Everyone in tech is convinced that AI will eliminate junior developers first. “Why hire a junior when AI can write code?” they ask. The prevailing wisdom is that entry-level developers are most vulnerable to automation.

They’re dead wrong.

I wrote “The Future of AI Belongs to Experienced Operators with Good Taste” a few months back and that’s still absolutely true. But there’s a massive plot twist most people are missing: AI coding assistants aren’t just productivity tools - they’re the great equalizer.

Junior developers with the right attitude and intentional practice are positioning themselves to outpace expensive, slow senior developers who refuse to adapt. The window is open right now, but it won’t stay open forever.

Read More

“Software supply chain management” is one of those terms that sounds like Venture Capital-funded vendor marketing bullshit right up until it isn’t.

In 2016 the npm left-pad incident taught many of us in the software industry the importance of:

1. The fragility of depending directly on central package management systems, such as npm or nuget.org, hence why artifact proxying tools like JFrog Artifactory became so important; and
2. How centralized package management systems probably need to make stronger security and availability guarantees, such as not allowing hard deletes of packages in the first place.

One of the distinguishing features of nuget.org is they make it very, very hard for authors to delete their packages - only in exceptional cases, such as malware inclusion, will they allow the permanent deletion of packages.

Imagine my surprise yesterday, when I discovered that two of our Akka.NET packages were deleted¹, by Microsoft, without any advanced notice. I only discovered that this was an issue when one of my own Akka.NET applications failed to build on CI/CD due to missing package versions.

I’ll get into the reasons why they did this, but the bottom line is: this is a disturbing precedent that really should never be repeated.

In essence, Microsoft’s adjacent business units abused NuGet to deal with their own security vulnerabilities - getting a level of access that would never be granted to any other publisher on the platform.

Read More

Intro

Over the past year or so we’ve built out a decent-sized test lab environment for Akka.NET and I’ve also personally started a small homelab environment for creating some useful services for my family’s use. Both of these networks use the same components:

• Tailscale for secure...

  Read More

Azure released a major update to some of their VM images last week and it’s caused a number of problems for me:

1. mono support was removed from ubuntu-latest, which caused all of our FAKE v4.0 builds to no longer work¹ for Akka.NET and several of our other mature projects;
2. SignService, our workhorse for Authenticode signing all Petabridge NuGet packages for the past seven years, stopped working suddenly on the Azure App Service we’ve been using.

I have no idea what Microsoft did to kill this service off, but my guess is they finally stopped supporting the ancient version of .NET Framework this was running on starting on April 11th or so:

We had owed a customer an update today and the race was on to find a replacement for SignClient - quickly. We quickly settled upon dotnet/sign - and then the race was on to figure out how to solve the infernal quagmire of Azure Entra / AAD permissions hell in order to access our Azure Key Vault where our signing certificate is stored.

This post explains how to do that.

Read More

I have a lot of respect for Geoffrey Huntley. So when I read his blog posts about AI over the past couple of months: “Dear Student: Yes, AI is here, you’re screwed unless you take action…” and “The future belongs to people who can just do things” among others, I thought to myself - “am I missing something?”

This image of his, in particular, summarizes his take on AI and the impact it’s going to have on the software development industry:

He’s essentially singing the same song that people who sell AI courses do: “if you’re not dropping everything to learn AI right now, you’re going to get left behind!” His conclusion to “The future belongs to people who can just do things” ends thusly:

Ya know that old saying ideas are cheap and execution is everything? Well it’s being flipped on its head by AI. Execution is now cheap. All that matters now is brand, distribution, ideas and [retraining] people who get it. The entire concept of time and delivery pace is different now.

Distribution, brand, et al are important - no doubt. The idea that any LLM, even ones with future capabilities, is a catch-all substitute for experience is laughable.

In a world where typing in the right prompt to a chat window is “all you need” for “execution,” this actually makes idea guys even more commodified and worthless than they already are - and they’re already worthless.

Read More

“You can build it cheap, fast, and good - pick two” is how the saying goes, referring to the inherent trade-offs in software development priorities. It makes intuitive sense but utterly fails in real-world applications. Two simple reasons why this correlation does not hold:

1. Price is not realistically correlated to quality of outcomes and
2. Price isn’t correlated to faster delivery times either.

Price is its own independent quality determined entirely by the buyer’s and seller’s perception of value.

As the Dan Luu article I linked to mentions - it’s fairly difficult even for experts within a given domain to accurately assess the market value of their own services (or someone else’s), hence why price discovery has to be tested continuously¹.

But let’s take a closer look under the covers at the price vs. quality and price vs. speed relationships.

Read More

This week FluentAssertions, a popular open source library designed to make it easier to write assertions during unit testing, changed its license from Apache 2.0 to some commercial terms under the name of a new business entity, Xceed.

The net impact of this is that FluentAssertions now costs $129.95 per seat for commercial use for version 8.0 and later.

Naturally the .NET community was in uproar over this on /r/dotnet and in a few other places, like this comment from the “.NET Eventing Framework” thread which inspired “.NET Developers Begging for Ecosystem Destruction”

In this post we’re going to unpack two things:

1. Impact of the FluentAssertions change and
2. Broader questions about what .NET users would prefer: “re-license or die?”

Read More

As of Monday this week, my company Petabridge turns 10 years old. I’ve been my own boss for longer, but my tenure at Petabridge is nearly 5x my tenure at every other company I’ve founded and at every place I’ve worked.

When you set out on a new venture, rarely do you expect things to go this well or last this long - so I decided to take some time to cobble together 10 lessons that have kept me sane throughout my entire odyssey with Petabridge.

Read More

My management style has evolved a lot over the years, but one constant I’ve kept from the beginning is to coach the best possible performance out of my players. That seems like an vacuous management platitude, but it’s not: doing this requires tremendous patience, brutal-yet-sympathetic candor, and an ability plus...

Read More

If you follow me on Twitter / X, you have likely seen several increasingly exasperated tweets from me about a legacy software project from hell. This project deserves its own series of blog posts and YouTube videos, but in service to a higher calling in the field of software I’ll reveal it now: these coding horrors all originate from our rewrite of Sdkbin.

More accurately: we decided the best path forward was to rescue Sdkbin 1.0 and not rewrite it after all, but we’re still conducting the software equivalent of tearing a building down to its foundation and starting over again.

For all of its faults, Sdkbin does generate a significant amount of revenue for us each year. We’ve kept it on life support for four years because its original author left it in utterly incomprehensible shape. In this post I’m going to talk about the plague that’s killed four years of opportunities and left this project swaddled in technical debt before it even served its first customer: frameworkism.

Read More