• Palette Inspiration – Timeless Colors of the Great Masters – Go crazy with color pallets from famous paintings.
• ‘It simply fills my life and saves me’: Inside Varya Yakovleva’s sketchbooks
• Artist Ray Exworth hid awe-inspiring art installations inside his sheds – ”An eerie head installed in ‘The Shed Opposite the House”
• Paul Carus’ The History of the Devil and the Idea of Evil (1899)
• shadcn/ui – The Foundation for your Design System – I think this is, like, an abstract design system of all types of components. Then, you can customize it to your look and feel?
• Nothing is boring in America – The unique, micro-tourism destination of America. More from touring everyday America through British expat eyes.
• AI scaffolding to summarize stuff to five levels of zooming in. – This has some Zettelkasten vibes but seems more like something for the robot rather than the human.
• The AEO Guide: Answer Engine Optimization from Strategy to Scale – SEO of AIs.

The Netherlands’ Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout.

Europeans are, of course, interested in reducing their dependency on American tech. And, sure, why not?

You can imagine the opposite: if America was dependent on France for email, Germany for CRM, and The Netherlands for IaaS, we’d probably be upset about the dependency – more than likely our usual nativist tendencies would kick in.

Sovereign cloud, in this case, means “not American tech.”

Avoiding US tech sometimes means moving to open source, which carries the assumption of lower costs. There’s an opportunity for the EU to do some major funding of open source software by directly hiring and paying open source maintainers. Paying the stability and security of EU society – affordable, if “free” health insurance for the whole family – would be a nice part of compensation.

Meanwhile, Netherlands police recently seized a server running in Amsterdam, it seems, at the request of American authorities:

In a written response to the ANP news agency, Amsterdam’s Public Prosecutor’s Office stated that the seizure was carried out under the mutual legal assistance treaty between the Netherlands and the U.S. In this case, the prosecutor’s office said there was no ground for refusal. It also noted that the seized data have not yet been shared with the U.S.

As one person said: “You can’t solve legal problems with technical solutions.”

Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybersecurity would have prevented it.

Here in the Netherlands, there was a similar grocery store hack. It took a few days to get things back on track.

🔗 Fridge hack costing millions and sparking fires stemmed from poor security

IBM’s real differentiator is not within its products, but in the lived experience of taking out 30% of the operating cost of a 115-year-old, 280,000-person enterprise, along with the playbook, assets and culture change that came with it… A harness built for one company over two and a half years is a story, but a harness installed in 25% of clients is a business.

🔗 IBM doesn’t need to sell more products, it needs to sell the Enterprise AI Harness it built on itself

🔗 Your Software Supply Chain Risk Doesn’t Stop At Your Suppliers

A large part of portfolio marketing’s success was in evangelizing these deliverables — getting sales and marketing across the revenue engine to read, remember, and act on them.

AI engines aren’t so resistant. Instead, they demand context. These same assets can now serve as inputs into systems. Sales no longer has to struggle to find and make sense of a battlecard — instead, they can ask an agent to help them compose a response to a hard question. Instead of interpreting a messaging document, demand marketers can ask a messaging agent to refine their campaign materials. These tools dramatically expand the impact of portfolio marketing’s expertise. The requirement for portfolio marketing is to ensure that these deliverables are up to date, unambiguous, and on target.

Marketing people are often one of the least technical groups in an organization. The bias against “slop” means they can’t just shoot out AI generated content. Well, that is bad. There’s probably a couple years of arbitrage: marketing organization that go full on Claude crazy¹ and build systems around AI – instead of just slides and “battle cards” – have an advantage.

🔗 Portfolio Marketing’s AI Honeymoon Is Over

Also, something called MARGE.

Across the cubical farm we heard the finance manager yell outloud “who the fuck is going to pay for all these Cokes?”

RentAHuman launched in February 2026 with the specific idea that agents could seek out people and assign tasks through an adapted server. In practice, the assignments are short, concrete actions that require a body. “Right now jobs are basic because we are focusing on tasks anyone can do,” Liteplo says. “Still, many skilled tasks are posted, such as photography, security audits, and software testing.” Only half of those jobs require a physical body in the world: “The most frequent assignments were marketing campaigns, creative tasks, field research, hiring, and technology or development. Physical errands were 48.5%, which means half were not,” YeckehZaare says.

But:

“Of the 779 listings I analyzed, 676 (87%) were labeled as published by ‘human,’ 72 by an agent or AI bot and 31 as ‘other.’”

Of more interest, an artist figures out a new way to incorporate AI into some performance art.

🔗 Hire a human: The future where AIs get people to do physical labor is upon us

There is a danger associated with growing up, of putting aside children’s books. We must be careful lest all we are left with is a world that is very much not alive, a natural world that is mere piles of stuff – stuff that people can use or not use, preserve or destroy, just as they want. When Lewis wrote about giants rising from the mountains of Mourne, it was a Romantic idea. There was nothing very practical about it. We weren’t yet aware of climate change; the natural world was not yet in crisis; species were not going extinct at the rate they are today. Now we need an idea of the natural world as something that has value and life of its own, quite independent of us. This would have been so obvious to people in the past that it would not have been worth stating, but 200 years after the Industrial Revolution our sight has become a little clouded.

🔗 Author Susanna Clarke: in defence of fantasy fiction

ICYMI

Original content published since last time.

• The Bottom Fell Out Of The Software Industry – Software Defined Talk #594 – “This week, we discuss AI yes/no deciders, the SaaS apocalypse, Bending Spoons, and Oxide’s funding.”

Related to your interests

• Six Principles, Five Patterns and a Named Human Accountable for Every AI Workflow – The same models and vendors produce radically different results from one organization to the next, so the differentiator is the operating system the technology lands in…so the CEO has to rebuild decision rights, accountability, skills and goals around them, starting with naming who is accountable for every AI-enabled workflow.
• Your agents need a platform – “Agents need a platform to keep them healthy and on-track.”
• Accenture Tells Employees They Can Now Spend Only $29 on Claude Per Month – There’s so much (more) shadow IT in the future of Accenture and other companies.
• Berkshire Hathaway invests further $330 million in Bending Spoons following $600 million IPO investment – Probably the most interesting tech PE firm there is.
• Ten of the most bizarre films and their posters
• Iosevka – A typeface for all your code needs. If you push the weight up enough, it looks OK for regular text too.
• MS Clipart Search – Find 90s era clipart.
• Soviet-Era Illustrations of J. R. R. Tolkien’s The Hobbit (1976)
• Dutch meat consumption continues to decline, with pork seeing biggest drop – “[A]verage person in the Netherlands ate around 33.7 kilograms of meat in 2025, compared with 34.4 kilograms a year earlier.”
• Postgres 19 delayed after AI reviewers find more bugs than humans can fix

Upcoming Talks

• DevOpsDays Istanbul 2026 – Istanbul, Turkey, October 24th, 2026. Keynote, title to come.
• VMware Explore on Tour 2026 London – London, UK, November 18th, 2026. “Build a Platform That Developers Want to Use”
• Cloud Native Denmark 2026 – Copenhagen, Denmark, November 19th, 2026. “What goblins and druids can teach us about enterprise AI”
• Build Stuff 2026 – Vilnius, Lithuania, December 2nd-4th, 2026. “What goblins and druids can teach us about enterprise AI”

Logoff

The format of this newsletter is a bit all over the map. Should it be a list of everything from my week of blogging and link reading, or just the stuff I haven’t posted yet? Who knows. I lean to the second, as actually blogging links as I find them is the more reliable “actually post it” workflow.

Meanwhile, it’s conference and travel season: that time before December, and after August. I’ve got travel each week in October.

Want to subscribe to this newsletter and get it in your email? Do that here. You’ll just get this type of link and post round-up, not everything posted on the weblog.

“Enterprise and consumer AI revenue will be insufficient to support profitable returns on all planned AI capital expenditures during this period,” said Gartner Senior Director Analyst Will Sommer. AI data center owners would need to generate $8.5 trillion in revenue through 2030 to cover announced capital spending, financing costs and expected investment returns, he said. “However, total enterprise and consumer AI revenue that can be attributed to AI data centers during this period is forecast to reach no more than $3.6 trillion.”

🔗 AI datacenter capex will far exceed forecast revenue through 2030

And so they decided to build the solution internally, forming a team, hiring new talent, and giving them access to the AI tools they needed. Six months and significant investment later, the internal team had produced basic prototypes. But it couldn’t manage what practitioners call the “last mile”: handling complex regulatory requirements, coordinating multiple AI agents, and making the tool reliable enough for everyday use. The bank eventually re-engaged the vendor, who deemed that it would take them more time to fix what the bank had built than it would for them to build out their original pilot from scratch—which is what the bank ended up hiring them to do.

🔗 Turn Vibe-Coded Prototypes Into Tools Your Company Can Actually Use

According to the cybersecurity professionals CSO spoke with, one of the biggest cybersecurity failures by the frontier AI labs is the lack of implementation of tried-and-true containment practices that stretch back to the 1990s, such as setting up secure sandboxes that would effectively bar agents from escaping their test environments.

These are things that we’ve been dealing with for years," Rob T. Lee, chief AI officer and chief of research at SANS Institute, tells CSO. “There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out.’”

🔗 AI agents aren’t “going rogue.” Frontier labs are skipping security basics.

What is the diffusion gap? It’s the delta between what you can accomplish with models (ie how powerful they are) and how the average person uses models.

🔗 Unrealized potential in normie AI use

Related, from the ponders at Anthropic:

1. Anthropic staff expect much larger productivity gains from AI on the tasks it is well-suited for. Among US adults who use AI at work, 26% say a task takes a quarter of the time or less with AI, compared to 59% of Anthropic staff.
2. When it comes to their own job, over half of Anthropic staff expect AI to be able to do at least 80% of their current work by 2030, compared with 5% of US workers.

Human coordination grew rather than shrank. Median meeting time is up 20%, and 16% even for technical individual contributors. Agents showed up in nearly half of public Slack channels but layered on top of human communication instead of replacing it. Decisions made privately are invisible to agents, so the workplace pushes toward doing work in the open.

Summarized by AI.

🔗 Anthropic Studies Itself: Junior Tech Hires Fall From 27% to 9% as Agents Log 6x Human Hours and Attention Becomes the Bottleneck

UK government pilots cut legacy-system discovery from weeks to hours – five weeks to under a day for 33 Clojure apps, 15 days of manual regression testing to 30 minutes – and the real gain is that modernization work nobody could justify starting becomes cheap enough to plan. AI speeds up understanding the old system; it doesn’t replace the governance and engineering needed to change it.

Mostly summarized by AI.

🔗 UK GDS Pilots: AI Cuts Legacy-System Discovery From Weeks to Hours, but Only Amplifies Existing Delivery Capability

Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday.

Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week.

🔗 Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified

The trouble with standard templates is that everyone uses the defaults. Before you know it, everyone’s slides look the same. People ignore boring things, so there’s value in breaking that monotony.

🔗 Build your slide template

Geopolitical implications and polarisation are very much in people’s minds (inside and outside work). There is no avoiding discussions about the risks of relying on US inference providers, and the insularity of Europe regarding ownership of both core infrastructure and skilled resources is excruciatingly obvious to everyone even as they try to keep the business running.

🔗 11 Years at Microsoft

“I am just very reluctant to spend a lot of energy quantifying it because it winds up wasting a lot of people’s time inside the institution when we actually need to get them to focus on doing things… as much as important and dramatic and exciting as this theme is, it takes a long time to really do things that are visible at an institution of our size.”

Barnum also said that the $2 billion annual AI investment figure previously provided by Dimon was “not exactly right” and said the actual spend was around $700 million annually.”

Indeed. Does one measure the ROI of email or Excel?

🔗 JPMorgan: Quantifying AI benefits is “wasting time”

• Workday goes headless, opening its HR and finance data to outside AI agents – This would make hundreds of thousands of people’s lives better without having to even wakeup enterprise ROI meetings.
• Practitioner Voice – How to write technical stuff, or anything else instructive, that isn’t boring.
• IDC’s Worldwide and Regional Developer Forecast, 2026–2030 – Worldwide developer population projections expand from 44.8 million in 2026 to 53.3 million in 2030.
• IDC Survey Spotlight: How Is AI-Generated Code Share Changing Across Industry Verticals? – Survey findings indicate AI-generated code now accounts for 50% of production code across industry verticals, requiring agentic testing and governance to manage machine-generated volume.
• IDC Survey: Open Source Software Trends, 2Q26 – Roughly 70% of enterprise workloads run on open source software across every stage of the software development life cycle, establishing community and commercial OSS as production defaults rather than cost-cutting experiments.

The above are links for you, dear readers, that do not have their own post on the weblog. Filed from FRA.

Original: Patchmageddon: The race to patch software vulnerabilities before zero-day cyber-exploitations proliferate by Michael Cembalest, J.P. Morgan Eye on the Market, July 22, 2026. (PDF)

Summarized by AI.

Beyond Detection Engineering: Building Security Engineering at Scale AI is only as useful as the engineering foundation around it. If the data isn’t normalized or the documentation doesn’t exist, the model has little context to work from. Instead of asking, “What can AI do?” we started asking, “What engineering work can AI help us do faster?”

It became another engineering tool. It accelerated research, helped analyze coverage, identified gaps, and assisted with drafting detections that the team could make production ready.

Many organizations expected AI to create maturity. It does not. Without consistent telemetry, governance, validation, and engineering discipline, AI simply helps organizations move faster in the wrong direction.

AI didn’t change the job. It changed how much of the job we could spend doing the work that matters most.

🔗 Beyond Detection Engineering: Building Security Engineering at Scale

• Digital sovereignty: Federal government withdraws from AI partnership with Mistral and SAP – “The [German] federal government is withdrawing from the partnership with Mistral and SAP. The decision fuels doubts about Europe’s path to digital sovereignty.”
• Home Depot and Lowe’s share a common goal for their AI assistants, but their strategies diverge
• Cabinet recognizes: Cloud Act can collide with AVG and give access to Dutch healthcare data – [Translated:] Furthermore, there is no insight into American access to Dutch patient data. The US government can secretly request our healthcare data. The government does not know if Dutch care data has ever been requested. The lack of reports is certainly not proof that such requests do not take place.”
• Not enough nerds left Twitter, it’s still relevant – “Since that blog post, Federico Viticci and John Voorhees returned to X. Other people started posting to X who had never even posted to Twitter before, like Jensen Huang and Jeffrey Katzenberg. While I still believe X is doomed in the long run — closed, rudderless, and toxic to many — the AI community has held on to a remnant of the old Twitter, and in fact that community is growing, apparently immune to the decay of a platform that has no soul.”
• Tiny5 – “Tiny5 is a family of compact 5-pixel variable fonts that capture the essence of 1980s – 90s digital minimalism. Inspired by the graphing calculators and pocket gadgets of the era, they distill letterforms to their absolute essentials – proving that even at just five pixels tall, clarity, charm, and personality can thrive together.”
• PC Market Woes Continue: Shipments Fall 20.1% in Q3 2026 as Pull-In Hangover and Supply Constraints Bite – IDC – ”Worldwide PC shipments fell 20.1% year over year in Q3 2026 to 62.7 million units, according to preliminary results from IDC Research (IDC), the second consecutive decline and a deeper one than the 3.8% drop in Q2. ”
• Anime, etc., now completely normal, even for the olds – “A new NRG survey commissioned by anime streamer Crunchyroll found that in the United States, the percentage of consumers aged 13 to 54 who watch Japanese animation at least weekly increased to 41 percent this year, up from 39 percent. The percentage of daily watchers also increased to 21 percent from 13 percent in 2025. The idea that people age out of anime was rattled by the survey, with 58 percent of viewers aged 45 to 54 indicating that their fandom had intensified.”
• AI coding has made CI a bottleneck, so we reworked ours to keep up – “Some of our earliest gains required almost no optimization of CI itself. Moving our workloads off GitHub Actions to third-party runners with faster CPUs, higher-performance storage, and better cache infrastructure gave us faster machines to run the same pipeline on. In a like-for-like comparison of the two days either side of the switch, jobs ran 34% faster on average, with some workloads like tsc dropping 52%.”

The above are links for you, dear readers, that do not have their own post on the weblog.

At Dreamforce 2026, Salesforce spent a good chunk of its keynote telling customers they might never need to log into Salesforce again. That’s a remarkable message from a company whose web UI has been the center of its business for more than two decades, and it connects the two biggest takeaways I had from the event: Salesforce is flattening the personas it serves, and it is relinquishing control of the user interface. – Rachel at RedMonk

And:

Other software companies, they think their product is the UI. But that’s not what we think at Salesforce. At Salesforce, our product is the trust that all of you, our customers, put in us to hold your data. To hold your workflows, your business processes, your permissions, your security rules. That is the Salesforce product. – Patrick Stokes

🔗 Dreamforce 2026, RedMonk

Over six months of scanning some of the world’s most widely used open source projects, Anthropic’s models surfaced more than 29,000 candidate vulnerabilities. Its human review pipeline, which relies on six external security research firms to reproduce and triage findings, has worked through only about 6,000.

A disclosure dashboard puts some numbers behind the problem. As of October 2, outside security firms had confirmed 5,674 of the 6,123 findings they reviewed as valid, but only 516 vulnerabilities had been patched upstream.

🔗 Claude found 29,000 possible bugs in open source. Only 516 have been fixed.

But, forks take longer:

On predictors: custom patches matter most. Packages Google had patched took three times longer at the median than unpatched ones, and “Google-specific patches or customization” was also the single most-cited reason engineers gave for a slow update. Volume of external dependencies, package size, and upstream change velocity tracked effort as well, while package age and how heavily a package was used internally showed no consistent relationship.

The practical reading is that forking and patching is where the maintenance bill accrues, not consumption itself.

Summarized by AI.

🔗 Google Measures the Cost of Keeping Open Source Up to Date: Half of Updates Take Under 2 Hours, Custom Patches Triple the Median

If your employer has banned the use of AI, you should quit and find a company that is already going through an AI transformation.”

If your team is too busy doing their new job to experiment with AI, you’re preparing them to be replaced. Maybe you’re okay with this, but hopefully you’re not, because it should weigh heavily on you if you truly care about your team.

Sometime in the next six months, you’re going to have to start having some hard conversations about moving people on from your company. You should already be putting your employees on a vitality curve and ranking them. Naturally, competent employees who have been using AI will be ahead of competent engineers who haven’t.

🔗 if your team is too busy doing their ‘normal job’ to experiment with AI, you’re preparing them to be replaced

Right now, your washing machine is subject to more safety rules than AI. Every carton of milk that you see in the grocery store is subject to safety rules and inspection.

🔗 AI is less regulated than milk, Microsoft president says

ICYMI

Original content published since last time.

• Markdown for the Masses – Software Defined Talk #593 – “This week, we discuss Google Docs finally getting Markdown, Cloudflare’s CF CLI, Gartner’s agentic AI abandonment stat, and forward deployed engineers.”
• Animated Bedtime Stories, Telling Dummies What to Do, and Why Docker Lost, with Viktor Farcic – Software Defined Interviews #128 – “Viktor Farcic makes animated bedtime stories about tech history because he decided people should not have to look at his face. He also runs 20 to 50 agents at once, has them argue with each other, and reviews their work off a private YouTube channel in the morning.”

Related to your interests

• Beyond the Kubernetes complexity: Delivering an AI-Ready Platform Developers Love (Over Lunch) – What a proper platform looks like. You know, a PaaS.
• The Cloud Admin’s Path to Platform Engineering – A call to get VI admins interested in platform engineering: ”Your Challenge: if your platform team redesigned the infrastructure layer tomorrow, would anyone think to call you [a VI admin] first? What could you ship in the next 90 days to change that answer?”
• Is sandboxing sufficient to contain rogue agents? – “AI alignment isn’t really the problem here: labs just need better infrastructure.”
• VulnCheck: CVEs Up 45% in 1H-2026 but Exploitation Up Only 10%, and AI-Found Bugs Get Exploited at the Same 1.3% Rate as the Rest
• IBM and Red Hat patch 400-plus unknown Java flaws, open Clearinghouse for fix requests – Putting those 20,000 developers to work! A whole or bugs being found and fixed everywhere. Related: What Developer Teams Should Do Differently.
• Jevon’s Paradox, 70s Hollywood Edition – The editor became very important. So, like: what if same for AI?
• Apple Says It Will Further Lock Down MacOS in Response to Third-Party A.I. Agents – It’s probably a good idea, but it will be very annoying for the AI-crazed…like myself.
• Unspecified Full Disk Access Screw Tightening – Finer grained and more transparent access controls on MacOS (that have CLI options instead of just hard-enforced GUI modals) would be cool.
• Europe Needs 105,000 More Bike Mechanics by 2032 as Maintenance Barriers Keep 121 Million From Riding More
• Tom Cruise’s Digger has flopped spectacularly – but I think it is a misunderstood masterpiece – Seems like it’d be fun to watch. Related: ¯\_(ツ)\_/¯
• Scrambled Eggs ‘James Bond’ – “For FOUR individualists: 12 fresh eggs; Salt and pepper; 5-6 oz. of fresh butter.”

Upcoming Talks

• VMware Explore on Tour 2026 Frankfurt – Frankfurt, Germany, October 13th, 2026. “Build a Platform That Developers Want to Use”
• DevOpsDays Istanbul 2026 – Istanbul, Turkey, October 24th, 2026. Keynote, title to come.
• VMware Explore on Tour 2026 London – London, UK, November 18th, 2026. “Build a Platform That Developers Want to Use”
• Cloud Native Denmark 2026 – Copenhagen, Denmark, November 19th, 2026. “What goblins and druids can teach us about enterprise AI”
• Build Stuff 2026 – Vilnius, Lithuania, December 2nd-4th, 2026. “What goblins and druids can teach us about enterprise AI”

Want to subscribe to this newsletter and get it in your email? Do that here. You’ll just get this type of link and post round-up, not everything posted on the weblog.