Tips, tutorials, and updates from SlopCop.
A surprising amount of program behavior is defined by what is outside the program. Database URLs, feature flags, and library settings sit in configuration files or environment variables, while the code reading them may make some half-assed assumptions on what comes out on the other end. Strings are an
I wrote in August that humans shouldn't spend their time reading code anymore. (TLDR: the opportunity cost isn't worth it.) That doesn't mean that you should dispense with code review entirely. It just means that you should have agents perform the reviews (as well
An asynchronous function can release every resource before it finishes and still hold one at the wrong time. Borrow a connection from a small pool, then wait for an unrelated network request, and that connection remains occupied while the function is paused. A release call later in the function does
I spent most of my career in managed-runtime languages like Java and Python, so coming to Rust presented a few new land mines for me. I'm now about six months into primarily writing code in Rust, or more accurately, causing code to be authored in Rust, and
We make heavy use of the Agent Client Protocol (ACP from here on) so that we can wire up whatever model or harness we want to whatever front end we want (today the front end is Mjolnir principally). With ACP we are able to create a new Client or a
I started using AI heavily when a friend and Brokk founder Jonathan Ellis launched his own startup Brokk and I started using his then revolutionary tool Brokk in April of 2025, at that stage basically all models were pretty terrible and things like Cursor or Claude Code were basically useless
A profile field can be stored safely with a parameterized SQL query and still cause stored cross-site scripting (XSS) when it is later inserted into a page without the right output encoding. The same stored value could cause SQL injection if another part of the application concatenates it into
I've been using Opus 5 as my daily driver for a few weeks now across a bunch of projects and it's a really capable model, but it has two habits that drove me a little nuts before I figured out how to deal with them: 1.
I ran out of tokens pretty quickly this month (new fun thing I’m building was a bit hungrier than expected), and so I had to pull out a couple of subs for providers I don’t normally use (Z.ai and Meta) and I was pleasantly surprised at how
DataFlowBench ranks eight static analyzers for CI, editors, security review, and low-noise workflows, including licensing trade-offs.
Eight analyzers, thirteen languages, and not one clean sweep Reliable agentic code generation needs solid quality signals, so we created DataFlowBench and UsageBench to help evaluate Bifrost, our static analysis guardrail for keeping AI-generated code in check. These benchmarks includes other analyzers as well as Bifrost. In this post,
On Friday, I published a coding subscription tier list (reproduced above) that took a mostly-quantitative view of the different subscription plans available. It starts by looking at tokens-per-dollar, then uses DeepSWE's results to normalize to tasks-per-dollar: Clearly OpenAI destroys the rest of the
