Blog
Articles, guides, and notes on software engineering.
Creating Value in the Age of Generative AI
A review of Creating Value in the Age of Generative AI. Going beyond the tooling question of how to use generative AI, it addresses how to create value in the generative AI era from a practitioner's viewpoint. Organized around mindset, skills, data, and use cases, it centers on the thinking that connects technology to organizational and business outcomes.
Recent Posts
Microservices Patterns
A review of Microservices Patterns. Chris Richardson's systematic organization of microservice design patterns. From decomposition strategies to Saga-based distributed transactions, API Composition, CQRS, and event sourcing, it lays out the challenges and standard solutions in distributed systems, complete with their trade-offs.
Secure API: Principles for Design, Construction, and Implementation
A review of Secure API. A book that treats API security as consistent principles spanning design, construction, and implementation. From authn/authz, TLS, and secret management to dependency vulnerabilities and CI/CD, it organizes the whole API lifecycle from the threat-based view of why it is needed.
The Software Developer's Career Handbook
A review of The Software Developer's Career Handbook. A book by Michael Lopp, known for Being Geek. On the situations everyone hits in their career: changing jobs, promotions, dealing with bosses, and conduct in meetings and chat, it offers questions to guide judgment rather than forcing a single right answer.
Guide to the Software Quality Body of Knowledge, 3rd Edition (SQuBOK Guide V3)
A review of the Guide to the Software Quality Body of Knowledge, 3rd Edition (SQuBOK Guide V3). The third edition of SQuBOK, systematically organizing knowledge of software quality. Alongside quality concepts, management, test techniques, and metrics, it takes in recent topics like agile, AI/ML, and security. One to keep as a map of quality knowledge.
Prerequisite Knowledge Before Starting a Risk Assessment
A single map of the prerequisite knowledge worth having before you start a risk assessment. Starting from assets, threats, vulnerabilities, and risk, it places NIST SP 800-30, ISO/IEC 27005, OWASP ASVS, NIST SP 800-63B, and CVSS v4.0, through to threat modeling and MITRE ATT&CK.
Why the Domain Fades From View in Web Development, and Why It Eventually Comes Back
Understand what a domain really means, why it works as an architectural boundary, and the structural reasons the domain fades from view in web development.
An Introduction to Monitoring Design: From Purpose to SLIs
Reframing the purpose of monitoring as decision-making, this guide walks through a tool-agnostic way to design monitoring: the big picture, design principles, user-impact scenarios, and SLI definition, for beginners.
Designing Engineering Management as a "Deck"
Don't let management practices—1on1s, OKRs, review rules—pile up as a loose collection. A way to design them as one system (a deck) around the quality and reproducibility of decisions, and the conditions that turn a practice into an outcome.
Hands-On API Learning
A review of Hands-On API Learning. A practical book you learn by building, spanning API design, implementation, testing, and operations. It covers essentials for long-term operation such as design principles, documentation, versioning, and security, and works as a checklist for revisiting your own API design.
Beyond Vibe Coding
A review of Beyond Vibe Coding. Looking past 'vibe coding'-letting AI write code-it covers how to make real use of AI in practice, presenting practices for embedding AI into the whole development workflow rather than treating it as a mere code generator, and offering a map of how review, testing, and refactoring change in the AI era.
Context Engineering
A review of Context Engineering. It focuses on how to design the context you give an LLM. Beyond wording prompts, it covers choosing and structuring the information you pass in and combining it with retrieval and memory. Closely tied to the challenges of building RAG and agents, it offers a perspective for lifting ad hoc tweaks into reproducible engineering.
How to Craft an Engineering Strategy
A review of How to Craft an Engineering Strategy. It presents engineering organizational strategy not as abstraction but as concrete steps. Through diagnosing the situation, setting direction, and translating it into action, it teaches a template for building technical decisions along the organization's context, clarifying for those wary of the word strategy.
Good Code, Bad Code
A review of Good Code, Bad Code. A book that concretely shows the difference between good and bad code through lenses like abstraction, modularity, error handling, and testing. It offers judgment criteria you can use directly in daily reviews, such as clarifying contracts, guarding against unexpected input, and making misuse hard.
Prompt Engineering for LLMs
A review of Prompt Engineering for LLMs. An O'Reilly book that systematically organizes prompt engineering. Rather than a grab-bag of tricks, it explains from the principles of why a prompt works. Through tokenization, few-shot prompting, and output evaluation, it turns prompting from experience and intuition into something you can design.
The Work of a Senior Engineering Leader
A review of The Work of a Senior Engineering Leader. A book for leaders shifting from getting things done individually to achieving results through others. It carefully organizes the areas technical skill alone cannot cover: delegating decisions, prioritization, and engaging stakeholders.
Simplicity: Sustainable, Humane, and Effective Software Development
A review of Simplicity. A book that asks how to keep software development, so easily swallowed by complexity, simple. Beyond technical techniques, it makes you realize that choices about what not to build and where to stop are what let you keep developing healthily over the long term.
The Book You Wish Your Parents Had Read
A review of The Book You Wish Your Parents Had Read. A book on parenting and the parent-child relationship by British psychotherapist Philippa Perry. Rather than a set of discipline techniques, it emphasizes how to build a relationship with your child and how to face your own emotions. Its view of valuing repair after mistakes over perfection lingers.
Thinking in Systems: A Primer
A review of Thinking in Systems. A book by Donella Meadows, known as a classic of systems thinking. Around concepts like stocks and flows and feedback loops, it offers a way to see the world as a system of interrelated parts. It argues for finding the cause of problems in structure rather than individual elements, and for discerning leverage points.
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
Explains where to store access tokens in an SPA (the danger of localStorage), a BFF + session design that keeps tokens out of the browser, and why starting token-less is often enough.
