标签：#mentorship

Introduction: The Systemic Failure in Application Security Onboarding Consider the scenario of a junior Application Security Engineer tasked with securing a 2-billion-line codebase, written in unfamiliar languages, within a one-month deadline. This is not a theoretical exercise but the lived experience of a recent graduate in India, whose public appeal for assistance reveals profound deficiencies in how organizations integrate and support junior AppSec talent. The pressure is unrelenting, the tools are insufficient, and the expectations are disconnected from practical realities. This case is not an isolated incident but a symptom of a broader organizational failure to address the complexities of application security in high-stakes environments. The engineer’s experience underscores a critical misalignment: the exponential growth in codebase complexity has outstripped the resources and guidance provided to those responsible for securing them. Absent a senior AppSec mentor, with limited proficiency in critical languages such as Laravel/PHP and C#, and equipped only with rudimentary tools like grep and Codex, the engineer is forced to navigate an environment rife with unseen risks. The consequences are twofold: individual inefficiency and self-doubt, compounded by organizational exposure to unmitigated security threats. The causal pathway is unambiguous: massive codebases + unrealistic deadlines + subpar tools + absent mentorship → overwhelmed engineers → cursory reviews → undetected vulnerabilities → systemic security compromise. The risks extend beyond individual burnout to include data breaches, financial liabilities, and reputational damage. This is not an edge case but a predictable outcome of organizational neglect. The urgency is undeniable. As software systems increase in complexity and cyber threats proliferate, the demand for competent, adequately supported AppSec professionals has never been more critical. Yet, organizations persist in failing to bridge the

The next evolution of software developers: from implementation to intent, orchestration, and...

Bridging the Gap: Navigating the Chasm Between Academic Coding and Real-World Software Development The transition from academic coding to professional software development is fraught with challenges, particularly when it comes to navigating and debugging large, unfamiliar codebases. This gap, often overlooked in educational curricula, leaves new developers ill-prepared for the complexities of real-world projects. Below, we dissect the technical mechanisms involved in codebase navigation and debugging, their constraints, and the resulting instabilities, while reflecting on the disconnect between academic training and industry expectations. Mechanisms of Codebase Navigation and Debugging The process of understanding and working within a large codebase involves several interconnected mechanisms. Each plays a critical role in a developer's ability to efficiently and accurately contribute to a project. Code Navigation : Involves traversing a codebase using tools like "go to definition" to map code structure and dependencies. This mechanism relies on the developer's ability to interpret relationships between files and functions. Impact : Efficient navigation reduces time spent understanding the codebase. Internal Process : Iterative exploration of code paths. Observable Effect : Reduced time to locate relevant code segments. Code Comprehension : Analyzing existing code to infer purpose, logic, and side effects. Requires pattern recognition and logical deduction. Impact : Accurate comprehension minimizes unintended modifications. Internal Process : Mental modeling of code behavior. Observable Effect : Correct identification of code functionality. Debugging : Identifying and resolving bugs while minimizing collateral damage. Relies on isolating root causes and understanding dependencies. Impact : Effective debugging prevents regressions. Internal Process : Hypothesis testing and validation. Observable Effect : Bug resolution without introducing new issues. Documentation Ana

Does it still make sense to learn how to code? This is a question I’ve been thinking about a lot...

I was two hours into a bug and completely certain it was mine. Properties I'd added on the Java side of an application weren't showing up on the JavaScript side. I'd just touched that code. It had to be my change — that's not a hunch, that's just how these things go, you break the thing you were last inside of. I spent the better part of an hour re-reading my own diff, convinced the answer was somewhere in it, because it obviously had to be. It wasn't in my diff. It was a legacy codegen sync script, three steps removed from anything I'd touched, quietly failing to invalidate an old artifact. I didn't find that out by getting smarter. I found it out by walking away from my own certainty, twice, guided by a checklist I'd set long before I ever opened that file. Here's that checklist, the same one every time. I go through this checklist anytime I'm about to dig into a problem that I know might be tricky. Before you start — while you're calm, not while you're stuck — decide how long you're willing to work under pressure before you're required to stop. I typically set this at two hours . Decide what activity you'll do when the timer goes off. Something calibrated to wherever you happen to be that day: a walk or a coffee run at the office, cooking dinner or picking up a controller at home. Set the timer and get to work. When the timer goes off, stop. Immediately. No snooze button, no "just five more minutes," especially when you feel close. Get up and perform the activity from step two. Then loop back to step three. If the day's ending and the work isn't done, "call it done for today" and return to the checklist tomorrow. That's the whole thing. It reads like it belongs on a sticky note, and I want to own that up front instead of pretending it's more sophisticated than it looks. Why you need a plan instead of just trying harder I built this checklist to get unstuck. What it's actually for is disrupting confirmation bias, and I didn't fully understand that until I'd used i

Previously, I wrote about How I Processed 666K Pages Of Flattened PDFs into a Full Text Search Engine called the Apario writer . Upon on the conclusion of the last segment, I was able to optimize the compilation time of the original collection of data by rewriting the sidekiq Ruby pipeline script into a dedicated Go Application. Regardless of what compiling the PDF assets would look like, I still needed to serve those assets - and that's where the writer did little to nothing to actually address the OPEX of the project from 2020. Given the size of the data set, the 666K pages ended up compiling into a directory of ~1.13TB in size. This was held in storage that was distributed across several high volume storage dedicated servers on OVH behind MinIO . This provided an S3 compatible API directly. What I Know About OPEX OPEX or Op erational Ex pense is how you describe a spending of money that is used explicitly for the operations of the business versus a capital expense. Hardware was considered a CAPEX or Cap ital Ex pense. So when Bit Fry Game Studios needed their DevOps pipeline upgraded for the 9 hour game builds into a 30 minute private enterprise cloud build, it required a CAPEX investment of $69K plus trust in me in order to achieve a -$15K/month OPEX savings. Annualized over a hardware lifecycle, over $472K can be recovered from OPEX by making a small CAPEX expense up front. One of the first projects that I ever worked on was in PHP and MySQL on Ubuntu 8.04 . It was to balance the budget of a department that had ACME Bucks so to speak. It required me to write a finance module, fully tested, that managed Blue , Green and Black dollars. Blue dollars were for OPEX. Green dollars were for CAPEX. Black dollars were for external vendors where money left the company (versus moving between departments). Black depreciated instantly - meaning 100% of it was paid immediately. Blue dollars were borrowed over a 12 month pay-back period. Green dollars were borrowed over a 36

Those who have been following me for a while will know that teaching and mentoring are a Big Deal™️ to me. Before I got into tech I was a teacher, and still consider myself a teacher at heart. Being a teacher and mentor was never separate in my eyes from being a good programmer and engineer; on the contrary, teaching was a tool that helped me become better at my craft at every stage of the journey. But in the last few years, and accelerating in the last few months, the landscape for teaching and learning has been changing at a scary pace. The advent of LLMs and "AI" coding assistants has drastically shifted how we acquire engineering skills in ways that we are definitely not prepared for. All of that has prompted many thoughts and conversations, and I hope to distill some of them in this blog post. In true Talmudic fashion, this post doesn't contain too many answers and will hopefully leave you with more questions than you started with. But asking the questions is how we start these conversations, and these conversations need to be happening if we are to do right by the coming generation of programmers and engineers. Don't Spoon-Feed Me As a student, whether in Yeshiva when I used to spend hours each day poring over dense Talmudic legal debates and esoteric Chassidic philosophy or later while learning Rails and React at the Flatiron bootcamp, I quickly realized an uncomfortable truth about skill acquisition. My best, most profound learning never happened when a lesson went smoothly; it happened when I was painfully stuck, banging my head against a cryptic error message or wrestling with a concept that just wouldn't click (usually at 2 AM, fueled by cold coffee and sheer stubbornness). When you strip away that struggle, you get rid of the growth. And when you get rid of the growth, the learning just doesn't happen. Even if you memorize just enough to pass the test, "easy come easy go." Without that cognitive friction, the knowledge evaporates the moment you close you

This is my first post here, so I'm going to use it as an introduction. I'm Usman, a software + data engineer who primarily works with data pipelines, backend systems. Not a huge fan of frontend development though. Although I do what I can, projects honestly feel incomplete without them, because at the end of the day you do have to showcase a working end to end system when you build something. I'm here after dozens of incomplete personal projects, and projects that never even got past the design phase, you know the drill. Procrastination and imposter syndrome kept stopping me from taking the next step, but I'm here now, gotta keep myself in check fr. I was scrolling through LinkedIn the past few days, and oh my god, the amount of AI-related brain rot there. Every single post written by AI, telling you how to use AI and how not to use AI. I mean I get it, yeah, the paradigm is shifting and AI is essential to development, but where are your personal anecdotes, stuff you solved, stuff you learned, the challenges you faced, how you overcame them. You know what maybe it's my fault, it's my algorithm after all. Anyway, here I am, looking to interact with like-minded engineers and learn from them. I'm also going to post regularly about my progress and what I am building, even though I have quite a bit of experience, and have built and contributed to large-scale production systems and pipelines, I'm going to start with something small, so I can stay consistent and keep myself in check. Software engineering fascinates me a lot, and there are so many domains that I wish to explore and have explored like game development, data engineering, web/app development. My significant other is graduating in a few days, and I'm thinking of making a small game for her, alongside which I'll be working on a small sales lead enrichment pipeline. Hoping to showcase my work and document it publicly, and hoping to get to know and learn from you all! Also, I'd love to know your thoughts on the am