A refreshed and rehosted Alan.is With the advent of AI and services like Cloudflare Workers, you don't have to be paying for website hosting or making compromises with your look and feel https://alan.is/insights/refresh-rehost/ #cloudflareworkers #rss #feeds #linksharing #qwibbit

With AI, no one can hide Technical debt is no longer just a line item on a balance sheet. It has become an active, accelerating security crisis. For decades, we operated under a collective, unspoken agreement. We built systems that were not necessarily secure; they were just difficult to audit. We relied on the concept of “security through obscurity.” We assumed that as long as our vulnerabilities remained buried deep in legacy code or hidden behind complex, undocumented workflows, they were effectively non-existent. We were not being dishonest. We were simply being pragmatic. In my years running engineering teams and conducting diligence engagements for private equity, I have seen this pattern repeat endlessly. When we perform a deep dive on a target company, we almost always find the same rot. There are unpatched libraries from 2014. There are “temporary” hardcoded credentials that have been in production for three years. There are critical systems still running on protocols that should have been retired during the Bush administration. And yet, these flaws remain hidden. Why? Because patching is a nightmare. Patching requires significant downtime and rigorous testing. If you touch a legacy system that has not been updated in half a decade, there is a legitimate chance it simply will not come back up. The risk of breaking the business often outweighs the perceived risk of the vulnerability itself. Furthermore, there is no real glory in a successful patch. No one throws a party because the system stayed upright after an update. You get no recognition for being right, but you are heavily blamed if you are wrong. So, we kick the can. We document the debt, acknowledge the risk, and push it to the next quarter. We treated technical debt like a manageable interest payment. AI has just changed that entire calculation. The “Black October” PHP crisis proved this is not merely theoretical; it is our new reality. When the php2shell exploits (CVE-2026-109618) surfaced, the industry did not have time for a scheduled maintenance window. It was a chaotic scramble. Even heavyweights like Cloudflare were forced into an emergency cycle, deploying mitigations and pushing fixes in real-time to stay ahead of the exploit wave. This was not a controlled roll-out; it was survival mode. The most concerning part is not just the scale; it is the catalyst. As researchers at Wiz pointed out, these flaws have existed for years, but frontier AI models changed the fundamental math. They reduced the barrier to entry so significantly that they turned longstanding, complex vulnerabilities into repeatable, automated exploits. The “obscurity” we relied on did not just fail; it was actively dismantled by the very technology we were using to build the future. This is exactly what Jason Clinton, Anthropic’s Deputy CISO, warned about this week. Looking at the chaos of the PHP meltdown, his message was blunt: “As bad as things have gotten in the past four days, they are going to get a lot worse before they get better.“ He is not talking about a temporary spike. He is warning of a “vulnerability tsunami” that will arrive before we have the capacity to patch our critical infrastructure. His advice to leaders was not to buy more AI defenses; it was to go to your boards and demand help for the basics. We need to fix the foundation before the flood arrives. The era of “later” is over. AI does not care about your sprint velocity or your quarterly roadmap. It does not get tired, and it does not have a bias toward stability. If an LLM-driven agent can crawl a codebase, it acts like water. Water finds every crack, no matter how small or how deep. We used to assume that exploiting a complex, undocumented vulnerability required a level of human effort and specialized knowledge that made most “small” holes not worth the trouble. We banked on human laziness. We assumed attackers would not have the time or the motivation to hunt for that one specific, obscure flaw in your PHP implementation. That assumption was our greatest vulnerability. AI has commoditized the hunt. An automated agent can now perform the work of a highly skilled security researcher in a fraction of the time and at a fraction of the cost. The “obscurity” we relied on has evaporated. The holes are being surfaced not by malicious intent alone, but by the sheer, indifferent efficiency of the technology itself. For leadership, this changes everything. You can no longer treat technical debt as a secondary concern to feature delivery. You cannot “plan” to fix your security posture in 2027. The tools required to dismantle your infrastructure are already here, and they are getting faster every month. If you are still relying on the hope that nobody will bother to look under your rug, you are not managing risk. You are just gambling with a deck that is being shuffled by an algorithm. The cracks are there. The water is flowing. It is time to start patching. If you need help navigating this, reach out to us at ThinkLikeaCTO.ai, where we are helping organizations think through the complex issues facing the CTO in the AI era. P.S. Marge helped review the post. Gemini produced the “Lord of the Rings (2001)” image and the little video of the AI overlords seeking out all those bugs! https://alan.is/insights/with-ai-no-one-can-hide/ #php #blackoctober #ai #rss #feeds #linksharing #qwibbit

What You Lose When Your AI Coding Tool Can Revoke Access A developer posted a screenshot on Reddit this week. His Android TV used to crawl. Sponsored tiles in the launcher, telemetry phoning home, menus that took a second to react to every button press. Now it runs like an Apple TV. He pointed Claude Code at the box over ADB and told it to strip out the bloatware. That was it. This is what AI is fantastic at, opening up opportunities for those that can dream up the problems needing to be solved. The average person 5 years ago, would never have thought of rewriting their Smart TV software due to the sheer learning required to do so. Now it’s less than evening’s project. TechCrunch ran the story and Tom’s Hardware followed. It is a good story. Then I went back to Reddit and read the comments, and the mood changed. The Bans As more people try this, the same kind of post keeps turning up. Somebody asked an AI agent to do something to their own hardware, got a refusal, pushed again, and later found the account flagged or suspended. I have not verified every one of these, and some will be people leaving out the bit where they did something daft. But there are enough of them now that it is a pattern. This thread in r/aiwars is one example, and it is about ChatGPT, not Claude. So this is not one vendor having a bad week. The policy language is there if you want it. Anthropic publishes its safeguards, warnings and appeals page, and it is written broadly enough to cover almost anything a lawyer wants it to cover. Here is the part that gets me. Nobody is attacking anything. A man wants to remove an ad launcher from a television he paid for and put in his living room. That is the whole crime. Fair Is Fair There is a reasonable defence and I should give it. ADB access, bypassing protections and modifying firmware sit very close to things that cause real harm. A vendor that lets its agent do anything on any device is a vendor that gets sued the first time it bricks something or helps someone break into something. Blanket caution is cheap. Judging each case is expensive. I accept all of that. It still does not explain why the line lands on a man deleting an ad package from his own TV. A classifier that cannot tell that apart from an attack is a classifier that has been tuned for the vendor’s comfort, not for the user. And the vendor’s comfort tends to line up neatly with the comfort of the companies selling the TVs. The Cognitive Lease We have never had a coding tool tell us no. A compiler does not care what the program is for. An IDE does not read your commit and decide it dislikes the politics. You could write whatever you liked and the tool did what it was told. AI agents change that. When you hand your thinking to one, you are not buying a tool. You are renting reasoning capacity from a company, on terms they can rewrite, and they can end the arrangement without asking you. I call that a cognitive lease. You get the output while you stay inside the lines. You lose it when the landlord decides you have crossed one. Think about what that does to the old argument that a human employee might refuse too. They might, and you can hire another one. You cannot hire another Claude. The refusal is in the weights, the weights belong to somebody else, and the account is the only door. Who Owns the Box The TV is the same story from the other direction. You think you own the plastic, the glass and the silicon. What you own is a licence to a device built to serve an advertiser. The manufacturer wants the tracking on and the ads in the launcher. Removing them breaks the business model, and that is why the debloat story went round at all. Now put the two together. The hardware vendor has locked the device down, and the AI vendor will not help you unlock it. Neither of them cares about your reasons. Both of them have an interest in you leaving things as they are. The Move Local The people in those Reddit threads are not arguing about it for long. They are installing Qwen and other open weights models. Local models are slower than the big hosted ones and they need real hardware. They also carry their own safety tuning, which is more or less strong depending on who trained them. What they do not have is an account to ban. Nobody reads your prompts. Nobody changes the terms on a Tuesday. For a job like debloating a television, a model that is a bit slower and does what it is told beats a clever one that might lock you out. I expect two tiers to form. One is the hosted tier, convenient and capable and moderated, with an account behind it. The other is the local tier, rougher and entirely yours. Most people will use both. The question is which one you let your business depend on. What To Do About It If your product, your pipeline or your team depends on one AI provider, you are a tenant. Check your lease. Build on a layer that lets you swap the model underneath. Keep your prompts, your tools and your test cases in your own repository, not in a vendor’s console. Run a local model for anything you cannot afford to have switched off, and test that it actually works before the day you need it. The vendors know loyalty to any given model is close to zero, which is why they push their own tooling so hard. Do not let a convenience feature become a dependency. Own your hardware. Own your stack. Then nobody can serve notice when you decide to flash your smart kettle. P.S. Marge helped review the post. Gemini produced the “Men In Black (2019)” image, and Facebooks Muse the coder at the table. https://alan.is/insights/cognitive-lease-ai-coding-agents/ #codingtool #access #reddit #claudecode #adb #hardware #fair #cognitive #ai #rss #feeds #linksharing #qwibbit

DeLorean vs Tesla: The Race to Build the Ultimate Flying Car I was scrolling through the news this morning when a headline caught my eye. DeLorean is entering an eVTOL racing series called Airspeeder. It sounds ridiculous. A brand that essentially exists as a ghost of 1980s cinematic longing is now claiming to be the original flying car brand. They are even partnering with university engineering teams to design a racer for the 2027 season. It is a classic move. When you lack a real product roadmap or a manufacturing base that can compete with the giants, you buy a legacy. You wrap your ambitions in stainless steel and gullwing doors because people remember how they felt when they saw them on screen. It is not about engineering excellence. It is about brand equity harvested from a movie. Somewhat timely given Tesla’s recent marketing junket showing off their “flying” roadster. The Ghost Brand Trap This is what I call Legacy Laundering. It happens when a company with more name recognition than actual substance tries to leapfrog the hard work of fundamental innovation by attaching itself to a high-profile trend. They do not build the engine, they do not solve the battery density problem, and they certainly do not own the sky. They just sign a contract to put a logo on a spec chassis. The problem with DeLorean is that its legend was built on a lie. The actual car was a mechanical disaster, riddled with electrical faults and build quality issues that made it more of a liability than a luxury. Its only real claim to fame wasn’t engineering; it was being the prop for a movie about time travel. I remember all the hype at the time in the UK: factory in Belfast, Thatcher hailing it as a great job creator, and then John DeLorean caught in a drug bust – tit. It was built on lies. Had it not been for the movie, the car would have faded into obscurity. They are not building a future; they are trying to squeeze every last drop of sentimentality out of a cinematic memory. It is a desperate attempt to trade on nostalgia because they cannot stand on their own merits. They are reversing into a legacy that was, in reality, a nightmare. The Racing Circus The Airspeeder series itself is part of this. It is a racing league for electric vertical take-off and landing vehicles. It is high tech, it is flashy, and it is incredibly unproven as a commercial or even a sustainable sporting endeavor. By bringing in names like DeLorean, the organizers are trying to manufacture instant relevance. It doesn’t even look like a frigging DeLorean – fucking behave! We all seen Doc flying off in the car at the end of the first movie so we know the car CAN fly! They want you to think this is the beginning of a new era of transport. In reality, it looks more like a high-speed marketing exercise. They are using student teams from UC Berkeley and Georgia Tech to do the heavy lifting on design. That is fine for education, but it is a strange way to build a serious industrial racing program. It feels like they are building a toy rather than a tool. The Demand for Originality Stop celebrating the resurrection of ghosts. If you want to build something that matters, build it from the ground up. Do not try to sell us a dream that was actually a mechanical nightmare. There is a reason we are not all driving around in DeLorean’s! Build something new. Or do not bother. P.S. Marge helped review the post. Gemini produced the “Back to the Future” image, and Facebooks Muse, created the DeLorean racing through the desert. https://alan.is/insights/delorean-vs-tesla-the-race-to-build-the-ultimate-flying-car/ #ultimateflying #flyingcar #tesla #race #delorean #brand #legacy #racing #airspeeder #ghost #rss #feeds #linksharing #qwibbit