Blog
Practical thinking, AI tools, and technical deep-dives — field-tested knowledge from real-world work.
Press the "JA" button in the top right — rather than a simple translation, it switches to a Japan-focused version built on the same structure. Give it a try.
Protecting data at rest is not a single switch. Choose the encryption layer (app / DB-TDE / disk), keep keys out of code (env vars → KMS → envelope encryption), encrypt and test-restore backups, and tighten access control — mapped by "which threat, defended by what," with US (breach laws, HIPAA, PCI DSS) and EU (GDPR Art. 32) drivers.
Read moreData you hand to US providers (OpenAI, Google, AWS) is reachable by the US government through the CLOUD Act, FISA 702, and NSLs — fast — while a non-US government's MLAT route averages ~10 months, and Japan has no CLOUD Act executive agreement. The sovereignty asymmetry the EU litigated in Schrems II, mapped for builders.
Read moreWhat happens to data you hand to AI/cloud services after you delete it? Retention, government access (CLOUD Act, FISA, NSL), managed enclaves, and the EU view (GDPR, Schrems II) — mapped for builders, kept separate from the training-use question.
Read moreAs your Skills pile up, split them by nature — single-task "work Skills" and flow-orchestrating "orchestration Skills" — to keep improvement loops and context light.
Read moreAuthentication (who you are) and authorization (what you may do), explained as one connected map — from passwords, MFA, and passkeys to SSO, OAuth, OIDC, and SAML, up to Zero Trust. A concept guide for US/EU builders, centered on NIST SP 800-63-4 and eIDAS 2.0.
Read more"Open" does not always mean free for commercial use. A model's weights carry a license layer separate from the code — sort them into three buckets (Apache/MIT, conditional community like Llama/Gemma, restricted/non-commercial). A commercial-use cheat sheet for LLM, image, and audio models, plus a use-case checklist and the version/EU/MAU traps.
Read moreBuilding an OSS/SaaS procurement policy from scratch? A copy-and-adapt kit: a three-tier allow/caution/deny list, an intake request template, and a re-licensing watch clause. Plus the operational flow from adoption to SBOM-in-CI, quarterly inventory, and change detection — practical structure, not abstract principles.
Read moreCompare Terraform, OpenTofu, CDK, Bicep, Pulumi, and Crossplane by use case. With 2026 end-of-support tools (Copilot CLI, Deployment Manager, cdktf) and the OSS-license, EU-sovereignty, and compliance forces behind the choice — a six-use-case guide on one specialized-vs-generalized axis.
Read moreNot sure where to run Claude? Approval-only, full control, autonomous batch, or team rollout each fit a different place. We map nine options onto four zones and narrow to one by use case, budget, and data residency — with the US/EU compliance forces (HIPAA, FedRAMP, sovereign cloud) that drive the choice abroad.
Read moreAsked to "provide an SBOM"? A practical map: SPDX / CycloneDX today, ten tools by role (Syft, Trivy, Grype, OSV-Scanner, ScanCode, and SaaS), realistic setups by team size, a copy-paste CI recipe, and the US/EU drivers (EO 14028, EU CRA) — free OSS first.
Read moreAI service safety splits into three tiers: enforced by settings, per-use discipline, and enterprise contracts. Training opt-outs and retention, the three mechanical layers for CLI and autonomous agents, a pre-input five-question checklist, and contract-only guarantees (ZDR, audit logs) — with the US/EU drivers (FTC, state laws, GDPR, AI Act).
Read moreBuilding an internal app in-house? A builder-and-approver guide: the convenience-vs-control trade-off, the shadow-IT to citizen-development to in-house gradient, the three pillars (operations, security, licensing), a pre-release checklist, and the US/EU secure-development picture (NIST SSDF, EU CRA/PLD).
Read moreWhere to run code safely: a five-layer trade-off map (VMs, microVMs, containers, OS sandboxes, WebAssembly), how to try untrusted code safely, an eight-item AI-agent sandbox checklist (Claude Code / Codex), and the US/EU drivers (NIST SP 800-190, FedRAMP, EU CRA) — for indie developers and practitioners.
Read moreUnderstand communication security through eight layers (OSI 7 plus an authentication / authorization layer): what to defend at each layer (TLS, IPsec, mTLS, zero trust, OAuth / OIDC), a layer-by-layer checklist, and the US/EU drivers (NIST, FedRAMP, NIS2, CRA, GDPR) — for practitioners who are not security specialists.
Read moreApply a Skill's top-of-file summary structure to the context files you feed AI — a two-layer shape that keeps context consumption down.
Read moreFor work that needs stable output, narrow AI's role and bracket it with deterministic code — making peace with probabilistic wobble.
Read moreHave AI build it, then keep saying "fix this" as you use it — growing a Skill into a tool that fits your hand.
Read moreUnderstand enterprise networks through three zones and two layers of gatekeepers (firewalls): a parts cheat-sheet, three traffic-flow scenarios, VPN vs ZTNA, cloud-connection choices, and a planning / pre-release checklist — for practitioners who are not infrastructure specialists.
Read morePublishing on GitHub, collaborating abroad, or making controlled technology accessible to non-residents can put software inside an export-control regime — though most public OSS clears the publicly-available exemption. The dual-use logic, a five-category screen, US EAR / ITAR and EU Dual-Use basics, and a self-diagnosis checklist.
Read moreAI regulation pulls in different directions: the EU's risk-based hard law with extraterritorial reach, a US federal layer that swings by administration plus a state patchwork, and Japan's promotion-first model. An attribute-based screen for which regime actually reaches you.
Web-accessibility "mandates" are widely misread. In the US the ADA imposes a duty of access but no binding WCAG standard for the private sector; the EU EAA is an enumerated list with exemptions; WCAG is mandated directly only for government. The accurate scope for builders.
Whether AI-generated work gets copyright turns on human creative contribution; prompt-only output is hard to protect in Japan, the US, and the EU. Separate copyright from the service contract and from disclosure duties, with per-jurisdiction tests.
Read moreIf a contract is silent, the deliverable's copyright usually stays with the maker — "we paid for it" is not enough. The default rules, copyright-assignment clauses (work made for hire, the 17 U.S.C. §204(a) signed writing), moral rights, and USPTO/EUIPO trademark screening, for both the hired and the hiring side.
Read moreOnly a CDN-level block actually stops an AI-training crawler; robots.txt, X-Robots-Tag, and noai signal intent and leave a record. A four-layer defense stack, host-by-host setup, and where US fair-use and EU DSM litigation now stands.
Read moreAI service Terms are a contract, distinct from the underlying model license. Read them across six axes — training opt-out, commercial use, output ownership, liability, indemnity, retention — for personal, commercial, and enterprise-API cases.
Read moreA US/EU-focused guide: when you scrape — or let an AI fetch pages — sort your case into four legal lenses (CFAA, copyright/fair use, GDPR, contract) before you use the data. Covers hiQ, Meta v. Bright Data, the Ross/Bartz/Kadrey AI-training split, and Clearview.
Read moreRoyalty-free and free mean neither zero cost nor unlimited. Before you use any image, music track, AI-generated asset, Creative Commons work, or font, check commercial use, caps, modification, credit, and redistribution — with a font-by-use table.
Read moreBefore adopting third-party OSS, identify its tier by SPDX identifier and reconcile it with your linking and distribution form to see what source-disclosure duties reach your code — from MIT to AGPL, plus the source-available trap and case law.
Read moreA pre-ship rights check for US/EU developers: copyright exceptions (fair use, EU DSM Art. 4), AI-generated work (human authorship, the EU AI Act), and the four-tier OSS license spectrum.
Read more