I posted about my talk on socials, which by my standards is a LOT of self-promotion. My boss was not impressed 🙃

Lack of judgement used to mean not producing. Now it means 10+ pages. The declared expectation might be higher output, but the real one is better judgement.

https://cate.blog/2026/10/20/judgement-output/

If you don’t shape your career, capitalism will. That’s the premise of DRI Your Career, and the final cohort of 2026 starts today 🦝

It’s async, with feedback from me and @jyhsu on everything you write.

The 8 weeks starts now, but you can still join us: https://driyourcareer.com/dri-your-career

The less control you feel you have, the more important it is to use the control you do have well.

@jyhsu and I both see this in coaching: people say they want space to figure out what’s next, then dive straight into another intense job. Giving yourself that space is scary, especially when your whole career has rewarded doing and achieving.

https://driyourcareer.com/dri-your-career (last cohort of the year starts Monday)

I’m fascinated by other people’s productivity systems because of what they reveal about the inner workings of someone’s brain. Reading Hilary Gridley’s made me realise one way I use mine is to get different views of what I need to do depending on headspace. The fundamental question of productivity systems is not “how do I organise it all,” it’s: how do I actually get things done?

https://hils.substack.com/p/how-i-built-a-to-do-system-that-actually

If your values can’t help you choose between two things you care about, they aren’t really values. And if you want to know what a team actually values, follow the money. Look at who gets hired, who gets promoted, and who gets the raise.

Kieran Snyder on why values aren’t a democracy: https://kieransnyder.kit.com/posts/your-values-aren-t-a-democracy

Tell me your most absurd values stories. I want to hear them!

Claude and I have been on an adventure trying to reverse engineer code review. It’s superficially a good idea, but on a deeper level probably less ROI than I initially thought.

The issues review missed weren’t followed by bugs any more often than any other code, and a lot of what got enforced was one person’s preference rather than a team agreement.

https://cate.blog/2026/10/13/attempting-to-reverse-engineer-code-review/

This is what thinking through every edge case looks like. Deeply nerdy! But fascinating.

Apple’s write-up of Reference Image walks through every step that has to be validated before you can say “this photo is real”. Sensor keys minted at the factory, a timestamp bound on both sides of the capture, processing on code anyone can inspect, post-quantum signatures, and a way to revoke fakes without exposing who took the photo.

https://security.apple.com/blog/apple-reference-image/

/via @halle

A long time ago, I was on a Gamergate target list. Nothing happened, but it was scary and it made me think very concretely about two threats: people getting into my accounts, and people turning up in person.

The second one is why, for years, my travel newsletter only ever said where I'd been, never where I was going.

I didn't call any of that threat modelling at the time. I was thinking the way engineers think, working out who I was worried about and what they might do.

That's a threat model though, and it's where @halle and I start in Breaking Into the Security Mindset: the same thinking, pointed at your product instead of your life.

There's something a bit radical about two women building a course about security, which I love. Security has a specific idea of who belongs in it, and plenty of engineers rule themselves out.

Our take is that we do security all the time. We just usually call it "bug fixing" or "UX". Turns out, for all the FUD, it's not rocket science. It's a systematic way of looking at things, and engineers are trained for this.

Our first cohort starts TOMORROW, October 12. We'd really love it if you joined us.

https://www.driyourcareer.com/security

Burnout is up, optimism is down, and the biggest worry about AI isn't losing your job but being expected to do more for the same pay.

My take: this is a result of pressure for AI to deliver results without any space to experiment and learn.

https://www.lennysnewsletter.com/p/how-tech-workers-are-feeling-in-2026

I had a great time seeing friends and making new ones at swiftCon.

Lovely to exchange experiences and stories on building accessibility cultures in a roundtable.

Great presentations by the likes of @bens on the 1 Billion Row Challenge, @Clure on App Intents, @designatednerd on arts and crafts, @cate on taking control of your career — and many others.

I was on the program committee for swiftCon and got excited about @bens’s talk on the billion row challenge in Swift when it was just an abstract. So cool to see it in person.

Super nerdy optimizations all the way down. mmap and multithreading eventually, but my favourite part was swapping out Swift’s standard types for raw bytes and unsafe pointers 👩🏻‍💻

For those not at the event, he did a whole NSScreencast series on it: https://nsscreencast.com/episodes/604-brc-part1

There's a difference between what's for machines and what's for humans, and we shouldn't juice our own productivity by wasting other people's time.

I use AI on most of what I write, usually: rough notes in my own voice, iterate, edit, repeat. My blog posts are taking more time, not less, because the feedback loop is fast enough that I go round it more often instead of rereading the same draft and losing sight of how it can be better.

Is it making my writing better? Sometimes. Sometimes it's helping me get something into words sooner. But one thing I'm fanatical about is information density.

@jnsgruk on going back to writing it himself: https://jnsgr.uk/2026/10/write-it-yourself/

Tech workers used to be pampered Instagram raccoons, living for the aesthetic. Now we live in Toronto, and Toronto raccoons don't wait for someone to leave the lid off 🦝

@jyhsu and I are doing an Anthropic webinar on DRI-ing your career. We'll talk about finding the goals that matter to you, having a constructive relationship with feedback, and knowing when it's time to move on.

October 13, 10am PT / 6pm Irish time, recording for everyone who registers.

https://www.anthropic.com/webinars/dri-ing-your-career

If you're iterating on your product with AI, you should be iterating on your guardrails too. Ours went from 12% of PRs to 36% in six months. Wrote up how I check whether our software factory is working, and the scripts to try it yourself.

https://cate.blog/2026/10/06/is-the-software-factory-working/

"I'm an engineer because I love to build things. I also need to be responsible about it, to protect our users. Where are the lines?"

If you're asking that too, you're who @halle and I made Breaking Into the Security Mindset for.

Do you have too many security fixes coming in, or worryingly few given everything you've heard, and want to get in front of it?

Ever heard someone talk about agentic coding as a "security nightmare" and felt overwhelmed?

Maybe your team has no "security person" and you think it could be you, but how to begin?

We wanted to make it tractable for you, so we walk you through threat models, structured security coding for humans and agents, a project that helps you understand how vulnerability detection works, and more: https://www.driyourcareer.com/security

It's systematic and accessible. Security work is engineering, and it's probably more familiar than it seems at first.

Our goal: by the end you know where your lines are, and you can get back to building.

Our first cohort starts NEXT WEEK, October 12. We'd really love it if you joined us.

RE: https://infosec.exchange/@halle/117370381555791812

I really love our arguments that are not really arguments! I think it demonstrates the complexity of working through these problems and balancing out pressure for velocity and depth of understanding.

For women there's a line between being a b*tch and being a pushover. I think there's a second line - getting credit for your work, and getting sh*t done.

This month, what's my job again? Self promotion - and it's not my fave.

https://newsletter.whatsmyjob.club/archive/a-less-pointless-game/

Very intense post from @halle on what it takes to really sandbox a local agent.

The goal is (close to) zero trust: the agent can read and write in one working directory and nothing else. Getting there takes a hardened local model server, a sandbox profile with nearly everything switched off, a DNS workaround, and then 42 tests to check the boundaries are where you believe them to be.

https://theoffcuts.org/#part-2-of-3-the-sandboxed-local-agent

We'd spent years slowly retiring the hero engineer. He's back: one man and his 500 agents.

@halle and I on the stereotypes that keep people out of the security mindset.