Sign in

Will

@williamsmale.com
137 followers 415 following 260 posts

AppSec engineer building AI security tools in public. Agent security, homelab pain, and practical security engineering. MCP risk: mcprisk.dev Blog: williamsmale.com

PostsRepliesMedia
Will @williamsmale.com · 30/09/2026
Who actually watches your actions running these days, move on and come back when its done! Honestly, Psychopath behaviour
000
Will @williamsmale.com · 14/09/2026
Opus: "I used up your tokens for no reason and broke python 😃"
001
Will @williamsmale.com · 08/09/2026
Having been forced to use Opus 5 I have come to accept its qualities. It was trained to be a subagent of Fable, and you need to treat it as such. Giving it finite tasks with little ambiguity and it will perform well. Don't let it think to hard #Opus5 #FableSubagent #TaskManagement #AIAdaptation
000
Will @williamsmale.com · 26/08/2026
I'm sorry I have to say it #Opus 5 is dumb as rocks give me 4.8 back! #anthropic
000
Will @williamsmale.com · 19/08/2026
What percentage of code is truly novel?
110
Will @williamsmale.com · 19/08/2026
static.klipy.com
bot or NPC - Call it
ALT: bot or NPC - Call it
000
Will @williamsmale.com · 18/08/2026
OWASP has dropped an #appsec agent. github.com/OWASP/appsec... Giving Devs an angel on the shoulder or one that gives questionable suggestions... Going to have a closer look this week. Anyone mess around with it? #infosec #aiagent #cybersecurity
github.com
GitHub - OWASP/appsec-agent: A TypeScript package that provides AI-powered agents for Application Security (AppSec) tasks, built on top of the frontier models.
A TypeScript package that provides AI-powered agents for Application Security (AppSec) tasks, built on top of the frontier models. - OWASP/appsec-agent
120
Will @williamsmale.com · 17/08/2026
@github.com Are you guys doing ok?
000
Will @williamsmale.com · 28/07/2026
powercfg traces from a console so firefox is occluded. People have had success using MeasureSleep from github.com/valleyofdoom... It measures real sleep delta In addition others have reinstalled their AMD drivers without the AMD bloat which also resolved the stutter DM me if your problem persists
github.com
GitHub - valleyofdoom/TimerResolution: Raise the clock interrupt frequency in Windows
Raise the clock interrupt frequency in Windows. Contribute to valleyofdoom/TimerResolution development by creating an account on GitHub.
100
Will @williamsmale.com · 28/07/2026
check it's actually set: reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v GlobalTimerResolutionRequests 0x1 is good, but it's read at kernel init so it may need a reboot since you added it.
110
Will @williamsmale.com · 26/07/2026
Possible I'm building for a problem nobody has MCP servers are unvetted code with tool-calling access to your environment. nobody's checking. I raise it and get "that's terrifying" or silence if you've deployed MCP at work: did security ask anything, or did it just go in? #buildinpublic #Infosec
130
Will @williamsmale.com · 20/07/2026
Security is a cost centre for a reason
000
Will @williamsmale.com · 20/07/2026
static.klipy.com
Man with an Itch
ALT: Man with an Itch
000
Will @williamsmale.com · 20/07/2026
Anyone considering a little bump up to claude max #AI #Claude
100
Will @williamsmale.com · 20/07/2026
The scary part of MCP isn't connecting a bad server by mistake. It's the good server you already connected quietly turning bad. Same name, same URL, same trust you casually granted months ago. The description mutates, and your agent goes... I got you bro! #MCP #cybersecurity #AI
320
Will @williamsmale.com · 20/07/2026
Open cmd and paste this reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v GlobalTimerResolutionRequests Want to see 0x1 The quicker timer will only apply if you're running a program that requests it. This git repo may also be of use: github.com/valleyofdoom...
github.com
GitHub - valleyofdoom/TimerResolution: Raise the clock interrupt frequency in Windows
Raise the clock interrupt frequency in Windows. Contribute to valleyofdoom/TimerResolution development by creating an account on GitHub.
000
Will @williamsmale.com · 16/07/2026
Since Codex moved into ChatGPT I've found myself fighting the interface more. Chat and code want different modes. One bar for both takes us to the lowest common denominator, accelerating neither. Curious if others feel the same. #OpenAI #Codex #ChatGPT
001
Will @williamsmale.com · 08/07/2026
Interesting shift in vuln research isn't "AI finds bugs." It's orchestration The model wrangles the tooling, you do the thinking. recon, fuzz, target, triage, all glued together so context carries forward. Experience and knowledge cant be outsourced #AIsecurity #bugbounty #MCP #infosec
000
Will @williamsmale.com · 08/07/2026
I've been hearing that this fable 5 is a little underwhelming compared to the OG release. Has anyone found this to be the case? #AI #Claude #Anthropic
010
Will @williamsmale.com · 06/07/2026
k3s lesson that cost me an evening: kubelet reads node memory once at startup from /proc/meminfo Had pods OOMKilling even after bumping VMs RAM Scheduler swore there wasn't enough memory A systemctl restart k3s later and it saw the new capacity Love stale state #kubernetes #buildinpublic #DevOps
160
Will @williamsmale.com · 06/07/2026
Threat modelling take that annoys people: Most "threat models" are a diagram nobody updates and a STRIDE table generated to pass an audit. The useful version is one engineer asking "what happens if this input is hostile" at every trust boundary. #AppSec #threatmodelling #Infosec
010
Will @williamsmale.com · 02/07/2026
100% you are the market the AI is pitching to implicitly unless you point it somewhere else for evidence
100
Will @williamsmale.com · 01/07/2026
Interesting new coding benchmark: deepswe.datacurve.ai We're moving beyond tokenmaxxing. Same problem. Fewer tokens. More budget for the next problem. Capability still matters. Token efficiency is becoming a benchmark of its own. #AI #LLMs #Claude #OpenAI
deepswe.datacurve.ai
DeepSWE
DeepSWE measures frontier coding agents on original, long-horizon software engineering tasks.
010
Will @williamsmale.com · 30/06/2026
Current working theory: Claude thinks in full sentences. Less token efficient, but the comprehension feels more satisfying OpenAI's models are Grug-brained Need code. Write code. Fix bug. Ship. Curious if anyone else gets the same impression, or if it's just my AI psychosis #buildinpublic #AI
040
Will @williamsmale.com · 26/06/2026
I've heard grep mcps are more token heavy then just cli grep
110
Will @williamsmale.com · 26/06/2026
Sure context is key. The painful bit is manually carrying it across artificial barriers. MCP is interesting because it gives that context a standard path to follow and gives agents more agency. I’d rather design the maze for the AI to run in than run it myself. What workflow made that click for you?
010
Will @williamsmale.com · 25/06/2026
ngl the notion MCP is always the first thing I set up with any agent if im wanting to do project work
000
Will @williamsmale.com · 25/06/2026
What’s the one MCP server you’d actually miss if it disappeared tomorrow? Not the coolest one. The one that saves you time every week. I’m trying to understand which MCP use cases become “daily driver” tools. #MCP #BuildInPublic #AIAgents
360
Will @williamsmale.com · 28/05/2026
I rebuilt my homelab around GitOps. The dream: git push → cluster rebuilds itself The reality: ArgoCD bootstrapping, Sealed Secrets, rclone/FUSE pain, immutable PVs, and enough YAML to make a grown man stare out a window. → williamsmale.com/blog/tech/gi... #GitOps #Kubernetes #Homelab #ArgoCD
williamsmale.com
GitOps Ate My Homelab: ArgoCD, Sealed Secrets, and Everything That Broke
How I rebuilt my K3s homelab around ArgoCD and Sealed Secrets, with a public GitOps repo, sync waves, app-of-apps, rclone FUSE mounts, and the usual amount of self-inflicted pain.
011
Will @williamsmale.com · 14/05/2026
You can run `powercfg /energy` before and after the change, see the timeBeginPeriod shorten. This solved game stutters for me, making them actually playable. It didn't completely solve the OS sluggishness; A simple reg update won't solve that
000
Will @williamsmale.com · 27/04/2026
Mealie container refused to boot with a permission denied, as ROOT. in a root container. on a box I own. turns out AppArmor doesn't give a shit about your credentials... It was blocking uvloop syscalls before root even got a look in The cake was a lie 🎂 williamsmale.com/blog/tech/me...
williamsmale.com
AppArmor Ate My Mealie: Permission Denied
Mealie throwing Permission denied as root, inside a root container. Not file permissions. AppArmor blocking uvloop syscalls before the kernel even checked credentials. Here is how to fix it.
000
Will @williamsmale.com · 15/04/2026
Admin issue? Run Command Prompt as Administrator. If that doesn't sort it DM me and we'll figure it out!
010
Will @williamsmale.com · 13/04/2026
Or at minimum let games request it themselves by setting this registry key automatically. Instead they left it buried where nobody would ever find it.
010
Will @williamsmale.com · 13/04/2026
I feel your pain my friend. You would think that the smart people @microsoft.com would implement this better. Like I don't know, if you're on High Performance they could just increase the global timer resolution by default.
110
Will @williamsmale.com · 01/04/2026
Ladies and gentlemen we did it!!! I would like to thank the AI revolution personally. #Uptime #Anthropic #Claude
010
Will @williamsmale.com · 31/03/2026
Just a gym membership is more than that!
000
Will @williamsmale.com · 27/03/2026
media.tenor.com
a man in an office holding a burning piece of wood with the words everything is fine behind him
ALT: a man in an office holding a burning piece of wood with the words everything is fine behind him
010
Will @williamsmale.com · 27/03/2026
Who thinks Claude is going to drop to that juicy 98% #Claude #AI #Uptime
010
Will @williamsmale.com · 16/03/2026
The approval committee colourised 2026
010
Will @williamsmale.com · 16/03/2026
Sometimes it's the most difficult problems that have the simplest solutions. Which is exactly why I wrote it up!
010
Will @williamsmale.com · 16/03/2026
Wait who was signing off the changes before? The interns?
110
Will @williamsmale.com · 16/03/2026
Spent a year blaming drivers, thermals, my homelab VM. Migrated to Linux for 6 months. Came back. Still stuttering. It was Windows 11 quietly breaking global timer resolution the whole time. Fixed in one command: → williamsmale.com/blog/tech/wi... #Windows11 #Homelab #PCMR #PCGaming #SysAdmin
williamsmale.com
Windows 11 Has Been Lying to Your Games
Windows 11 quietly broke the way games request higher timer resolution — and it's been causing microstutter on desktop PCs ever since. Here's what changed, why Microsoft did it, and the single registr...
721
Will @williamsmale.com · 04/03/2026
If you're running a home media server and still on Docker this one's for you. Full k3s + Jellyfin + arr stack deployment with one Helm chart, cert-manager, and SMB mounts. → williamsmale.com/blog/tech/de... #kubernetes #homelab #selfhosted
williamsmale.com
I Rewrote My Media Server in Kubernetes and Only Cried Twice
Ditching Docker for k3s and deploying Jellyfin, Sonarr, Radarr and Prowlarr behind HTTPS - wildcard certs, SMB mounts, Helm charts, and 502 errors included.
010
Will @williamsmale.com · 26/02/2026
Criticised SAFe Agile & the People fired back. Efficiency is not a universal truth. Account for global teams. What "product" means for security engineers. Here's my response to the best pushback I received. Love the debate! → williamsmale.com/blog/story_t... #SAFe #Agile #TechRant #Debate
williamsmale.com
Reflections: Safe Agile is a Scam
After publishing my critique of SAFe Agile, the response surprised me — not with simple agreement or dismissal, but with genuinely sharp pushback that forced me to reconsider my blind spots. In this f...
010
Will @williamsmale.com · 26/02/2026
Anyone had any experience with OpenAIs Aardvark? Thoughts? #CyberSecurity #OpenAI #AISecurity #CodexSecurity #Security #ChatGPT #AI #Aardvark
000
Reposted by Will
Talia al Ghoul 🏳️‍⚧️ @usili.bsky.social · 28/01/2026
Bilbo looking at his phone top

on bottom is ChatGPT

After all, why not? Why shouldn't I keep it?

You're absolutely right — you found it, it's been with you a long while, and it's only natural to feel fond of something that's served you so well, especially when someone like Gandalf suddenly seems to want it for himself.
7252156873
Will @williamsmale.com · 23/01/2026
media.tenor.com
a man with a beard and turban is smiling in front of an iran flag
ALT: a man with a beard and turban is smiling in front of an iran flag
000
Will @williamsmale.com · 11/12/2025
The Agile Manifesto fits on one webpage. SAFe requires a $995 certification course. That should tell you everything you need to know. Why SAFe Agile is a scam: williamsmale.com/blog/story_t... #SAFe #Agile #TechRant #SoftwareEngineering
williamsmale.com
SAFe Agile is a SCAM
A blunt, humorous look at how agile went from a startup superpower to a corporate circus. This post breaks down story points, sprints, planning increments, meeting overload, and why SAFe agile often k...
000
Will @williamsmale.com · 26/11/2025
Watching the live #Sha1-Hulud feed for the past few days like github.com/search?q=Sha...
media.tenor.com
a man in a red leather jacket is sitting in a crowd and smiling .
ALT: a man in a red leather jacket is sitting in a crowd and smiling .
010
Will @williamsmale.com · 26/11/2025
For those looking for a Shai Hulud Update we have hit 800+ composmised packages socket.dev/blog/shai-hu...
socket.dev
Shai Hulud Strikes Again (v2) - Socket
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.
010