One for the Road: Trust, but Verify

Before stepping away, one last day of checking my lab and my plans turned into a lesson I keep relearning: “done” isn’t the same as “verified.

Before stepping away, one last day of checking my lab and my plans turned into a lesson I keep relearning: “done” isn’t the same as “verified.

I installed Orca, an open-source IDE for running AI coding agents in parallel, on Debian entirely from the terminal — then turned off its Yolo mode, built a sandbox repo, and walked the git worktree cycle by hand before letting an agent near it.

I set out to install Goose, the open-source AI agent, by following the official docs. Three times the instructions didn’t
match what my terminal actually did. Here’s what went wrong, how I worked around each one, and why “read the error, not just the docs” saved the day.

I’m stepping away from the blog for a little while to be fully present on a trip abroad. Here’s why, and what comes next when I’m back.

A late-night BBC headline about a critical PHP flaw sent me checking my own WordPress site. Here's how I found my PHP version, protected and verified my backups, checked for intruders, and pushed my host for a straight answer, plus what's still open.

I finally sent my first request to Inception's Mercury 3 API. Along the way I lost a key, saved a shell command instead of a secret, hit a 401, and learned how to store API keys safely on Linux.

"In Fortran, God is real unless declared INTEGER." A late-night programmer joke led me into Fortran's implicit typing, the legendary DO10I bug, and a hands-on Debian lab where Python silently returned 0 instead of 60, and flake8 caught my typo twice.

Last month’s Tumbleweed post ended with a warning: Mesa was split between Packman and openSUSE, the same setup that broke VLC. Three weeks later, it bit. Here’s how one zypper command moved eight Mesa packages to a single vendor, how a 911-package upgrade went through cleanly, and how a Packman codec package slipped in through the back door anyway.

An AI agent solved 49 of 50 unpublished research physics problems for under $3 each. Are these "virtual polymaths"? Half right. Here's what the new TheoPhysEval paper shows they still can't do, and why it matters for security.

Before restarting the CSI Linux Certified Investigator course on EchothisLabs, I verified my CSI Linux VM's big upgrade, closed five network services an investigation box doesn't need, fixed group memberships, and mapped out where the course goes from here.