All posts
Every note on AI-augmented engineering, LLM infrastructure and shipping real software — drawn from things I actually built.
Stuxnet: the worm that crossed from code into physical damage
Most malware steals passwords or encrypts files. Stuxnet broke uranium centrifuges. How a USB-delivered worm crossed the gap between software and the physical world, and what it changed forever.
Read
The first AI-run cyberattack is already here
In 2025 Anthropic reported a state-sponsored group using Claude Code to run most of a hacking campaign on its own. What modern AI hackers actually do, what they still cannot do, and how defenders should respond.
Read
The $1 billion bank heist that a typo stopped
In 2016 hackers used Bangladesh Bank's own SWIFT access to ask the New York Fed for almost a billion dollars. They got $81 million. A misspelled word, a street name and a broken printer saved the rest.
Read
The $1.5 billion Bybit hack: when the screen lies to you
In February 2025 North Korean hackers stole about $1.5 billion in Ethereum from Bybit, the largest crypto theft ever. They did not break the blockchain. They poisoned the web page the signers trusted.
Read
The $25 million video call where everyone was a deepfake
A finance employee joined a video call with the CFO and several colleagues, then sent $25 million. None of the other people on the call were real. How the Arup deepfake scam worked, and how to stop the next one.
Read
Inside the FBI's Cyber Most Wanted list
Million-dollar rewards, Lamborghinis with stolen-money plates, and suspects who may never be arrested. Who is on the FBI's Cyber's Most Wanted list, and why the list still works.
Read
From Creeper to Stuxnet: a short history of computer viruses
The first computer virus was a joke. Then came a pair of brothers in Lahore, a worm that took down a tenth of the internet, a love letter that infected millions, and a digital weapon that broke real machines.
Read
Lazarus Group: the hackers who fund a nation
Sony, Bangladesh Bank, WannaCry, Ronin, Bybit. One North Korean hacking operation keeps showing up behind the biggest heists in history. Here is how they work, and what every builder should learn from them.
Read
How police hacked LockBit, the world's biggest ransomware gang
In February 2024, the UK's National Crime Agency, the FBI and partners took over LockBit's own leak site and turned it against the gang. Inside Operation Cronos, and what it revealed about ransomware promises.
Read
Trojans: the malware you invite in, and how the FBI uninstalled it
Zeus, Emotet and Qakbot infected millions of computers by looking harmless. Then police did something wild — they used the botnets' own channels to remove the malware. A plain guide to trojans and the biggest botnet takedowns.
Read
WannaCry: the global ransomware stopped by a $10.69 domain
In May 2017 a worm encrypted hospitals, factories and train stations in over 150 countries in a single weekend. A 22-year-old researcher stopped it by registering a domain name. Here is how, and why it should never have spread.
Read
Will AI replace developers? What actually changes
The honest answer from someone who ships with AI every day — it replaces the typing, not the judgment. Here's who's actually at risk, and who gets more valuable.
Read
Is AI dangerous, or just misunderstood?
The scary robot on the news and the tool I use every day are not the same thing. A builder's honest, non-hype take on where AI actually helps, where it actually harms, and what to watch.
Read
Vibe coding is fun — until it hits production
Prompting until it works is a great way to learn and prototype, and a dangerous way to ship. Where "vibe coding" earns its place, where it quietly bites, and how to graduate a vibe-coded prototype into something real.
Read
How I audit AI-written code — and the bug that proved why
I ship as an AI-augmented solo builder, but I never trust what the model produces. Here's the review discipline that caught a missing Android permission in every earlier release build.
Read
Payment-native from day one — building with QRIS in Indonesia
Cards are the wrong default for the Indonesian market. Here's how I make apps take money natively with QRIS — and why verification has to happen on the server, never the client.
Read
One key, five LLMs — building Vensix, an OpenAI-compatible gateway
Why I put a single billing-and-routing layer in front of Claude, GPT, Gemini, DeepSeek and Kimi — and what an OpenAI-compatible API buys you for the Indonesian market.
Read
Shipping a whole business on Cloudflare Workers
No servers to patch, no region to pick, and a bill that rounds to zero at low traffic. How I run real products — a dealership CMS, a temp-mail service, this very site — on Cloudflare's edge.
Read
I wrote Indonesian payroll twice on purpose
CoalTrack computes statutory payroll on the server in PHP and again on the handset in Dart. Duplicating the logic sounds wrong — here's why it's the safest thing I did.
Read
Access control belongs in the database, not the UI
Hiding a button is not security. How I enforce who-can-see-what with Postgres row-level security — and back it with an audit trail the app is not allowed to rewrite.
Read
Debloating Android without root — and proving it worked
A no-root, fully reversible debloat toolkit over wireless ADB, with real before/after numbers from a vivo V21. No placebo "boosters" — measured frames.
Read