Full Width 
Shortcuts 
Sign Up 
Log In 
Articles 
Reading List More from Tom MacWright
September was another big month for my life, mostly for me offline. Another good month for bicycle riding, seeing more of the trails on Randalls and Wards Islands. The New York area has taught me a few things about islands and one of them is that they're very fungible. On a map, Randalls and Wards Islands look one one island because they're "conjoined". They were conjoined on purpose: they used to be two, with a bridge and everything. But then in 1955 the government announced they wanted to join up the islands "by allowing private contractors to dump debris within Little Hell Gate for free" (!) Photo from From City of New York Department of Parks: 28 Years of Progress, scanned by Erica Fischer (!) CC BY SA 2.0 The opposite happened with Fire Island: it was one island for a while until 2012, and Hurricane Sandy broke it back into two. Photo from USGS, PD Dump trash to combine islands, dump water from the sky to divide them. That's just how life is. .two-up{display:grid;grid-template-columns:1fr 1fr;gap:10px} Listening I watched Magnolia this month and finally got the hype around Aimee Mann. It's a little frustrating that the songs from the film aren't on And a throwback: Dusty Springfield's version of When the Love Light Starts Shining Through His Eyes. Originally recorded by the Supremes and forgive me for highlighting the blue-eyed soul version of this song but it's so driving and urgent in a way that most of the other versions aren't, it's such a good slice of that very particular rushing rhythm of the era. Reading On a meta-level: I'm getting pulled back to Instapaper from Readeck, because I rely on offline reading so often and unfortunately the Readeck iOS offline mode is unreliable. It is open source and I should contribute and in all likelihood the issue will get fixed, but in the meantime I need something to look at on the subway. Reading: I enjoyed Spiral's launch post a lot, as well as turbopuffer's post about their refactoring. Database companies in the AI-adjacent space are a nice hybrid kind of reading, still concerned with architecture and a little more grounded than a lot of the "big idea" or marketing-centric stuff that I read from AI labs. I also liked Charles Broskoski's "Personal Business" essay (one of the are.na founders). And I've been really liking reading Work by Bud Smith. Review of that soon. Otherwise The end of October will be even more packed than September for me, so if I don't post, don't worry, I'm not dead, I'm partying.
I skipped August's Recently because this summer has been relentless, mostly in the positive sense. July and August were filled with bike rides, 5K races, friends in town, life changes and logistics. For a friend's birthday, we rode the rickety Coney Island Cyclone, which was faster and more intense than I remembered it. But it's been 18 years since the last injury on the coaster, and the rider was partly at fault: good enough for me. .two-up{display:grid;grid-template-columns:1fr 1fr;gap:10px} I rode my first proper randonneuring ride: 200km (124mi) to all of the beaches around Brooklyn. It was pretty challenging, as you'd expect, but I didn't 'find my limit' for endurance, but I did find my limit in terms of how many gels & ride-nutrition packets I could consume before sugar becomes repulsive. I do still heartily endorse maple syrup packets for ride nutrition: compared to the space-age fuels that all taste like fruit or coffee, it's an identifiable substance that tastes like you'd expect. And, not pictured, but I ran a bunch of 5Ks. Haven't hit my goal this year of going sub-20, but got close in the last one - 20:15. I'm not giving up yet, because the weather is getting better and Brooklyn has a lot of 5K options. Listening Hot Creek by Duffy x Uhlmann Duffy x Uhlmann has been in my rotation for a year now and the new album has all the things I like from the combination. This and Shrunken Elvis go along well together and both have been hits at dinner parties. This album from Frances Quinlan, the frontperson of Hop Along, went under the radar, but it's so good. I've also been playing Hop Along's send album Get Disowned. I really like everything that this band has put out. It's a product of Philadelphia but I hear some of the elements that drew me to DC post-punk in the turn-on-a-dime songwriting. Get Disowned by Hop Along Watching This video, 'The surprising truth about what motivates us', is kind of an artifact of the 'Obamaverse', as one of my friends would put it. It's by Daniel Pink, a writer-speaker-self-help kind of guy, and it's accompanied by one of those realtime hand-illustrations. There are lots of reasons to tune it out as YouTube filler. Still, I thought it was pretty cool for two reasons: first, it connected directly with Andrew Kelley's video, which is the next one. And it connects with my feelings about incentives and how most simple incentives are counterproductive. And second, the drawing is real. I'm so used to the artificial version of this visual style that it took a minutes to realize that the it wasn't AI or some 'drawing hand' style of video essay, it was a real person making quite nice illustrations: specifically Andrew Park. Found myself nodding along to every bit of this interview with Andrew Kelley. His values and motivation are so nice to encounter in this current phase of tech. He's kind of a role model, which is something that I used to find trite in my early career but I'm coming around to. As Adam Neely pointed out in his video, a lot of the people heavily using Suno (an AI music tool) could not cite any role models, and defaulted to a sort of enclosed, self-centered stance. I see this with engineering too: it's hard to discern what values or talents the people at 'the forefront of the industry' have that I want. Finding personal qualities as something to imitate instead of desires and possessions (cue the segue into Girard's Memetic theory) seems like a better way to live. Reading What strengthens a relationship? Almost always, it is personal investment. Perhaps an AI agent might be better at predicting what my father will want for his birthday than I am, but it definitionally cannot give him my time and consideration. Love is not just a feeling; it is a way of paying attention. Elizabeth Lopatto in The Verge picks apart Mark Zuckerberg's weird, sad view of humanity. It's worth a read even just for the incredible opening anecdote. Home of the titular 100 foot waves. Which existed when I was a kid of course, but the larger world didn’t know about them yet. They were our secret. My grandfather and I would walk to the lighthouse and watch the waves hitting against the cliffs and he’d tell me that these were the biggest waves in the world. I didn’t believe him, of course. I thought it was standard grandpa hyperbole. But I also didn’t want to believe that I was seeing the biggest of anything. Not yet. I wanted the really great things to be in the future. Something to aim for. Which means I missed out on some great things that were right in front of me. Mike Monteiro's newsletter is always beautiful and melancholy, and this is a really nice edition of it. I read and highlighted a few other articles but they were all saying things about AI, mostly about how it makes the world worse and makes people feel bad. I won't add those to the pile because I don't want that kind of content to dominate what I mention, even if it does dominate what I read. Elsewhere For the Val Town blog, I wrote about our experience with the bug bounty program. It's been a very interesting experience. Val Town has a pretty difficult security surface: in contrast to Mapbox, which was mostly a read-only API, it's a very read-write system with many access controls. At the center of the product is a sandbox that we want to keep secure. And because we're living in the AI age, a single bit of functionality can be exposed via REST API, React Router loaders, tRPC, and MCP. Building a model layer and a shared authorization layer - modeled after Oso - has helped a bit. But the reports still come in. It's pretty wild how AI factors into it: I'd say that 100% of the vulnerability reports used AI to write the report itself. From the best reporters, the vulnerabilities come with screen recordings and evidence, and it's clearly not all-robot. But - I suspect that other people manning help desks & bug bounty programs know this experience - it's jarring to go three replies into an email conversation with someone and they suddenly stop using an LLM to write their emails and the voice completely changes, from hyper-literate to abbreviated and misspelled. I also wrote about our new authentication scheme that makes vals require login and makes it possible to manage permissions to val applications, not just their code. It was pretty fun to implement, and the sixth or seventh time working with HMAC schemes I'm starting to get a natural grasp on them.
June was a big month: I went to Porto & Lisbon, and had a lot of life stuff happen. I'll get into the trip once I get my rolls of film developed. Three rolls at a new photo developing place: fingers crossed! Reading I finished reading Intermezzo (of the bag) and it was fantastic. I've always liked Sally Rooney's books but this was the one where the writing style really clicked. Also, The Vegan. Meh. I read Patricia Lockwood's 'A Tradcath Wedding' via Perfect Sentences but found an additional sentence to be perfect: Whenever they rang the chimes, which seemed to be every four seconds or so, a toddler screamed ‘WOW A BELL!’ to the visible displeasure of the celebrants – though isn’t the entire point of the ritual that you’re supposed to be that awestruck every time? Patricia Lockwood is the funniest writer I've read. You cannot grow a pumpkin, but you can improve the odds. Taylor's 'You Cannot Grow a Pumpkin' is a fantastic little prose poem of sorts. Watching I'm always trying to find a 'romp' when it comes to movies. Something lighthearted, pretty easy to watch, so on. We watched The Pink Panther this month and it is a perfect example of the genre. The inspiration for the watch came from the hamburger scene: But there's so much more of this kind of thing in the movie, little bits and physical comedy. Oh, and I also watched The Departed, which everyone says is good and is good. Elsewhere I wrote Accidental Anonymity on the micro blog, and it stirred up some discussion on Bluesky as well as at least one blog response. It was kind of an angry piece, as I said at the start. I will keep trying to stay out of the trap of writing about that topic all the time. Listening The only album I bought this month was Songs of Her's by Her's, which is fine. I wish I had something more profound to say about it given how the band met an unbelievably tragic end. Maybe more influential than that was Know Your Enemy's recent podcasts, especially this one about the pope's encyclical. I've really grown to love that podcast, and it has been part of me intellectually reconnecting with, but not readopting, Catholicism. Art Here's some art I really liked this month: This Hockney piece called 'Picture Emphasizing Stillness' from 1962 was at the MAC/CCB museum in Lisbon. Via Tim Babb, I enjoyed finding Tomás Sánchez's work.
A section of trail in Switzerland May was a big month! The highlight was a cycling trip around Lake Konstanz, passing through Konstanz, Bregenz Austria, Stein am Rhein in Switzerland, and Meersburg. A farm in Bodenseeufer, Germany We passed a lot of operating agriculture, growing apples, strawberries, and other fruits. The route is very continuous, mostly flat, and popular with retirees. It's very idyllic riding: lots of protected and separated lanes. There are some interesting regional differences in the riding. Swiss drivers were noticeably more aggressive and gave a lot less space to bikes, but the Swiss infrastructure was really nice when it was off-road. Also it was interesting to see that the vast majority of other cyclists on most of the route were on ebikes. This only changed when we were close to hip cities and we'd notice more young people on high-end road bikes. Münster St. Maria und Markus Taking the ride in 40-60 mile days left a lot of room for checking out the towns, food, and views. It was very easy being vegan in Germany, and significantly harder in Austria and Switzerland. Some highlights: KERVAN Imbiss in Konstanz: cheap, delicious vegan kebabs Insel Mainau: beautiful botanical garden on an island, recommended to follow up with Biergarten St. Katharina, a beer garden in the woods The Pile Dwelling Museum in Uhldingen-Mühlhofen-Unteruhldingen: very aesthetic museum plus recreations of pile dwellings In Zurich: the Swiss National Museum was gigantic and featured the best-integrated high-tech exhibits I've seen On the final evening we took a cable car up to Panorama Restaurant Falsenegg and it delivered on the name Reading I read The Technological Republic the book by Alex Karp and one of his employees. It was terrible as expected: part sales-pitch, part standard-issue MAGA cultural critique, part implied defense of just war. The last part was the most interesting to me, because Karp spends so much time grandstanding about his intellectual background and telling protestors to quiet down and have a real discussion, and this book confirms that he can't actually have that conversation. He has nothing to say about the moral complexity or justification of war. It's surprising that the only critical reviews I could find of the book are from other right-leaning sources. Providence, an American Christian Realist magazine, found it too weak. The Independent Institute didn't like it based on their Libertarian principles. I guess it's just so far from any left-wing thought that nobody bothers to read it. Democratic governance rests on a bargain so old we’ve forgotten it’s a bargain at all. The governed have something the governors need: labor, tax revenue, military service, consumer spending. This dependency is the source of democratic leverage. The whole system functions because power is distributed, and it’s distributed because the people at the top need something from the people at the bottom. I'm still trying to avoid writing about AI, but this piece by Owen McGrann was worth the time. It takes a lot of points that I've long agreed with and stitches them together into a coherent but miserable whole. On the bright side, I'm just finishing reading Intermezzo and it's wonderful. A totally rejuvenating and inspiring novel. Listening Cheekface is a ~9 year old band in the tradition of Cake, They Might Be Giants, etc. They've got some great hits - part sardonic and ironic, part euphoric and ultra-light pop choruses. It's Sorted by Cheekface Watching Adam Neely's talking about AI and music again, and like always, it's very worth watching. The generational element is especially interesting here: just like the commencement speakers getting booed, there's a consistent theme where Gen Z (and millennials, to some extent) are rejecting the AI hype while older generations are optimistic and coincidentally in a position to benefit from it.
More in programming
My now-traditional “summary” of the conference along with my own commentary and thoughts.
Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a glimpse of what we’ll soon be able to do.
Imprint’s average engineer is merging 4x more PRs than 2 years ago. Yay. Aggregated behind the average is something even more interesting: we have two teams that are merging 10x their PRs over that period. One engineer is merging 25x the PRs per week of our average engineer two years ago, and a number are merging 10x. That’s pretty neat, and the slope of the line suggests our average in a year is going to look much closer to today’s p90 than today’s p50. Even more importantly, we aren’t just shipping more, our quality has improved: incidents are down 42% half-over-half, and critical incidents are down 78% half-over-half. I think we’ve always known the quality/velocity tradeoff wasn’t a particularly useful construct, but that’s undeniable today. As we’ve walked this path, we–like everyone else progressing down it–have run into the problem of pull request review. The p50 pull request review took about 33 minutes to complete 2 years ago, but now takes us about 77 minutes. The slope here correlates tightly with the number of pull requests getting merged. Tightly enough that addressing it became one of my priorities for the week. We solved it! Just kidding, we’ve absolutely not solved it, but I think our current approach is an interesting one, which we call the small-change. The work discussed here was shaped and done by many folks at Imprint including Dan, Joy, Daniel, Lenny, Taylor, Ted, and Annie, among many others. Why review pull requests? There are four reasons we review pull requests: Knowledge sharing between author and reviewer – software engineering is generally learned via apprenticeship, and reviews are a primary mechanism of experienced engineers teaching others what good software looks like. We believe the current volume means that this knowledge sharing will have to move towards operating on clusters of pull requests, rather than individual pull requests Preventing errors – review has always been an expensive time to catch errors, and we believe that effective CICD along with harness verification techniques like poteto’s pstack are more effective mechanisms for preventing errors than review Preventing malicious behavior – my experience is that even careful code review will generally miss competent malicious behavior, although fortunately most malicious behavior is incompetent. We believe both sorts of behavior are best identified using a combination of fixed rules (modifying these specific objects/classes/files requires review), anti-abuse mechanisms that we’ve refined in our LLM-based member support experiences, auditing, and audit log inspection Compliance obligations in our documented controls – these can be changed, but today they require that an independent human reviews changes in a subset of our repositories In the modern development paradigm, we think there is a better solution for each of these problems. But, we also want to make these changes very cautiously. Small steps with small-change We believe we move fast by finding narrow, contained ways to validate new practices, so to iterate our way into an effective solution, we’ve developed the concept of a small-change. Here’s how it works: When a pull request is marked ready, CICD determines whether it is eligible to be a small-change. This is represented as a passing Github check. There is also a label for visibility, but it is the check itself, managed by the build and not human modifiable, that determines eligibility. (The label is used for initial filtering, but the check is still independently verified.) Something is a small-change if it meets all of these criteria: It is less than 1,000 lines of code There are no p1 or p2 findings from our ai-code-review automated review bot The author has “experience” in the service or application, defined as 10+ prior merged pull requests into that service or application’s directories. For changes working across multiple services or applications, the author must have experience in all of them to qualify Impacts fewer than N distinct services or applications. N is 1 on our frontend monorepo, and N is 3 in our backend monorepo, where typical changes will modify both a gRPC service and a common HTTP gateway Shared libraries and utilities files are not eligible for small-change Each repository has a .small_change file which allows per-path customization while we continue to tune the behaviors. For example, a service dealing with money movement can be excluded Our Slack automation tags every reference to a pull request with reacji labeling the state of that pull request, for example if it has failing tests, if it has been approved but tests are still running, or if it is ready to merge. We added a small-change reacji that indicates which of those pull requests meet the small-change criteria In our internal skills repository, we created two skills that have been distributed across harnesses: review-small-change which takes a list of repositories and reviews all open, non-draft, small-changes, including providing approval if they meet the review’s criteria (all checks pass including small-change check, and not touching on sensitive topics such as payments and security) review-pr-cluster which reviews batches of pull requests to identify common themes that came up, and suggest opportunities for discussion and adding verifications We set the social expectation that any error caused by a small-change is a failure in our system, and has to be solved at the system level: improvements to ai-code-review, to our verification mechanisms, to our CICD, to our harness, etc. This took about two days of infrequent attention to implement and rollout, although I imagine we will be tuning the knobs here for a long time. Maybe forever. fleet: centrally orchestrated harness I’ll briefly mention our other approach to reducing code review volume, which anchors on our centrally-orchestrated harness, fleet. (Which is similar to Stripe’s Minions although not following the one-shot approach in particular). We rely on fleet to implement and verify software in a highly controlled harness running in the cloud, with independent evaluation mechanisms to identify the correct number of independent reviewers for any given change. That number can be as low as one (e.g. fleet writes, one human reviews) for changes evaluated as safe. Results / next steps / reception I’ll be honest, it’s too early to give a useful result here. From early results, about 10% of changes qualify as a small-change. Those are now eligible for very fast approval, and generally get it unless they trip a flag, generally due to touching a security or money adjacent topic. While 10% is a small percentage, the core concept here is working, and ultimately will succeed or fail based on our ability to expand that percentage over the next few months in tandem with expanding our verification mechanisms to be increasingly comprehensive. This is ultimately going to fail or succeed depending on our ability to improve our verifications, which does require more difficult sorts of techniques to accomplish in low scale-complexity, high domain-complexity software than in the high scale-complexity, low domain-complexity products where many techniques like incremental rollouts are exceptionally effective. (Don’t get me wrong, they still work, they just provide less coverage when most users have different configuration and behavior.) Folks have not been uniformly excited about this, it’s a substantial change from how we’ve learned to be good engineers, and it’s uncomfortable to reevaluate whether a long-held best practice has become merely dogma. The most energizing part of the current cycle is that we get to reevaluate these practices we grew up on every week; the most painful part of the current cycle is that we’re likely to fall behind if we ever stop reevaluating them.
The park near my house has lots of chestnuts and my kids have been collecting them like crazy (it’s actually their favorite post-school activity). We accumulated quite a hoard. I thought it would be fun to make a launcher so we had something to do with our new chestnut collection. I wanted to go with a very simple crossbow-style design (like the famous D2 item) using latex tubing and a leather pouch for holding the chestnuts. This is what I came up with. It launches chestnuts about 220 feet, and it’s simple enough to build in an afternoon. The frame is a 42 inch 2x2 and a spare IKEA bed slat for the crossbeam, glued and screwed together. A 3/8 inch eye bolt goes through each end of the crossbeam, and the latex tubing is tied to those and to the pouch from a leather shepherd’s sling. Tying the tubing was the fiddliest part. It has to be stretched while you wrap it with butcher’s twine, so I clamped a couple of scrap blocks to my workbench to hold it. I like this design because the tubing can be wrapped around the eye bolts to easily add more tension and power. The Trigger My favorite part of the design was that I decided to use an archery release like this one for the trigger. It provides a safe and reliable way to hold the tubing back, and it’s made to let go cleanly. I 3D printed a little housing that mounts the release securely to the back of the stock, and the release clips onto a loop of archery D-loop cord on the back of the pouch. Then I added a dowel for a rear grip and an old handle I had previously removed from my shop vac. How Well Does It Work? We tried it at the park and it works surprisingly well. Aimed at about 35 to 40 degrees, it sends our chestnuts (on the small side, about 10 to 15 grams) about 220 feet. Thanks to the archery release, we haven’t had a single misfire. I got curious and did some rough math. To go that far with air drag, the chestnuts are leaving at somewhere around 85 to 100 mph, which works out to about the same energy as a paintball. So safety glasses are important and you never point it at anyone. You can find the 3D print on Printables and a full build guide on Instructables. Make sure to always use it with adult supervision :)
I have a lot of digital cross-stitch patterns and until recently they were a mess. My “collection” was a series of several hundred PDFs, disorganised and spread across my disk. Recently, I was looking for a pattern and it took me several minutes to find it. I had a brief moment of panic, thinking that I’d lost it, and the website this pattern came from is long since gone. Fortunately it did turn up, but it was clear I had to organise my pattern collection. Some people would use apps like Pattern Keeper or Flosshaven, but I just created another static website on my media drive. This is what it looks like: The patterns are arranged in a masonry layout with a preview thumbnail for each pattern, which is normally the first page of the PDF. If a pattern has multiple files – for example, different files for colour and black-and-white printing – there’s a list of links below the thumbnail. I can also add a source link to where I bought the pattern, if I want to find more patterns by the same author. Internally, it’s structured like my other static websites. The metadata for the patterns is stored in a JavaScript file, and then I have an HTML page which renders that metadata in this visual design. My pattern collection doesn’t change very often, so I’m adding new files by hand. There are no sorting or filtering options, because my collection is small enough that they’re unnecessary. I can scroll through the entire list in less than a minute and find whatever I need. I’d like to start making my own clothes soon, and I expect to copy this design to store clothing patterns. This collection now sits alongside my saved bookmarks, podcasts, TV shows, and more. I can keep all my patterns organised, and I won’t lose them in the depths of my hard drive. Technical tricks There are a couple of technical pieces I’m quite pleased with in this process: Masonry layout. I love the cascading grid style of a masonry layout, and I think they’re great when you have variable-sized content – like my pattern cards. I’ve been using them for over a decade; screenshots of my early web apps show my experiments with David Desandro’s Masonry.js library. Masonry layouts are now a native feature of CSS called “Grid Lanes”, which is simpler and more performant than the JavaScript approach. I’m excited to use these layouts in even more places. Thumbnails of PDFs. Most digital postage patterns are shipped as PDFs, and I’m creating the thumbnail images with my create_thumbnail tool. I had to extend my tool to support PDFs, which turned out to be straightforward with the pdf_oxide crate. I’d not come across Oxide before, but it’s a cross-language library for working with PDFs, and I can imagine using it in future. A coloured stripe for the palette. In the metadata for each project, I have the complete list of DMC thread colours and the pattern dimensions. I have a lookup table that converts DMC thread colours to hex codes, and then I’m able to create a linear gradient in CSS to render a coloured stripe of the pattern colours. Here’s an example from a pattern with four colours: border-bottom: 12px solid transparent; border-image: linear-gradient( to right, #7a451f 0%, #7a451f 25%, #985e33 25%, #985e33 50%, #e4bb8e 50%, #e4bb8e 75%, #361f0e 75%, #361f0e 100% ) 1; Building the HTML, CSS, and JavaScript was very quick – I have notes on how I build my media sites, and I’ve done it plenty of times before. I threw together the initial prototype in less than 15 minutes. The longer part was finding all the PDFs scattered across my disk – but now that’s done, and I know exactly where to find my patterns. [If the formatting of this post looks odd in your feed reader, visit the original article]
