Writing

Notes on judgment, and what the tools changed.

Essays on AI-assisted development, the security of generated code, and the occasional retrospective on a system built close to the hardware.

13 min read

Virtual CTO: what the role covers and when you need one

What a virtual CTO does, how it differs from a fractional or interim CTO, the signs you need one, what the first 90 days should deliver and how to choose one.

  • Virtual CTO
  • Fractional CTO
  • Engineering leadership
  • Technology strategy
10 min read

Legacy system modernisation: rehost, refactor, rebuild or replace

How to choose a legacy system modernization approach: rehost, replatform, refactor, rebuild or replace, the questions that decide it, and a safe cut-over.

  • Legacy modernisation
  • Software architecture
  • Migration
  • Engineering leadership
6 min read

Offline-first requests in the browser: a guide to oajax.js v2

How oajax.js v2 keeps web and hybrid apps working offline: cached reads, an outbox that replays writes in order, idempotency keys, and moving from v1.

  • Open source
  • Offline-first
  • JavaScript
  • PWA
  • Cordova
12 min read

Code audit services: what a source code audit covers

What a source code audit covers, how a good one is run, what the report should contain, and how to choose between code audit services before you sign.

  • Code audit
  • Secure code review
  • Application security
  • Engineering leadership
12 min read

Application security best practices: the list I enforce

The application security best practices that prevent real incidents, in the order they pay off: authorisation, secrets, input, dependencies and the CI pipeline.

  • Application security
  • Secure code review
  • Architecture
  • Engineering leadership
8 min read

What technical due diligence actually looks at

What a technical due diligence should cover, what to ask for, and the red flags I look for in a codebase, a team and a system before anyone signs.

  • Technical due diligence
  • Engineering leadership
  • Code review
  • Architecture
5 min read

What a video call should say to a screen reader, and what I have not verified

The design decisions inside call-a11y, an open-source library for call accessibility: why joins are batched on a fixed clock, why words still being recognised are never spoken, why a modal dialog silences your announcer, and the parts I could not check with a real screen reader.

  • Accessibility
  • WebRTC
  • Open source
  • Front-end
7 min read

What a screen reader user hears in your video call

Video call interfaces are among the hardest things to make accessible: the main content is not text and the state changes every few seconds. The five problems I find most often, what fixes each one, and how to test it by ear.

  • Accessibility
  • WebRTC
  • Real-time communication
  • Front-end
4 min read

Security in vibe-coded apps is a leadership problem, not a code-review problem

Code review catches specific vulnerabilities. It does not answer the harder question: who is accountable when a founder's own pull request ships a hole a model didn't know to avoid? The business case for treating AI-generated code as a governance risk, not a technical afterthought.

  • Security
  • Engineering leadership
  • AI-assisted development
  • Governance
  • Risk management
4 min read

MQTT: designed for the network that isn't there

MQTT solves a different problem than the real-time protocols I work in day to day — not lower latency, but survival on links that drop, sleep and reconnect. What the broker actually buys you, why publish/subscribe decouples devices that were never meant to know about each other, and what building one taught me before I understood why it mattered.

  • MQTT
  • IoT
  • Messaging
  • Protocols
  • Distributed systems
7 min read

Where GPS stops: tracking a workforce indoors at Hajj

GPS gives out at the door, and the busiest doors on earth are at Hajj. How a BLE wristband, a fixed grid of receivers and a CCTV density model kept a workforce findable inside the pilgrim sites — and what indoor positioning honestly costs.

  • Indoor positioning
  • BLE
  • Computer vision
  • IoT
  • Case study
4 min read

The placement problem fog computing solved before 'edge AI' had a name

Fog computing pushed computation toward the data years before 'edge AI' made the same idea fashionable. What the architecture actually solves, why placement inside an SDN is the hard part, and why the question hasn't changed since my final-year project — only the workloads have.

  • Fog computing
  • Edge computing
  • SDN
  • Distributed systems
  • Architecture
4 min read

The security risks nobody checks in vibe-coded apps

Generated code ships with a recognisable set of holes: absent authorisation, secrets in the client bundle, unbounded AI endpoints, and dependencies nobody chose. What I look for when reviewing an app that was mostly written by a model.

  • Security
  • AI-assisted development
  • Code review
  • Engineering leadership
4 min read

Why human validation is still the constraint

Generation got cheap; verification did not. What actually has to be checked when a model writes the code, why the reviewer is now the bottleneck, and how to restructure review so that is sustainable.

  • AI-assisted development
  • Code review
  • Engineering leadership
  • Process
4 min read · video

Is AI going to replace software developers?

The honest answer from someone who runs a 39-project portfolio with these tools in daily use: the job is being restructured rather than removed, some rungs of the ladder are genuinely disappearing, and the scarce skill has shifted from producing code to judging it.

  • AI-assisted development
  • Engineering leadership
  • Careers