Blog
Articles in the "Technical" category.
"Open" does not always mean free for commercial use. A model's weights carry a license layer separate from the code — sort them into three buckets (Apache/MIT, conditional community like Llama/Gemma, restricted/non-commercial). A commercial-use cheat sheet for LLM, image, and audio models, plus a use-case checklist and the version/EU/MAU traps.
Read moreBuilding an OSS/SaaS procurement policy from scratch? A copy-and-adapt kit: a three-tier allow/caution/deny list, an intake request template, and a re-licensing watch clause. Plus the operational flow from adoption to SBOM-in-CI, quarterly inventory, and change detection — practical structure, not abstract principles.
Read moreCompare Terraform, OpenTofu, CDK, Bicep, Pulumi, and Crossplane by use case. With 2026 end-of-support tools (Copilot CLI, Deployment Manager, cdktf) and the OSS-license, EU-sovereignty, and compliance forces behind the choice — a six-use-case guide on one specialized-vs-generalized axis.
Read moreNot sure where to run Claude? Approval-only, full control, autonomous batch, or team rollout each fit a different place. We map nine options onto four zones and narrow to one by use case, budget, and data residency — with the US/EU compliance forces (HIPAA, FedRAMP, sovereign cloud) that drive the choice abroad.
Read moreAsked to "provide an SBOM"? A practical map: SPDX / CycloneDX today, ten tools by role (Syft, Trivy, Grype, OSV-Scanner, ScanCode, and SaaS), realistic setups by team size, a copy-paste CI recipe, and the US/EU drivers (EO 14028, EU CRA) — free OSS first.
Read moreBuilding an internal app in-house? A builder-and-approver guide: the convenience-vs-control trade-off, the shadow-IT to citizen-development to in-house gradient, the three pillars (operations, security, licensing), a pre-release checklist, and the US/EU secure-development picture (NIST SSDF, EU CRA/PLD).
Read moreWhere to run code safely: a five-layer trade-off map (VMs, microVMs, containers, OS sandboxes, WebAssembly), how to try untrusted code safely, an eight-item AI-agent sandbox checklist (Claude Code / Codex), and the US/EU drivers (NIST SP 800-190, FedRAMP, EU CRA) — for indie developers and practitioners.
Read more