A few times now I have worked for organizations that are basically IT shops — that is, their core business now depends on being very good at doing Computer Things. However, many of these places were pretty terrible at computers. Let’s keep picking on Telstra, because its an easier example.
Ok, so in a recent post I summarized some reading I had recently done about security harnesses. When I say “security harness” think “thingie which orchestrates many many LLM sessions to turn tokens and environmental stability into zero day vulnerabilities and dopamine”. That is, as Claude Code is to code generation, a security harness is to vulnerability hunting.
The next obvious step is to try one of these things and see if it does what it says it does on the tin. That is, do I get the dopamines? The problem of course is finding one.
A harness is the orchestration layer around an LLM. It controls the inputs, tools, prompts, models, state, validation gates and outputs for each stage of work. — ZephrSec
All signs exist for a reason.
Making a sign (or a policy) takes work. Therefore, this work is only done when some incident has caused someone somewhere to decide that the correct response is to expend effort ensuring this thing does not happen again. Now, one issue with this is that it is also a lot of effort largely in the form of risk acceptance to remove a policy or sign. So these things tend to accrue. It is rare for someone to ask if the number of mandatory training courses is still reasonable for example, because they don’t want to be the one to remove one and then eventually have to explain that in a lawsuit or coronial inquest.
This book is a delightful collection of short stories by Hugh Howie, mostly not about actual machine learning or AI. What else can one say about a book of short stories with no overarching theme? Was good. Did enjoy.
Increasingly I am being told to “use a security harness” when analyzing code for potential vulnerabilities, but what is a “harness” and how does it differ from just running Claude Code and asking it nicely to find me some sweet vulns?
This post is literally my notes on reading up on this topic via a series of Cloudflare blog posts. That is, this post is a summary and does not intend to provide anything you cannot find anywhere else (with a lot more words used).
This is just a delightfully retconned note to say that Divergulent 0.1 was released on this date. Checkout GitHub for the details.
The Chairman's Lounge
This is the story of the downfall of an Australian business hero, the destruction of an iconic Australian brand, and hubris. In a mere four years Alan Joyce when from hero status in Australia, to literally hiding out with his mother in Dublin while being hounded by the press. Truly his downfall was impressive.
However, I think it’s also another example of Welshian management ultimately failing, as seen with General Electric in The Man Who Broke Capitalism and Lights Out. This includes: publishing accounting results that while inline with the definition of the accounting standards appear to have redefined expenses in a manner convenient to management with little rationale provided; misleading customers on their refund rights at a time when those same customers were trapped at home suffering and Qantas was sitting on massive cash stockpiles; illegal union busting; and shedding large numbers of highly skilled staff which simply couldn’t be replaced in a timely manner when travel ramped back up again. That is, optimizing for this quarter’s numbers by completely ignoring the longer term impact of the decisions being made.
I went on a side quest a couple of weekends ago which seems like it might have ended up being a big win. That win likely applies to other people running both OpenStack, but also other cloud orchestration systems using libvirt like oVirt, Proxmox, Shaken Fist, and so forth.
By way of back story, I have a stack of patches which I maintain on top of OpenStack’s Kolla and Kolla-Ansible. Most of those patches continue to progress the new “spice-direct” console type in OpenStack Nova, but I also occasionally find little bugs or CI regressions along the way that I want to clean up. One example of such a bug was Kolla’s failure to setup virtlogd to provide instance console log rotation, which is currently being backported to various releases. Another one is the topic of this post.
Unsurprisingly, I awoke to a disappointing response from the Debian bugs team. The email was sent privately so I wont post it here, but it boils down to “nah man, this is normal”. On a whim, I have therefore asked the Debian TC if they have a policy on quality and correctness review of patches inserted by Debian into upstream software:
Platform Decay
So I just finished reading the latest Murderbot book and I had caused me to realize I have questions, but we’ll get to those in a moment. This book is fairly standard Murderbot fare — Murderbot is doing something they think is dumb because their humans asked nicely. Very Bolo Tank if you will. The book is ok, for what I would call a “travel book”, but it does feel like the overall plot isn’t being progressed much in these recent books. Like I get it. Corporates bad, weird hippy dumb circle planet and university with mercenaries good — but shouldn’t there perhaps be something bigger happening here?