How to censor MCP servers with Azure APIM

17 Aug 2026 🔖 security iam 💬 EN

To reduce your “lethal trifecta” LLM attack surface, your company should probably prevent employees from using any MCP servers that aren’t censored via an API gateway.

How to unapprove old GitHub CLI operations

17 Aug 2026 🔖 security tips 💬 EN

If I have to use the GitHub Copilot CLI tool, I usually end up approving each file-edit one at a time, because I don’t want to forget I blanket-approved write access, forever, for a whole folder. Turns out there’s a file I can simply backspace it out of.

New computer day game plan

07 Jul 2026 🔖 windows devops 💬 EN

My PC’s been in limp mode for two years, and I finally ordered a new-to-me replacement. Given the equipment I have on hand, and the impracticality of buying much more in 2026’s era of price gouging, here’s the plan. (How lucky that I’ve gotten to learn a lot about enterprise “endpoint” management over the last few years. Potentially a game changer. This will be my first round of trying to do “new laptop day” in a repeatable, low-pain fashion.)

Microsoft 365's Agent Registry should list tools

29 Jun 2026 🔖 security iam 💬 EN

Microsoft’s new Agent 365 Agent Registry should list desktop IDE client tools like the GitHub Copilot CLI, GitHub Copilot VSCode Chat pane, etc. Anything less sells enterprises a security story that isn’t meaningful.

GitHub Actions Agentic Workflows

16 Jun 2026 🔖 security devops 💬 EN

1. This is a deterministic CI/CD pipeline, authored in YAML (a classic GitHub Actions “workflow”).
2. This is a nondeterministic CI/CD pipeline, authored in Markdown (a public-preview GitHub Actions “agentic workflow”).

I’m not sure how to feel about that. Lots of “lethal trifecta” (see Simon Willison’s blog) and “software supply chain security” (see Andrew Nesbitt’s blog) issues to be explored, that’s for sure.

Supply chain consumption tips

04 Jun 2026 🔖 security web development 💬 EN

I was just doing some developer education about how to safely use end-to-end testing SDKs such as Microsoft Playwright.

While, for authN and authZ, I still love my old “E2E and Synthetic Testing Considered Harmful” advice, I’d also like to add on some supply chain compromise tips.

I’m probably not the best at this, but here are some quick wins I think I’ve collected so far about how to import SDKs and other open-source libraries/packages/modules/software/etc. onto your computer / into your codebases, in this Sha1-Hulud / package-registry native worm era.

LLMs, rubber ducks, and doubt

03 Jun 2026 🔖 prompt engineering 💬 EN

Two LLM-related things that reminded me of “doubt” this morning:

1. I played with the GitHub Copilot CLI tool’s new /rubber-duck mode this morning and was not impressed, but I think that’s because I already word most of my prompts in rubber-duck “change my mind” fashion.
2. I stumbled upon a blog post by some guy named Scott Alexander, and am pretty sure he forgot that, unlike LLMs, our genes are simultaneously encoded with lots of algorithms of similar complexity to “next-sense-datum prediction” (the ones that I swear must be hugely behind doubt) under the hood, whereas LLMs are more or less only “next-token prediction” under the hood.

Recaps - Open Source Summit and Observability Summit 2026

18 May 2026 🔖 professional development 💬 EN

As assigned as homework during my #OSSSummit talk, (#OSSHomework!), here are my conference highlights from the Linux Foundation’s Open Source Summit and the CNCF’s Observability Summit. Still a work in progress; keep refreshing through next week until I get a chance to fully fill it in.

Microsoft wishlist

18 May 2026 🔖 professional development 💬 EN

Hi, Microsoft! Here’s that wishlist I approached you about toward the end of the day at the Linux Foundation’s Open Source Summit:

Observability Summit 2026 conference talk

17 May 2026 🔖 web development security iam 💬 EN

I presented “Secure by Design: Rethinking Test Credentials for Synthetic Monitoring” at the Cloud Native Computing Foundation’s (“CNCF”) 2026 Observability Summit (“#O11ySummit”).