David Coveney

David Coveney

@davidcoveney.com

Publisher of Design Week, head dogsbody at Standfirst, forward looking technologist and a person who cares that the world is progressing in a way that's good for everyone.

245 followers166 following1.2K posts

Although it's remarkable that a cyber security correspondent hadn't heard of PHP, it's also the case that a reporter's job isn't necessarily that of being a subject matter expert. They do pick stuff up as they go along, but reporting to the general public is often a form of translation.

When weak fascists try to gather strongmen it's because they're preparing.

"They can start cutting people's faces up. They can stab someone. They can shoot someone." EXCLUSIVE: Our hidden cameras capture the leader of Turning Point UK organising a fake rally for a foreign government and helping arrange a murder-for-hire with loyalist paramilitaries.

Imagine you knew that the cost of a new car would halve next year? You wouldn't replace yours just yet, would you? You'd wait, unless you were desperate or needed a new car to make real money NOW. This is what's happened in the software development market. People are deferring decisions.

I think people outside tech have no idea just how much of a panic developers and sysadmins are about this PHP vuln and now the Node one.

In the early days of UK social media you would be forgiven for thinking the world was rammed with nerds and journalists. And, oddly, bikers. Today I think the most busy are people with time on their hands, writers, procrastinators and people with agendas. The bubbles are considerable.

View full thread

Now, with adverts and influencers who can speak to core demographics everyone can get exactly what they want online, all of the time. But what you want and what you need are two entirely different things. I suspect AI accelerates that. Isolated people are most at risk.

So it probably matters to have hobbies and pastimes that encourage mixing across political lines. If I wanted to improve the world I'd spend it on finding ways to encourage group hobbies.

In the early days of UK social media you would be forgiven for thinking the world was rammed with nerds and journalists. And, oddly, bikers. Today I think the most busy are people with time on their hands, writers, procrastinators and people with agendas. The bubbles are considerable.

Everything is flavoured by the company you keep. In their quest for growth the tech firms had to make it easier to access. AOL and CompuServe realised disks on magazines would help. And immediately you saw the difference in the communities. But there was a lot of filtering.

We have automated dunning. If people haven't paid then after two weeks overdue there's an email that says "our automated servers will turn your site off soon." It's the best dunning process because it almost always gets a payment within a day. Protect your cashflow, people!

My wife keeps bringing home supermarket flowers that have been discarded. Sometime flowers have damaged stems or even fall off completely. I've discovered I can keep them alive for ages in shot glasses and it brightens up my desk at home.

Journalist saying AI is bad. Also saying it's wonderful because it saved him a load of money migrating his publication's website. So I checked the site out and every image file is in a folder called ./migration-staging/. The site screams vibe coded if you look at the structures.

But it works. It works well. The problem is that I very much doubt they understand maintenance or backup procedures. There's not a lot wrong in using AI to help you write prose or code. Just don't hand the whole job over. Use AI to speed up an expert, not replace them.

I was curious to see an old client had rebuilt the site we built for them. They've been hyping up how wonderful AI tooling was to do cheap migrations that "cost a fortune" when we did it. I don't know if I should tell them they're serving their production files from a migration bucket.

They were a difficult customer, always furious that stuff Cost Money. I guess they'll find out when someone tidies that bucket away. I wonder what their backup processes are like?

Am I the only person in the world who noticed that George Russell's car went into reverse after his crash and that's why he was launched across the circuit?

Designers on Bluesky. If you won something like this, would you be proud? This is a concept piece and I figure I should clinic it with the modest Bluesky audience I have. Artwork by Matt Nightingale and myself as we were ideating and going back and forth... Final will be just him.

David Coveney reposted

Free Jag design background story for BlueSky people: www.designweek.co.uk/the-in-depth... At 3000+words I perhaps wrote far too much but I enjoyed the stories, the materiality, the ideas and the approaches taken. Absolutely fascinating design story if you're into design process and/or cars.

designweek.co.ukThe in-depth story behind the Jaguar Type 01 design revolutionThere, with the silk shroud pulled back, stood the most important new Jaguar since the 1935 SS Jaguar 2.5-litre Saloon. I was at a preview of Jaguar’s reinvention held in the new flagship store in…

Photographed because I don't want the pile-on. This perspective of what's wrong with the country, to blame one person, is as dumb as blaming immigrants. But it's simple and comforting. I remember the Thatcher era well and voted against her when I hit 18. Seemed obvious. However...

View full thread

So I get grumpy when I see simple blame followed by a bunch of clapping seals. There. Morning rant done with. Happy Monday everyone. You slay!

Oh...gonna add something! Trump is awful. But he's not the problem either. If the people of the US don't address the underlying structural problems you'll get more Trumps. Figureheads for a cluster of powerful, wealthy people trying to extract ever more from the rest of us.

Photographed because I don't want the pile-on. This perspective of what's wrong with the country, to blame one person, is as dumb as blaming immigrants. But it's simple and comforting. I remember the Thatcher era well and voted against her when I hit 18. Seemed obvious. However...

View full thread

The reality is that problems are cyclical and symptoms get dealt with whilst nobody deals with the rent-seekers, the grant-takers and the institutional power brokers. They're tougher targets. Clouds not mountains. Yet they affect us hugely.

How can it be right there are families who own vast tracts of central London? Why is it that in many city centres it's almost impossible to buy land or even a building? The reason town centres are dead is because any successful business gets big rent increases on renewal.

Photographed because I don't want the pile-on. This perspective of what's wrong with the country, to blame one person, is as dumb as blaming immigrants. But it's simple and comforting. I remember the Thatcher era well and voted against her when I hit 18. Seemed obvious. However...

Anyone with an ounce of sense will realise that she was extremely popular with many. They wanted what she did. As a Liverpool lad I couldn't support her. But our problems didn't suddenly magically start with her. Nor did they end when she lost power.

Has the AIpocalypse arrived? Well, here's a story to make you itch: We've always been good at security and never had a breach that was down to our team. Some fifteen years ago we established a principle that now permeates through all Enterprise WordPress: don't trust PHP!

View full thread

We're also busy making sure we add more of our own protections at the edge. We realised our bot detection could be ramped up, and so we did what we needed to, patched everything, and watched. So far it's silence at the servers. But that was scary. The power of these new botnets is terrifying.

Has the AIpocalypse arrived? Well, here's a story to make you itch: We've always been good at security and never had a breach that was down to our team. Some fifteen years ago we established a principle that now permeates through all Enterprise WordPress: don't trust PHP!

View full thread

The good news about this was that we now had a signature to look for. It used a clever trick to make Laravel go into debug mode, then crash it, then get the env variables out, then use keys. It didn't try to do anything except one thing: create new Claude agents.

Hackers are out there and if you've used any permissive keys they're building an AI botnet. The Claude guardrails aren't stopping them. We're tempted to honeypot this in order to watch them, but we're not security researchers and we're kinda busy trying to service customers well.

Has the AIpocalypse arrived? Well, here's a story to make you itch: We've always been good at security and never had a breach that was down to our team. Some fifteen years ago we established a principle that now permeates through all Enterprise WordPress: don't trust PHP!

View full thread

An agent was probing out services and found a vulnerability in a Laravel library. It was a version or two out of date, but our dependency scanner that alerts us to risks didn't know the library had a problem. To save testing time on lower budget apps you can't be patching on every minor release.

Unless there's a security vulnerability you leave it alone until you're doing a set of updates. So we had a zero day. And the agent was using it to exfiltrate our AWS key. We knew because the new key leaked within hours. Annoying because we'd diligently rotated every single key.

Has the AIpocalypse arrived? Well, here's a story to make you itch: We've always been good at security and never had a breach that was down to our team. Some fifteen years ago we established a principle that now permeates through all Enterprise WordPress: don't trust PHP!

View full thread

To all intents and purposes the code space was immutable. The browser space somewhat less so, because Javascript. But our alerts went off this week. An AWS key had leaked and someone was trying to use it.

Now remember what I said about low trust? Our keys generally do only one or two simple tasks. In this case, access S3 and that's all. Good. It was the attempts to use other services that caused the alarms to go off. So why did we end up with a minor but scary breach?

Has the AIpocalypse arrived? Well, here's a story to make you itch: We've always been good at security and never had a breach that was down to our team. Some fifteen years ago we established a principle that now permeates through all Enterprise WordPress: don't trust PHP!

Now obviously PHP has to be able to do a few things to run well: update a database and update a filesystem. For a long time we made the filesystem a place that could not run code in any way. The database user could not run code. PHP could not install code.

My wife took this picture of our then five year old child, nine years ago today, and it's always going to hold a special place in the family photo album!

It occurs to me that you can track the ups and downs of someone's life simply by seeing what ratio of people to toilet they live with. Currently on 4:3, when the kids leave we'll be at 2:3 which is an extravagance. Have spent times at 6:1 in the past. The ratio doesn't correlate to happiness tho.