Skip to main content

Posts

AI-Assisted Development Under Deadline: What It Takes to Ship Production Code on an Unfamiliar Stack

When Photify AI was removed from the App Store, our team had about two weeks to preserve one of its core capabilities: AI-powered photo and video generation. The fastest path was to rebuild that functionality for the web inside Botify AI, a product built on a technology stack I had never worked with before. There was little time to learn the stack from scratch, yet the feature still had to meet production standards. Claude Code became an important part of that process. It accelerated my understanding of an unfamiliar codebase, generated working implementations and helped resolve issues that would otherwise have taken much longer to investigate. However, writing code turned out to be the easy part. The real challenge was deciding what the generated code should and shouldn’t become. AI could produce code that compiled, but it couldn’t judge whether it matched the existing system’s architecture, respected established patterns or introduced risks that would surface later in production. E...
Post a Comment
Read more
Recent posts

When the Message Broker Becomes the Bottleneck: Scaling Push and SMS With MongoDB Polling

A back-end team extracted notification delivery from a large Ruby monolith into a centralized Go service, only to discover that their shared RabbitMQ cluster could not reliably support the new workload. Here’s how they solved the problem using MongoDB as a polling queue and the trade-offs that came with it. The Scaling Problem Inside the Monolith Back in 2019, the engineering team at Wheely, a popular ride-hailing platform, had a coordination problem that emerged with the product. User-facing notifications such as push alerts, SMS confirmations and status updates were scattered around the large Ruby monolith. Various parts of the codebase made direct attempts to send messages without a shared logic, unified retry strategy and consistent way to track delivery outcomes. As the system continued to grow, new back-end microservices were introduced, with each one requiring its own path to the user’s device. Push campaigns made things worse. Sending thousands of notifications at...
Post a Comment
Read more

FakeGit Targets AI Coding Agents with Malicious GitHub Repos

Threat actors continue to find new ways to incorporate AI into schemes aimed at luring developers into downloading malware from fake repositories. The latest example involves almost 7,600 malicious GitHub repositories that are being used to distribute a loader and an information-stealer. The FakeGit campaign is nothing new, with Oleg Zaytsev, lead security researcher with Island, noting that it and SmartLoader have been haunting developers for years with false GitHub repositories that deliver the malware. What’s new is that the bad actors behind FakeGit have added AI into the mix, with many of the repositories presenting as AI skills or Model Context Protocol (MCP) servers and driving exposure via AI registries. They’re part of a technique Island calls “AgentBaiting,” which happens when a developer sends out an AI agent to autonomously find something they can use within GitHub repositories. “This brought an established malware operation into the workflows people and agents use to d...
Post a Comment
Read more

AI-Native Testing Is Now a Core Quality Engineering Discipline

Predictions from some of the most prominent voices in the technology industry suggest that software engineering could become increasingly obsolete within a year, jolting the developer community in ways that are still unfolding. The ripple effect spreads further across social media and news outlets, with some leaders urging developers to start seriously considering alternative career paths before the window closes. But while AI can generate functional code in seconds, it still cannot handle complex decision-making, understand ambiguous real-world requirements, navigate legacy systems, or take accountability for the behavior of large interconnected systems. Those limitations matter enormously in production environments where the stakes are high and the edge cases are unpredictable. If AI is writing code faster and in far greater volume than any human team ever could, then the surface area of what needs to be tested does not shrink but actually explodes, fundamentally changing ...
Post a Comment
Read more

New Copilot Dashboard Shows Enterprises Which Developers Are Actually Using AI — Not Just Who’s Logged In

GitHub has released a new dashboard that gives enterprise administrators a much clearer picture of how their developers are actually using Copilot, not just whether they’re using it at all. The move addresses a gap that’s dogged IT leaders since AI coding tools went mainstream: Seat counts and login data tell you who has access, but they say nothing about whether that access is translating into real engineering output. The new Copilot metrics impact dashboard, rolled out July 22, is available to enterprise administrators and organization owners with access to Copilot usage metrics. It builds on the AI adoption phase cohorts that GitHub added to its Copilot usage metrics API back in May, turning what was previously raw API data into a visual dashboard that admins can actually act on. From Activity Counts to Adoption Depth The core idea behind the dashboard is straightforward: not all Copilot usage looks the same, and lumping every licensed user into a single “active...
Post a Comment
Read more

The Trust Graph: Why Infrastructure Diagrams No Longer Describe Modern Systems

There is a ritual I’ve watched play out in more incident retros than I can count. Someone pulls up the architecture diagram — the one in Confluence, the one that hasn’t been touched since the last audit — and starts tracing boxes. Load balancer. VPC. RDS instance. EKS cluster. Everyone nods because the diagram is comforting. It’s also increasingly a lie of omission. It doesn’t show the GitHub Action that has write access to three cloud accounts. It doesn’t show the OIDC federation between your CI runner and your production IAM role. It doesn’t show the third-party SaaS chatbot holding a long-lived OAuth token that your sales team connected to Salesforce 18 months ago and forgot about. It doesn’t show any of the things that actually decide whether an attacker gets from “found a bug in a support ticket” to “exfiltrated your customer database.” That’s because the diagram was never wrong, exactly. It was just answering a question nobody asks anymore. Modern systems don’t fail — or get br...
Post a Comment
Read more

VS Code 1.129 Moves Agent Sessions Out of the Editor Window

Microsoft has released Visual Studio Code 1.129, and the headline change isn’t a new feature so much as a new foundation. The update introduces the agent host, a dedicated process that runs AI coding agents like Copilot, Claude, and Codex outside the editor itself, using a new open protocol called the Agent Host Protocol (AHP). That distinction matters more than it sounds. Until now, agent sessions in VS Code lived inside the extension host, tied to the lifecycle of a single window. Close the window, and the session’s context went with it. The Agent Host Protocol is an open, agent-agnostic protocol between a host and its clients that uses JSON-RPC for communication and immutable state with pure reducers for synchronized session data. In practice, that means an agent session becomes something closer to a resource on a server than a temporary artifact of one editor window. The host owns agent sessions independently of the clients that display and control them, which gives VS...
Post a Comment
Read more