I have been building locally with AI over the past year and I wanted to start moving what I had truly online. Taking something from prototype to hosted is normal work in my day to day. Doing it with no platform team behind me is a different story, because everything that machine had been covering for was suddenly mine to build. Your machine in every case, is the boundary. On your own laptop you’re the whole system whether you meant to be or not, it’s your logins, network and various local dependencies. Point a public URL at the same code and it’s doubtful to work (well safely). In a company a separate team is usually overseeing the security model and the various components. ...

A website serving Windows Server 2019 was returning the correct pages to every human who visited, to Bing, and to Yandex, and Thai casino spam to Googlebot alone. The admin who posted about it had spent days inside the box looking for the cause. They checked web.config, the URL rewrite rules, the HTTP redirects, the custom error pages, the IIS handlers and modules and ISAPI filters, robots.txt, the sitemap, and then ran findstr across every drive for the spam domain and the casino keywords. All of it came back clean. The same behaviour showed up on multiple unrelated sites on the same server, which ruled out a single compromised application and pointed at something sitting underneath all of them. ...

Three apps can still mean one underlying answer. I was heading to the ExCeL the morning after a tube strike, when the tubes were meant to be running again, and I had a session I wanted to catch. The boards outside the station said the trains were running soon, so I waited, switching between Citymapper and Google Maps to work out which one to believe. A woman walking past told me not to bother. She’d been standing at another station where the boards said the same thing and nothing had come, so she’d given up and was getting the bus. I ended up on a bus that didn’t go all the way, then the Elizabeth line, and the whole thing took far longer than I’d planned for a journey that was meant to be simple. ...

I’ve sat through more than one migration where something stopped working and the trace eventually led back to a service account nobody knew was there. In one case it was a Windows scheduled task running as domain admin that hadn’t been touched in years and didn’t have an owner anyone could name. The pattern keeps showing up because migration is the only exercise that forces enumeration of what an application actually depends on, and the dependencies tend to include credentials with more access than anyone remembered granting. Scoping the account down to the permissions it actually needed took longer than anyone wanted to spend on it, but it left the customer with permissions they could justify and revoke if they needed to. ...