put: Treating code as an opaque black box isn’t high-level visionary leadership; it is reckless abdication.

The real world: When the bots turn against you

Aaron then delivered an astonishing, previously undisclosed case study: the May 2026 RubyGems exploit.

He detailed how automated, AI-driven bots executing the “gem stuffer” attack discovered a Rube Goldberg chain of zero-day vulnerabilities:

• RubyGems webhooked to rubydoc.info.
• rubydoc.info processed YARD documentation inside a networked Docker container.
• YARD executed arbitrary .yardopts configurations, invoking malicious scripts.
• When the RubyGems team began revoking credentials, the bots independently leveraged a 6-year-old cached HTTP authorization vulnerability behind Fastly to sniff valid maintainer keys.

It was a chilling counterweight to DHH’s utopian fantasy. While DHH urged everyone to blindly delegate business infrastructure to autonomous agents, the security engineers at RubyGems were in the trenches defending against autonomous agent swarms exploiting undocumented edge cases.

And who saved the ecosystem? Not English prompts. Human engineers reading raw code, dissecting diffs, and understanding HTTP packet headers.

Reclaiming MINASWAN: Community over ego

Beyond the technical fireworks, Aaron’s keynote reminded everyone why the Ruby community existed long before DHH’s latest crusade.

Earlier in the conference, DHH talked extensively about himself, his great-great-grandfather, his 20-year-old talks, and his personal productivity stats. His talk had a lot of “Me, me, me”. (It made me wonder if he had a obsessed “human printer” assistant like a certain world leader we all know.)

Aaron used his stage time to bring up Mike Dalessio, a quiet, tireless open-source contributor who has maintained Nokogiri, SQLite3, and Ruby security for two decades. He announced Dalessio’s appointment as the newest member of the Rails Core Team.

It was an intentional, emotional tribute to the values of MINASWAN (“Matz is nice and so we are nice”). It centered the workers, the maintainers, and the collaborative joy of open source.

Early reactions in the comments

As I write this article (Sunday, September 27, 2026, 11:34 p.m. EDT), the video has been up only 4 hours.

The overwhelming sentiment in the comments was one of profound relief mixed with lingering exasperation over the conference’s rocky start.

My favorite was one commenter wry sobriquet for Aaron’s keynote, “Damage control: the talk”.

Another vented about the financial reality of attending: “Ah, good to see a technical talk about Rails in the last day, in the last keynote of this $700 USD event.”

Longtime fans who felt burned by Thursday morning’s eulogy found their footing again, with viewers praising Aaron for actually delivering on the conference’s namesake: “If I want to see talks about AI, I’ll watch talks about AI. I watched Rails World, expecting talks about Rails and its future.”

A few lone voices dismissed Aaron’s plea to keep reading code as an unsustainable luxury that businesses will soon steamroll in pursuit of pure feature velocity. Others immediately countered with the hard reality of accumulated tech debt: companies can afford not to care about code quality until the unreadable slop starts breaking production and costing them customers.

For a community nursing collective whiplash, Aaron’s keynote proved that the heart of Rails is still very much beating, even if its original architect was eager to call time of death.

The verdict: Don’t concede your destiny

DHH opened Rails World 2026 by declaring that the era of human programmers writing code is dead, telling an anxious room of working engineers that caution is for “fucking losers.”

Aaron Patterson closed Rails World 2026 by showing that the people actually building Ruby’s compilers, runtime, and security infrastructure haven’t quit. They’re making the language faster, safer, and more concurrent than it has ever been.

You don’t have to swallow the black pill of defeatist obsolescence, nor do you have to swallow DHH’s white pill of corporate gaslighting and throwaway slop.

As Aaron proved, there is a third way: Remain curious, keep mastering your tools, understand the abstractions beneath your feet, and refuse to surrender your agency.

Get in, loser. We’re going programming.

The post Aaron Patterson’s closing keynote (and antidote to the DHH funeral) at Rails World 2026: “Get in loser, we’re going programming” appeared first on Global Nerdy.

The best one-line summary of David Heinemeier Hansson’s (DHH) keynote at Rails World 2026 was Stefan Lindbohm’s comment on its YouTube video:

“This is the most confusing funeral I’ve ever experienced”

This was the flagship keynote for the framework’s premier gathering, and it felt less like an affirmation of Rails’ future and more like an intellectual abandonment of its foundational craft, delivered by a creator increasingly insulated from the core community that used, supported, and helped build Rails alongside him.

(And DHH also did it so LOUDLY. I can’t be the only one who’s noticed that late-career DHH is a lot like late-career Al Pacino, who seems to think that the most effective way to get a message across is by YELLING.)

The keynote cannot be understood as an isolated technology talk. It set up a lawnchair right on the crossroads of two growing crises:

1. The existential disruption of generative AI on software as craft, and
2. A deep, multi-year revolt within the Ruby ecosystem against DHH’s personal politics, power concentration, cultural alienation, and let’s face it: he’s become yet another techno-dick.

Abandoned by its own creator

In his hour on stage, DHH barely mentioned the technology the audience had gathered to celebrate. In fact, an AI transcript analysis by a commenter revealed  that the word “Ruby” was spoken just 11 times throughout the entire presentation.

Instead, DHH unveiled a series of radical repudiations of the doctrines he spent two decades embedding into software canon:

“Pencils Down” on manual code. DHH announced that 37signals has banned hand-written code as standard operating procedure. Hand-writing code is now treated as a failure state. He also declared, “I have retired from being a professional programmer,” and that English is now his favorite programming language. He said that in the past year, only ~3% of the code he produced was Ruby. This. could be a hard pill to swallow for a community that had a tenet called “Exalt beautiful code”.

Ditching the web app. For 20 years, DHH championed server-rendered web applications, HTML over the wire, and the “Majestic Monolith”. At the keynote, he announced that 37signals’ flagship email client, HEY, is abandoning the web app model entirely. Armed with agentic code generators, a small team was tasked with pumping out six native desktop and mobile applications simultaneously.

Black-box Rust backends. Admitting he despises Rust (“like pouring acid in my eyes”, “inhumane to ask people of flesh and blood to subject their eyeballs to”), DHH celebrated outsourcing the entire HEY backend to AI agents writing Rust. His justification was rooted in total detachment: he never has to read or maintain it. It functions purely as an opaque black box.

The “loser” ultimatum. Dismissing concerns over job displacement, intellectual property theft, or code maintainability, DHH commanded the room to “take the white pill” and embrace extreme acceleration (the 2026 version of “move fast and break things”). His parting assessment for anyone feeling cautious or skeptical about turning software development into black-box agent orchestration: “The black pill is for fucking losers. Don’t be a loser.”

(The most extreme example: that two-hour unedited Primeagen interview with DHH from 2024. Caffeinated baboons would’ve been less noisy.)

Alienating the audience

To understand why this keynote felt less like bold leadership and more like a betrayal, you have to look at the cultural fracture that preceded it.

In a poignant, widely read November 2025 reflection, In Praise of DHH, long-time developer (and my friend) Filipa MV captured the tragic arc of DHH’s relationship with the community:

“Prologue. I never met him, but I liked him. He was cool. He could be arrogant, and brash. He was maybe a little too self-satisfied. But on the whole I would say he was someone I admired, someone I looked up to. He was a role model. David Heinemeier Hansson (aka dhh), indirectly, through the creation of Ruby on Rails and the community that sprung up around it, had a big impact on my life… Rails was the connective tissue that threaded together many meaningful friendships of mine.”

As Filipa noted, many in the community historically tolerated DHH’s arrogance because of his undeniable taste and track record: “I have always liked David’s technical leadership! I have historically thought that he’s right more often than he’s wrong!”

Yet, as documented across the ecosystem, from Filipa’s essay to David Celis’s The DHH Problem, to Tekin Süleyman’s The Ruby Community Has a DHH Problem, DHH made a JK Rowling-like slide from a brash, opinionated visionary into a reactionary figure engaged in institutional power games:

The culture war shift. In recent years, DHH turned his public channels toward culture-war grievances: railing against DEI, adopting anti-trans talking points, praising far-right British agitators like Tommy Robinson, and describing London’s multicultural demographics as a “nightmare.” For a global community founded on the Ruby ethos of MINASWAN (“Matz is nice and so we are nice“), watching the titular figurehead of Rails embrace xenophobic tropes and exclusion felt like an assault on the community’s foundational spirit.

Power and institutional captivity. When community members and contributors pushed back, they discovered that DHH had architected a structure where he could not be held accountable. Between controlling the Rails trademarks, chairing the Rails Foundation, dominating Rails Core alongside Basecamp and Shopify (who also have a problematic leader), and exerting leverage over events (such as the contentious Ruby Central and RubyGems funding dramas of 2025), DHH built, as Filipa MV observed, “a world where people can’t say no to him.”

The Eeection of the community. When DHH told his Rails World audience not to be “losers,” it confirmed what critics had warned: the empathy was gone. To quote Filipa MV: “He has great technical taste but he is not a good leader… To have him keynote and hold a veto over the community is to say to people like me, and brown-skinned people everywhere, ‘you don’t belong here.’”

“Feel the fucking room, ffs” and the revolt in the comments section

DHH probably intended his keynote to be an exhilarating, Steve Ballmer-style “Oh, what a time to be alive!” rally. The public reception in the conference hall and across the YouTube comment section was characterized by shock, grief, and exhaustion.

The “conference tax” vs. the pitch. Attendees and remote viewers quickly noted the absurdity of paying premium ticket, travel, and lodging fees for a Rails conference only to be told that Rails is an afterthought and programming is dead:

“I attended Euruko a few days ago… Matz talked about tech. I feel sorry for everyone who bought a ticket and ‘has’ to be there to endure the rest of what’s coming.”

“Came here for Rails, got told I’m a loser in the shadows lol.”

“Imagine being a speaker following this talk and having to talk about Rails after DHH dumped it for Rust.”

Wealthy techie vs working techie. Commenters drove home the stark class divide between a multi-millionaire founder playing with unlimited API tokens and everyday developers navigating a brutal tech market and a rising cost of living:

“He’s a multimillionaire talking to a room of people who still need a paycheck for the next 30 years. He has his bag, of course he’s excited. He’s got nothing to lose like the rest of us.”

“The problem is not really that AI will end careers, the problem is that the people who will end it are trying to convince you to be happy about it… Feel the fucking room, ffs.”

The knowledge freeze and architectural decay. For years, DHH and 37signals marketed themselves as the ultimate defenders of digital sovereignty. They led the charge on leaving the public cloud (“Cloud Exit”), crusaded against Apple’s App Store tax, championed self-hosted SQLite, and preached independence from Silicon Valley oligarchs.

Yet at Rails World 2026, that posture inverted entirely:

• From sovereignty to model rent-seeking: The software pipeline was surrendered to centralized model providers like Anthropic and OpenAI. As one commenter observed: “Rails World 2025: End to end freedom. Rails World 2026: Just depend on other companies.”
• From craft to disposable slop: Software is no longer a well-tended garden engineered for human delight and maintainability. It’s now an unread, disposable byproduct generated in mass volume. To cite the work of another techno-dick: We are now the pointy-haired bosses from Dilbert.
• Cannibalizing his own moat: If an email client, a desktop utility, or a SaaS backend can be vibecoded in 20 minutes from plain English prompts, the economic justification for 37signals vanishes. Why pay a monthly SaaS subscription to HEY or Basecamp when an agent can compile a custom personal client directly to native bytecode?

The end of an era

Programming languages and frameworks are like Freddy Kruger or Jason Voorhees; they’re hard to kill and live longer than expected.

Ruby on Rails won’t vanish overnight. Thousands of monoliths power the backbone of global businesses, and Ruby’s and Rails’ expressive designs will always offer genuine joy to developers who care about the craft of programming.

But something did die on the keynote stage in Austin: the social contract between the framework and its creator. For years, developers looked the other way during DHH’s controversies because he remained the ultimate champion of developer ergonomics, craftsmanship, and the indie hacker’s right to build elegant software.

By taking the stage at Rails World to declare coding obsolete, dismiss Ruby as a relic, flaunt unreadable Rust generated by third-party black boxes, and label his own audience “losers” for caring about their craft, DHH finalized a break that had been brewing for years.

Rails may endure, but its original architect has officially left the building. It’s now up to the community to decide whether it continues to chain itself to an alienated founder, or finally gather the courage to build a post-DHH future.

Postscript

why the lucky stiff, where are you when we need you?

Post-postscript

Monday, September 28, 2026: Fortunately, the closing keynote’s vibe was so, so different.

The post DHH’s opening keynote at Rails World 2026: “The most confusing funeral I’ve ever experienced” appeared first on Global Nerdy.

The post Saturday picdump for Saturday, September 26 appeared first on Global Nerdy.

This list includes both in-person and online events. Note that each item in the list includes:

When the event will take place

What the event is

Where the event will take place

Who is holding the event

This week’s events

• Monday, September 28
• Tuesday, September 29
• Wednesday, September 30
• Thursday, October 1
• Friday, October 2
• Saturday, October 3
• Sunday, October 4

Monday, September 28

Tuesday, September 29

Wednesday, September 30

Event name and location	Group	Time
World Toasters Toastmasters Club Online event	Toastmasters Division E	7:05 AM to 8:00 AM EDT
Tampa Highrisers Toastmasters Hyde Park United Methodist Church	Toastmasters District 48	7:45 AM to 8:45 AM EDT
Computer Repair Clinic 2079 Range Rd	Tampa Bay Technology Center	8:30 AM to 12:30 PM EDT
IndieGameBusiness® Sessions:The Path from Storefront to Success30.9/10AM ET Online event	Orlando Unity Developers Group	10:00 AM to 6:00 PM EDT
Productivity Wednesday 300 E State Street	Kazba Cafe – Oldsmar FL	10:00 AM to 1:00 PM EDT
NotebookLM: Turn Your Documents into an AI Research Assistant Online event	AI Tool of the Week	12:00 PM to 1:00 PM EDT
Lunch Hour Meetup Online event	Sarasota Web Development Meetup Group	12:00 PM to 1:00 PM EDT
Online: DaVinci Resolve – Color Page Online event	Orlando Video & Post Production Meetup	4:00 PM to 5:30 PM EDT
Wednesday Night Gaming Nerdy Needs	Brandon Boardgamers	5:00 PM to 10:00 PM EDT
40k Escalation League Battlebrush Games	Battlebrush Games: Paint Minis & Play Warhammer/Warmachine	5:00 PM to 9:00 PM EDT
CNC Wednesday’s MakerSpace St. Petersburg	Makerspaces Pinellas Meetup Group	5:30 PM to 7:30 PM EDT
Orlando Chess Association West Osceola Library	Greater Orlando Chess	5:30 PM to 8:30 PM EDT
Wednesday Board Game Night Bridge Center	Tampa Gaming Guild	5:30 PM to 11:00 PM EDT
AWS Transform Entrepreneur Collaborative Center (ECC)	Tampa Bay AWS User Group	6:00 PM to 7:30 PM EDT
Casual Commander Wednesdays Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	6:00 PM to 11:00 PM EDT
Board Game Night Critical Hit Games	Critical Hit Games	6:00 PM to 11:00 PM EDT
ELKS Euchre Night Elks Club Ladge #1873	Greater Orlando Euchre Players	[ UNKNOWN DISPLAY TIME ]
Board game night at CHG! Critical Hit Games	Saint Pete Boardgamers	6:00 PM to 11:00 PM EDT
Magic Pioneer Event Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	6:45 PM
Sun Coast Euchre Club The Hanger Restaurant & Flight Lounge	Suncoast Euchre Club -St Pete	6:50 PM to 8:50 PM EDT
Carrollwood Toastmasters Meetings meet In-Person and Online Jimmie B. Keel Regional Library	Toastmasters District 48	7:00 PM to 8:30 PM EDT
Games & Grog! Board game night @ Peabodies Peabodies	Nerdbrew Events	7:00 PM to 11:00 PM EDT
St Pete Wednesday Game Night Right Around The Corner	St Pete Game Night	7:00 PM to 9:00 PM EDT
Cardfight Vanguard!! OverDress Weekly Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	7:30 PM to 9:30 PM EDT
Return to the top of the list

Thursday, October 1

Friday, October 2

Saturday, October 3

Sunday, October 4

About this list

How do I put this list together?

It’s largely automated. I have a collection of Python scripts in a Jupyter Notebook that scrapes Meetup and Eventbrite for events in categories that I consider to be “tech,” “entrepreneur,” and “nerd.” The result is a checklist that I review. I make judgment calls and uncheck any items that I don’t think fit on this list.

In addition to events that my scripts find, I also manually add events when their organizers contact me with their details.

What goes into this list?

I prefer to cast a wide net, so the list includes events that would be of interest to techies, nerds, and entrepreneurs. It includes (but isn’t limited to) events that fall under any of these categories:

• • Programming, DevOps, systems administration, and testing
  • Tech project management / agile processes
  • Video, board, and role-playing games
  • Book, philosophy, and discussion clubs
  • Tech, business, and entrepreneur networking events
  • Toastmasters and other events related to improving your presentation and public speaking skills, because nerds really need to up their presentation game
  • Sci-fi, fantasy, and other genre fandoms

• Self-improvement, especially of the sort that appeals to techies
• Anything I deem geeky

The post Tampa Bay tech, entrepreneur, and nerd events list (Monday, September 28 – Sunday, October 4) appeared first on Global Nerdy.

There’s a six-part series on the NetFoundry blog with a title that’s becoming only more apparent as we move further into the Age of AI: You Will Never Patch Fast Enough. Here’s the Math.

It’s written by Jack Poller. Yes, his title says VP Product Marketing, but he has a long history as a developer, so he’s got first-hand experience with what fixing software used to be like, and an educated view into what it’s like now. So the “here’s the math,” part of the title makes it clear that this is an article written by someone who’d rather show you the arithmetic than the adjectives.

Jack kicked off the series on our blog yesterday, and here’s my summary:

The numbers

From Verizon’s 2025 DBIR and FIRST’s mid-year forecast:

• Disclosures: 40,000+ CVEs in 2024, up 38% year over year. FIRST’s June revision puts 2026 near 66,000, which is considerably higher than the February projection of 59,427, and running about 46% above that baseline through April.
• Remediation: for the edge and VPN device vulnerabilities DBIR studied, a median of 32 days to close, and only 54% fully closed at all. The average for that set was over half a year (209 days).
• The median time from disclosure to exploitation was five days. Exploitation as a breach vector rose 34% year over year and factors into 20% of breaches. Edge and VPN devices went from 3% to 22% of studied breaches in a single year.

Five days versus 32 days, on the same population of assets. There are some levers available to you that can cut that time down to 25 days (more analysts, tighter change windows), but that reduced time is still five times as long as the disclosure-to-exploitation time.

FIRST attributes the climb to 66,000 CVEs to three structural drivers and not just one:

• AI-assisted discovery
• A 449% jump in GitHub Security Advisory volume
• A 3,119% increase in VulnCheck acting as CNA of last resort

The VulnCheck figure is largely a backlog of already-existing vulnerabilities finally getting IDs assigned. FIRST’s interpretation is that this reflects better discovery and reporting rather than software getting worse. In my opinion, this emphasizes Jack’s point: Even flaws that don’t count as “new” are still going to end up in your queue.

Capacity and latency are different problems

A key part of Jack’s post is the section on volume versus risk. If you filter all those CVEs for things that are actually being exploited, such as CISA KEV entries or or EPSS above 10%, the actionable burden is fairly flat, and it’s a workload that’s manageable with some smart triage. If your team is well-run team, they can 66,000 disclosures without extra headcount, simply because most of them will never be weaponized against anyone.

But you’ll still be left with the set of vulnerabilities attackers have already decided are worth building for. That’s the slice with the shortest clock on it. Prioritizing well gives you a smaller list that burns faster.

So there are two different questions here, and they have different answers:

1. Can my team absorb the workload? Sure, with good triage.
2. On the items that survive triage, can I close before exploitation? Median five days against median 32.

Getting better at the first question doesn’t change the answer to the second one. In systems terms it’s problem of service-time rather than throughput. You can have a perfectly stable queue and still blow every deadline in it.

Where the series goes

Jack’s argument is that same as WOPR from the movie WarGames: Don’t play games you can’t win. In practical security terms, it’s better to make the asset unreachable, so an unpatched flaw has no network path to it. The CVE stays open in your scanner, but the exposure doesn’t exist.

NetFoundry calls this vulnerability cloaking, and parts 2 through 6 in Jack’s series will cover risk-acceptance waivers, the technical case, assets that can never be patched (EOL systems, plus everything not yet disclosed), the CFO math, and a vendor checklist.

The honest limit, because I’d rather say it than have it said at me: this helps for things that shouldn’t be broadly reachable in the first place. Your public web front end has to answer the internet and no overlay changes that. Where it bites is the large category of stuff that’s internet-reachable for reasons nobody can currently articulate: management interfaces, internal APIs, appliance admin panels, that one jump box. Which, per DBIR, is exactly the category that went from 3% to 22%.

Once again, here’s the article: You Will Never Patch Fast Enough. Here’s the Math.

The post “You will never patch fast enough” (or: 5 days to exploit, 32 days to patch, and why better triage doesn’t close that) appeared first on Global Nerdy.

It’s not that they’re idiots, but that their attention is getting pulled in so many different directions at once these days.

The post My systems design advice appeared first on Global Nerdy.

(On the bright side, I had time to draw a “back of the envelope” comic that covers the big CVE!)

The CVE numbers

Here are the numbers:

• 1,248 new network-exploitable CVEs
• 117 of these CVEs are rated at 8.6 or higher
• 12 of these CVEs are a perfect 10.0:
  • 9 of those twelve in vm2 alone

Worth reading

1. The Langflow flaw

CVE-2026-85025 (9.8) is unauthenticated RCE in IBM Langflow OSS 1.0.0–1.11.5. It’s reachable through publicly shared MCP project endpoints, with read and write access to chat sessions on top. Whatever context, credentials, or proprietary data flowed through those sessions comes along with it.

The mechanism is the interesting part. Langflow lets you share a flow via an MCP project endpoint so other tools and agents can call it programmatically. The code that’s supposed to enforce “this one flow is public, everything else isn’t” doesn’t hold that boundary. So “publicly shared” quietly generalizes from one flow to the host. This happens without a privilege escalation chain, user interaction, or even any waiting for someone to click anything.

All in all: 8 CVEs against Langflow in a single seven-day window, including the one above: code injection, OS command injection, path traversal, an incomplete scanner denylist, and this one.

2. The difference between CVE vs. KEV

• CVE: Common Vulnerabilities and Exposures. These are publicly-disclosed security flaws, and may or may not have been used in an attack. These are weaknesses that have been announced.
• KEV: Known Exploited Vulnerability. This is a CVE that CISA (Cybersecurity and Infrastructure Security Agency) has confirmed is being actively exploited against real targets. A KEV is a CVE that got a job.

Mark writes that he’d bet money that the Langflow flaw above becomes a KEV. Another Langflow CVE has already done that: CVE-2025-3248, a missing-authentication RCE, which went onto CISA’s KEV catalog on May 5, 2025, with a three-week federal remediation deadline and confirmed ransomware use. Sysdig later documented that same flaw on a server nobody had patched in over a year as the entry point for what they assessed as the first fully autonomous agentic ransomware operation.

The traits that move a CVE onto KEV are the traits this one has: no auth, trivially scannable, and sitting on infrastructure that isn’t in anyone’s asset inventory. Langflow has supplied both ends of that pipeline before.

3. Why AI agent platforms keep showing up in Reachability Watch

Because these tools are three things all at once:

• New
• Fast-moving
• Production-critical

…and they’re shipped by teams optimizing for getting an AI capability out the door. As a result, exposure and hardening get less scrutiny than they’d get on a mature enterprise system.

The part that makes them worth an attacker’s time specifically: compromising one doesn’t get you a single host, it gets you the whole key ring. The same property that makes the platform useful is what makes the blast radius large, which is why “it’s just an internal tool on a dev box” ages so badly.

The post “Reachability Watch” for September 11 – 17, 2026: 8 CVEs against Langflow in one week, and why “publicly shared” = “publicly ownable” appeared first on Global Nerdy.

Their situation: a small team of internal colleagues testing a tool for business work that might later become part of their daily workflow, and their budget was zero dollars.

Their main question: Could they use the Free hosted version of zrok?

The super-short answer

Yes!

The short (but with some details) answer

If you’re on a small internal team with zero budget, zrok’s Free hosted plan will cover your core needs:

• A stable HTTPS address
• Browser access with no install for users
• Login-gated access for approved colleagues/users.

Watch the daily bandwidth (you’re limited to 5GB in any 24-hour period), make sure team knows about the interstitial page, and test from every region where you plan to use it.

Before the detailed 5 answers: What’s zrok?

zrok (pronounced “zee-rock”) is an open-source tool for sharing things running on your machine, such as…

• A web app,
• an API, or
• a folder of files…

…without the need for you to open firewall ports or set up servers. You run one command on the machine where the service lives, and zrok gives you a way for other people to reach it. If you’ve used tunneling tools like ngrok, zrok covers similar ground, with private sharing and zero trust networking built in, and with a much bigger bandwidth allowance, too!

zrok can share in two ways:

• Public shares give your service a regular HTTPS URL that anyone with a browser can open. zrok handles the TLS certificate. You can optionally require a Google or GitHub login so only approved people get in.
• Private shares are reachable only by people who also run zrok and have been given access, so the service is never exposed to the open internet.

zrok is built on OpenZiti, the open-source zero trust networking platform created by NetFoundry. Your service makes outbound connections to the zrok network instead of listening for inbound ones, which means there are no inbound ports on your machine for scanners and attackers to find. As far as unauthorized parties are concerned, nothing’s happening on your machine, and there’s no way in.

You can use the hosted version at zrok.io, run by NetFoundry, or self-host it under the Apache 2.0 license. This article is about the hosted Free plan.

The 5 questions, answered

1. Is small-team, business-related use allowed on the Free plan?

Yes! Testing a business tool with a few colleagues, and using it internally afterward, is allowed on the hosted Free plan. You don’t need a paid tier for commercial use.

The terms that apply are in NetFoundry’s Self Service Subscriptions Agreement. As with any service agreement, have someone read it before you build a workflow on top of it.

2. Can I reserve a persistent, custom-named public HTTPS address without a payment method?

Yes! By default, zrok2 share gives you a random share token that disappears when the share ends. zrok 2.0 adds namespaces and names, which let you keep a stable address:

• A namespace works like a DNS zone. The public namespace corresponds to share.zrok.io.
• A name works like a DNS record inside that zone. A reserved name persists across runs of zrok2 share.

If you reserve the name contenttool in the public namespace, your app is available at https://contenttool.share.zrok.io. That address stays the same every time you restart the share, and it comes with a trusted TLS certificate automatically.

To see which namespaces you can use:

# bash
zrok2 list namespaces

For the details, see Reserved names and namespaces and Manage reserved names.

3. Can colleagues use the app in a normal browser without installing zrok? Can I limit who gets in?

Yes to both! A public share is a regular HTTPS URL, so your colleagues just open it in a browser. Only the machine running your app needs zrok installed.

To limit access to approved people, turn on OAuth for the share. zrok supports Google and GitHub login for public shares, and you can restrict access by email address pattern:

# bash
zrok2 share public --backend-mode proxy \
  --oauth-provider google \
  --oauth-email-address-pattern '*@yourcompany.com' \
  http://localhost:8080

Anyone who visits is sent to sign in first. Only accounts whose email matches the pattern get through. You can repeat --oauth-email-address-pattern to allow several domains or specific addresses.

There’s also a bonus for developers. Once someone is authenticated, zrok adds headers such as zrok-auth-email to every request it forwards to your app. That means your app can tell who’s using it without you building a login system. See OAuth public frontend for the full flow.

4. Are there mandatory charges, usage limits, or restrictions?

No mandatory charges. The Free plan costs $0 a month and doesn’t require a credit card. It does come with limits you should plan around:

• 5 GB of bandwidth per day, measured over a rolling 24-hour window. If you go over, your running shares are disabled and you can’t create new ones until usage drops back under the limit. For a small team using a content tool this is usually plenty, but heavy media uploads could reach it.
• 25 environments, 50 share backends, and 50 private access frontends. A small team won’t come close.
• Rate limits on public shares: 2,000 requests per IP and 7,500 requests per share, each per 5-minute window.
• An interstitial page. Accounts without a card on file show an anti-phishing page the first time someone visits a public share. It’s a one-time click-through for each visitor, but tell your colleagues about it so it doesn’t surprise them. Adding a card removes it, and you’re still on the Free plan.

In case you were wondering, here’s what the interstitial page looks like:

There’s also community support through the OpenZiti Discourse forum.

All the details are on the zrok pricing page and in the service limits docs. If you outgrow the Free plan, you can self-host zrok with no limits under the Apache 2.0 license, or talk to NetFoundry about commercial options.

5. Are there known restrictions on reaching hosted zrok shares from mainland China or other countries?

We don’t publish a list of country-by-country access guarantees. Whether a public URL is reachable from a given country depends partly on things outside our control, like local network policy.

Our advice is to review the terms of service linked above, then test your exact setup from the locations your users will be in before you roll it out. Stand up a throwaway share, have a colleague in each region load it and click around, and confirm it performs well enough for your needs.

Worth watching on Ziti TV

On the OpenZiti YouTube channel, there’s the Sharing Safely (and Rocking Out) with zrok episode, where hosts Clint and Joey explore zrok’s commands and talk zrok with its creator, NetFoundry developer Michael Quigley.

The post Can you use zrok’s Free hosted plan for your team’s internal tool? (or: 5 questions, answered) appeared first on Global Nerdy.

The post Saturday picdump for Saturday, September 19 appeared first on Global Nerdy.

This list includes both in-person and online events. Note that each item in the list includes:

When the event will take place

What the event is

Where the event will take place

Who is holding the event

This week’s events

• Monday, September 21
• Tuesday, September 22
• Wednesday, September 23
• Thursday, September 24
• Friday, September 25
• Saturday, September 26
• Sunday, September 27

Monday, September 21

Tuesday, September 22

Tuesday from 10:00 a.m. to 11:00 a.m. (online): Computer Coach, via their Tampa Cybersecurity Training Meetup group, presents Career Changing Successfully!

Ready for a career change? Join our webinar, “Career Changing Without Resetting Your Journey,” and learn actionable steps to transition successfully. Recognize your current skills and seize new opportunities without starting from scratch. Register now and take the next step in your career!

Find out more and register here.

Tuesday from 5:30 to 8:30 p.m. at Hidden Springs Ale Works (Tampa): It’s the September edition of TampaTech Taps & Taco Tuesday!

This is a once-a-month gathering of Tampa Bay’s tech community for good company, good conversations, 15% off the regular beer prices, and most importantly, FREE TACOS!

Find out more and register here.

Tuesday from 7:30 to 9:00 p.m. (online): Tampa AI Applications Meetup Group presents Mastering Guardrails for Generative AI Testing!

This session explores key strategies for testing and validating AI guardrails: covering bias detection, hallucination control, and output validation. Gain valuable insights into building trustworthy AI systems and effectively testing generative models in real-world applications.

Find out more and register here.

Wednesday, September 23

Wednesday from 12:30 to 1:30 p.m. (online): Heart of Agile St. Pete – Tampa – Orlando is hosting an online coffee corner!

The Heart of Agile Coffee Corner brings people together from around the world via Zoom in a casual setting to share and discuss ways we Collaborate, Deliver, Reflect, and Improve.

We explore the kinds of topics people ask for: real-world stories of Agile in practice, small high-leverage changes in how we work together, and the intersections between Heart of Agile and emerging areas like AI — shaped by who’s in the room and what you bring.

The Heart of Agile is not just for software teams. It applies anywhere people work together — healthcare, education, community work, product development, coaching, and beyond — so you’re welcome whether or not you work in tech.

This is not a formal talk or webinar. Expect an informal, conversational space where you can join for as much time as you have, listen in, and contribute when you’re ready.

Find out more and register here.

Wednesday from 6:00 – 9:00 p.m. at Coppertail Brewing (Tampa): ISACA West Florida Chapter is hodling their Q3 2026 Networking Event!

Whether you’re deep in tech or work in a technology-adjacent field, this is the perfect chance to connect with fellow professionals, share ideas, and just have a good time.

Find out more and register here.

Event name and location	Group	Time
World Toasters Toastmasters Club Online event	Toastmasters Division E	7:05 AM to 8:00 AM EDT
Tampa Highrisers Toastmasters Hyde Park United Methodist Church	Toastmasters District 48	7:45 AM to 8:45 AM EDT
Computer Repair Clinic 2079 Range Rd	Tampa Bay Technology Center	8:30 AM to 12:30 PM EDT
NAT’L CHECKERS DAY—YOUR MOVE FOR SOME FUN!Wednesday, September 23, 2026 Citrus Park Town Center Mall	Tampa (Citrus Park Area) Games Meetup Group	10:00 AM
Productivity Wednesday 300 E State Street	Kazba Cafe – Oldsmar FL	10:00 AM to 1:00 PM EDT
ChatGPT Beyond Chatting: 10 Things You Didn’t Know It Could Do Online event	AI Tool of the Week	12:00 PM to 2:00 PM EDT
Heart of Agile Coffee Corner–September 2026 Online event	Heart of Agile St. Pete – Tampa – Orlando	12:30 PM to 1:30 PM EDT
BrowserStack Meetup Orlando: AI for Proactive QA Defect Prevention Online event	BrowserStack Meetup group Orlando	1:30 PM to 2:30 PM EDT
Wednesday Night Gaming Nerdy Needs	Brandon Boardgamers	5:00 PM to 10:00 PM EDT
40k Escalation League Battlebrush Games	Battlebrush Games: Paint Minis & Play Warhammer/Warmachine	5:00 PM to 9:00 PM EDT
CNC Wednesday’s MakerSpace St. Petersburg	Makerspaces Pinellas Meetup Group	5:30 PM to 7:30 PM EDT
Wednesday Board Game Night Bridge Center	Tampa Gaming Guild	5:30 PM to 11:00 PM EDT
Orlando Chess Association West Osceola Library	Greater Orlando Chess	5:30 PM to 8:30 PM EDT
ISACA West Florida Chapter – Q3 2026 Networking Event Coppertail Brewing	ISACA West Florida Chapter	6:00 PM to 9:00 PM EDT
Casual Commander Wednesdays Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	6:00 PM to 11:00 PM EDT
Board Game Night Critical Hit Games	Critical Hit Games	6:00 PM to 11:00 PM EDT
Board game night at CHG! Critical Hit Games	Saint Pete Boardgamers	6:00 PM to 11:00 PM EDT
Tampa Writers Alliance Critique Group Online event	Tampa Writers Alliance	6:30 PM to 8:30 PM EDT
Magic Pioneer Event Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	6:45 PM
Sun Coast Euchre Club The Hanger Restaurant & Flight Lounge	Suncoast Euchre Club -St Pete	6:50 PM to 8:50 PM EDT
Carrollwood Toastmasters Meetings meet In-Person and Online Jimmie B. Keel Regional Library	Toastmasters District 48	7:00 PM to 8:30 PM EDT
Apopka Foliage Toastmasters Online event	Apopka Foliage Toastmasters	7:00 PM to 8:30 PM EDT
Games & Grog! Board game night @ Peabodies Peabodies	Nerdbrew Events	7:00 PM to 11:00 PM EDT
St Pete Wednesday Game Night Right Around The Corner	St Pete Game Night	7:00 PM to 9:00 PM EDT
Presentation Wed 9/23 at 7 pm: Creative Photography by Barbera Maker Online event	The Art Of Photography – Tampa/St. Pete	7:00 PM to 9:00 PM EDT
Board Games at M+M M+M videogames	Tampa 20’s and 30’s Social Crew	7:00 PM to 10:00 PM EDT
Cardfight Vanguard!! OverDress Weekly Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	7:30 PM to 9:30 PM EDT
The Strength Born from Adversity: A Stoic Perspective Online event	Philosophy for Everyday Life – Talks and Classes in Florida	8:00 PM to 9:00 PM EDT
Return to the top of the list

Thursday, September 24

Thursday from 4:00 to 7:00 p.m. at American Legion Post 138 (Tampa): It’s time for the monthly Tampa/ MacDill AFB Orange Call, Networking Event & Tech Round Table!

The purpose of this event is to bring together communicators, guardians, and enablers of all ranks, titles, and experience levels to network, share resources, and foster professional development.

Invited: communicators, guardians, and enablers past and present as well as DoD civilians, business leaders, defense executives, government contractors, nonprofit organizations, and military community stakeholders from across the Tampa Bay area.

The program will include networking opportunities, a stand-up, tech. roundtable conversations, and a meet-and-greet focused on MacDill missions and the communications community, including the growing role of cyber operations and the importance of defending our nation’s networks and critical infrastructure.

Find out more and register here.

Thursday at 5:45 p.m. at Hillsborough Community College’s Dale Mabry Campus (Tampa): TampaBay AI Meetup / Tampa QA Meetup / Tampa Java User Group present Known and Unknowns: Testing AI-Generated Code!

Billy Korando (developer advocate at Oracle) is visiting from Kansas City and will be here to walk us through three distinct phases of testing AI-generated code, from defining expected business behavior and covering edge cases to uncovering bugs and risks you may not have anticipated. Telling your coding agent to “write tests” isn’t enough, and Billy’s here to show us ways that work.

Find out more and register here.

Thursday from 5:30 – 7:00 p.m. at University of Tampa’s Skyview/TECH 694 (Tampa): IEEE Florida West Coast and Women in Engineering present Data Science & AI in Action : Industry Perspectives!

This event will feature 5 lightning talks from industry leaders, followed by an open panel discussion.

Find out more and register here.

Thursday from 6:00 – 8:00 p.m. at Embarc Collective (Tampa): Tampa Digital Mixer!

Calling all e-commerce operators, remote workers, digital marketers, Shopify entrepreneurs, Facebook Ads pros and AI enthusiasts and start-up entrepreneurs! Join us for an evening of high-impact networking and actionable conversations in the heart of Tampa Bay.

The Digital Mixer is not just an event for trading business cards and forgetting names by Friday, but turning a Thursday evening into real clients, real partnerships, and real career moves.

Find out more and register here.

Friday, September 25

Friday at noon to 1:00 p.m. (online): Computer Coach, via their Tampa Cybersecurity Training Meetup group, presents Back To Basics: The Fundamentals That Still Matter!

Back to Basics is a practical look at the fundamentals that can make a difference in your job search. This presentation will discuss what is working for candidates, along with the importance of preparation, professionalism, and knowing how to make a strong impression.
The conversation will cover:

• What candidates should know about the current job market
• Why preparation matters before applying and interviewing
• How professionalism can influence the hiring process
• Ways to stand out without overcomplicating your job search
• Simple fundamentals that are easy to overlook

Find out more and register here.

Saturday, September 26

Sunday, September 27

Event name and location	Group	Time
Ice Cream Social Carrolwood village Park	Geekocracy!	12:00 PM
Meeting 7: Gangsters of Capitalism by Jonathon Katz Heights Lounge (Coffee, Kombucha, Herbal Teas, Hookah)	The Culture Club – A Nonfiction Book Club	1:00 PM to 3:00 PM EDT
Adventures of the Tomb of Annihilation (5e 2024 D&D Campaign) Cozy Dragon Games	Adventurers of Central Florida	2:00 PM to 6:00 PM EDT
Sunday Chess at Wholefoods in Midtown, Tampa Whole Foods Market	Chess Republic	2:00 PM to 5:00 PM EDT
D&D Adventurers League Critical Hit Games	Critical Hit Games	2:00 PM to 7:30 PM EDT
Sunday Pokemon League Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	4:00 PM to 8:00 PM EDT
Escape Room & Dinner! ‍ 2480 East Bay Drive	St. Pete Life & Fun 50+	4:00 PM to 7:00 PM EDT
Community Hang-out Night Online event	Nerdbrew Events	6:00 PM to 9:00 PM EDT
A Duck Presents NB Movie Night Discord.io/Nerdbrew	Nerd Night Out	7:00 PM to 11:30 PM EDT
Return to the top of the list

About this list

How do I put this list together?

It’s largely automated. I have a collection of Python scripts in a Jupyter Notebook that scrapes Meetup and Eventbrite for events in categories that I consider to be “tech,” “entrepreneur,” and “nerd.” The result is a checklist that I review. I make judgment calls and uncheck any items that I don’t think fit on this list.

In addition to events that my scripts find, I also manually add events when their organizers contact me with their details.

What goes into this list?

I prefer to cast a wide net, so the list includes events that would be of interest to techies, nerds, and entrepreneurs. It includes (but isn’t limited to) events that fall under any of these categories:

• • Programming, DevOps, systems administration, and testing
  • Tech project management / agile processes
  • Video, board, and role-playing games
  • Book, philosophy, and discussion clubs
  • Tech, business, and entrepreneur networking events
  • Toastmasters and other events related to improving your presentation and public speaking skills, because nerds really need to up their presentation game
  • Sci-fi, fantasy, and other genre fandoms

• Self-improvement, especially of the sort that appeals to techies
• Anything I deem geeky

The post Tampa Bay tech, entrepreneur, and nerd events list (Monday, September 21 – Sunday, September 27) appeared first on Global Nerdy.

Calling all devs, designers, AI and data geeks, cyber and everyone in the “tech-ish” orbit!

This event brings together technologists and technology-adjacent professionals to connect, share knowledge, learn and grow together.

Yes, it’s last minute, but a lot of people have signed up already, and for those of you collecting cybersecurity CPEs, attending this one will earn you 2!

The agenda

AI Panel –  Revisiting AI Transformation opportunities due to the rapid evolution of capabilities

With AI model performance and tooling evolving at a breakneck pace, the lifecycle of technical feasibility has compressed. Solutions deemed impractical just months ago are frequently production-ready today. We will examine how enterprise leaders and practitioners are navigating this shifting baseline—reassessing former roadblocks, managing risk, and executing sustainable AI transformation strategies.

Panelists:

• James Gress
• Jim Lovett
• Mikael Loefstrand

Talk: Detection of Confounders in Computed Tomography Datasets

Computed Tomography (CT) scans are used to train machine learning models to predict cancer outcomes. Datasets are frequently composed of images collected using different devices or settings, which can reduce classifier accuracy.

This talk covers an automated method for screening CT datasets to detect features that make models learn spurious associations – called confounders – and other unwanted variations in data. By understanding what affects data quality, we can mitigate these issues or adjust image acquisition processes to prevent them from happening in the future.

Speaker:  Nikolai Fetisov

Talk: The chart is already multimodal. Why isn’t the model?

Every clinical decision draws on labs, coded history, notes, and imaging at once. Most deployed models read one.  The work began as an ONC engagement, built as a physician assistant and trained with split learning, so records never left the institutions holding them. Asked which task would earn a place in their day, physicians answered consistently: help with the differential.  The 2015 National Academies report found that most people will experience at least one diagnostic error in their lifetime. These are usually failures of consideration rather than knowledge: the right diagnosis was never placed on the list.

Solution is valuesets governed data trained with multimodal model built with fusion architecture.  Each branch is projected to a shared width, given its own self-attention, and combined in one late fusion feeding condition heads that share a representation.  Results are early with no prospective study with clinicians yet, but the validation metrics looks promising.   Future improvements with contrastive learning and focal loss will drastically increase recall and additional testing is carried out by analyzing Krippendorf alpha.

The opportunities of this engine serve six workflows: diagnostic support, risk adjustment, trial recruitment in phase3, quality measurement, Hedis scoring, and rare disease detection. Only the label set, the threshold, and the recipient change.

Differential diagnosis is the capability. The opportunity remains open.

Speaker: Sravan K. Elineni

Talk: AI-Powered Defense for PHI: Smarter Cybersecurity for Healthcare Compliance

As cyber threats targeting patient data grow more sophisticated, healthcare providers are turning to AI to stay ahead. Rather than reacting after damage is done, AI-powered tools spot unusual activity early, streamline HIPAA compliance, and speed up incident response—helping protect EHRs, medical devices, and telehealth systems while preserving the trust patients place in their care.

Speaker: Yukti Goyal

Talk: ADios: Breaking up with Active Directory

(previously presented at 2026 BSides Tampa)

Active Directory (AD) became the de facto standard for Windows-centric organizations to add security, but today, removing AD or minimizing its footprint is considered a security enhancement.

More than a technical optimization, switching from hybrid-AD to cloud-native Entra ID is a risk reduction strategy. Have the capabilities of cloud native reached a tipping point where more organizations can seriously consider reducing or eliminating AD? This session will discuss a regulated organization’s journey to cloud native, reasons to do so, challenges, and lessons learned.

Speaker: Daniel Jarboe

Talk: The Market is Trying to Tell You Something

The tech job market has been sending signals for two years. Most of us have been too busy surviving it to read them. After 15+ years in tech and a recent job search that took me across a couple dozen companies, I came away with both a new role and something just as valuable: a pattern.

Job descriptions have quietly shifted. Hiring panels are asking different questions. “ROI” means something specific now that it didn’t mean in the zero-interest 2010s or the Great Resignation era of a couple of years ago. The skills companies say they want versus the skills that actually get you hired don’t look like they come from the same list.

This talk is an honest, experience-based, practitioner-level read of what the market is telling us about where tech is headed. It doesn’t have any LinkedIn takes or recycled frameworks; just patterns from the front lines, with implications for how you position yourself, make the case for your team, and think about the next few years of your career.

Speakers: Joey de Villa (and maybe Anitra Pavka)

A bit of singing and creativity:

Singer: Kat Casperson

The venue

The event will take place at Schiller International University, which is located in Park Tower, located in downtown Tampa at 400 N Tampa St, on the 9th floor.

There will be food and drink, sponsored by ISACA West Florida Chapter.

Want to attend?

It’s free! Register here!

The post Machine Learning / AI / Technology / Risk + Happy Hour Prototype v0: Thursday, September 17! appeared first on Global Nerdy.

Blasphemy!

The quite-full ECC was about three-quarters software developers, and Pratik had just finished taking a headcount of the Java people, the TypeScripters, the Pythonistas, and of course, the Rustaceans (“most people want to rewrite everything in Rust, and I find it extremely annoying”). That’s when he said what would’ve gotten him tarred, feathered, and run out of a Java meetup if we’d been back in the days of Java SE 18 or 19:

“One of the things that you may get from this session is that the programming language doesn’t even really matter anymore.”

Of course, his paln was to prove that statement by the end of the night, as well as the conclusion that you should draw if you still plan to remain in software: If you hand the coding off to a machine, the valuable work moves up the stack.

Pratik is a longtime Java/JVM guy, one of the organizers behind the DevNexus conference in Atlanta, and as of about a month ago, he works at Hugging Face. He also polled the room on what Hugging Face actually does, and enjoyed the answers (mine: “Hang out with Jensen!”). The correct one, which he eventually told us, was that they own Transformers and the rest of the library stack that lets you download, and better still run the models.

The gamble: Building before the presentation

It takes time for an software factory to build things, even on a late-model MacBook with 64GB RAM like Pratik’s. Sp he started the demo at the beginning and then talked over it, which I suppose is the new version of “live coding”. I do that myself (both live agentic coding as well as raw-dogging the code the old-fashioned way), so I have to respect Pratik’s boldness.

He asked the room for an app idea. Someone suggested a horse-boarding scheduler, which was too big. Charles, who works for a sports organization, suggested a playoff odds calculator. Pratik assessed that it was doable within the given time, so he agreed to build that.

Pratik opened Gemini and, off the cuff, dictated a rough spec: look at the remaining season schedule for all 30 MLB teams, calculate each team’s chance of making the playoffs, and let the user tweak the metrics on the page to try different scenarios.

Gemini spat out a 255-line spec in a few seconds. He pasted that into his software factory, told it “Create a new app called MLB Odds, here’s the spec, let me know when it’s finished and what the URL will be,” hit enter, and walked away from it to start the actual presentation.

“Again,” he said, “this may be a total disaster. It may not work, but let’s see how it goes.”

So what is a software factory?

Pratik was upfront that this is the most undefined term in the industry right now: “If you ask 10 people in this room what a software factory is, you’ll probably get 10 different answers.” Here’s his:

An AI software factory is a system, not a team, that turns human-written specifications and intent into working software, using agents to perform most or all of the coding, testing, review, and release work.

The key word is system. You say “go build this,” walk away, and come back hours or a day later to working software. It’s like handing a project to a team of engineers and going off to do something else (or hey, nothing. You’re the boss!).

And critically, a software factory is not one-shotting. Telling Claude or ChatGPT “build me this website” and pasting in a detailed description relies entirely on the raw intelligence of the model. A factory applies rigorous software engineering process around the model: planning, architecture, implementation, testing, QA, security review, version control. The process is the product.

The levels: where you are on the ladder

Pratik walked through a progression that got a lot of nodding in the room:

• L0: Manual coding: Open an editor, translate what’s in your brain (or in a written spec) into code, hit a wall, go read the docs or Stack Overflow, keep going.
  
• L1: “Spicy autocomplete”: IDEs got language servers and started completing large fragments for you. A genuine step change in velocity.
• L2: AI pair programmer: You describe what you want to a chatbot, it emits code, you copy it into your editor and fix it up. You’ve effectively stopped going to Stack Overflow directly, because the model already ate it.
• L3: AI as a senior developer: You give it a spec, it builds, you review the code and tell it when it picked the wrong approach.
• L4: You’re the PM: You write specs, you review plans, you check back later.
• L5: Software factory: specs go in, software comes out. You review the product, and you may never look at the code at all.

His take: most working developers are somewhere between L2 and L4 right now, depending on how much freedom their employer gives them.

What’s left for software engineers, then?

Pratik clearly flagged this part as his own opinion. Like a lot of developers, myself included, he went through the “there’s no way AI replaces me” phase. He concluded that it doesn’t replace software engineers, but it does dramatically change what they spend their day doing, which is the remaining high-value work. I get the feeling that programmers went through something similar when going from assembly to higher-level languages.

With AI writing the code, the process of programming becomes even higher-level, with these becoming our main activities:

• System design. The model knows how to write code. It does not know that you can’t build a browser front end in Python, and it doesn’t know that your real-time app needs in-memory caching to hit a sub-three-second response. And if it improvises those decisions unprompted, you will not like the implementation.
• Security.
• Making sure user requirements are actually met.
• Writing and maintaining the specs and the architecture.
• Building the validation harness that keeps the factory honest.
• Agent orchestration.

He also noted, to the product managers in the room, that the line between PM and engineer is blurring fast in both directions.

The four jobs of a factory

At minimum, Pratik argues, a software factory has to do four things:

1. Plan the build
2. Code it
3. Test it (looping back to implementation when tests fail)
4. Verify with a QA/security/architecture-compliance pass (the kind of review a human QA engineer would do by using the result as a user would, not only unit tests)

The single most important artifact in all of this is architecture.md. That file is where you, the engineer, do the system design: “This is a web app, use Vue, this is the backend, these are the performance targets, this is how we build things around here.” It’s exactly what you’d tell a new team lead. The factory can’t extrapolate it from your brain.

Specs are a separate thing from architecture: specs are the features, architecture is the system. For spec format, Pratik mostly writes Markdown, though he noted that larger teams use a more rigid PRD structure, and GitHub’s Spec Kit is out there if you want something opinionated.

Pratik’s actual stack

Here’s what he’s running, top to bottom:

Hermes Agent as the front office. Hermes (the open-source, self-hosted personal agent from Nous Research, in the same category as OpenClaw) is his always-on orchestrator. It runs on a server, it’s reachable via Telegram, Discord, Slack, or email, and it has persistent memory that turns repeated requests into reusable skills. Hermes takes his request, polishes it into a formal spec, finds the right project directory, and dispatches a headless job to the factory floor. He runs it on a 35B-A3B Qwen model, which has 35 billion parameters, but only 3 billion active per token, so it fits on a modest server.

pi.dev as the factory floor. pi.dev is Mario Zechner’s minimal terminal coding harness. It ships with four tools: read, write, edit, bash. It has a tiny system prompt, and hooks for everything else. That’s it: it’s a build-your-own coding agent, not a sealed product. Pratik picked it over Claude Code, Codex, Cursor, OpenCode, Kiro, and the rest because it’s lightweight, it doesn’t burn tokens, and you can point it at any model you want.

Someone reasonably asked why he didn’t simplyu use Hermes for the coding too, since Hermes can code. His answer was about context hygiene: he wants Hermes to be the manager and pi to be the worker, and he doesn’t want to pollute the coding agent’s context with all the management and channel-routing overhead. “It doesn’t have memory. It doesn’t have learning. I don’t want all that stuff for my worker software monkey that’s going and building the code.”

A local LLM. Qwen 3.6 27B, running on a 5090 at home rather than on his laptop for the demo. (Qwen 3.8 27B had landed a few weeks earlier and he said the jump was a substantial improvement.)

A context MCP server. This is the piece I think people will underrate. Qwen 3.6’s knowledge cutoff is roughly a year stale, which means it doesn’t know current Vue and Nuxt APIs. So he plugs pi into an MCP server loaded with current docs and code samples for whatever he’s building (HTML/CSS, Vue.js, Nuxt) so that it builds against Nuxt 4, not whatever it “half-remembers” from last year.

And there isn’t one factory, there are three: a front-end one (Vue/Nuxt), a Java/Spring Boot one for performance-sensitive backends, and a Python one for utilities. Same seven-step process in all three, different tooling underneath.

The seven steps, and where they live

Inside the project’s .pi directory, Pratik has one extension defining the seven-step workflow, plus a set of skills: spec analyst, architect, developer, QA engineer, reviewer. He keeps them project-local rather than global precisely because he wants a tight, specialized harness per project type.

He opened up the spec analyst skill live, and the reveal was how short it is:

The whole thing is barely a screen’s worth of text telling the model it’s a technical product manager who reads requirements systematically and translates them into concrete action plans with features, data models, and API contracts, followed by a handful of instructions: do requirements gathering, document assumptions, create a data model, define the API contract. That’s it. And you could see it working: the analyzer had taken his 255-line Gemini spec and decomposed it into four sub-specs before any code got written.

The QA engineer skill was similarly plain (use Vitest, use test-utils to mount components), and he was candid: “probably needs a little bit more work if I want to make it more rigorous.”

For visual QA he uses a Playwright plugin. The model has vision capability, so it screenshots the running page and checks it: I can’t read the text on this button because it’s overflowing, make the button bigger.

Why local, and why anyone should care

Two reasons, and Pratik was blunt about both.

Reason one is intellectual property. Yes, there’s a checkbox that says don’t train on my data. Do you believe it? “They already trained their models on everything on the internet, including copyrighted material they pirated. I don’t know if I trust these guys with stuff I care about.” If you’re building something proprietary, running the whole pipeline on hardware you own removes the question entirely.

Reason two is cost, and this is where the harness argument lands. The most quotable thing Pratik said all night:

“The harness that calls the underlying LLM matters actually much more than the LLM does.”

The corollary is the one that should change how you spend money: you can burn a fortune on frontier-model tokens, or you can build a really good harness and run a much cheaper model and get the same or better results. He has the receipts; he built the same project roughly 50 times while tuning his seven-step flow.

He’s not a purist about it, either. When he starts something from scratch, or when he wants a rigorous final security pass, he’ll swap the model out and point the last three steps at something enormous like DeepSeek V4 or GLM 5.3 via OpenRouter or Hugging Face inference providers. Same harness, better LLM, but only where it’s worth paying for.

The hardware detour (and the bad news)

Pratik spent a useful chunk of the talk on quantization, because it’s the thing that determines whether any of this runs on your machine.

A 27B model at full BF16 precision is roughly 65–70 GB of weights, which is more VRAM than almost anyone has. Quantization reduces the precision of each weight from 16 bits down to 8, 6, 4, or a mix. Qwen 3.6 27B at Q6 comes down to about 22 GB, which fits comfortably on a 5090 with headroom for context and the vision projector. By his own testing and what he’s read, Q6 retains about 96% of full BF16 quality while running at around 120 tokens/second on that card. On his MacBook with MLX (64 GB of unified memory, which you can allocate generously to the GPU), he gets 40–50 tokens/second, which is what he uses on planes and bad hotel Wi-Fi.

Someone asked whether ~27B is the floor for useful coding models. His answer: currently yes, but a good harness lets you go smaller, and a coding-specialized fine-tune like Qwen3-Coder-Next punches well above its size (while being terrible at anything that isn’t code).

The bad news: now is a terrible time to buy hardware for this. The 5090 that cost someone in the room $2,500 a year ago is around $5,000 now. An RTX Pro 6000 with 96 GB went from roughly $8,000 to $16,000. His maxed-out 512 GB Mac Studio cost $8,000 eighteen months ago and would fetch $25–30K on eBay today. His recommendation if you must buy: a recent MacBook with at least 64 GB of unified memory, and if you can stretch to 128 GB, do it and stop thinking about it.

Fine-tuning is not how you give a model your data

This came out of an audience question and it’s worth pulling out, because it’s one of the most common misconceptions Pratik runs into.

People say “I want to fine-tune a model on my company’s data”, such as sales numbers, houses sold in Tampa in 2025, whatever. That’s the wrong tool. Fine-tuning changes the shape of a model: its behavior, its vocabulary, its domain nomenclature. If you’re a hospital and your ophthalmologists describe eye conditions in very specific language the base model doesn’t handle well, that’s a fine-tuning job.

Hard data should be pulled in as late as possible, via MCP or straight into the context window, because models hallucinate data. Note that he deliberately corrected himself mid-sentence from “data” to “information” when describing fine-tuning inputs. That distinction is the whole point.

The room pushed back, which was the best part

Two solid challenges came from the audience, and Pratik didn’t dodge either.

“Isn’t this just waterfall, which we spent 20 years learning to hate?” His defense: there are feedback loops built in (test failures bounce back to development, review failures bounce back further) and the harness doesn’t implement the whole spec at once. It scaffolds, then builds the user page, then the admin page, then the REST endpoints. Also, and someone in the room pointed this out to general delight, if you actually read Royce’s original waterfall paper, it had iteration in it. The verdict was tabled for the bar.

“Every one of those artifacts is itself a product you have to maintain.” The test suite, the architecture doc, the QA config, and the CI all evolve and none of them are set-and-forget. Pratik conceded the point. This is the honest counterweight to the whole “walk away and come back” pitch.

So did the MLB odds app work?

Sort of. Which is more honest than most demos.

The first run got killed partway through because it wasn’t doing what he asked. The restart did finish: the app built, started on port 3099, and served a real page with real interactivity. Clicking around ran an actual simulation under the hood.

The problems were exactly the ones you’d predict. Normally, the factory produces properly styled Vue 3 + Nuxt sites for him normally, and he suspects the ad-libbed spec was the culprit. And the numbers were nonsense. The Rays were given a 0.3% shot; someone noted the data looked very old. Pratik’s response: “I didn’t tell it where to go get the data from. So yeah, I was very lazy.”

That’s not a failure of the factory. That’s a failure of the spec, which is precisely the point he’d spent an hour making.

Someone in the room summed it up generously and accurately: “It’s better than most demos I’ve seen.”

Limitations, stated plainly

• This factory is good for small to medium projects. Larger ones need heavier machinery (he name-checked obvious.ai in Atlanta, who sell an industrial-strength factory as a service).
• The demo was greenfield. You can put a factory on top of an existing brownfield codebase, but you’ll need a discovery pass and a hand-built architecture.md first.
• There is no standard. What a car repair shop needs from a software factory and what an airline needs are different things. Pratik thinks some standardization is coming, but he’d put it at least a year or two out.
• Everything in this space has a shelf life measured in weeks. His own words: “What I tell you today is the right way to do it will be antiquated and the wrong way to do it a month or two from now.”

Takeaways

If you only keep five things from this one:

1. A software factory is process, not vibes. The difference between a factory and one-shotting an app in a chat window is that the factory wraps the model in software engineering discipline: specs, architecture, staged implementation, tests that loop back on failure, QA, security review, and a git history you can roll back. Vibe coding has none of that.
2. The harness matters more than the model. This is the highest-leverage idea of the night. A well-built harness plus a cheap 27B local model can match or beat a frontier model driven sloppily, at a tiny fraction of the cost, and without shipping your IP to somebody else’s training run.
3. architecture.md is your job and nobody else’s. The factory will happily build the wrong system beautifully. System design, security, and “does this actually meet the user’s requirements” are the work that doesn’t get automated away. Be the team lead, not the typist.
4. Garbage spec in, garbage app out, and the MLB demo proved it live. The parts of the app that failed were the parts Pratik never specified: the styling and the data source. If you find yourself blaming the model, check the spec first.
5. Start small and build your own. pi.dev plus a handful of Markdown skills is a genuinely approachable starting point; Pratik’s entire spec-analyst skill is one short paragraph plus a checklist. Point it at a paid API if you don’t have the hardware, because right now is a genuinely bad moment to buy GPUs. And keep the context MCP server in mind, because your local model’s knowledge of your framework is probably a year out of date.

Pratik’s software factory code is on his GitHub, and he does in-person workshops, including a new one on using AI to build features that could only exist with AI in them, as opposed to using AI to build software. He gave that one at KCDC last week. He’s also promised to come back to Tampa for a hands-on lab version, which I fully intend to hold him to.

Oh, and DevNexus 2027 is running ten tracks, seven of them AI. If you’re looking for a conference to go deep on this stuff, that’s the one.

The post Notes from Pratik Patel’s talk, “Building a Mini-Software Factory using Pi.dev and Local LLMs” (September 14, 2026) appeared first on Global Nerdy.

The latest edition of NetFoundry’s regular Reachability Watch articles, covering September 4 – 10, 2026 and written by Mark Jaffe, our Chief Strategy and Marketing Officer, is up:

https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-11/

And with this edition, a new “back of the envelope” drawing by Yours Truly, which shows the “env var” pattern behind two of the CVEs in this report.

In this edition:

• 906 new network-exploitable CVEs
• 96 clearing the CVSS 8.6+ bar
• 5 at a perfect 10.0

Microsoft shipped 15 critical network CVEs in a single release, 14 of them at 9.8, across DNS, DHCP Server, RPC Runtime, USB Mass Storage, and Telnet Client.

The most notable part of this Reachability Watch is this set of CVEs:

• CVE-2026-86124 (9.8): AutoAgent’s inter-agent TCP server executes whatever you send it, as root, with no authentication in the request path at all
• CVE-2026-86121 (9.8): Same outcome in Cua’s computer-server, gated on CONTAINER_NAME being set
• CVE-2026-85661 (9.8): excel-mcp-server reads and writes arbitrary files when EXCEL_FILES_PATH is blank
• CVE-2026-85688 (9.8): TEN Framework’s TMAN Designer API takes unauthenticated file reads and writes with no env var required

The CVEs come from four different projects, but they all have the same shape: reachable by default, with authentication either optional or absent. In two of them, the auth check exists as real code, wired behind a conditional on an environment variable, and it fails open when the variable is missing. It’s not that anyone turned security off; instead nobody confirmed it was on.

Here’s my own opinion of what the main take-away for this edition is: The environment variable may be the headline, but the bind address is the actual exposure. AutoAgent’s server binds every interface by default, not loopback. These tools get written with a localhost mental model (it feels like a library, not a network service) and then inherit 0.0.0.0 from whatever framework default was closest to hand.

The auth flag and the bind address are two independent decisions, and the second one is what turns a local misconfiguration into something an attacker can reach. If AutoAgent’s default bind was loopback, the attack approach would have resulted in a configuration bug and not an unauthenticated RCE, and it wouldn’t have required anyone to write an auth system at all.

All this is the argument for handling reachability underneath the app: An overlay doesn’t care whether the service remembered to check a password, because an unauthorized requester never gets a path to the port in the first place.

Once again, the latest edition is Reachability Watch is here:
https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-11/

The post “Reachability Watch” for September 4 – 10, 2026: Four different CVEs, but they have the same shape! appeared first on Global Nerdy.

This list includes both in-person and online events. Note that each item in the list includes:

When the event will take place

What the event is

Where the event will take place

Who is holding the event

This week’s events

• Monday, September 14
• Tuesday, September 15
• Wednesday, September 16
• Thursday, September 17
• Friday, September 18
• Saturday, September 19
• Sunday, September 20

Monday, September 14

Monday at 5:45 at Entrepreneur Collaborative Center (Tampa): Join Tampa Bay AI Meetup for a rare Monday meetup where Pratik Patel from Hugging Face (yes, that Hugging Face) will talk about pi.dev.

pi.dev is an open-source, terminal-based agent harness that strips away the bloat to give local LLMs direct access to a minimal toolset (read, write, edit, bash). Most AI coding assistants are sealed cloud platforms heavy on dashboards and light on local control, and pi.dev addresses that gap.

This talk will explore how to harness a minimalist architecture to build a local “mini-software factory.” Pratik will show you how to feed a structured application specification to pi.dev and watch it autonomously architect, generate, and test a project end-to-end. You’ll see the exact configuration, prompt engineering tricks, and custom extensions needed to make this work seamlessly using a 100% local LLM pipeline.

Find out more and register here.

Tuesday, September 15

Event name and location	Group	Time
September Saint Petersburg Book Club $3.00 Gateway to India (new!)	Saint Petersburg Book Club Meetup Group	5:30 PM
CEO Toastmasters Online event	Toastmasters Divisions C & D	8:00 AM to 9:00 AM EDT
Using Your Age As An Advantage Online event	Tech Success Network	10:00 AM to 11:00 AM EDT
AI Workforce Academy — Build Your First AI Employee Online event	Orlando AI Magnet Community	10:00 AM to 12:00 PM EDT
Weekly Open Make Night 4931 W Nassau St	Tampa Hackerspace	6:00 PM to 9:00 PM EDT
Disney Lorcana Night Critical Hit Games	Critical Hit Games	6:00 PM to 11:00 PM EDT
Hobby Night Critical Hit Games	Critical Hit Games	6:00 PM to 11:00 PM EDT
Tuesday Coffee and Chat @ Fin and Bean – Carrollwood Fin and Bean	Tampa Bay Mosaic	6:00 PM to 7:00 PM EDT
Paper Reading Hyde Park	Tampa Machine Learning	6:15 PM to 8:15 PM EDT
Florida Podcasters September Meeting Oxford Exchange	Florida Podcasters Association	6:30 PM to 8:00 PM EDT
September Florida Podcasters Association meeting Oxford Exchange	Tampa eMarketing Groups	6:30 PM to 8:00 PM EDT
Loner Seekers Euchre – Tampa Shamrocks Ale House	Loner Seekers Euchre – Tampa	6:30 PM to 9:30 PM EDT
D&D @ Critical Hit Games (Full) Critical Hit Games	RPG-Pinellas	6:30 PM to 11:00 PM EDT
September Book Club: Family, Fate, and Macondo: One Hundred Years of Solitude Mi Sitio Columbian Restaurant	Their Eyes Were Watching Books – Classic Book Meetup	6:30 PM to 8:30 PM EDT
Return to the top of the list

Wednesday, September 16

Thursday, September 17

Friday, September 18

Saturday, September 19

Sunday, September 20

Event name and location	Group	Time
Brunch at Oak and Stone Oak & Stone – St. Petersburg, FL	Geekocracy!	11:59 PM
Sunday Gaming Tampa Bay Bridge Center	Tampa Gaming Guild	1:00 PM to 11:00 PM EDT
Sony Spiderman 2018 Game Meet HOB Brewing	Dunedin-Palm Harbor Video Game Book Club	2:00 PM to 4:00 PM EDT
Sunday Chess at Wholefoods in Midtown, Tampa Whole Foods Market	Chess Republic	2:00 PM to 5:00 PM EDT
D&D Adventurers League Critical Hit Games	Critical Hit Games	2:00 PM to 7:30 PM EDT
Craft Club Cinema Presents: ‍ The Princess Bride Craft-Along Green Light Cinema	St. Pete Knit, Crochet & Fiber Arts at The Common Thread	2:00 PM to 4:00 PM EDT
Saltmarsh and Beyond (5e 2024 D&D Campaign) Cozy Dragon Games	Adventurers of Central Florida	3:00 PM to 7:00 PM EDT
Traveller – Science Fiction Adventure RPG Black Harbor Gaming	St Pete and Pinellas Tabletop RPG Group	3:00 PM to 6:00 PM EDT
Sunday Pokemon League Sunshine Games | Magic the Gathering, Pokémon, Yu-Gi-Oh!	Sunshine Games	4:00 PM to 8:00 PM EDT
Community Hang-out Night Online event	Nerdbrew Events	6:00 PM to 9:00 PM EDT
A Duck Presents NB Movie Night Discord.io/Nerdbrew	Nerd Night Out	7:00 PM to 11:30 PM EDT
Return to the top of the list

About this list

How do I put this list together?

It’s largely automated. I have a collection of Python scripts in a Jupyter Notebook that scrapes Meetup and Eventbrite for events in categories that I consider to be “tech,” “entrepreneur,” and “nerd.” The result is a checklist that I review. I make judgment calls and uncheck any items that I don’t think fit on this list.

In addition to events that my scripts find, I also manually add events when their organizers contact me with their details.

What goes into this list?

I prefer to cast a wide net, so the list includes events that would be of interest to techies, nerds, and entrepreneurs. It includes (but isn’t limited to) events that fall under any of these categories:

• • Programming, DevOps, systems administration, and testing
  • Tech project management / agile processes
  • Video, board, and role-playing games
  • Book, philosophy, and discussion clubs
  • Tech, business, and entrepreneur networking events
  • Toastmasters and other events related to improving your presentation and public speaking skills, because nerds really need to up their presentation game
  • Sci-fi, fantasy, and other genre fandoms

• Self-improvement, especially of the sort that appeals to techies
• Anything I deem geeky

The post Tampa Bay tech, entrepreneur, and nerd events list (Monday, September 14 – Sunday, September 20) appeared first on Global Nerdy.