efitz writings

Technology, power, and leverage

Mon, 25 May 2026 00:00:00 +0000

I was just listening to this week’s (2026-05-21) All In Podcast. David Friedberg said something that I found very interesting. He said that many people are distrustful of tech companies because of a perceived imbalance in power- namely, that technology creates an opportunity for a very small number of people to exercise an outsized amount of power. I’m writing this to explore how Friedberg’s observation either modifies or invalidates my previous assumptions about power.

About

Sun, 24 May 2026 00:00:00 +0000

I’m a computer security guy specializing in security architecture, cloud security, and application/product security. I’ve worked for 3 of the MAG7, and I’ve worked for all the major clouds except Azure (AWS, GCP, OCI). I’m coming up on 30 years in the security field.

As hobbies, I write software and sometimes build hardware. I love smart home stuff; my goal is to have a home so “smart” that it just does what I want and I don’t have to “control” it with apps or voice assistants. For example, most of the lighting in my home is on timers or presence sensors, and my rules take into account circadian rhythms and ambient light.

Projects

Sun, 24 May 2026 00:00:00 +0000

A selection of my open-source projects on GitHub, grouped by topic. Almost everything is Apache 2.0 and/or MIT licensed.

Agentic Coding

skills — My AI-agent skills & plugins.

TMI - Threat Modeling Improved - Threat modeling platform for humans and agents

TMI Wiki

tmi-ux — Web front-end for threat-model and data-flow-diagram editing, with OAuth/OIDC and real-time collaborative editing.
tmi — REST API server and platform for humans and agents to run security reviews and threat modeling.
tmi-tf-wh — Webhook-driven, cloud-hosted Terraform analyzer for TMI.
tmi-clients — REST clients for the TMI threat-modeling API.

Security tools

sqdist — Rust CLI that scores how likely one string is spoofing or squatting on another.
pypi-proxy — Experimental local PyPI pull-through cache with hooks to support security scanning before use.
asciicast-utils-python — Python utilities to record and play back terminal sessions as asciicast files.
dominfo — Gathers domain-name info to assess subdomain-takeover risk.

Cloud, DNS & infrastructure

r53 — Python CLI for AWS Route 53: simple record management and dynamic DNS.

Hardware projects

lcars-pi-clock — LCARS (Star Trek: TNG) themed clock/calendar for a WaveShare e-ink display on Raspberry Pi.

File & document utilities

scan-namer — Renames scanned documents in Google Drive with descriptive names based on their content.
renamer — Local file renamer.

Web & UI experiments

css-animations — Exploring CSS animations to explain user interaction in lieu of written help.
gesture-test — Experiments toward an asynchronous touch-gesture library for Python.

Other

homebrew-tap — Homebrew tap for distributing my tools.
tesla-alexa — Connect Amazon Echo (Alexa) to Tesla vehicles. Very outdated, do not use.

AI and the Coming White-Collar Crunch

Fri, 26 Dec 2025 00:00:00 +0000

Here’s a thing that has been bothering me lately.

Frontier AI models are now performing at the 90th percentile or higher on a bunch of tasks that form the backbone of what white-collar workers do: reading comprehension, coding, legal research, medical diagnosis, quantitative reasoning, analytical writing. And they do it dirt cheap compared to hiring a human.

Here’s the uncomfortable truth that nobody likes to say out loud: most people, by definition, have average cognitive abilities. And a huge portion of professional (“white collar”, “elite”, etc.) employment has never actually required exceptional intelligence. Dilbert, Q.E.D. It required a combination of average-to-moderately-above-average ability, reliability, and the ability to be productive when working with others and to not make others less productive. The college degree was mainly a signal that you cleared that bar.

How to be Smart

Wed, 03 Dec 2025 00:00:00 +0000

I am a smart person. I’m writing this to tell you tricks that I’ve figured out how to be a smart person.

Note that smart and successful are orthogonal concepts. Being smart makes it much easier for you to be successful, but there is a lot more to success than smartness- there’s work ethic, willingness to take (smart) risks, interpersonal skills, and a lot of luck (opportunity, circumstances, and so forth). Being smart makes it easier to reduce the luck factor.

The effect of LLMs on software licensing

Mon, 25 Aug 2025 00:00:00 +0000

Here’s something I’m thinking of lately: I think that open source SaaS and restrictive OSS licenses are in for a rocky road now that agentic coding is taking off.

If your software is straightforward and it’s open source and you’re using licensing to enforce freemium, or if you are using freemium add-ons that aren’t open source, then you had better hope your moat is deep enough- either through patents or sheer difficulty of the problem space. Similarly, if you’re trying to use GPL3 or other licensing to try to keep other people from commercializing your OSS, you’re likely also going to be disappointed.

My experience creating software with LLM coding agents - Part 2 (Tips)

Fri, 22 Aug 2025 00:00:00 +0000

This post details my experiences creating software with LLM coding agents, emphasizing that what you do with AI agents is ‘creation’, not just ‘coding,’ and sharing what worked for me. This is not ‘The One True Path To AI Success.’

tl;dr:

I’m not a professional developer, just a hobbyist with aspirations
I wanted to accomplish a coding project beyond my skill level and have been experimenting with agentic coding tools for several months (spoiler: mostly success)
You should use Anthropic’s Claude Sonnet model for complex coding tasks.
Experiment with various agents and models; be adaptable as the field evolves quickly. I prefer Claude Code and Roo Code at this time.
If you are a heavy user, you should use pay-as-you go pricing; TANSTAAFL. I posted this on Hacker News and was very forcefully corrected that with Anthropic in particular, you can use the Claude Pro or Claude Max plan and auto-switch to pay-as-you-go if you run out of capacity.
If you are a light user, use your favorite free or “comes-with-my-monthly-subscription” chatbot and whatever model it comes with. I expand on what “light” means later but think “not very much at all, bash one-liners, single-file python scripts, etc.”
Part 1 of this post has background and describes how I chose agent, model, and subscription type.

Mad AI Skillz

Context

“Context” refers to the agent’s short-term memory, including system prompts, standing instructions, and provided information, which the model uses for reasoning. Coding agents are really good at getting additional context if needed - they can add source code files, they can invoke local tools to extract particular information, and they’ll send that up to the model if needed.

My experience creating software with LLM coding agents - Part 1 (Selecting Tools)

Thu, 21 Aug 2025 00:00:00 +0000

tl;dr:

I’m not a professional developer, just a hobbyist with aspirations
I wanted to accomplish a coding project beyond my skill level and have been experimenting with agentic coding tools for several months (spoiler: mostly success)
You should use Anthropic’s Claude Sonnet model for complex coding tasks.
Experiment with various agents and models; be adaptable as the field evolves quickly. I prefer Claude Code and Roo Code at this time.
If you are a heavy user, you should use pay-as-you go pricing; TANSTAAFL. I posted this on Hacker News and was very forcefully corrected that with Anthropic in particular, you can use the Claude Pro or Claude Max plan and switch to pay-as-you-go if you run out of capacity.
If you are a light user, use your favorite free or “comes-with-my-monthly-subscription” chatbot and whatever model it comes with. I expand on what “light” means later but think “not very much at all, bash one-liners, single-file python scripts, etc.”
Part 2 of this post has a long list of a lot of tricks/skills I picked up to make software creation easier, more efficient, more accurate, and cheaper, when using agentic AI.

Commence the Blogging

As a security engineer with a CS/ECE background, I’ve spent nearly 30 years collaborating with developers and writing personal software, recognizing good and bad design patterns.

Modern advertising is litter

Wed, 30 Jul 2025 00:00:00 +0000

If you’ve ever walked down the strip in Las Vegas, you’ll encounter something strange - there will be people standing on the sidewalk trying to put business-card size ads in your hands, with pictures of beautiful women on them and phone numbers. (It’s exactly what you think it is, and I seriously doubt the pictures are real).

I think that this is modern advertising in its purest form. It is in your face and hard to avoid, unsolicited and unwanted but pushed on you anyway, and somehow legal. It also results in a large amount of litter as most people realize what just got stuck in their hand by a stranger, and recoil from it, dropping it on the street.

Crime and Punishment - what is punishment for?

Wed, 23 Apr 2025 00:00:00 +0000

Throughout my life I’ve seen a lot of opinions about prison sentence length, fines, whether we should have the death penalty, what is cruel and unusual punishment, etc. In the 90’s, for example, we had “tough on crime” laws, mandatory minimum sentences, “three strikes” laws, etc. Things always come full circle so it was no surprise (to me at least) that in the 2010s we saw “bail reform” and other things like that.

IPv6 is mainly just an IoT protocol

Sat, 04 Jan 2025 00:00:00 +0000

I’ve been struggling for a couple of years to try to get IPv6 support for my home. I use Frontier as my ISP. Frontier doesn’t support residential IPv6 in my area. I tried tunneling via Hurricane Electric (you should try this) but it was not satisfying and was way too much work.

So I bought Starlink as a “backup” :-) ISP, which natively supports IPv6.

Unfortunately I use Ubiquiti Unifi for my home networking and WiFi, and their support for IPv6 is a barely-implemented afterthought.

Stablecoins

Sat, 04 Jan 2025 00:00:00 +0000

I’m not bullish on cryptocurrency; in particular I’ve always thought that the proof-of-work infrastructure for mining and transaction clearing (Bitcoin and Ethereum) was too energy-wasteful and too slow to make it useful for commerce. Ethereum seems to have solved the energy problem by means of switching to proof-of-stake and somehow they’ve greatly improved the transaction speed problem, but I don’t know how and am wary. It also seems crazy dangerous to distribute immutable programs on a blockchain. And most other tokens and NFTs seem like scams.

What does a customer mean whey they say your software is "noisy"?

Thu, 17 Aug 2023 00:00:00 +0000

I have worked in/with security software since about 1996. I have talked to hundreds or thousands of customers/users of security software over the years. One of the things that I hear people say frequently about security software is that it’s “noisy”. This observation is usually targeted at time series output like logs and so forth.

After diving deep on a lot of these issues to understand what people meant by that, I’ve come up with a simple taxonomy describing what “noisy” means from the customer’s point of view. The purpose of this taxonomy is to help security (or other) software developers avoid or fix problems with their output in order to delight their customers, or at least not disappoint them.

What if there were a cryptocurrency that supported disputes?

Sat, 14 Jan 2023 00:00:00 +0000

I’m just jotting down a random idea here; maybe it’s not fully formed yet.

I think that there are two main reasons that normal people eschew cryptocurrency:

Transactions are irreversible and indisputable. Once the transaction is signed and confirmed, the crypto is gone forever.
Normal humans just aren’t cut out to protect secret keys well, and one misstep can result in either exposing your key (see #1) or in losing your key; either way you just lost all the cryptocurrency in your wallet, forever.

Dorsey et al are working on solutions to #2 Block hardware wallet. But I’m thinking about #1.

Icon Activism

Mon, 20 Jun 2022 00:00:00 +0000

Hey app developers, I appreciate that you are people with hopes and dreams and passions. However, the home screen on my phone is not an appropriate place for you to express your politics.

I gave you consent (and likely money) to place and execute your code on my device to provide me with specific functionality. I’m pretty picky, so congratulations, your app was the best I could find that did that thing.

March 2022 Best Prosumer Smart Home Stuff

Mon, 04 Apr 2022 00:00:00 +0000

Here’s my current list:

Apple HomeKit (if you’re an Apple user). Otherwise [Samsung SmartThings(). DIY with open source controller are a huge time suck and you’ll constantly be doing custom integrations and hitting weird compatibility edge cases.
Lighting & fan controls: Lutron Caseta. The switches themselves are high quality. They get the LED brightness level correct - the LEDs won’t illuminate your entire room at night. Caseta is super easy for 3-way installations- install it as a 1-way and use a bound, wall-mounted remote. Caseta also lets you do simple automations like time-of-day and time-after-last-presence. Beware that there is a 75 device limit per hub and per account, and remotes count towards that. I have to use 2 hubs; I put all my automation controlled devices on one hub and all my voice-controlled stuff on the other.
Ceiling fans: all of them nowadays come with crappy remotes- before you install it, pull out the remote control module from the fan and wire it as a dumb fan and light. Use A/C fans; DC motor fans need their own special controllers that tie in the motor controller with the remote control receiver unit, so they’re hard to automate.
Deadbolt: Schlage Encode Plus.
Voice Control: Amazon Alexa. The super easy skills SDK makes this the hands down winner when you want to go outside the box. Also it seems to get little details down more correctly than Apple Siri. For example, if you map your Alexa and your lights to the same room, then you can say “turn on the lights” and it will figure out the room you’re in based on which Alexa heard you, and turn on the lights in the room you’re in.
Thermostat: EcoBee. I recommend getting the EcoBee 3 lite rather than the more expensive one with built in Alexa. The EcoBee with voice control has Alexa integration, but IMO it’s not that great - I mute the microphone on mine because it always answers the wake word even if another Alexa is better positioned and also answered. I guess it would be OK if your thermostat were far from any other Alexa. Also, it periodically loses connectivity to Amazon and complains. So as a voice assistant, it’s not great, but as a thermostat it’s awesome, way better than Nest. It also has these little remote temperature sensors that let it average the temperature across a large space, making better comfort decisions.
Sprinkler/Irrigation controller: Rachio. Super easy to install, monitors your local weather and skips automatically without need of a rain sensor, and adjusts watering for type of soil and slope. It does a really good job.

Some callouts: The most awesome dimmer switches I ever found were Plum Lightpads. Not a good choice now as the app is bound to a proprietary cloud service and the company seems like it’s on life support. I supported them on Kickstarter and was very happy with them, but they never did a good job publishing an API and the LED ring was too bright at night- you had to turn it off with the app, you couldn’t dim it enough. But man did I love those switches. Nowadays there are a few other touch dimmers out there, but they’re all ugly.

Schlage Encode Plus smart deadbolt is exactly the lock I've been waiting for

Mon, 04 Apr 2022 00:00:00 +0000

Friday I received my Schlage Encode Plus smart deadbolt lock, and this morning (Sunday) I installed it.

I’ve been waiting for the release of this lock since I first read about its announcement at CES 2022.

I’m a picky smart home hobbyist. In my last home I went full Z-Wave with Samsung SmartThings for the controller, but my experience was meh (I’ll write that story someday). Since I purchased my new home in July I’ve gone the other way- I’m trying to connect as many things as possible with WiFi, and using vendor specific technologies, and tying it together with Apple HomeKit.

How some ML researcher with more IQ than foresight will destroy the earth

Sun, 03 Apr 2022 00:00:00 +0000

Great story I found online.

IoT Security funny quote

Sun, 03 Apr 2022 00:00:00 +0000

Found online: “Remember, the ‘S’ in ‘IoT’ stands for ‘Security’.”

Users will execute arbitrary code if you pay them just a little

Sun, 03 Apr 2022 00:00:00 +0000

It’s all about the benjamins.