The job that was never there is the hardest one to explain. After the last post, my inbox filled up for four days. The hardest messages were not from people who had lost a job. They were from people who had gone outside, sat down, looked back, and realised they had never quite had one.A few weeks ago I published an interview with somebody who finished their company’s AI development plan and was let go eleven days later.I expected messages about the training. Those came.The other kind I did not expect. There were more of them. They were worse. And every…
Author: drweb
Certificate renewal is often treated as a scheduled task: run an ACME client, obtain a new certificate, and move on. In practice, that view is too narrow for production systems.A certificate is not useful because it exists on disk. It is useful because the right service is presenting it to users. Between issuance and that final state, several operational steps can fail.The more useful way to think about renewal is as a deployment workflow: renew, deploy, reload, verify, and recover when something goes wrong.Renewal Success Is Not Production SuccessThe first failure mode is simple: a certificate authority successfully issues a…
(Technical) Project Manager
TL;DR — Key Takeaways Pillar Security researchers exploited a prompt injection in Google’s Gemini CLI workflow to gain Editor-level access to an internal Google Cloud project. The attack began with hidden instructions embedded in a GitHub issue that were processed by an AI agent triaging bug reports. The prompt injection led to the issuance of Workload Identity Federation credentials, one of which enabled impersonation of a more privileged account. Cybersecurity researchers from Pillar Security this week revealed how a prompt injection inserted into a GitHub repository was used to gain Editor-level access to an internal Google Cloud project using a…
TL;DR — Key Takeaways Testing alone does not prove a release is production-ready. Business-critical systems also need data integrity, reconciliation, exception handling and operational approval. Production validation creates a formal release gate, ensuring issues, dependencies, evidence and sign-offs are resolved before deployment. The strongest model combines automation with business judgment, using repeatable workflows, documentation and targeted manual review for high-risk releases. In an enterprise environment, production failures are more often defined as testing failures, but they include other high-impact aspects, such as release readiness, data quality, exception handling and operational approval. However, the missing layer is not just about conducting…
TL;DR — Key Takeaways Harness launched an agent-ready code repository and AI code review service designed to handle the higher volume of commits and pull requests generated by AI coding agents. The repository is built to support thousands of simultaneous pull requests and commits while maintaining search, history and diff performance across large repositories. DevOps teams can assign AI agents specific permissions, apply RBAC and OPA-based policies, and track agent activity separately from human developers. Harness today launched a code repository service that is specifically designed for DevOps teams that are relying on artificial intelligence (AI) agents to generate code.Martin…
AI coding agents are becoming part of everyday development work. Developers use them to find libraries, configure projects, troubleshoot installation problems, and set up new tools. An agent can search GitHub, read project documentation, and run commands without the developer having to work through every step manually.That convenience is creating another security concern for DevOps teams. An agent can encounter software and instructions during a task, decide that they are relevant, and act on them. A repository, README file or configuration file can therefore become part of the execution path.Recent attacks have shown how this can be abused. Malicious repositories…
I let AI recommend SQL Server indexes across a week of queries, measured every number before and after, and the result was not the one I expected to write about.I expected a comedy. I have read enough confident nonsense from chatbots about SQL Server to assume I would end up with a post full of terrible indexes and easy jokes.That is not what happened, and the actual answer is more useful.AI never connected to SQL Server or executed anything. I gave a general-purpose chat model one query at a time, manually reviewed its suggestions, and applied the candidates in a disposable…
How I used AI for this postChatGPT to generate images based on info specifically provided by me,including examples.Grammarly to catch grammar and sentence construction errors.I did a presentation on Vector Economics at EightKB, a popular SQL Server Internals conference, recently. The talk was well received. Among the follow up suggestions, one was about doing a blog series on DiskANN Algorithm – the algorithm created by Microsoft Research, documented here, and is used for vector index on SQL Server Vector Search.DiskANN is meant to help with searching a billion-vector dataset from a single machine using SSDs.Microsoft Research’s original work demonstrated a…
TL;DR — Key Takeaways Sonar launched SonarQube Hunter Agent to identify broken access control, business-logic vulnerabilities, and authentication or session-management issues across entire codebases. The AI agent traces how code and data move through an application, helping uncover flaws that traditional deterministic scanners may miss. Sonar says the tool can run investigations on demand and surface verified issues directly within DevSecOps workflows through CI/CD integrations. Sonar today made available an artificial intelligence (AI) agent designed to discover vulnerabilities and business logic flaws that pose the greatest risk to an organization should they be exploited.The SonarQube Hunter Agent first analyzes an…