Blog
Articles tagged "Solo dev".
Protecting data at rest is not a single switch. Choose the encryption layer (app / DB-TDE / disk), keep keys out of code (env vars → KMS → envelope encryption), encrypt and test-restore backups, and tighten access control — mapped by "which threat, defended by what," with US (breach laws, HIPAA, PCI DSS) and EU (GDPR Art. 32) drivers.
Read moreAs your Skills pile up, split them by nature — single-task "work Skills" and flow-orchestrating "orchestration Skills" — to keep improvement loops and context light.
Read moreAuthentication (who you are) and authorization (what you may do), explained as one connected map — from passwords, MFA, and passkeys to SSO, OAuth, OIDC, and SAML, up to Zero Trust. A concept guide for US/EU builders, centered on NIST SP 800-63-4 and eIDAS 2.0.
Read more"Open" does not always mean free for commercial use. A model's weights carry a license layer separate from the code — sort them into three buckets (Apache/MIT, conditional community like Llama/Gemma, restricted/non-commercial). A commercial-use cheat sheet for LLM, image, and audio models, plus a use-case checklist and the version/EU/MAU traps.
Read moreCompare Terraform, OpenTofu, CDK, Bicep, Pulumi, and Crossplane by use case. With 2026 end-of-support tools (Copilot CLI, Deployment Manager, cdktf) and the OSS-license, EU-sovereignty, and compliance forces behind the choice — a six-use-case guide on one specialized-vs-generalized axis.
Read moreNot sure where to run Claude? Approval-only, full control, autonomous batch, or team rollout each fit a different place. We map nine options onto four zones and narrow to one by use case, budget, and data residency — with the US/EU compliance forces (HIPAA, FedRAMP, sovereign cloud) that drive the choice abroad.
Read moreAsked to "provide an SBOM"? A practical map: SPDX / CycloneDX today, ten tools by role (Syft, Trivy, Grype, OSV-Scanner, ScanCode, and SaaS), realistic setups by team size, a copy-paste CI recipe, and the US/EU drivers (EO 14028, EU CRA) — free OSS first.
Read moreAI service safety splits into three tiers: enforced by settings, per-use discipline, and enterprise contracts. Training opt-outs and retention, the three mechanical layers for CLI and autonomous agents, a pre-input five-question checklist, and contract-only guarantees (ZDR, audit logs) — with the US/EU drivers (FTC, state laws, GDPR, AI Act).
Read moreBuilding an internal app in-house? A builder-and-approver guide: the convenience-vs-control trade-off, the shadow-IT to citizen-development to in-house gradient, the three pillars (operations, security, licensing), a pre-release checklist, and the US/EU secure-development picture (NIST SSDF, EU CRA/PLD).
Read moreWhere to run code safely: a five-layer trade-off map (VMs, microVMs, containers, OS sandboxes, WebAssembly), how to try untrusted code safely, an eight-item AI-agent sandbox checklist (Claude Code / Codex), and the US/EU drivers (NIST SP 800-190, FedRAMP, EU CRA) — for indie developers and practitioners.
Read moreUnderstand communication security through eight layers (OSI 7 plus an authentication / authorization layer): what to defend at each layer (TLS, IPsec, mTLS, zero trust, OAuth / OIDC), a layer-by-layer checklist, and the US/EU drivers (NIST, FedRAMP, NIS2, CRA, GDPR) — for practitioners who are not security specialists.
Read moreApply a Skill's top-of-file summary structure to the context files you feed AI — a two-layer shape that keeps context consumption down.
Read moreFor work that needs stable output, narrow AI's role and bracket it with deterministic code — making peace with probabilistic wobble.
Read moreHave AI build it, then keep saying "fix this" as you use it — growing a Skill into a tool that fits your hand.
Read moreUnderstand enterprise networks through three zones and two layers of gatekeepers (firewalls): a parts cheat-sheet, three traffic-flow scenarios, VPN vs ZTNA, cloud-connection choices, and a planning / pre-release checklist — for practitioners who are not infrastructure specialists.
Read morePublishing on GitHub, collaborating abroad, or making controlled technology accessible to non-residents can put software inside an export-control regime — though most public OSS clears the publicly-available exemption. The dual-use logic, a five-category screen, US EAR / ITAR and EU Dual-Use basics, and a self-diagnosis checklist.
Read moreAI regulation pulls in different directions: the EU's risk-based hard law with extraterritorial reach, a US federal layer that swings by administration plus a state patchwork, and Japan's promotion-first model. An attribute-based screen for which regime actually reaches you.
Web-accessibility "mandates" are widely misread. In the US the ADA imposes a duty of access but no binding WCAG standard for the private sector; the EU EAA is an enumerated list with exemptions; WCAG is mandated directly only for government. The accurate scope for builders.
Whether AI-generated work gets copyright turns on human creative contribution; prompt-only output is hard to protect in Japan, the US, and the EU. Separate copyright from the service contract and from disclosure duties, with per-jurisdiction tests.
Read moreIf a contract is silent, the deliverable's copyright usually stays with the maker — "we paid for it" is not enough. The default rules, copyright-assignment clauses (work made for hire, the 17 U.S.C. §204(a) signed writing), moral rights, and USPTO/EUIPO trademark screening, for both the hired and the hiring side.
Read moreOnly a CDN-level block actually stops an AI-training crawler; robots.txt, X-Robots-Tag, and noai signal intent and leave a record. A four-layer defense stack, host-by-host setup, and where US fair-use and EU DSM litigation now stands.
Read moreAI service Terms are a contract, distinct from the underlying model license. Read them across six axes — training opt-out, commercial use, output ownership, liability, indemnity, retention — for personal, commercial, and enterprise-API cases.
Read moreA US/EU-focused guide: when you scrape — or let an AI fetch pages — sort your case into four legal lenses (CFAA, copyright/fair use, GDPR, contract) before you use the data. Covers hiQ, Meta v. Bright Data, the Ross/Bartz/Kadrey AI-training split, and Clearview.
Read moreRoyalty-free and free mean neither zero cost nor unlimited. Before you use any image, music track, AI-generated asset, Creative Commons work, or font, check commercial use, caps, modification, credit, and redistribution — with a font-by-use table.
Read moreBefore adopting third-party OSS, identify its tier by SPDX identifier and reconcile it with your linking and distribution form to see what source-disclosure duties reach your code — from MIT to AGPL, plus the source-available trap and case law.
Read moreA pre-ship rights check for US/EU developers: copyright exceptions (fair use, EU DSM Art. 4), AI-generated work (human authorship, the EU AI Act), and the four-tier OSS license spectrum.
Read more