Given all the different things I’ve worked on in my career, the one thing that’s remained consistent is finding ever worse source code running something important that’s designed to be used in a very specific way without any sort of error handling (meaning it’s waiting to be abused).

• Does it work? Yeah, for the use case specification.
• Does it break? Yeah, when not used correctly.
• Does it break the service? Sometimes, but probably not encountered in the way anyone notices.

Given these factors, it’s going to go unnoticed.

This is the theory for why software should go through code reviews. People should check each other’s work. This is why it should go through quality assurance testing to ensure it works as expected and doesn’t break unexpectedly. This is why there are bug bounties to find problems so they can get addressed before they break things.

But, as long as things kind of sort of just work enough, the garbage will remain out there. AI won’t fix it. AI will probably make more of it. Human code reviewers, QA testers, and bug bounties won’t keep up plus miss things, so AI will take over those roles. Which means it will miss things too, but it will keep up with the code generation.

The questions are:

1. Will things crash and burn because the AI misses something.
2. Will the humans tasked to resolving it, be able to figure out what the AI created?

My Magic 8-Ball says: Signs point to yes about #1 and no about #2.

1. Entire Claude Code CLI source code leaks thanks to exposed map file. Ars Technica. ︎

It feels like a lot to go through them. It feels inefficient to not be able to tell which incident I am checking before I click. And, the design makes me have to check them the most inefficient way possible.

I’ve had this blog since 2000. That’s over a quarter century of messages. Thousands of posts.

I am no longer the same person.

There’s a therapy in putting thoughts into an external brain. Journaling is a good way to help process and not dwell.

This article reads like a beat reporter attended the session and wrote a summary. My problem is I can’t seem to find corroborating information. Nothing on the House Education Committee web site. They seem to post their stuff after the legislative session. I looked in Google searches, the Atlanta Journal Constitution, and need to recall some of the lesser state and Atlanta papers to see if I can find anything about that committee meeting and what was discussed.

I’m of two thoughts:

1. If there’s not a person being assigned to this stuff, then an AI covering and elevating things like this that might otherwise get missed because no one is doing is great. My general impression is the journalism companies are looking to layoff people as their way to profitability, so I’m not sure that’s why I can’t find people doing this stuff.
2. I don’t know anything about this website to trust they are have controls to ensure the integrity of what they publish. And a push to AI for journalism in general means a loss of jobs for PEOPLE. So, it sucks that the ONLY source is this. I’d like to compare the coverage of a handful of articles.

CitizenPortal.ai is a platform designed to help you stay informed about state officials by giving direct access to their original statements and actions while staying completely unbiased and optimistic.

It offers features like deep search capabilities, allowing you to find every word spoken by your representatives on any topic, and AI-generated summaries of government meetings for quick understanding. Additionally, you can create and share clips from a vast library of speeches, interviews, and press conferences, facilitating informed discussions within your community.

From “AI Chief“

=====

I had a flippant reply to this tweet.

And then I spiraled thinking about it.

By the end of ice ages, humanity hunted large mammals like mammoths to extinction. We also eliminated giant sloths, sabertooth tigers, among others.

Hunting these creatures required cooperation, coordination, planning, and execution. They needed many people, acting in concert by understanding and trusting each other to behave in predictable ways. Mutual understanding.

Modern project and operations management needs the same. Managers struggle when all the steps of a plan have to be mapped out in part because analysis can sometimes miss things. Acting in concert by understanding and trusting each other is required for success.

Managers can struggle getting to where workers work well together. Turnover changes team dynamics. Events external to work can create a minefield. People are full of wild variables to navigate. They are the solution, but it takes work.

Systemization creates the promise of making it better. Create an understanding of how it all works. Make the processes consistent, acting in concert by being understood and trustable by all. Like a mammoth hunting party.

Systems work is different. The work can be sustainable. The human element is a difficult challenge here too. So a system to coordinate the systems. At some point the systemization becomes the mammoth. It’s what we hunt and why we cooperate, but in the end we are going to extinguish it. Well, replace it with another “better” system. Better meaning a different one we think will be more efficient but that’s only because we haven’t used it yet. Odds are it’s going to be more complex with more issues and challenges.

What I love about automation is eliminating the need for myself. I create things that do my work so I don’t have to. It frees myself for other things… like doing more automation. The dream of AI is to have something that will create my automation for me so I am freed to… I dunno. Whatever I would do if I didn’t have to do anything?

A critical-severity vulnerability in the Advanced Custom Fields: Extended (ACF Extended) plugin for WordPress can be exploited remotely by unauthenticated attackers to obtain administrative permissions.

ACF Extended, currently active on 100,000 websites, is a specialized plugin that extends the capabilities of the Advanced Custom Fields (ACF) plugin with features for developers and advanced site builders.

Unauthenticated privilege escalation to get admin is about as bad as it gets. Though, it does appear the WordPress blog has to have mapped “role” as a custom field. It’s impossible for anyone other than the blog owner to know if that’s the case. Well, probably spammers and scammers seeking sites to compromise and turn into platforms to exploit might given which ones they successfully turn.

It’s tracked as CVE-2025-14533:

• NIST
• tenable

Podcasts and TikTok content creators often get into the context and meaning. They take the story of the day and wrap it with why it matters and what it could affect. This facilitates understanding. Knowing it happened without why seems counter-productive.

Bureaucracy relies on process and procedure. Follow the process. Stay within the procedures. Stressors remain low as what to do is known and repeatable. Work easily flows as we are doing what we should. It’s order. They also exist to protect the organization.

The exceptions to the process and procedure create chaos. We have to make decisions as it’s often unknown. Though, all too often there’s known exceptions where we know what to do.

When we have to ask others to make an exception, we expend reputational capital. We are breaking the order. Others grant us a favor doing something outside the normal, which likely means more effort in tracking, understanding, and decision-making. In the short term it means a hit on credibility inside the bureaucracy as the procedures exist for a reason. Too many asks for exceptions can break trust as well.

Part of why I overcommunicate is to prepare for the possibility of engaging in reputational repair. Part of asking for the exception will involve explaining the context so the grantors are on my side, part of my team, and we are working together to solve the issue. Also, we may need to work on improving the procedures, which will require building consensus necessitating understanding. Exceptions create a potential of extra work beyond just the simple ask, so I need my boss to know.

Also, my role has become to handle exceptions so my boss doesn’t have to expend so much effort on them. There’s trust in me and maintaining that is giving a heads up with context.

I wonder how many software vendors are going this route because they know their users are increasingly hitting this limitation.

It sucks for Cybersecurity because the whole point of their approving the administrator requests was so they can screen for malware, ransomware, and other potentially problematic software. It’s just so inconvenient to getting our work done to wait hours for an approval. Plus the uncertainty of getting it. (One person was on day two of getting approval.)

The natural response is already in motion to obtain an inventory of installed software and remove inappropriate installs. So, I wonder what the users will do to end-run this new approach. It’s the normal cycle. Administrators forbid something the users need to get their work done, so they figure out a way to do it anyway.

One of the most important skills we taught was to locate salient terms as they influence the answers we get. The more closer to the jargon, the better the research one would find. Better relevant terms, yields results with improved usefulness. Vocabulary worked wonders. Knowing the topic in ways to manipulate the search made research work.

As a result, working in IT, I monitor buzzwords and learn about them. I try to understand them in the current and potential future context. And watch their progress.

AI are replacing search engines, but the same issue remains. We still have to know what to ask to get the right answers.

Additionally, we have to know how to determine the answer validity. For that, we need knowledge to fact check.

It’s reasonable if one knows one is allergic to related drugs, one is to the new one. Like, say you are allergic to penicillin. You reasonably could be to related drugs.

I feel like most people who are allergic have no idea if they are. Or what symptoms indicate they are.

For instance, I had a chronic cough. A new specialist doctor expressed concern about having this cough for five years. He switched me to a different medication, and the cough improved. I was allergic and had no idea.

In my professional life, my job is to fix it, so a vague meaningless error message means hours of trying things. Depending on impact, this might sit broken for days while other things of higher priority get the attention. (Given my position, others come to me with these things they couldn’t figure out.)

In my personal life, I take affront. Providing a layperson with such useless errors seems a disservice. They can’t use the product or service without a reason why. Those like me might work around it, and friends or family sometimes some to me for help. We should all do better about holding the providers to account.

Troubleshooting is an art. It helps to have a wealth of knowledge about system failure modes along with resolutions. It makes sense for professional information technologists who ensure computers remain operational to know. As technology expands, everyone encounters failures more often. Providers know they should trap errors and send something useful. There will be times when errors escape, but most of the time, they should either get automatically corrected or tell the user something useful.

The real problems are the unknown things lurking where one person knows how they work that are fragile and good enough. Until they aren’t. These ticking timebombs lie in wait. That one person keeps them running. They leave. Death, retirement, or even changing jobs means that one person who keeps an important thing going isn’t there anymore. What happens when it breaks? No one knows how to fix it. There’s a period of frustration and anger because it’s broken with no solution.

We see fairly often at the institutions using our services. The one person who knew the authentication system left and it has coasted on fumes for months to years. They keep meaning to upgrade it, but no one has figured it out the passwords to get into the system. (The penetration test found they were the defaults.) The payment gateway critical to accepting funds was managed by that one person who retired years ago. A consultant setup the automation system last year, but no one really knows how it works. It’s just running along doing it’s job until someone complained about all this bad data, only they can’t stop the bad data because no one can update the workflows.

What’s more interesting to me is these things force them or us to address the issue. Custom fragile processes no one, including us or vendors, understand gets replaced with standard integrations. The business process has to adapt to using it the correct way, but that’s the trade off for doing it the right way. That’s hard work to implement. That’s disruptive. The business has to suffer for a while.

Why can’t we do it the right way from the beginning? The business drives innovation. The business wants something tailored to how they want to work and IT helps them get it that way. The business thinks their way is a competitive advantage. The business rewards IT for being helpful. And so IT delivers these custom solutions that give the business ever more fragile solutions. The rewards aren’t more staff to support all the stuff, not that anyone really knows how much support really is needed.

Looking at it tonight, I thought, “East.” Suddenly, it clicked.

My childhood home was east of my grandmother’s house. The most likely time to walk from her house to mine at night is this time of year. (It’s only really visible in the winter when it gets dark earlier.) Orion would sit above my house like a guide. More than likely I would be happy from sweets, games, and stories.

Maybe there’s some association. And it might be all these years later, I am still reminded of these good times by seeing a named collection of stars.

All the past week it was mostly China. Today, it’s the USA.

Why things work the way they do requires understanding how things work. There is in general, but there are also ways that things are not the perfect scenario because the data is dirty, there’s an exception, or there’s a difference. All of these end up needing a modification to the process to account for them.

Maybe we are an exceptional organization because we have so many exceptions?

If any of the things I get involved in were easy, then someone else would have already decided and managed it. I would never know. Things getting brought to me tend to be either questionable or already broken with someone wanting to figure out how to resolve it. Which is fine. I enjoy unraveling the problem and making it better and the conversations around how to not encounter the issue again.

Today, looking through, I noticed an article about a suspicious death and police soliciting for more information. Knowing many of the local Facebook groups are super gossipy, I searched on the victim’s name seeking for find more information.

Instead, I got what looks like a bunch of phishing in the search results. They looks like news articles, but they are fake news organizations. “6 News Mk” is just article after article with the same couple of photos of a “police line do not cross” yellow tape for different events to spam Facebook. The oldest one is from Friday and newest is from Saturday. I would bet they used AI to spew a bunch of posts at Facebook. Some kind of throttling shut down the postings, but no moderation has deleted them. Safely capturing the URL portraying as the full article, it looks like it has a payload.

There’s not really a Facebook option to report that a page is attempting to infect or compromise visitors. (I didn’t link to them because I don’t want my readers to accidentally compromise their computers.)

Also, I found a dozen different ones impersonating a news organizations doing the same for stories about this victim. There’s more of this stuff than results I’d deem legitimate.

I don’t know that staying away from the dark corners of Facebook will help. The goal of these phishing pages is to get them into the news feeds of victims. Facebook needs to do better.

The awareness stuff is all the same stuff with a twist: Be careful.

Over time, I’ve noticed that authentication is more and more cumbersome. We longer, more complex password requirements which make it harder and harder to remember passwords. (Much of what I do is in places password managers cannot see to suggest the correct one, I have to look it up and distinguish between 20+ different options.) We have multi-factor authentication everywhere, so it’s more time remembering where to find the code (an app, email, sms), finding the location, if email or sms waiting and waiting and waiting for it to show up, and maybe getting distracted by something else.

My personal favorite is to get a certain Excel spreadsheet, I have to go through 4 logins and MFAs just to see it. The session cookies don’t apply in some contexts, requiring another authentication only for it to redirect me somewhere else to authenticate again. Rinse. Repeat. Although, everything is slightly different enough to make it questionable when there’s an issue: Is it me or them, and if them which? The service provider or identity provider?

It’s all just a lil bit complicated. Just enough so that people like me are going to be employed in IT for a long time keeping it working. And more layers will get added, making it less likely anyone actually fully understands how it all works. Maybe that one super genius who retired last year? And next year, we will add something to make sure that’s wrong.

Over the past week, I’ve engaged in more than 20 one-on-one chats, have unread messages in 8 different Teams channels, and am currently sitting on over 25,000 unread emails. This level of noise is unsustainable. I find myself relying heavily on memory and mental mapping to locate critical information, which is neither scalable nor efficient.

There’s a clear need for me to leverage intelligent AI agents that can help filter, prioritize, and surface what truly matters. The current model forces us to be reactive and overly dependent on manual recall. Despite my ability to eventually find what I need, the process is inefficient and occasionally embarrassing when I can’t immediately locate key details.

This experience underscores a broader challenge: we need better tools and systems to manage information flow, reduce cognitive load, and support decision-making. I believe this is an area ripe for innovation and investment.

Over the years of giving people the features customers desired, Teams developed into an overly complicated morass of places where information gets lost. It’s no longer simple to use. For some it probably still falls into productivity, but for others it might hinder it.