Joe M.

Non-Devs Just Don't Understand

Thu, 01 Oct 2026 01:26:18 -0500

Everyone reading this has probably not just already encountered AI, but adapted to it.

There’s just no getting around it: if you’ve been in Software Engineering over the past few years, you’ve seen your day-to-day change in serious, fundamental ways.

I have a close friend who just found a job after six months of unemployment. This person is a true “Rockstar” / 10-xer / whatever your preferred term is. He is an incredibly talented dev and architect that can cut entire new services from whole cloth.

Hear Me Out: If We Find Life Out There... Maybe We Should Kill It

Thu, 10 Sep 2026 01:26:18 -0500

I’ve started reading a new sci-fi book, and it has the single most realistic and terrifying depiction of first contact I’ve ever encountered.

It’s called The Killing Star and I can’t stop thinking about it.

First, let me save you a click - physical editions are priced in the low hundreds of dollars. Even though the book was only published in ‘95, it must’ve had a small run. The good news is it’s available as an ebook.

If You Knew God Exists, Wouldn't You Become a Priest?

Sun, 30 Aug 2026 01:26:18 -0500

I’ve been thinking a lot about AGI lately, which means a lot of things to many people. It can be anything from a true, human-equivalent reasoning machine to something more akin to a God - so far ahead of us as to be a qualitative leap in intelligence.

I’m actually more inclined to believe we’ll leapfrog the first and arrive at the second. And this is why: We have the power to throw more inputs - training, data, electricity - to force more output, with AI, than we can with the human brain. You can’t house two pizzas and somehow raise your IQ with the extra calories, as tantalizing as that possibility would be.

"Vibe coding" is the new "Internet dating"

Wed, 10 Jun 2026 01:26:18 -0500

Cast your mind back to the early 2000s…

Dating was very different.

For those living pre-iPhone there was no Tinder (2012), Hinge (2013), or Bumble (2014). Primarily desktop-driven apps like OKCupid (2004), eHarmony (2000), and the original, venerable, Match.com (1995) dominated.

Swiping as a fundamental dating U/X didn’t exist yet. Instead people specialized in long-form essays about why they traveled the world with their dog, or answered hundreds of questions about their hobbies, interests, and favorite foods, so they could be matched with their soulmate.

Senior Developer Koans

Fri, 05 May 2023 00:56:18 -0500

“We need to integrate with a SOAP API that’s been deprecated for 3 years” said the Engineering Manager. And the Developer wept.

A Senior Developer wanted to choose the best Node framework for his project, so he asked the Master. “Deno” said the Master.

“Teacher” asked the Junior Developer, “Why doesn’t my feature work in Firefox?” “All features work in Firefox” replied the Senior Dev, “from a certain point of view.”

The Naming Game

Sun, 15 Sep 2019 18:56:18 -0500

A while ago my friends and I were brainstorming names for our then as-yet-untitled-form-side-project #1. We had a few considerations in mind that, in light of recent discussions around naming, could be fun to share.

So I’ll share them.

We wanted our name 1) to be simple, 2) possible to register as a .com or .io domain, 3) have a positive association, and 4) to explain the service had something to do with forms.

A Quick Guide to Collecting Sci Fi

Sun, 08 Sep 2019 12:56:18 -0500

Over the years of avidly collecting my niche (New Age science fiction from the 60s and 70s), I’ve picked up a few germs of knowledge about book collecting, preservation, and general enthusiasm.

It is an addicting hobby, and like any pursuit, something you can improve at with just a tiny bit of perfectly normal, not-clinical, garden-variety obsession.

Buy your Bible

Before anything else, buy the excellent Science Fiction and Fantasy Authors: A Bibliography of First Printings of their Fiction edited by L.W Currey (Currey also runs an excellent antiquarian book store you can buy from online. They are one of my favorite stores because of their careful packaging). You can either track down one of slightly rarer-but-still-affordable hardcover editions or purchase a CD of the contents from Currey himself.

Formcake - A Backend Form API

Fri, 19 Jul 2019 12:56:18 -0500

🍰 Formcake was made to solve a simple but common problem: You have a contact form, lead page, or survey, but you don’t want to spin up an entire server just to field that one form’s submissions.

Enter Formcake - you sign up, create a form, and get an endpoint that looks like formcake.com/api/forms/<YOUR_FORM_ID/submissions that you can put into your <form> tag’s action endpoint.

You can then configure success and error redirects if you want them, or just have the user stay on the current page - or you can incorporate an AJAX call to submit the form and display your own success / error message.

Adding a Loading Icon in Nuxt

Fri, 28 Jun 2019 00:56:18 -0500

Today I’m going to discuss implementing a loading icon like you see in a lot of SPAs within the context of a Nuxt project I’m working on - Form Cast, a simple form backend-as-a-service.

The Icon

My project at the moment is pretty spartanly designed, with a plain white background. For my loading icon, I wanted something with a flash of both activity and color. After surfing around, I decided on this (it’s technically a typing activity icon, but who cares).

Comparing Integrations in the Form Market

Sat, 22 Jun 2019 00:56:18 -0500

The form market is huge. Everyone wants to make drag-n-drop, marketing and growth hacker-friendly forms that can do everything from lead capture to payment processing.

And so naturally, I asked … maybe there’s room for me?

But seriously, with a lot you get less-than-stellar design, clunky widgets, and unwieldy WYSIWYGs. That’s why a few friends and I decided to dream up an MVP based on making the Stripe or Slack of form companies - something that works hard through efficient UX to reduce cognitive load and just be easier at all the things, generally. Don’t try to create another form builder for marketers - instead make a detatched backend that anyone who knows their way around a form tag can slice into their markup.

Junior Developer Koans

Sun, 24 Mar 2019 00:56:18 -0500

“Generate a react app without scaffolding” instructed the Master.
The student could not.

The old man told the young:
“Python has seen 3 versions in my day”.
The young man responded:
“Node has 12.”

“Teacher”, the student inquired, “What’s the best Javascript MVC?”
The teacher replied.
“It’s not JQuery.”

A Junior Developer wanted the best Javascript framework for his side project, so he evaluated every option before deciding.

He starved to death.

Writing a Book with Unix

Thu, 07 Mar 2019 12:56:18 -0500

Introduction

Last year I published my first book with a publisher, Hands on Bug Hunting For Penetration Testers.

Going in, I was determined to set up a workflow that would allow me to:

Keep a backup of the book.
Allow me to easily track my writing progress.
Work on the book offline.
Keep my own copy of the book.

What set of tools could possibly control the versioning, backup, access control, and portability of plain text?

Three Hundred Users in Seven Weeks

Sun, 24 Feb 2019 12:56:18 -0500

Seven weeks ago, a friend and I started writing a newsletter for junior devs and strategizing about stuff like open rates and content strategies.

But if you’ve followed any of this before now - or seen those link titles, you’ll notice we go from 100 subscribers in two weeks to 250 in three all the way up to… 300 users after almost two months. What happened?

Why We Hit a Plateau

There are a few reasons growth slowed.

Automated Scanning with Arachni

Fri, 22 Feb 2019 12:56:18 -0500

Scanners have a tricky reputation. Their point-and-click simplicity and utility as automated reconnassiance tools means they get love from script kiddies and professionals alike. They also have compelling use cases for flushing out certain vulnerabilities, like XSS, where there may be too many input vectors or payload varities to feasibly go through the application by hand.

The problem is a lot of the most popular scanners, like Burp Suite and Websecurify, rely on a GUI for their targeting information and follow a similar pattern:

Five Tips for Junior Developers-To-Be

Sun, 17 Feb 2019 12:56:18 -0500

Landing your first “Software Developer” or “Web Developer” position is a big get. More than a designer-who-programs or a writer-who-markups, taking on a role where your principal responsibility is coding is a big step in any technology career.

You could be thinking about a career transition or graduating a bootcamp or computer science program - this article has five tips, some less earth-shattering than others, that nevertheless will help you on your search. They come from being on both sides of the hiring table, after breaking in through outside the university system.

Two Hundred Fifty Users in Three Weeks

Sun, 03 Feb 2019 12:56:18 -0500

At three-weeks, the ongoing experiement in writing a newsletter for junior devs and open strategizing is in full swing.

Quick recap: Three weeks ago a friend and I launched jobletter a job newsletter targeted early career devs looking for quality listings and career information.

Writing about this experience provides an opportunity to chronicle our efforts. If it grows this will be a fun account of why, if not, then we learned a lot, and these posts will teach us more.

How We Reached a 67% Open Rate and a 26% CTR

Mon, 21 Jan 2019 12:56:18 -0500

Three weeks ago we launched jobletter.

Since then, we’ve been promoting the site, collecting feedback from friends, and experimenting with with a more open approach to writing about our process.

All that culminated in us reaching a milestone this past Friday - our first email. Over the past week we’d worked with a freelancer to deliver an email template, as well as winnow down the jobs we’d been collecting. We wanted a good mix of industries, company sizes and technology stacks - emphasizing location-independent postings like businesses hiring in multiple locations, or startups open to hiring remote junior workers (harder to find, but they exist).

One Hundred Users in Two Weeks

Mon, 21 Jan 2019 12:56:18 -0500

Recently my business partner and I launched a new service, jobletter.io with a simple premise: We deliver Junior Developer jobs to your inbox.

Breaking into development to get those all-important first two years of production experience is long, exhausting work, filled with pouring through a lot of “Software Developer - 5+ years req” posts and keyword salads where your prospective employer’s stack includes Every Goddamn Thing™.

It makes the idea of a short list of quality, curated, 0 years of experience-and-up jobs, delivered to you, pretty appealing.

Jobletter - Junior Developer jobs in your inbox

Mon, 07 Jan 2019 18:56:18 -0500

A few days ago, David Broadlick and I launched Jobletter into beta, as a way for developers at the beginning of their careers to get a concentrated dose of high-quality jobs targeting their skillset and experience level.

Right now we’re still building out some of our customization features: We’d like to add location and specific skill targeting, more customized sending schedules, and more content options, but we’re excited to start sharing a service very much borne out of our own experiences.

Building a Python 3.6 Seed App with Docker, Tox, and Pylint

Thu, 06 Dec 2018 13:56:18 -0500

Seed apps are great.

They can be the test-bed for new devops features, mini onboarding exercises, or just “batteries-included” starter kits for greenfield applications.

Especially in the web application (and Python) world, almost everything comes with extra considerations - testing, linting, containerization - wouldn’t it be great if we could make a Python seed that came with all of that baked in?

What a beautiful, productive world that would be (skip straight to the github repo to go there now).

Burp Extensions - Setting up XSS Validator

Tue, 16 Oct 2018 18:56:18 -0500

Hunting for XSS

XSS / Cross-site scripting (which is just another form of Code Injection) can be a severe vulnerability.

It’s also very common.

That potent combination - profitability and ubiquity - marks it as a worthy target for penetration testers interested in public bounties.But because of a high rate of false-positives (and inevitably imperfect detection logic) the process of ferreting out XSS comes with a lot of noise. The XSS Validator from Nvisium is designed to solve this problem. It verifies XSS findings exported from the Burp Suite interface in a Phantomjs server designed to receive, analyze, and validate possible XSS snippets. The extension is critical for testing a target with a large attack surface.

Bug Hunting for Penetration Testers Available Now

Sun, 16 Sep 2018 13:56:18 -0500

Hands-On Bug Hunting for Penetration Testers is now available. The book covers how to detect, validate, and write submission reports for XSS, SQLi and NoSQLi, XXE, CSRF, and more vulnerabilities, including sections on detecting hidden content, crowdsourcing code injection snippets and other malicious inputs, writing quality submission reports, and more. It uses Burp Suite as a principal tool and proxy, with Python (3.6.5) and Bash scripts thrown in to augment, extend, and automate different testing functions. All the tools used are free. You can find the work in both ebook and print versions:

Creating my Blog and Book Sites on the Free Stack

Thu, 02 Aug 2018 12:45:18 -0500

When I was setting out to revamp my personal blog and create a new site for my book, I had a couple of considerations in mind. I wanted both sites to be highly-available (I don’t get much traffic, but also don’t want a hug of death), simple (with as few moving parts as possible), and easy-to-update and generally extend.

All of that led me to a static workflow.

Settling on (but not for) Static

I love static sites. They’re a zen koan in a universe of epics: As large as they need to be (and no larger). Leaning into static sites means that your application is easy to reason about, since it’s just HTML or a simple template generator. And it’s also easy to deploy and host - even just rsync-ing a folder to an nginx server could do for a basic setup.

My Writing Tech Stack

Tue, 31 Jul 2018 18:56:18 -0500

All writers have their own workflows for writing: Many people use Word, Google Docs, or Libre Office - George R.R. Martin famously uses WordStar, a DOS-based text-processing system from the mid-80s. As long as your personal productivity is juiced and you’re comfortable, you can be as idiosyncratic as you want. Somewhere a hardcore cypherpunk is writing the next cryptographic epic in vim.

In that spirit, I’ve evolved my own writing process over time as I’ve looked for a workflow that minimized application overhead, allowed me to translate documents between formats, provided robust version tracking, integrated well with other tools, and worked offline. There are several parts to the stack.

Pentest Proving Grounds

Mon, 30 Jul 2018 15:56:18 -0500

One of the most helpful tools in learning the fundamentals of penetration testing is the ability to test your analysis against deliberately-vulnerable applications - sites and/or apps with consciously introduced flaws, catalogued for easy reference. Beyond a great introductory exercise, testing against deliberately vulnerable apps can also be a great way to calibrate new scanners or automated reconnaisance methods. And in addition to the actual vulnerable endpoints within the applications themselves, many of them also feature their own guided tutorials explaining how to detect - and often mitigate - the vulnerabilities they contain.

Pre-order Hands-On Bug Hunting for Penetration Testers

Sat, 23 Jun 2018 13:56:18 -0500

Update: The book has since been released. See how to purchase it at handsonbughunting.com or use the Amazon link included in the article below.

This October I’ll be releasing my first book with Packt publishing, Hands-On Bug Hunting for Penetration Testers.

The book covers:

Preparing for pentesting engagements
Building an automated pentesting workflow
Detecting and reporting OWASP’s Top 10 most common bugs
Finding the best bug bounty programs
Focusing on testing the right parts of a web application
Formatting vulnerability reports to maximize your payouts
Going further

If you have some experience with penetration testing, it’ll be a good introduction to public bug bounty programs, and if you’re just getting into security, it’s a great series of walkthroughs for getting up to speed - even if you have to search for the meaning of a term or two (or three).

The Top 5 Burp Suite Extensions

Thu, 17 May 2018 18:56:18 -0500

If you’re a freelance security researcher, chances are you’ve heard of — or use — Burp Suite, a program commonly considered the gold standard for penetration testing software. But if you’re only using the stock version, as great as it is, you’re missing out! Both the free and paid versions of Burp support helpful extensions that add extra functionality to the main client — whether it’s a separate (and free) scanner, an IP randomizer, or a plugin for validating XSS vulnerabilities. This list is intended to give you a quick-hit overview of some of the best extensions that you can add easily and painlessly to your current setup to be more profitable and productive as a security researcher.

A Brief Illustration of Functional Programming

Fri, 22 Sep 2017 18:56:18 -0500

Functional Programming is a powerful programming paradigm that tries to reduce bugs and make it easier to reason about an application by avoiding state changes and the mutation of global values, generally.

In software coded using functional programming patterns, all functions can be understood by the arguments passed to them as parameters. There is no reliance on the instance variables of the class (like in Object-Oriented Programming (OOP) patterns) or some other state-dependent variable modified through assignment in runtime by the source code (like in Imperative Programming).

1-Minute Markdown

Tue, 13 Jun 2017 18:56:18 -0500

What’s Markdown?

Markdown is punctuation for the web. It enables authors to easily write documents that feature common online staples like links, images, as well as italicized, bold, and other types of rich text, using a simple, lightweight set of symbols that can easily be converted to HTML, doc, pdf, or rtf files. Since markdown files are just plain text, they’re an ultra-portable way to write web-compatible content without the mess of a WYSWIG editor or proprietary file types.

An Event Loop Allegory

Fri, 05 Aug 2016 18:56:18 -0500

Two jugglers walked around a small track, practicing their craft.

The first one, Sync, wasn’t really what you’d call a juggler, so much as an apprentice juggler or (less charitably) a juggler-wannabe - a straight up ball tossin’ poseur.

Sync could only keep one ball in the air at a time. In fact, he only owned one ball. As he traced the circle of the track with his steps, his bouncy red ball would draw a series of parabolas in the air, tracing a gentle up-and-down curve following his path. As he walked, Sync would think somber thoughts about his place in the larger hierarchy of the cutthroat world of professional juggling.

Contact Me

Mon, 01 Jan 0001 00:00:00 +0000

Hire Me

Mon, 01 Jan 0001 00:00:00 +0000

Although I am a happily-employed man, I am always looking to moonlight on development or writing projects.

You can reach me through the contact page on this site, or connect with me through LinkedIn.