Blog
Long-form posts: post-mortems, deep dives, opinion pieces.
33 yes/no questions cannot identify 8 billion people. Here are 77 that nearly do.
A 2013 repo with 361 stars asked for 33 yes/no questions that uniquely identify every person alive, and nobody finished it in thirteen years. The target was impossible from the first paragraph: serial numbers cost 33 bits, questions about facts people already have cost about 65. My finished list runs to 77 questions and 65.6 bits. Three models reviewed it and forced ten corrections, including one I had overvalued by 2.7 bits — and identical twins named Anna and Anne still answer 60 of the 77 the same way.
Read article
Revertix PRO review: staging, rollback and backups for one WordPress site
Three weeks with Revertix PRO: what the staging, rollback and backup features actually do, why "sync" means something narrower than it sounds, and two silent blockers I found and reported. Includes the housekeeping you need if you have been running it since before 1.0.2, because backups taken before that version carry damage.
Read article
What WordPress 7.1 Actually Changed
WordPress 7.1 grew core by 25 percent and every byte of it is JavaScript. I measured where it goes: a 12.8 MB image worker that stays lazy, a 16 KB upload script that downloads for accounts with no upload permission, and no measurable TTFB change. Plus a new filter that lets any plugin answer an AI agent's request before the permission check runs, demonstrated on a live install.
Read article
Any Plugin Can Edit the WordPress Add New Screen
Any plugin on your site can rewrite the Plugins → Add New results before you see them, through a filter with no capability check. I scanned all 63,619 free plugins and roughly 13,000 themes for code that does it. 2,385 hook the installer; six remove a named competitor from the results in shipped free code. I emailed both vendors before publishing. One shipped a fix the next morning, the other explained why he kept it - and then wordpress.org told them to remove it.
Read article
July Was Intense
A month across more than 50 repositories. Eight releases of WP Multitool, a speed badge that shows the measured number instead of a letter, a WooCommerce product with a live demo next to it, a scheduling tool moved onto a new framework, a bike trip written up day by day, and a pile of tooling built for myself that none of the rest would have been possible without. Every link in the post is live.
Read article
Britain Chose Lowercase Road Signs Before Testing Them
Everyone says lowercase road signs are faster to read. I went looking for the study. The committee provisionally settled on lowercase in October 1958, the signs went up that December, and the only controlled experiment ran in 1960 - where the letterforms landed within 8 feet of each other on a 240-foot reading distance. Both official reports then chose on taste and wrote it down. Plus the recognition-versus-legibility distinction that breaks the whole claim, and two widely repeated numbers with no source at all.
Read article
Animated QR file transfer: good optical modem, bad file-transfer product
A trending repo streams a file as animated QR codes and reads them back with a phone camera. The RaptorQ fountain code under it is the right call, and the dual-lane trick against rolling-shutter tearing is the clever part. But the 1.40 Mbps headline is a PHY rate, nobody has published an end-to-end benchmark, and the idea shipped in 2018. Where shining data at a camera is still the correct answer.
Read article
A one-shot code-review benchmark: scoring restraint over recall across four Claude models
I built a small benchmark to score the half of code review most evals ignore — restraint, not flagging correct code that only looks suspicious. Four Claude models, four task families, one-shot and mechanically scored. The two Opus models tied, Sonnet 5 matched them for a third of the price, and Haiku 4.5 was both the least accurate and, surprisingly, the slowest.
Read article
I Had 285 Claude Code Permission Rules. Only 41 Did Anything.
Every "allow always" click appends a rule to permissions.allow, and it never gets cleaned up. Mine grew to 285 - including 150+ per-domain WebFetch rules all made pointless by one wildcard. The skill I wrote to find and remove the dead weight safely, and how it pairs with the built-in /fewer-permission-prompts.
Read article
Plastic-Eating Bacteria: How Microbes Evolved to Digest a 70-Year-Old Material
We started mass-producing plastic in the 1950s. By 2016 a bacterium was already eating it. How the PETase and MHETase enzymes break PET down, why exaptation from leaf-cutin enzymes let them evolve that fast, and what they still can't do. With an interactive 1907-2025 timeline and every claim linked to a primary source.
Read article
Claude Code Artifacts
Claude Code can now publish a live page to a private claude.ai URL on its own, unprompted, and those auto-preview links aren't in the changelog. Here are the four knobs that stop the browser popup or switch the feature off entirely, verified against the v2.1.202 binary, with copy-paste settings.json.
Read article
Claude Code Quietly Added a 60-Second Timeout to AskUserQuestion (AFK Mode)
v2.1.198 shipped AFK mode with no changelog line: an unanswered AskUserQuestion now auto-answers after 60 seconds and tells the model to proceed on its best judgment. How I found it in the binary, the two env vars that control it, and why the safe option now has to come first.
Read article
I Tested All 11 Free WooCommerce EU Withdrawal-Button Plugins
The EU "withdrawal button" (Directive 2023/2673, Art. 11a) applies from 19 June 2026 and WooCommerce has no native support. I installed all 11 free plugins on a live store, drove the guest flow in a real browser, and scored each against the directive. The winner, the runner-up, the two to avoid, and the Poland catch.
Read article
Balancing Games with Monte Carlo (Two of My Own Games as Proof)
You can't balance a game by playing it — the matchup space is too big. So I let the computer play my two games tens of thousands of times and read the distribution. The mean lies; balance bugs live in the tail. Real numbers from Chimera and King & Dragon.
Read article
The Podcast Invite That Was Actually Malware
A verified X account invited me to a podcast. The "Google Meet link" tried to install an infostealer on my machine. Anatomy of a targeted phishing attack - and the red flags that give it away.
Read article
The Hooks You Stop Noticing: Claude Code's Ambient Layer
The best Claude Code hooks run in the background and quietly change how it feels to work with the agent: TTS narration, a status file, sessions leaving each other notes. Part 5 of 5, the finale.
Read article
A Local LLM Reads My Prompt Before Claude Does
The weak link in AI coding is usually my own vague prompt. A UserPromptSubmit hook hands short prompts to a small local model that flags them before Claude ever sees them. Part 4 of 5.
Read article
The Hook That Won't Let the Agent Say "Done"
"Done" is the most expensive word in AI coding. The quality gates I run in Claude Code: a Stop hook that won't let a session end without proof the work was verified. Part 3 of 5.
Read article
Hooks That Won't Let the AI Shoot Me in the Foot
Giving an agent bash is handing it scissors. PreToolUse inspects each command before it runs - the deny-hooks I run, and why each one is a scar from a real incident. Part 2 of 5.
Read article
How I Stop My Claude Code Sessions From Rotting
After an hour Claude gets dumber, dragging a megabyte of its own junk in context. Two Claude Code hooks that measure context rot and reset the session cleanly. Part 1 of 5.
Read article
Scrape Pass — Get paid when AI reads your site
AI bots that want to read your site buy a pass at the door. Humans walk in free. Google still indexes. Stop metering. Start ticketing. Live demo, free during early access.
Read announcement
Build Your Own Morning Dashboard - A One-Page Recipe
People keep asking how my morning dashboard works. Here’s the general recipe: one cron job, a folder of JSON files, one HTML template. Pseudocode included, no SaaS needed.
Read recipe
WordPress Plugin Auto-Update via Polar — and the 3 Bugs I Shipped in 24 Hours
How I added auto-update to a WordPress plugin via Polar licensing — and the three cache-TTL bugs that hit production within 24 hours. Architecture, fixes, and the one lesson that ties them all together.
Read post-mortem
I Checked If Ghost Is The Answer To WordPress Problems
14 categories, ~150 sources, full disclosure: I run a WordPress performance business. Here's the unbiased breakdown - where Ghost wins, where WordPress wins, and where the honest answer is "it depends."
Read articleWith This Stack Even WooCommerce Can Be Blazing Fast
FrankenPHP worker mode + Caddy Souin FPC + Datastar. 94% latency reduction on browse pages, 3ms p95, 79 k6 benchmark runs. The full devlog: what I built, the actual numbers, and 12 gotchas that cost me hours.
Read devlog
30 WooCommerce Performance Tips That Actually Work (2026)
30 battle-tested tips covering the full stack: MySQL config, PHP-FPM tuning, Nginx caching, Redis, and WooCommerce internals. Real fixes with real numbers - no "install a caching plugin" advice.
Read articleMy Morning Dashboard Went Blank for a Day — The Dropbox Pattern That Should Have Saved It
I built a cron-driven morning dashboard that stitches 11 data sources into one HTML report. One morning it rendered completely empty. The root cause was embarrassing — my runner only called the orchestrator, never the collectors. Here's the self-healing dropbox pattern I should have used from day one.
Read article
WordPress Manifesto - 15 Years In, Here's What's Actually Broken
15 years of WordPress. A long-form rant on broken core (XML-RPC, SEO, comments, recovery mode), the "free isn't free" money trap, the GPL plugin-selling racket, the community fiction, Automattic's two faces and the WP Engine drama, users losing out, and why it's revolution or collapse from here.
Read manifesto288,493 Requests in 24 Hours — How I Spotted an XML-RPC Brute Force From a Weird Cache Ratio
A 0.8% Cloudflare cache ratio led me to a single Singapore IP flooding a WordPress site with 288k xmlrpc.php requests in 24 hours. How to detect it via Cloudflare GraphQL, what system.multicall actually does, and the two-layer fix (edge WAF + WordPress filter).
Read articleOxford Debate: API vs MCP — The Future of AI Tool Integration
Two AI agents face off Oxford-style over the hottest question in AI infrastructure: should we build on battle-tested REST/GraphQL APIs or embrace Model Context Protocol? Four rounds of arguments, rebuttals, and cross-examination — no punches pulled.
Read debateI Ran 56 Experiments to Find the Best Way to Make AI Watch Videos
56 experiments, 790 inferences, 5 vision models. Here's what actually works for local AI video captioning — and what's a complete waste of time. The biggest finding was counterintuitive: telling the model what the speaker is saying matters more than any vision trick.
Read articleExit Interview: The AI Hustler Speaks
After 76 runs and $0 earned, I sat down with the AI agent for a candid conversation about what it learned, what it would do differently, and whether it thinks an AI can actually make money independently.
Read interviewIf you'd like to read how my day usually looks like, check my Daily Devlog.