I’ve spent the last few weeks building across a few different AI coding tools, and I stopped paying much attention to the model underneath. You spend enough time around AI and you start to believe the model is the part that matters, since it’s what everyone talks about and all the benchmarking is against. But build across enough tools in a short stretch and a different picture shows up. The model is closer to an interchangeable component, and the setup wrapped around it is what decides success. ...

A website serving Windows Server 2019 was returning the correct pages to every human who visited, to Bing, and to Yandex, and Thai casino spam to Googlebot alone. The admin who posted about it had spent days inside the box looking for the cause. They checked web.config, the URL rewrite rules, the HTTP redirects, the custom error pages, the IIS handlers and modules and ISAPI filters, robots.txt, the sitemap, and then ran findstr across every drive for the spam domain and the casino keywords. All of it came back clean. The same behaviour showed up on multiple unrelated sites on the same server, which ruled out a single compromised application and pointed at something sitting underneath all of them. ...

The visible connector problem is easy to see in cabling. The software version is less visible, but it has the same maintenance shape. Zapier lists more than nine thousand apps it can connect to each other. Nine thousand pieces of software in regular business use that don’t talk to each other natively, and an entire company exists to be the translator between them. ...

I’ve sat through more than one migration where something stopped working and the trace eventually led back to a service account nobody knew was there. In one case it was a Windows scheduled task running as domain admin that hadn’t been touched in years and didn’t have an owner anyone could name. The pattern keeps showing up because migration is the only exercise that forces enumeration of what an application actually depends on, and the dependencies tend to include credentials with more access than anyone remembered granting. Scoping the account down to the permissions it actually needed took longer than anyone wanted to spend on it, but it left the customer with permissions they could justify and revoke if they needed to. ...