The Pipeline Was the Attack
On 31 March 2026 a poisoned axios release went up on npm, and the machinery the industry built to keep itself patched delivered it to 895 repositories before anyone woke up. CISA's advice afterwards was to add seven days of latency. Microsoft's was to turn the bots off. Both are right, and the distance between them is the only decision left: security is a loop now, and the whole job is choosing what delay you set on it.
14th September 2026 · 13 min read
The Option to Abandon
An agent is the most confident refiner ever built, and refinement is not invention. Real invention means walking away from something that works, and whether your organisation can afford that walk is set in infrastructure nobody thinks of as a decision. The tools are now the same for everyone. What they let you do is not.
25th August 2026 · 11 min read
The Audit Is Already Scheduled
A breach notice by SMS and a ministerial reply about the largest education breach on record, inside the same month, and neither contains a sentence the recipient can verify: the party that knows what was taken is never the one writing to you. An audit is not a badge you receive; it is a question you put to your own systems. If your customers' data sits in stacks you rent, the involuntary version is already scheduled.
28th July 2026 · 14 min read
Bytes Don't Pay The Rent
Five years inside the CDN buy. Premium live is where the per-GB question runs out. The serious end of streaming already built their own capacity. Here's what the bill is telling everyone else.
1st June 2026 · 7 min read
What I Learned Building 8 Tbps of CDN
Five years, 8 Tbps of capacity, a two-engineer core team, and a streaming-only audience watching live sport at scale.
20th May 2026 · 6 min read