The blog
Notes on building websites, design, and the brands I love working with.
Okay, But Actually… Encryption at Rest Does Not Fix a Bad Application
Someone asked whether a hypothetical business app used envelope encryption and what its blast radius was. Fair questions, once we know what the app stores. Here is what encryption at rest protects, what it cannot fix, and why a locked database can still hand information to the wrong person.
Okay, But Actually… Big Companies Build Custom Software Too
Someone asked why the world's most profitable companies don't build custom software. Walmart and JPMorganChase do. Their own explanations show how large businesses choose what to build and what to buy.
Okay, But Actually… Data Residency Is Not the Same as Data Protection
People love throwing California, Europe and Brazil into conversations about custom software before asking what the application actually does. Here is what data residency tells you, what it does not, and why buying SaaS does not make the legal questions disappear.
Okay, But Actually… Custom Does Not Mean Homemade Security
Using Supabase, Stripe or managed hosting does not make a product less custom. I am much more concerned about the person who chose the whole stack because AI sounded confident and now cannot explain what any of it is doing.
Okay, But Actually… One Developer Is Not Automatically the Scary Option
An experienced solo developer should not be confused with a beginner holding an AI subscription, and a crowded agency org chart is not proof of competence.
Okay, But Actually… Custom Software Is Not the Problem Here
Some AI-built apps should not be anywhere near real customer data. Before hiring anyone, ask who controls access, what happens after launch, and whether the person building it can explain their own security decisions without secretly asking AI.
I got the first screen back, and it humbled me
The oldest, smallest piece of the game turned out to be the hardest. It also reinforced what I already knew about AI: it can be completely thorough and completely wrong at the same time, and just as sure of itself either way.
I'm rebuilding a dead game for an audience of two
The servers went dark back in 2018. All I've got left is the app file, a lot of nostalgia, and AI tools that finally make rebuilding it possible.
Why 'it works' isn't the same as 'it's done'
You can get a website on screen fast. Getting one you can trust with real users and real money is different. Here's why the order you build in matters.
Will AI replace web designers?
Will AI replace web designers? Here's the honest answer from someone who builds with AI daily. It changes the job a lot, and deletes it far less than the headlines say.
No AI slop: what I actually mean (yes, I use AI every day)
I use AI every day to build websites, and I still say no AI slop. Here's what that actually means, and why the tool was never the problem.