The Journal All entries Updated weekly
Writing on AI adoption, bespoke software, intelligent automation, and the things a one-person workshop learns along the way. No newsletter to sign up to. Read it here or by RSS.
A phisher impersonating IONOS, a registrar form that only accepts JPGs as evidence, a confirmation page that promises silence, and a dead security watchdog reborn as a Bulgarian casino site. This is what reporting abuse looks like, end to end.
OPAQUE lets a server authenticate you without ever seeing your password, and it is a genuinely elegant piece of cryptography. I spent an evening working out whether to put it into Wegweiser, and then worked out why I should not. Here is the reasoning, including the more interesting question underneath it: could you encrypt a customer database with the same trick?
A client recommended a tool, I went to look at the company that makes it, and found my own website. Nobody copied anybody. We had both asked a machine for something distinctive and been handed the same thing. Here are the measurements, and what actually fixes it.
Why the AI inside Wegweiser can read your entire estate and change none of it, and what two and a half years of building it taught me about being wrong in public.
Two 8B models on a home GPU, one message every thirty seconds, no task and no end point. They reached a fixed point in about 180 turns and repeated the same sentence word for word. Reviving them took six fixes, and every one of them contradicted something I would have told you was true about prompting.
I retired two Hyper-V servers onto a single Linux box - about twenty single-service VMs, moved one at a time by a script small enough to read in one sitting. Here is how it works, the one-line trap that boots a migrated VM with no network, and the honest trade-offs.
I was recently approached by a top-tier expert network. Their client - a major management consultancy - was conducting a study on the future of penetration testing, market demand dynamics, and the structural impact of AI on cybersecurity. They wanted an hour of my time to map out the future of the industry.
My Windows agent's signing certificate expires in three days, on purpose. A field guide to Azure Trusted Signing - the timestamp that makes a signature outlive its certificate, the role nobody mentions, and the build step that fails by succeeding.
Old Forge Technology Limited is now an accredited member of Made in Britain. A maker's mark on a software consultancy takes one sentence of explaining: software is made, and ours is made at a bench in Kennett, Suffolk.
Felgate gives every practice its own container, its own database and its own encryption key. That is supposed to be the expensive way to build multi-tenancy. Here is the machine that makes it cheap: how one Stripe webhook turns a signup into a live, isolated portal with no hands on the wheel, and the three ways reality fought back.
A short seafront walk, a table at the Ferry Boat Inn we were only meant to borrow, and a reservation card for a couple called Felgate who never came. Years on, the name sits over a practice portal for nutritional therapists in their early years - the affordable alternative to tools priced for clinics that already exist. Live this week.
Old Forge Technologies has passed Cyber Essentials - what the certification actually audits, what the process surfaced, and why a verifiable badge beats a screenshot.
