The Comforting Lie Of SHA Pinning

Update (3 November 2026): GitHub has added workflow dependency lockfiles. I tested the original attack again and wrote up the results in GitHub Actually Fixed SHA Pinning. I Wasn’t Expecting That..

Preparing for Quantum Computers That May or May Not Exist

In my day-to-day life as a Platform Engineer I find I spend an unusual amount of time thinking about identity. Not so much in the philosophical sense. In the much less interesting sense of certificates, tokens, key exchanges, and authentication. Logging in to AWS. Signing API calls. Issuing certificates. Rotating secrets. Establishing tunnels between systems that would rather not trust each other… and everything in between.

Terraform Six Years On (Retrospective)

Back in 2019 when I started at BJSS as a fairly junior Platform Engineer I was first introduced to Terraform around the time when 0.11 and 0.12. If you remember that migration path, you’ll know it wasn’t exactly the gentlest onboarding experience.

JPEG Compression, but for Thought: AI as Clear-Text Encryption

There seems to be a current trend happening corporate and professional communications - looking at you LinkedIn - where people write bullet points and have AI tools expand on it.

Prompt Driven Development; BDD but shift-left-y-er

Déjà Vu in the IDE

Every few years the industry seems to come back to the same idea with a fresh lick of paint. Behaviour-Driven Development (BDD) was all the rage when I entered Platform Engineering, what feels like forever ago. With Cucumber, Gherkin, SpecFlow and the rest, the plan was to write tests in something approaching natural human language: Given … Then … When. It is not far from the familiar As a … I want … So that … format we use in user stories.