Software maker · Ruby/Rails loyalist · AI tinkerer · https://xitter.cf/t.co/5YeFjzAObu
Warsaw, Poland
Joined February 2008
- Tweets1.2K
- Following183
- Followers2.2K
- Likes3.4K
Pinned Tweet
I'm taking on consulting projects, starting in November.
Web apps, Rails, infra, and helping teams get results from AI.
Let's talk: ptrchm.com/work-with-me
Piotr CH retweeted
One of the biggest security risks in small teams is giving everyone direct access to production.
And it's very common.
Here's a way you can reduce the attack surface:
- introduce a bastion server as the single entry point to production
- everyone must SSH into the bastion first
- every command on the bastion is logged
- anything that touches prod requires a manually entered TOTP code
- all deployments go through the bastion
- the bastion is accessible only via Tailscale
There are more sophisticated solutions for this, but this works really well for small teams.
As a bonus, it blocks AI agents from running commands against production.
For example, on the bastion, you can't run `kubectl` to access the Kubernetes cluster. You must use a wrapper script, like `sudo pkubectl`, which prompts for a TOTP code (users get sudo only to allowed commands, no root escalation).
I'm about to hit my weekly limits on the Claude sub.
Added Grok 4.7 to the slop arsenal for a test ride.
What else should I try?
One of the biggest security risks in small teams is giving everyone direct access to production.
And it's very common.
Here's a way you can reduce the attack surface:
- introduce a bastion server as the single entry point to production
- everyone must SSH into the bastion first
- every command on the bastion is logged
- anything that touches prod requires a manually entered TOTP code
- all deployments go through the bastion
- the bastion is accessible only via Tailscale
There are more sophisticated solutions for this, but this works really well for small teams.
As a bonus, it blocks AI agents from running commands against production.
For example, on the bastion, you can't run `kubectl` to access the Kubernetes cluster. You must use a wrapper script, like `sudo pkubectl`, which prompts for a TOTP code (users get sudo only to allowed commands, no root escalation).
ActionBar is now free *and* open source.
I'm removing it from the App Store, so please switch to the GitHub version if you want updates.
github.com/pch/actionbar
RAWmakase 0.4.2 brings our most-requested feature: file management.
You can now delete, move, rename, and batch-rename files directly in Library.
It's not quite finished yet... because of the sheer number of filesystem and cross-filesystem scenarios that need to be handled. 😓
This is an early release, so BACK UP your files first! Please report any issues on GitHub.
Release notes: github.com/pch/rawmakase/rel…
Coming tomorrow: LUT support!
New day, new RAWmakase release (0.4.1):
· iPhone ProRAW & Samsng DNG support
· Edit WebP, AVIF, and JPEG XL files (h/t @priard)
· Monochrome DNG support
· Fixes for multiple bugs and regressions
Coming up next: file management (delete, move, rename) and LUT support.
Try it on Linux (Omarchy is a first-class citizen), macOS, or - if you really have to - Windows.
Release notes and downloads: github.com/pch/rawmakase/rel…
A little peek into how the sausage is made:
Watch me use @t3dotcodes and Opus to fix a user-reported issue in RAWmakase - with very little prompting.
(it's unbelievably cringe to watch and listen to myself, so lmk if this is watchable)
New day, new RAWmakase release (0.4.1):
· iPhone ProRAW & Samsng DNG support
· Edit WebP, AVIF, and JPEG XL files (h/t @priard)
· Monochrome DNG support
· Fixes for multiple bugs and regressions
Coming up next: file management (delete, move, rename) and LUT support.
Try it on Linux (Omarchy is a first-class citizen), macOS, or - if you really have to - Windows.
Release notes and downloads: github.com/pch/rawmakase/rel…
RAWmakase 0.4.0 is now available.
RAW files are now processed by our own Rust-based decoders, about 20% faster, with better Lightroom rendering parity.
A fundamental change in the internals.
Full release notes: github.com/pch/rawmakase/rel…
I'm sure this introduces some new problems, so if you notice anything weird, go straight to GitHub Issues. 🙏
Is 2027 going to be The Year of Linux for Photography?
Great shots, btw!
Just set up mr boxington by @jdxcode to stop Rust build artifacts from eating up my disk space (when using git worktrees):
github.com/jdx/mr-boxington
How my workflow looks now:
· @t3dotcodes as an orchestrator
· git worktrees
· 2 machines (MacBook M1, Beelink SER8 with @omarchy)
· multiple agents at once, on both machines
· yolo mode
· dataset with "ideal results" that the models verify against (400GB)
· local CI: still manual, for dataset checks only
I don't read the code, because it's way over my head and I don't know Rust (yet). But I glance at PRs and diffs for a high-level review of what the agents may unncesarily slopify: changes in too many files, changes in too many modules, conditional fixes for specific cameras (if camera == canon_x then do sth) instead of generalized solutions, overly cautious changes for unneeded backwards-compatibility, etc.
Opus writes the code, calls a Codex review subagent before pushing - has to get an OK from Codex before it opens a PR.
Same goes for planning. I say what I want and what is considered "done", then Opus and Codex make a plan - when they agree, they start a new thread for the implementation. Often I'll ask them to open a tracking issue on GitHub.
When a GitHub issue comes in, I open a new thread in T3, paste the link and say "work on this". No automation yet, because not every issue should be worked on immediately (or at all).
For PRs, I let agents review the code and make fixes directly in the PR branch.
Lots of one-off research tasks that never end up in the codebase.
CI still continues to be the bottleneck, same for the dataset-related checks, and Rust compile times.
Also, I keep running out of disk space on the mac thanks to git worktrees, cargo builds and other artifacts.
T3Code has been the biggest unlock so far. Highly recommended (the nightly build).
RAWmakase 0.4.0 is now available.
RAW files are now processed by our own Rust-based decoders, about 20% faster, with better Lightroom rendering parity.
A fundamental change in the internals.
Full release notes: github.com/pch/rawmakase/rel…
I'm sure this introduces some new problems, so if you notice anything weird, go straight to GitHub Issues. 🙏
Apparently, AI is just as bad at time estimates as humans.
It's done already!
20% faster than LibRaw, better rendering parity with Lightroom (median ΔE00 from 1.04 down to 0.71).
Shipping tomorrow: github.com/pch/rawmakase/pul…
I keep maxing out my Codex plan, but somehow, a random reset from up above always saves the day.
Deus ex machina.
Apparently, AI is just as bad at time estimates as humans.
It's done already!
20% faster than LibRaw, better rendering parity with Lightroom (median ΔE00 from 1.04 down to 0.71).
Shipping tomorrow: github.com/pch/rawmakase/pul…
Opus has been at it for 36 hours already and says it'll finish tomorrow.
Give it a way to verify its own results and it can keep going for multiple days without much supervision.
How my workflow looks now:
· @t3dotcodes as an orchestrator
· git worktrees
· 2 machines (MacBook M1, Beelink SER8 with @omarchy)
· multiple agents at once, on both machines
· yolo mode
· dataset with "ideal results" that the models verify against (400GB)
· local CI: still manual, for dataset checks only
I don't read the code, because it's way over my head and I don't know Rust (yet). But I glance at PRs and diffs for a high-level review of what the agents may unncesarily slopify: changes in too many files, changes in too many modules, conditional fixes for specific cameras (if camera == canon_x then do sth) instead of generalized solutions, overly cautious changes for unneeded backwards-compatibility, etc.
Opus writes the code, calls a Codex review subagent before pushing - has to get an OK from Codex before it opens a PR.
Same goes for planning. I say what I want and what is considered "done", then Opus and Codex make a plan - when they agree, they start a new thread for the implementation. Often I'll ask them to open a tracking issue on GitHub.
When a GitHub issue comes in, I open a new thread in T3, paste the link and say "work on this". No automation yet, because not every issue should be worked on immediately (or at all).
For PRs, I let agents review the code and make fixes directly in the PR branch.
Lots of one-off research tasks that never end up in the codebase.
CI still continues to be the bottleneck, same for the dataset-related checks, and Rust compile times.
Also, I keep running out of disk space on the mac thanks to git worktrees, cargo builds and other artifacts.
T3Code has been the biggest unlock so far. Highly recommended (the nightly build).
How my workflow looks now:
· @t3dotcodes as an orchestrator
· git worktrees
· 2 machines (MacBook M1, Beelink SER8 with @omarchy)
· multiple agents at once, on both machines
· yolo mode
· dataset with "ideal results" that the models verify against (400GB)
· local CI: still manual, for dataset checks only
I don't read the code, because it's way over my head and I don't know Rust (yet). But I glance at PRs and diffs for a high-level review of what the agents may unncesarily slopify: changes in too many files, changes in too many modules, conditional fixes for specific cameras (if camera == canon_x then do sth) instead of generalized solutions, overly cautious changes for unneeded backwards-compatibility, etc.
Opus writes the code, calls a Codex review subagent before pushing - has to get an OK from Codex before it opens a PR.
Same goes for planning. I say what I want and what is considered "done", then Opus and Codex make a plan - when they agree, they start a new thread for the implementation. Often I'll ask them to open a tracking issue on GitHub.
When a GitHub issue comes in, I open a new thread in T3, paste the link and say "work on this". No automation yet, because not every issue should be worked on immediately (or at all).
For PRs, I let agents review the code and make fixes directly in the PR branch.
Lots of one-off research tasks that never end up in the codebase.
CI still continues to be the bottleneck, same for the dataset-related checks, and Rust compile times.
Also, I keep running out of disk space on the mac thanks to git worktrees, cargo builds and other artifacts.
T3Code has been the biggest unlock so far. Highly recommended (the nightly build).
RAWmakase is a great exercise in building software for 2027: almost completely automated, with me just managing concurrent agent threads and making decisions.
Biggest bottlenecks so far, still unsolved:
· token prices
· automated code review flow
· CI slowness
· model-independent agent orchestration
· handling token limits (auto-switch, see above)