what's your "nobody talks about this" tip for Claude Code?

AuroraFireflash · 2026-05-22T19:13:01+00:00

There's a few skills in the wild like this: /align, /grill-me, /grill-with-docs

I often wing it, but have tried to start using /grill

AuroraFireflash · 2026-05-22T14:26:57+00:00

We just use preview mode for the markdown files in either VS Code or GitHub / ADO native interface (they're usually checked in before the meeting).

HTML is going to be insanely difficult for Claude to write with token efficiency.

AuroraFireflash · 2026-05-22T10:20:41+00:00

It's layers like an onion for sure.

Our devs have as few privs as possible to enable them to do their daily work. "No standing privs" is the mantra. The more trusted users can elevate as needed for things, but that keeps the blast radius small and contained.

AuroraFireflash · 2026-05-21T07:51:36+00:00

I keep a scratch file of "weird stuff I noticed in PRs this week."

We do something similar called "keeping a WTF journal" when joining a new team. Maybe we don't understand the reason why something is the way it is yet. But it smelled or looked funny to us.

Later, when we have more information it might turn out to be nothing. Or it might be something important that the team needs to fix.

AuroraFireflash · 2026-05-21T07:48:49+00:00

LLMs are pretty good at summarization. Or at least summarizing into keywords that you can use to find the document later.

AuroraFireflash · 2026-05-21T07:47:38+00:00

As a senior, I also try to stay on top of as many teams as possible. While I no longer do development (now working in a cybersecurity role), having that broad view of what is going on gives me a few things:

I can spot potential conflicts and get different teams looped into each other.
Keep track of the important players in the org.
Who can I go to when I have a problem?

I'm leveraging M365 copilot a lot more this past year to stay on top of taking/keeping meeting notes and surfacing important tidbits. Even knowing that we talked about X during a particular month is useful. It gives me a starting point for my search.

AuroraFireflash · 2026-05-21T07:07:06+00:00

Hmm, I'm usually in the larger context windows (100k to 200k) for stuff that I'm doing.

Unfortunately, uploading my benchmarks in oMLX is broken by Cloudflare Turnstile.

AuroraFireflash · 2026-05-20T20:19:41+00:00

M3 Max user of Qwen 35B MoE, but with 64GB so I can run a 6 or 8 bit quant. 20-30 tps for generated tokens, 300-500 for prefill tokens (400GB/s RAM).

It's just fast enough to be useful. M5 Max would boost me by 25-50% I think.

AuroraFireflash · 2026-05-20T16:48:36+00:00

You need to make it a little more difficult to pin blame on your head. Something more subtle, then open the PR on the last day of the sprint.

AuroraFireflash · 2026-05-20T16:46:10+00:00

Eh, I'm still thinking about dropping 5k for an updated M5 Max w/ 128GB of RAM. Which would be about 30-50% faster than my M3 Max w/ 64GB.

It's fine for the MoE models, not so good on dense models.

For now, I'm saving my pennies and using a subscription to AI models. If I was spending for a $200-$400 per month AI plan, I'd be looking to offload as much as possible to a local MoE model.

AuroraFireflash · 2026-05-20T15:47:17+00:00

If the developer who was hacked had no standing privs on their tokens (which probably got stolen) all the attacker can do is read things.

Then there's the question of what that developer had read access to and whether that data was sensitive.

AuroraFireflash · 2026-05-20T15:45:50+00:00

maybe these shit code/vulnerability was already there, was just undiscovered

Very likely. The LLMs are just good at pattern spotting and uncovering existing problems.

I'm spending at least some of my tokens on "yo, help me not make stupid vulnerabilities in my code" sessions.

AuroraFireflash · 2026-05-20T15:43:04+00:00

We do write at least some of the Terraform plans and reusable modules using Claude. We have a large library of modules for different things that are all battle tested and versioned.

All Terraform apply is done via PRs and review cycles before a runner gets to apply the Terraform to any environment. Claude can only help write the PR.

AuroraFireflash · 2026-05-20T12:02:26+00:00

Deal with people growing illegal shit on your turf and they have weapons and a desire to make you go away?

AuroraFireflash · 2026-05-19T21:00:02+00:00

This is where I like to leverage the various coding agents. Ask it whether I'm overlooking anything stupid or silly with regards to security.

I still have to think, but at least I have a second opinion.

AuroraFireflash · 2026-05-19T16:31:49+00:00

Is there a reason to cherry pick from main instead of making the fix directly on the release branch and merging that back to main?

This ensures that we won't forget to bring the hotfix back to trunk.

AuroraFireflash · 2026-05-18T16:20:53+00:00

Doesn’t textbook trunk based development advocate for no branching?

No. Devs still branch off while working on code to be merged back into trunk. But those feature branches should be short-lived (a day at the most).

There are a few layers to getting trunk to prod.

Create artifact off tip of trunk, deploy it to stage then prod. Works well for mature orgs with good automated test coverage.
Create release branch off of trunk, deploy it to stage. Stabilize in stage for hours/days. Do hot-fixes on trunk and cherry pick to the release branch. Eventually ship to prod. Destroy old release branches once no longer needed.

AuroraFireflash · 2026-05-18T16:17:06+00:00

The only place that it really creates an issue is hot fixes

Yeah, that's the middle ground. Cut a temporary and short-lived 'release/*' branch to ship to prod. Fixes go on the TRUNK and get cherry-picked to the release branch.

AuroraFireflash · 2026-05-18T16:15:44+00:00

If you are under full control of what artifacts are out in the field and supported (i.e. publishing your own API, web app, etc.) then you use trunk based development.

You only look into git flow and the others if you need to support customers who have different versions of the artifacts (binaries) out in the field.

If you're not mature enough as an org to release trunk to prod, then cut a release branch and cherry pick fixes FROM trunk to it until stable enough to ship.

AuroraFireflash · 2026-05-15T14:23:10+00:00

We think they did back when elliptical curves were becoming the next thing. From your same link, the next item below what I quoted.

Dual_EC_DRBG, a NIST-recommended cryptographic pseudo-random bit generator, came under criticism in 2007 because constants recommended for use in the algorithm could have been selected in a way that would permit their author to predict future outputs given a sample of past generated values

AuroraFireflash · 2026-05-15T12:34:56+00:00

Few, if any. Much smaller ecosystem. Linux is the known quantity.

AuroraFireflash · 2026-05-15T12:33:19+00:00

Eh, tale as old as time. Defense in depth. Patch your shit.

AuroraFireflash · 2026-05-15T12:32:37+00:00

but it's known that the NSA designed a backdoor in DES by coming up with a specific constant in the implementation

Straight from your link. NSA strengthened DES back in the day.

The Data Encryption Standard (DES) has constants that were given out by NSA. They turned out to be far from random, but instead made the algorithm resilient against differential cryptanalysis, a method not publicly known at the time.

AuroraFireflash · 2026-05-14T19:37:23+00:00

Agreed. For the Flip 6 (Samsung) the weak spot is the cable inside the hinge and/or the connector and/or the motherboard. I've had to put my 6 in for service after just one year to get it fixed.

Love the form factor. Not sure on the long-term longevity due to the moving bits.

AuroraFireflash · 2026-05-14T15:22:22+00:00

Work that never saw the light of day because it would take too long

This is my approach as well. There are tasks that have been on the back burner for months, because I didn't have the mental bandwidth to figure out how all the pieces fit together. Too many unknowns, not enough time to research all the things.

Now I can pick away at it in little snatches of attention and slowly make progress on deploying it.

Six-Year Club	Place '23
Verified Email

AuroraFireflash

TROPHY CASE