标签：#software

You budgeted six months. It took fourteen. You wanted one thing; you got three things that almost do it. And somewhere between the first sprint and the final invoice, you stopped understanding what you were even paying for. If that sounds familiar, this is the breakdown no one gave you before you started. What custom software development actually means Custom software development is building software from the ground up for your specific business, not configuring Salesforce, not installing a plugin. You're solving a problem your operations have, the way your operations actually work. What trips people up: "custom" doesn't mean "built entirely from scratch." Good dev teams use frameworks, libraries, and third-party services. What's custom is the logic of how your data flows, how business rules are enforced, how users interact. Scope range is huge: Custom dev covers everything from a lightweight internal dashboard to a full-scale multi-tenant SaaS platform. This is why cost estimates vary so wildly. 3 things nobody tells you before you sign 1. Scope creep is almost always the client's fault "Users should be able to manage their accounts" sounds simple. It actually contains dozens of decisions: can they change their email? What verification is required? Can they delete their account? Each one is a feature. Each feature has a cost. The fix: Run a discovery phase (2–4 weeks) before writing a single line of production code. It costs money upfront. It saves far more mid-project. 2. The cheapest bid rarely wins long-term A $40k quote and a $180k quote for the same project both happen. The $40k team isn't lying; they're optimistic, underbidding to win work, or scoping something different. What actually happens: you hit $40k, and you're 40% done. Higher bids from experienced teams often include architecture planning, documentation, testing infrastructure, and post-launch support things the cheap bid omitted. These aren't extras. They're what make the software maintainable in t

Most write-ups on this subject are about technique. This one is about the three decisions you should make before you write any code, because in my experience every project that went badly went badly for a reason that was decided on day one and not noticed until much later. I have built this kind of collection twice, for competitive analysis and for a partner-vetting workflow. Neither of them needed to touch anything behind a login, and I want to explain why that turned out to be the useful constraint rather than the limiting one. Line one: the login wall is a boundary A login wall is a statement about who the content is for. Treating it as an engineering obstacle to be routed around is the decision that puts a project on the wrong side of everything: terms of service, the platform's own detection, and in several jurisdictions the law. So the first line is simply: if it requires an account to see, it is out of scope. Not "hard," not "for later." Out of scope. I am not going to discuss techniques for getting past one, and I would be sceptical of any article that does. The interesting engineering question here is not how to see more. It is how much you can actually do with what is openly published, and the honest answer is: considerably more than people assume before they check. This constraint also has a practical benefit that is easy to miss. A pipeline built only on openly available data does not break when authentication changes, does not require credential management, and does not put an account at risk. Mine has survived two platform changes that took down colleagues' authenticated collectors. Line two: public does not mean unrestricted The second line is the one developers get wrong most often, and it has nothing to do with access. Data being publicly visible says nothing about whether you may store it, for how long, or what you may do with it. In the EU and UK, information about an identifiable person is personal data whether or not they published it themselves

If you build with Prisma, you already know Prisma Studio. Run one command and you get a clean, visual way to browse and edit rows in your database. It's genuinely useful, and I reach for it every day while developing. But somewhere between "I need to look at my data" and "I need to let a support agent safely edit a customer's record in production," Prisma Studio quietly stops being the right tool. It was never trying to be that tool. It's a database viewer. An admin panel is something else, and the gap between the two is exactly the part that matters once real people and real permissions are involved. I ended up building a small package to fill that gap for my own Express + Prisma apps. Writing it forced me to be precise about what an admin panel actually adds on top of a database browser. Here's the distinction as I now understand it. A database browser shows rows. An admin panel governs them. Prisma Studio connects to your database and shows you everything. That's the point of it, and it's also why you'd never hand it to a non-engineer or expose it in production. It has no concept of who is looking, what they're allowed to do, or which rows they're allowed to touch. An admin panel's whole job is those three questions. The package I built mounts a React UI at /admin and a guarded JSON API under /admin/api/* on your existing Express app. Every single request through that API runs the same pipeline, in the same order: authentication → permission check → tenant scope → validation → Prisma mutation/query → optional audit event That ordering is the entire difference. A database browser skips straight to the mutation. An admin panel refuses to run the mutation until it knows the request is authenticated, permitted, scoped to the right tenant, and valid. Permissions and scope are two different questions This was the design decision I care most about, because collapsing these two into one is how data leaks happen. Permissions decide which actions a role may take. Can an ed

At what point did you start to think you were an engineer? An engineer. What a lofty,...

Moving from AI-Assisted Engineering to AI-Agentic Software Engineering The rise of AI coding assistants has transformed how developers write software. Tools like GitHub Copilot, ChatGPT, Claude, and Gemini have significantly improved developer productivity by helping generate code, explain concepts, and automate repetitive tasks. However, the industry is now entering the next evolution: AI-Agentic Software Engineering . Instead of AI simply assisting developers, AI agents can now take ownership of entire software engineering tasks—from requirement analysis and architecture design to implementation, testing, documentation, and code reviews. The challenge is no longer whether to use AI, but how to integrate AI agents into a structured Software Development Lifecycle (SDLC). This requires moving away from vibe coding toward specification-driven development , where AI agents operate using well-defined requirements, standards, and engineering principles. Today, I'd like to discuss two of the most popular frameworks enabling this transition. 1. Spec Kit Spec Kit is a specification-driven framework designed for Human + AI collaborative software development . The philosophy is simple: define the specification before generating the code . Rather than asking an AI to build an application from a vague prompt, Spec Kit encourages teams to create structured specifications, architectural decisions, and engineering principles that guide AI throughout the development lifecycle. Some key benefits include: Structured and repeatable software development Better requirement traceability Consistent architecture decisions Reduced AI hallucinations Lower development costs through predictable AI interactions Support for selecting the most appropriate LLM based on project requirements Integration of quality engineering practices from the beginning of the SDLC Spec Kit is particularly valuable for engineering teams that want to adopt AI without sacrificing software quality or maintainability.

Developers write far more legally consequential prose than they think, and almost none of it is code. It's the SECURITY.md in the repo root. It's the "Security" page someone in marketing asked you to fill in three years ago. It's the status page update typed at 2 a.m., and the sentence in a customer notice specifying exactly which data was affected. The research summarized in this overview of what the evidence shows about cyber incident disclosure treats post-breach communication as a measurable discipline with predictable failure modes — and the enforcement record of the last three years has quietly turned it into an engineering discipline too. In the most closely watched cybersecurity case of the decade, the only allegation that survived a motion to dismiss concerned a technical description of access controls posted on a website. The claim that survived was written by engineers On July 18, 2024, Judge Paul Engelmayer of the Southern District of New York issued a 107-page opinion in the SEC's case against SolarWinds and its CISO. Most of it was a defeat for the agency. Claims built on blog posts, press releases, and podcast appearances were dismissed as non-actionable corporate puffery — statements too general for any reasonable investor to lean on. The theory that cybersecurity controls fall under "internal accounting controls" was rejected outright. Post-incident 8-K disclosures were held to be reasonable given what was knowable at the time. One thing lived: the company's "Security Statement," a technical page describing its practices to customers. The court let claims proceed specifically on its representations about access controls and password policy , because those were concrete enough to rely on and, as pled, contradicted by internal presentations, security assessments, and Slack messages. The SEC ultimately dismissed the whole action with prejudice in November 2025, so no liability was ever established — but the legal line drawn in 2024 didn't go anywhere.

Well, first real job and I still haven't gotten used to waking up for a 6:30 AM shift... I've been...

I’ve been building a side project called OopsCalorie , an AI-powered calorie and meal tracking app. The idea sounded simple enough: User logs or takes a photo of their food. AI identifies the meal. Estimate calories and macros. Save the entry. Done. Simple, right? Well... Then we started testing it with Filipino food. 😂 AI Meets Filipino Food 🇵🇭 One of the funniest parts of building OopsCalorie has been testing the food recognition. At one point, our AI confidently looked at dinuguan and decided: That's champorado. Okay. I can kind of see where you were coming from. Both are dark, both can be served in a bowl... But still. 😂 Then came bagnet . AI: Lumpiang Shanghai. Bro. Not even close. 😂 These bugs are funny, but they also exposed one of the more interesting engineering problems behind OopsCalorie: Image recognition is only the first step. Correctly identifying a meal — especially regional dishes — requires much more context than I initially expected. The Real Problem Isn't Just Calories When I started the project, I thought the difficult part would be estimating calories. Turns out, before you can estimate: You need to know what the food actually is. And food can be surprisingly ambiguous from an image. A photo might contain: multiple dishes sauces hiding ingredients visually similar foods regional dishes that aren't well represented in training data different cooking methods unknown portion sizes ingredients completely hidden underneath other ingredients Even humans sometimes need context. "Is that pork adobo or humba?" "Is that fried pork belly or bagnet?" Now imagine asking an AI to determine that from pixels alone. Building Around AI Instead of Blindly Trusting It This changed how I'm approaching the system. Instead of treating the AI response as absolute truth, OopsCalorie is evolving toward a workflow where AI provides an intelligent estimate while the user still has the ability to provide context and correct it. We're experimenting with things like: Image +

What Is Software Testing? 🧪 Software testing is the process of checking software to make sure it works correctly and does what it is supposed to do. For example, when we use a login page, we can test: Correct username and password Wrong password Empty username Empty password Forgot password option The goal is to find bugs and problems before the software is used by customers. Why Is Testing Important? Testing helps developers and companies: Find bugs Improve software quality Provide a better user experience Prevent problems after release Even a small bug can sometimes cause a big problem, so testing is an important part of software development. Manual Testing In manual testing, a tester checks the application manually without using automation scripts. For example, a tester can open a website, enter different inputs, click buttons, and check whether the expected result appears. Automation Testing In automation testing, we use tools and programming to test software automatically. Some popular tools are: Selenium Playwright Cypress Automation is useful when the same tests need to be performed many times. Conclusion Software testing is an important part of creating reliable software. If you are a beginner, you can start with manual testing , then learn SQL, API testing, and automation testing .

The most interesting thing about AI coding agents right now is not that they can write code. It is that they are starting to operate computers. That sounds like a small distinction until you feel it in the workflow. A code generator lives inside a text box. It waits for a prompt, returns a patch, and leaves the rest of the job to you. A software operator can inspect the app, click through the broken flow, read the console, run the server, reproduce the issue, change the code, and check whether the thing actually works. That is a different kind of tool. OpenAI's May 29 Codex update points in that direction. Codex now supports computer use on Windows in the Codex app for eligible users, so it can see, click, and type in Windows applications while testing and refining software. The same release also expands remote control, letting a user steer work from ChatGPT on mobile or Codex on Mac while the Windows machine remains the host for the project files, shell, app server, and local context. I do not think the important part is Windows support by itself. The important part is the new shape of work. Coding Was Never Just Typing For a while, the AI coding story was mostly about generation. Could the model write a component? Could it scaffold an API route? Could it refactor a file without losing the plot? Useful, but narrow. Real software work has always been messier than text generation. You open the app. You notice the layout is wrong. You click a button. Nothing happens. You check the terminal. The dev server crashed. You restart it. The page loads, but the empty state is off. You resize the browser. The mobile nav breaks. You skim the network tab. The request is fine, but the UI state is stale. None of that is "write code" in the pure sense. It is operating the system around the code. That is why computer use matters. It gives the agent access to the loop that human engineers actually live in: observe, diagnose, change, verify. The text editor is only one stop in that lo

Introduction Your program keeps opening transactions. A signup writes a new user row. A checkout debits one account and credits another. A form submission updates three related tables at once. You wrap it all in BEGIN and COMMIT and move on, trusting that the database will handle whatever happens in between. Most of the time it does. But what is it actually promising you when it handles that? And what does it have to do behind the scenes to keep that promise? Say a user transfers ₹1,000 from Account A to Account B. The application runs two updates: subtract 1,000 from A, add 1,000 to B. Now say the server crashes right after the first update runs but before the second one does. Account A: -₹1,000 Account B: +₹0 That money didn't move. It vanished. No error message fixes that, and no user accepts "the server restarted" as an explanation for their missing balance. This is the exact problem a set of guarantees called ACID was built to solve. Most developers can recite the acronym, Atomicity, Consistency, Isolation, Durability, without being able to explain what any of the four words actually promise, or what the database has to do internally to keep those promises. This article tries to fix that. -- 1. What Is a Transaction? Before ACID makes sense, you need to understand what a transaction actually is. A transaction is a group of one or more database operations treated as a single logical unit of work. Either the whole group succeeds, or none of it does. The bank transfer above is a textbook transaction: two updates that only make sense together. In SQL, a transaction usually looks like this: BEGIN ; UPDATE accounts SET balance = balance - 1000 WHERE id = 1 ; UPDATE accounts SET balance = balance + 1000 WHERE id = 2 ; COMMIT ; BEGIN tells the database "everything from here on is one unit." COMMIT tells it "we're done, make it permanent." If something goes wrong in between, a constraint violation, a crash, the application deciding to cancel, the database can issue a RO

SpaceXAI has introduced Grok Bot, a system of persistent AI agents that operate on dedicated cloud computers and can interact with websites, applications, inboxes, and other tools. By Daniel Dominguez

In this podcast, Michael Stiefel spoke to Tracy Bannon about the role of artificial intelligence in software and the attendant risks in the areas of security, software development, and society at large. While it might be reasonable to assume a certain amount of trust within a software ecosystem, the risks escalate when the boundary between two software ecosystems is crossed. By Tracy Bannon

Run the same salary through three different paycheck calculators and you'll get three different answers. None of them explain why. That bothered me enough to spend three weeks building an alternative. The result is payculate.org — a paycheck calculator for all 50 US states and DC where every deduction line opens up and shows its own arithmetic . The interesting problem wasn't the code The tax math itself is straightforward: progressive brackets are a loop, FICA is two multiplications with a cap. I had a working federal calculator in an afternoon. The hard part was that every state is a special case , and a generic model breaks on most of them: Wisconsin has a standard deduction that shrinks as you earn more — it starts at $13,230 and falls by 12 cents per dollar above a threshold, reaching zero around $126,000. Alabama lets you deduct your entire federal income tax before calculating state tax. The more federal tax you pay, the less Alabama income you have. Utah looks flat at 4.5%, but gives a taxpayer credit that phases out with income — so the effective rate climbs while the headline rate never moves. Ohio taxes nothing on the first $26,050, then a flat 2.75%. South Carolina rewrote its entire income tax in March 2026: six brackets became two (1.99% / 5.21%), and the federal standard deduction was replaced by a state-specific deduction that phases out above $40,000 of AGI. That last one I only caught during a routine data check last week. Most calculators I checked are still showing the old six-bracket system. The lines nobody counts The bigger discovery was what national calculators leave out entirely: employee-paid state payroll premiums . Washington charges no income tax at all. But Paid Family & Medical Leave (0.807%) and WA Cares (0.58%, uncapped) still take about $1,040 a year from a $75,000 salary . Most tools show $0 on that line. California's SDI lost its wage cap in 2024 and now takes 1.3% of every dollar — on a $200,000 salary that's $2,600 that appears

Unlock Seamless Idempotent Processing Without Coding Hurdles As a seasoned integration mentor, I'm here to walk you through a simple, no-code/low-code method to tackle the thorny issue of idempotent consumers in MuleSoft Anypoint. You’ve likely struggled with pre-built connectors and complex data transformations, but let’s take this one step at a time—no Java or XML required. The 3-Click Path: From Complexity to Simplicity Define Your Idempotency Key : Start by selecting the unique identifier in your message that will serve as your idempotency key. This could be an order ID, transaction number, or any field that uniquely identifies each event. Set Up Object Store Configuration : Navigate to MuleSoft’s Object Store configuration within Anypoint Studio and configure it for storing these keys. Here, you can choose between In-Memory or Persistent storage options depending on your scalability needs. Apply Idempotent Filter Component : Drag the “Idempotent Filter” component into your flow where you want to enforce idempotency. Configure this filter by specifying the object store and the key field that uniquely identifies each incoming event. And just like that, you’ve set up a system that ensures even when an integration event is delivered multiple times, it will only process once—eliminating double-charges or redundant data entries in your downstream systems. Why This Matters for Low-Level Beginners For many of us working with MuleSoft and similar platforms, the complexity around ensuring message processing integrity can seem daunting. Yet, by simplifying this process through intuitive component usage, we ensure that each event is processed exactly once, maintaining system accuracy without diving into complex scripting or configuration. Conclusion: Empowering Automators As you continue on your journey of automating data flows and enhancing business processes, remember—MuleSoft’s capabilities extend far beyond what rigid pre-built connectors might suggest. Embrace these n

Nintendo had a hotline where gamers could, at the time, call and speak with 'Game Counsellors' who provided them with tips and walkthroughs. It operated for quite sometime before Nintendo sunset it. There are a few (Product) lessons from this that I am sure will be of value to Product Leaders. 1- Necessity (Invention's mother) : The necessity of a situation usually births the creation of something that stands out from the rest. While Nintendo was not the first to use a phone as a 'business' function, it proved it can be used in the context of a video gaming community. That was their ‘necessity’. "We need a way to accomplish ‘xyz’ " usually turns to creating something specific to that situation. The ‘xyz’ in Nintendo’s case was supporting gamers instantly. It could also be something to support a Product or make it easier for the customer. It could be a feature or it could even be the Product itself. All we need to do is pay attention to our necessities, needs and allow it to guide us. Most people are not paying attention to their needs that’s why innovation and improvements appear difficult. Others know what their necessities are but prioritise wrongly – well that’s story for another day. The point here is simply to build for a necessary problem that exists and not out of assumptions. 2- Know what is available immediately : If necessity is calling, we cannot keep it waiting. We need to look around to know what’s available immediately. In most cases we do not need to go far for solution, we just need to pick what is close by then structure it to align with current needs. Sometimes the necessity demands using/importing an idea from some other place into your own specific area. In retrospect, Nintendo had other options it could have considered at that era in time. During that period, it was common to use print media to relate with the computer (and also gaming) community. There was also postal mail, bulleting boards. I do not know for sure but I am guessing the team at

What are you working on? I hear these words in my day-to-day. And sometimes, when I hear them, there’s this little brain freeze that happens because my brain is probably trying to put into words the amount of things that have wandered through my head in the last 24 hours. 😂 So I thought, okay, let me try something. I want to take some of those wandering thoughts, explorations, things I'm trying out and things I'm learning, and put them into writing. This is going to be a series where I come and talk about what I'm working on — software engineering, product, work, people, faith, relationships, rest, and whatever else happens to be taking up space in my head at the moment. So, what am I working on? I recently started writing backend code, and there’s a bit of a backstory to that. I built this frontend commerce store years ago where people can come and shop for furniture. At the time, I used a backend-as-a-service to handle the backend side of the application. Now, I’m coming back to that same system and writing the backend myself with NestJS. I wanted to go beyond just consuming a backend and actually understand what is happening behind the scenes. The learning process is a bit stretching at the moment because I’m getting familiar with a lot of new concepts. Tiring and frustrating? Yes. But the feeling when I finally understand the reason behind something is always refreshing. That has been really rewarding lately. I'm also in the middle of launching a mobile application at my workplace, going through system design classes, figuring out how to get the best out of my engineers (AI sub-agents, by the way 😅), and occasionally imagining that dream job where you get to build products that serve millions of people and work with really brilliant minds. Also, I discovered the productivity rush that comes with using large monitors. 😂 Then there's learning how to rest while also trying to close out all the open loops in my head. Building reading habits. Figuring out what to pri

With all the hype in the past several years around AI (or more specifically GenAI), I'm not afraid to say – I'm an AI skeptic. It doesn't mean that I don't believe that some day AI may have a huge impact on human beings' lives, but at the moment, all I can see is irrational hype. In my background, I came from infra-security; I am not a developer, nor do I consider myself an AI expert. I am a cloud architect, meaning I'm looking at proposed architectures, seeing how they suit business requirements, and whether they are deployed in a secure, resilient, and perhaps cost-effective way. I don't see value in adding AI to every design, just for the sake of saying "our application now includes AI". I've been watching the industry since 2023 go nuts. Suddenly, everyone is eager to add AI capabilities, chasing some unexplained FOMO before the machines replace our jobs. I'm not against the use of AI. As a matter of fact, I've been using Grammarly for many years (since, for most of us, English is not our first language). In the past several years, I've been using chatbots such as ChatGPT, Perplexity, and recently Gemini daily, asking questions about various topics and aspects of my life. From asking the bot to provide me an answer about a specific character in a favorite TV show, to "how do I resolve an alert shown on my car's dashboard," and up to "summarize this blog post for my newsletter". It's great that I can ask Gemini to create me a LinkedIn post based on an article I just read, add some emojis and hashtags, and at the end create me a cover image for the post. For a probabilistic system, this is great. I am expecting the system to be creative and produce me attractive results, sometimes even funny images. For a home consumer, this is great, but far from been ground breaking technology. I truly believe that the "big money" will come from enterprises paying a lot of money for AI-based solutions, once the industry can actually make something good from a non-deterministic s

A few days ago I posted here about DevStacker, my app for helping self-taught developers escape tutorial hell and build real projects. We were getting ready to launch it, but then we found some bugs in the login screen. The app itself was working, but the login flow had some issues, and obviously we can't really launch while the first thing users see is broken lol. So we delayed the launch for a bit and we're fixing it now. I'm pretty close to getting everything ready, so hopefully DevStacker will be live very soon. This is also my first app, and honestly I didn't realize how many random things can go wrong until I actually tried to launch one 😭 Anyway, back to fixing login. I'll post again when DevStacker is finally live 🚀

I'm building a programming language. Written like that, it sounds as if I had always dreamed about compilers, read the Dragon Book cover to cover, and spent years waiting for the day I could finally design my own language. Not even close. I was just writing ordinary web applications and constantly thinking things like: "Why do I have to write it this way here?" or: "Wouldn't this feel better if I could write it a little more directly?" I kept digging into those small annoyances instead of ignoring them, one by one, and somehow they turned into a programming language. It's called Seseragi . Seseragi (せせらぎ) is a Japanese word for the gentle sound or flow of a small stream. I wanted my programming language to have a Japanese name. https://github.com/KentaroMorishita/seseragi https://seseragi.vercel.app/ https://seseragi.vercel.app/tour/ It's still experimental and pre-release, but a Rust compiler, CLI, LSP, formatter, WASM Playground, Signal, and Web UI are already working to a surprising degree. Even I sometimes look at it and think, "How far is this thing going?" It started with being tired of if In 2024, I wrote this article on Qiita. https://qiita.com/KentaroMorishita/items/6329d20fbc6f98f72864 The title alone probably tells you I was already heading somewhere weird. I don't think I hated if itself. What bothered me was the feeling of tracing conditional branches as statements . That was also why I liked ternary expressions. Not just because they were short. They were expressions, so I could take the result directly as a value. const label = isLoading ? " Loading... " : hasError ? " Error " : " Ready " Of course, once these grow, they become painful too. So I started building my own match and when abstractions on top of TypeScript. Looking back, I was trying pretty hard to fight the language. But the underlying desire was already clear: I'd rather construct values than chase control flow. When I look at Seseragi now, the symptoms had started long before the languag