[{"content":"I sometimes write these summaries to document my thoughts on AI agents — and to have something to look back on (and probably cringe at) in the future. The last update was in May and a few things have changed:\nI switched to Google Antigravity from GitHub Copilot after receiving a one-year Google AI Pro as compensation for Google changing their Developer Premium program. The frontier models are good, and have gotten a lot better over the last year. Some are probably better than others but they have all been good enough for my tasks. I don\u0026rsquo;t think I could tell the models apart based on their output. We are moving from AI-assisted pair programming towards agentic development, basically relaxing how much we supervise the agent. The journey to AI Agents I have seen a “maturity” spectrum of AI Agents adoption on the internet:\nCode completion → Pair programming → Agentic development\nI have been doing pair programming with coding assistants for a while, where you are in the loop. Agents work means more independent AI. I was initially skeptical to letting agents work on their own as I thought that if I was not in the loop, then I would not learn. But I trust the agents more and more, and don\u0026rsquo;t review as much as before so I guess I am using more agentic development.\nIt has been a while since I have looked at build pipeline failures. I basically tell Antigravity to fix the GitHub Actions error, and so far it has been successful. I read the summary, and refresh tokens or access if that is needed, but I have not written GitHub Actions YAML for a while and I think that is a good thing.\nAnd Google Antigravity and GitHub Copilot identifies as AI Agent Platforms so I guess I am developing with agents now.\nModels are getting better The Google AI subscription limits the models I can use, but this does not feel like a problem as Gemini 3.8 Flash is pretty good. It has done all the things I told it, I have not seen any errors, but some design decisions were different than mine.\nWhen the AI agent struggles, then it is often caused by me. Example: I told it to do something and gave it an access token that did not have all the needed rights. The Agent iterated multiple times without solving the issue, until I looked at it and realized my error.\nMaybe agents could give better feedback to humans when we cause problems.\nI have not yet run out of tokens included in the Google AI Pro subscription so I think that part is pretty generous. But Google is the most restrictive about using the subscription tokens in other products like Hermes, Pi and OpenClaw so I am missing out in that area.\nUsing Agents for other things On social media I saw different people say they had used AI agents to configure their Unifi network so I tried it with good results. I later used it to review machine setup, suggesting how to free more disk space. I have asked Antigravity to convert oddly formatted audio files to MP3. I could figure out the arguments to FFmpeg but I am glad I don\u0026rsquo;t have to.\nAI agents are definitely useful beyond software development, but access control needs more work.\nAgent experiments I have started a couple of experiments to see if I can get more value from agents.\nUse Obsidian for notes, as the notes are stored as agent friendly markdown files. Give the agent access to the Obsidian folder and ask it to clean up an structure. Hopefully if I get enough notes in there the agents will be able to extract some useful information. I have a folder where I run all the configurations using agents. And have the AI write logs giving the next agent run a post-mortem changelog so it avoids past pitfalls. I don\u0026rsquo;t know if this is a good idea, but I hear about self improving agents and why not try? Thoughts I see I can get more value out of agents, not limited to software development.\nAn agent make it easier to do complex things (in code, in machine configuration), but is the complexity needed? For example I used and agent to configure my home network to best practices, but maybe Unifi could have simplified the UI and made it easier to configure the network in the best way.\nMy major use cases for agents:\nExplaining things \u0026ldquo;Getting the details right\u0026rdquo; when I use tools or libraries that I don\u0026rsquo;t use too often. Reviewing and improving stuff (code, configurations and texts like this) Writing code One-shot new disposable projects for experimenting ","permalink":"https://www.arvesv.com/posts/2026/ai_sept_2026/","summary":"\u003cp\u003eI sometimes write these summaries to document my thoughts on AI agents — and to have something to look back on\n(and probably cringe at) in the future. The last \u003ca href=\"../moreaidevelopment\"\u003eupdate was in May\u003c/a\u003e and a few things have changed:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eI switched to \u003ca href=\"https://antigravity.google/\"\u003eGoogle Antigravity\u003c/a\u003e from GitHub Copilot after receiving a one-year \u003ca href=\"https://gemini.google/subscriptions/\"\u003eGoogle AI Pro\u003c/a\u003e as compensation\nfor Google changing their Developer Premium program.\u003c/li\u003e\n\u003cli\u003eThe frontier models are good, and have gotten a lot better over the last year. Some are probably better than others but they have all been\ngood enough for my tasks. I don\u0026rsquo;t think I could tell the models apart based on their output.\u003c/li\u003e\n\u003cli\u003eWe are moving from AI-assisted pair programming towards agentic development, basically relaxing how much we supervise the agent.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"the-journey-to-ai-agents\"\u003eThe journey to AI Agents\u003c/h3\u003e\n\u003cblockquote\u003e\n\u003cp\u003eI have seen a “maturity” spectrum of AI Agents adoption on the internet:\u003cbr\u003e\n\u003cstrong\u003eCode completion → Pair programming → Agentic development\u003c/strong\u003e\u003c/p\u003e","title":"Agentic development - September 2026 edition"},{"content":"Getting stuck in a loop A typical workflow is:\nAsk AI to make something Test it If it fails, ask the AI to fix it Repeat… Sometimes you get stuck bouncing between steps 2 and 3. Each iteration adds more patches, more complexity — but the underlying problem remains.\nYou may need a redesign When you end up in that loop, you need to break out of it before it uses too much human or machine cognitive capacity. The right move is often to step back and challenge the premise of what you’re trying to do. In my experience, getting caught in a loop like this is a indication that you’re fighting the system.\nFighting the system is often a bad idea.\nInstead, find the root cause and work with the system to reach your objective — even if that means adjusting your plan, your architecture, or your assumptions.\nExample An example from my homelab: I got a new machine that I want to run Ubuntu Server on.\nMy goal was that all machine configuration should be done using Ansible. This gives me repeatability, consistency, and simpler management. It was a \u0026ldquo;quality of life\u0026rdquo; objective to make life easier for future me.\nThe design was straightforward: one ansible user with passwordless sudo and one SSH key managed by 1Password. This works well once the user exists. But how do you set up the user initially?\nI asked an AI to generate a “bootstrap” Ansible script that creates the ansible user. I tested it on a cloud VM first — it worked. When I tried it on the real machine, it failed with a timeout waiting for a sudo password. I pasted the error into the AI, it suggested a fix, it failed again, and I repeated this loop several times.\nEventually, I realized I needed to stop prompting and understand the actual failure mechanism.\nFor security reasons Ubuntu requires a interactive tty when entering the sudo password, basically blocking using a password for the Ansible “become” root feature. I tried to do something that was impossible without configuring the machine first. But the reason I wanted the “become” root feature was to configure the machine. The end result is that I readjusted the objective. All configurations should be Ansble scripts, except setting up the ansible user - that must be done manually.\nThe reason the script worked on my cloud test machine was that GCP sets up passewordless sudo for my default user.\nThese kind of confiuration can also be done using cloud-init, but that may be a project for another day.\n","permalink":"https://www.arvesv.com/posts/2026/ai_pitfall/","summary":"\u003ch3 id=\"getting-stuck-in-a-loop\"\u003eGetting stuck in a loop\u003c/h3\u003e\n\u003cp\u003eA typical workflow is:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eAsk AI to make something\u003c/li\u003e\n\u003cli\u003eTest it\u003c/li\u003e\n\u003cli\u003eIf it fails, ask the AI to fix it\u003c/li\u003e\n\u003cli\u003eRepeat…\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSometimes you get stuck bouncing between steps 2 and 3. Each iteration adds more patches, more complexity — but the underlying problem remains.\u003c/p\u003e\n\u003ch3 id=\"you-may-need-a-redesign\"\u003eYou may need a redesign\u003c/h3\u003e\n\u003cp\u003eWhen you end up in that loop, you need to break out of it before it uses too much human or machine cognitive capacity.\nThe right move is often to step back and challenge the premise of what you’re trying to do. In my experience, getting caught in a loop like this is a indication that you’re fighting the system.\u003c/p\u003e","title":"Where AI - and people - can get trapped"},{"content":"Until recently, I mostly used AI agents as context-aware search tools or partners for writing and coding. While valuable, I struggled to see where else they fit into a practical workflow. I kept seeing claims that autonomous agents could \u0026ldquo;run your business,\u0026rdquo; yet rarely saw clear examples of what work they were actually doing. If a process could already be automated with standard scripts, why involve an AI agent at all?\nThe turning point came when I saw several people using LLMs to review their UniFi network configurations. They provided API credentials, and the agent returned practical network optimizations. I want to try this.\nI set up a .env file with the connection details for my UniFi controller and prompted the agent: “Analyze my UniFi setup using the credentials in the .env file.”\nIt worked remarkably well. The agent identified obsolete firewall rules to prune, flagged misconfigured VLANs, and recommended security toggles I had overlooked. I used to think AI agents were confined to raw text. They can evaluate nearly any environment they can reach—whether over HTTP, SSH, or direct API integrations. That shifted my mental model from \u0026ldquo;What can I ask an AI?\u0026rdquo; to \u0026ldquo;What systems can I safely grant access to?\u0026rdquo;\nI now have a clean, AI-generated inventory of my home network with concrete steps to improve it—and a broader view of what agents can do.\n","permalink":"https://www.arvesv.com/posts/2026/moreai/","summary":"\u003cp\u003eUntil recently, I mostly used AI agents as context-aware search tools or partners for writing and coding. While valuable,\nI struggled to see where else they fit into a practical workflow. I kept seeing claims that autonomous\nagents could \u0026ldquo;run your business,\u0026rdquo; yet rarely saw clear examples of what work they were actually doing.\nIf a process could already be automated with standard scripts, why involve an AI agent at all?\u003c/p\u003e","title":"Use AI Agents for More"},{"content":"I recently let AI review my Unifi setup. One consequence was that I tightened security on my main network by enforcing WPA3. For older devices I already had a separate IoT less secure network on 2.4 GHz and WPA2, so in theory this should have been a simple migration.\nIn practice, it wasn’t.\nSeveral IoT devices were still connected to the main network and didn’t support WPA3, so they had to be moved. Modern devices are easy to reconfigure because they use Bluetooth Low Energy (BLE) for provisioning. Only one of mine — the Withings Body Cardio — was new enough to support BLE but still old enough to lack WPA3. That device moved over without much trouble.\nThe rest used the old method: creating a temporary Wi‑Fi network you connect to during setup. My affected devices were an original Amazon Echo and some TP‑Link smart switches. I tried for a while to get the Echo working, but the app no longer supports it directly. I found workarounds online, but eventually decided it wasn’t worth the hassle.\nI did manage to reconfigure the TP‑Link switches, but it was still a pain. Recently I’ve been buying IKEA Grillplats smart plugs, and they connect instantly to Home Assistant using Matter over Thread. They’re cheap (99 NOK), use only 0.5 W when idle — about 70% less than the TP‑Link switches — and are easier to manage. So for convenience and lower power consumption, I ended up throwing away the working TP‑Link switches.\nIs there a lesson here?\nAny configuration change can have unforeseen consequences. Companion apps to smart devices may drop support for your model. Increasing security is rarely a bad idea, but it can accelerate obsolescence. It is better to do these changes on your own time, rather than as a result of external security exploits in the wild. Was it the right decision to follow the AI’s recommendation? I learned something, I improved my network security, and I simplified my setup. But I also threw away devices that still worked.\n","permalink":"https://www.arvesv.com/posts/2026/forcedobsolescence/","summary":"\u003cp\u003eI recently let \u003ca href=\"../moreai\"\u003eAI review my Unifi setup\u003c/a\u003e. One consequence was that I\ntightened security on my main network by enforcing WPA3. For older devices I already had\n\u003ca href=\"../../specialitnetwork\"\u003ea separate IoT\u003c/a\u003e less secure network on 2.4 GHz and WPA2, so in theory\nthis should have been a simple migration.\u003c/p\u003e\n\u003cp\u003eIn practice, it wasn’t.\u003c/p\u003e\n\u003cp\u003eSeveral IoT devices were still connected to the main network and didn’t support WPA3, so they had to be moved.\nModern devices are easy to reconfigure because they use Bluetooth Low Energy (BLE) for provisioning. Only\none of mine — the Withings Body Cardio — was new enough to support BLE but still old enough to lack WPA3.\nThat device moved over without much trouble.\u003c/p\u003e","title":"Forced Obsolescence?"},{"content":"I do think AI/LLMs have value, but not as much as the “AI enthusiast crowd” thinks. I like specific concrete examples of what AI can do. I think that treating AI as a pair programmer is one case where it provides value.\nI don’t have much experience with human pair programming, but I have seen that having multiple people design and review code as it is written can be fantastically productive — and sometimes not. If you are a single developer, you can use AI as your pair programmer by asking it to explain and review code, suggest alternatives, and look for ways to simplify. In this setup, you are still the developer: the AI may write code, but you still need to understand it. Used this way, AI challenges your ideas, helps you learn, and leads to better code.\nSpecifically, I have used the paid versions of Copilot CLI and Gemini CLI with frontier models and I have used Pi with open and local models. They work similarly for my pair-programming workflow. Smaller models may still be useful: they may have less capability and older training data, but they can still provide helpful suggestions. Even the smallest local model I have tried, Gemma 4 e2b, has (slowly) produced good suggestions on my non-GPU machine.\nIn short: I think AI pair programming improves code, and it creates a learning environment for the developer with good access to information and faster, better feedback. I think you should have AI work together with you when you write code you care about1.\nThis text has been pair-written with an AI.\u0026#160;\u0026#x21a9;\u0026#xfe0e;\n","permalink":"https://www.arvesv.com/posts/2026/ai_pair_programming/","summary":"\u003cp\u003eI do think AI/LLMs have value, but not as much as the “AI enthusiast crowd”\nthinks. I like specific concrete examples of what AI can do. I think that\ntreating AI as a pair programmer is one case where it provides value.\u003c/p\u003e\n\u003cp\u003eI don’t have much experience with human pair programming, but I have seen that\nhaving multiple people design and review code as it is written can be\nfantastically productive — and sometimes not. If you are a single developer,\nyou can use AI as your pair programmer by asking it to explain and review code,\nsuggest alternatives, and look for ways to simplify. In this setup, you are\nstill the developer: the AI may write code, but you still need to understand\nit. Used this way, AI challenges your ideas, helps you learn, and leads to\nbetter code.\u003c/p\u003e","title":"AI as a Pair Programmer"},{"content":"I think there is value in sharing what software you use—and, more importantly, how you use it. I often think that real life usage examples are easier to understand than presentations.\nThis is not sponsored \u0026ndash; these are simply my impressions of tools I use.\nTailscale – a better VPN, or a virtual intranet? My high-level explanation of Tailscale is that it is essentially a virtual intranet \u0026ndash; a tailnet \u0026ndash; that connects your devices no matter where they are. It also includes several useful services, and the free tier cover my use cases.\nThe tailnet is a subnet with a DNS name like somename.ts.net. The name is assigned to you, you cannot choose it. I would have liked a more personal name.\nHow I use Tailscale: VPN Simplified SSH access on mobile devices Hosting internal applications behind real HTTPS certificates. VPN for cloud machines My usage is connected to having a home lab. I have machines running Home Assistant, Proxmox and a one-node Kubernetes cluster. If you don’t have a home lab or machines you need to reach, then you don’t need Tailscale.\nA better VPN I have a home network and a router with good VPN support, but I mostly use Tailscale to reach my home machines with SSH, RDP or HTTP(S) and more.\nAnother use case for VPNs is accessing geo-restricted content when traveling abroad. Tailscale supports this through exit nodes, which routes all your traffic through a device on your home network. I use exit nodes only when I want to pretend to services that I am at home. I have a homelab running 24/7 so setting up an exit-node is doable. If you have an Apple TV, it can also act as an exit node, which is a neat power saving option.\nTailscale SSH Tailscale SSH takes over the SSH protocol on your tailnet and removes the need to manage SSH keys. The idea is simple: if you’re authenticated on your tailnet, you’re already trusted.\nFor traditional setups, I use 1Password to manage SSH keys on my computers. However, handling 1Password SSH keys on phones and tablets is much less convenient. Tailscale simplifies this by removing the need to have SSH keys on devices connected to your tailnet. It took a while before I understood how Tailscale SSH worked, but now I think it is my favorite feature that makes SSH key management simpler overall.\nTailscale Serve, Services and Funnel If you run your own applications, Tailscale makes it easy to expose them inside your tailnet. With Tailscale Serve, you can expose an app behind a clean HTTPS URL for internal use. This is possible in other ways, but Tailscale makes it easier.\nYou can use the Tailscale Kubernetes ingress controller to expose services to your tailnet \u0026ndash; I have not used this yet. For applications on the tailnet you can let Tailscale handle the authentication and access control.\nFunnel is a way to expose your services externally - I have not used that feature yet.\nVPN for cloud machines Cloud VPN solutions exist, but they often cost money or require more setup. Tailscale gives me secure access without exposing public IPs\nTailscale also has support for ephemeral nodes, give tailnet access to short lived machines. I use it to give GitHub Actions runners access to my machines.\nSummary It is rare to see a product that has so many services that I use. Tailscale solves real problems, and the free tier covers everything I need.\n","permalink":"https://www.arvesv.com/posts/2026/tailscale/","summary":"\u003cp\u003eI think there is value in sharing what software you use—and, more importantly, how you use it. I often\nthink that real life usage examples are easier to understand than presentations.\u003c/p\u003e\n\u003cp\u003eThis is not sponsored \u0026ndash; these are simply my impressions of tools I use.\u003c/p\u003e\n\u003ch3 id=\"tailscale--a-better-vpn-or-a-virtual-intranet\"\u003eTailscale – a better VPN, or a virtual intranet?\u003c/h3\u003e\n\u003cp\u003eMy high-level explanation of \u003ca href=\"https://tailscale.com/\"\u003eTailscale\u003c/a\u003e is that it is essentially a virtual intranet \u0026ndash; a tailnet \u0026ndash; that connects your devices\nno matter where they are. It also includes several useful services, and the free tier cover my use cases.\u003c/p\u003e","title":"Software I use - Tailscale"},{"content":"I write these summaries to structure my own thinking about AI/LLM-assisted development — and to have something to look back on (and probably cringe at) in the future.\nWhat has happened in the last 3–6 months\nAI/LLM prices are increasing Local and mobile models are surprisingly capable CLI-based AI tools continue to work extremely well AI/LLMs remain excellent for search, explanation, and learning A wave of buzzwords: skills, multi-agent, CLI, MCP, plan mode AI tools still make mistakes, especially in uncharted territory AI/LLM prices are going up GitHub Copilot is changing its pricing structure this month. Anthropic and others are restricting the use of fixed-price subscription keys with third‑party tools like OpenClaw. The trend is clear: pricing will increasingly reflect actual resource usage — and it will be higher.\nI don’t love higher prices, but I do like reducing waste. Aligning cost with compute usage is probably healthy for the ecosystem.\nAs a developer, I’ll likely adapt by reducing context size, giving clearer instructions, and working in smaller steps. This mirrors good engineering practice anyway: single responsibility, tighter focus, and more deliberate iteration.\nLocal and mobile models My phone has 12 GB RAM, and it can run several local models that are more capable than I expected. Smaller versions of Google Gemma 4 can write and explain code — not at frontier level, but good enough for React, F#, and general development tasks.\nOffline AI-assisted development now feels realistic. I may eventually invest in a GPU/AI machine, but I’ll wait for the hardware market to settle. I’m curious how the on‑prem model marketplace will evolve.\nCommand-line access to AI/LLMs It’s been a year since Claude Code launched, and a CLI category of developer tools is here. I’ve used Copilot CLI, Gemini CLI, and Pi.dev for tasks like:\nGenerating code that I review Explaining what code does Reviewing my code and suggesting improvements AI/LLMs are fantastic for experimentation, prototyping, and throwaway projects. Those have never been easier.\nFor real projects — where mistakes matter — progress is slower. I want code that humans can understand so we can debug it when things break. That requirement hasn’t changed.\nLLMs as search engines and learning tools AI/LLMs are excellent at explaining code, error messages, and unfamiliar concepts. If you’re stuck, asking an LLM usually gives a decent answer.\nCode review from an LLM can also be educational — but it’s easy to get trapped in satisfying a pedantic AI instead of delivering value to real users.\nAgents, multi-agent systems, MCP, CLI, OpenClaw, and other buzzwords There’s a lot of work happening around connecting AIs to tools. MCP was the first wave, but now models are also good at using command-line tools, especially when described in a “skill” file. I hope the CLI trend continues — it’s portable and works outside development contexts.\nI’ve experimented with OpenClaw as a personal assistant, but without connecting it to anything important. The potential is huge, but I haven’t yet found a practical, useful task to automate. The opportunity is definitely there.\nThere’s also a trend toward giving AIs “roles” (frontend, backend, QA, etc.) and having multiple agents collaborate. I’m not convinced this is the right direction. It feels like non‑developers trying to impose traditional team structures on AI systems without understanding their actual strengths.\nCan AI be trusted? Not yet. I’ve seen too many mistakes.\nCode is cheap. Battle‑tested code is still expensive.\nThe current value of AI/LLMs developer assistance Experiments, prototypes, and one-off projects are dramatically faster\nGeneral development is faster\nLeaning stuff have never been easier\nBattle-testing “real” code is still slow\nWe ship more — and we ship more bugs (Several tech influencers have noted the same trend)\n","permalink":"https://www.arvesv.com/posts/2026/moreaidevelopment/","summary":"\u003cp\u003eI write these summaries to structure my own thinking about AI/LLM-assisted development — and to have something to look back on (and probably cringe at) in the future.\u003c/p\u003e\n\u003cp\u003eWhat has happened in the last 3–6 months\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAI/LLM prices are increasing\u003c/li\u003e\n\u003cli\u003eLocal and mobile models are surprisingly capable\u003c/li\u003e\n\u003cli\u003eCLI-based AI tools continue to work extremely well\u003c/li\u003e\n\u003cli\u003eAI/LLMs remain excellent for search, explanation, and learning\u003c/li\u003e\n\u003cli\u003eA wave of buzzwords: skills, multi-agent, CLI, MCP, plan mode\u003c/li\u003e\n\u003cli\u003eAI tools still make mistakes, especially in uncharted territory\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"aillm-prices-are-going-up\"\u003eAI/LLM prices are going up\u003c/h3\u003e\n\u003cp\u003eGitHub Copilot is changing its pricing structure this month. Anthropic and others are restricting the use of fixed-price subscription keys with third‑party tools like OpenClaw. The trend is clear: pricing will increasingly reflect actual resource usage — and it will be higher.\u003c/p\u003e","title":"AI/LLM Assisted Development — May 2026 Edition"},{"content":"We all know that we should pin GitHub Actions that come from external repositories. If a repository is compromised, pinning to a specific commit SHA can prevent malicious code from accessing your secrets during a workflow run.\nWe also know that we rarely do this. My reasons were:\nIt adds extra work SHAs is hard to read and verify I assumed Dependabot did not work with SHA-pinned actions After reading this tweet (recommended reading), I learned that you can actually combine SHA pinning with Dependabot updates. The trick is to include the human‑readable version as a comment after the SHA.\nAt that point, the obvious question was: why not build a tool that formats this correctly? I had a few GitHub Copilot Premium requests left, so I let an agent generate it. The result lives in this repository and it’s published as my first npm package .\nI use it myself, and it works for me.\nNow the question is: Do you trust this random tool enough to run it?\n","permalink":"https://www.arvesv.com/posts/2026/githubshatool/","summary":"\u003cp\u003eWe all know that we \u003cem\u003eshould\u003c/em\u003e pin GitHub Actions that come from external repositories. If a repository is compromised, pinning to a specific commit SHA can prevent malicious code from accessing your secrets during a workflow run.\u003c/p\u003e\n\u003cp\u003eWe also know that we rarely do this. My reasons were:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIt adds extra work\u003c/li\u003e\n\u003cli\u003eSHAs is hard to read and verify\u003c/li\u003e\n\u003cli\u003eI assumed Dependabot did not work with SHA-pinned actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAfter reading this \u003ca href=\"https://x.com/acolombiadev/status/2038990002609078399\"\u003etweet\u003c/a\u003e (recommended reading), I learned that you can actually combine SHA pinning with Dependabot updates. The trick is to include the human‑readable version as a comment after the SHA.\u003c/p\u003e","title":"GitHub Actions SHA pinning tool"},{"content":"Like many IT people I do technial support for friends and family. When I see the same issue in multiple households, it’s time to find a permanent fix rather than a quick patch.\nThe Symptom A printer connected to the local network suddenly appears \u0026ldquo;offline\u0026rdquo; or \u0026ldquo;disconnected\u0026rdquo; in Windows. Reinstalling the printer fixes it temporarily, but this isn\u0026rsquo;t a sustainable solution for a household that just wants things to work.\nThe Root Cause When Windows automatically configures a printer, it often maps it directly to the printer’s current IP address. (A consequence of using WSD or mDNS when trying to find the printer). However, most home routers assign addresses dynamically via DHCP for IPv4 and IPv6 (or SLAAC for IPv6). Because it is standard behavior for these addresses to change periodically, Windows eventually loses the \u0026ldquo;path\u0026rdquo; to the device.\nThe Solution There are two ways to fix this:\nDHCP Reservation: Access the router settings to assign a static IP address to the printer\u0026rsquo;s MAC address. Use the printer’s DNS name: during the Windows printer setup instead of using the raw IP. Both methods are easy for technical people, but not so obvious for non‑technical users. When I set up printers for friends and family, I try to do both so the setup stays stable.\nSummary If your printer keeps \u0026ldquo;disappearing\u0026rdquo;, it’s almost always because its IP address changed. Give it a stable identity — either through DHCP reservation or DNS — and the ghost printer problem goes away.\n","permalink":"https://www.arvesv.com/posts/2026/printconfig/","summary":"\u003cp\u003eLike many IT people I do technial support for friends and family. When I see the same issue in multiple households,\nit’s time to find a permanent fix rather than a quick patch.\u003c/p\u003e\n\u003ch2 id=\"the-symptom\"\u003eThe Symptom\u003c/h2\u003e\n\u003cp\u003eA printer connected to the local network suddenly appears \u0026ldquo;offline\u0026rdquo; or \u0026ldquo;disconnected\u0026rdquo; in Windows. Reinstalling the printer fixes it temporarily, but this isn\u0026rsquo;t a sustainable solution for a household that just wants things to work.\u003c/p\u003e","title":"Solving the \"Ghost\" Printer: Why Your Network Printer Keeps Disconnecting"},{"content":"Microsoft regularly asks me to renew my Azure certifications. To do that, I have to answer multiple choice questions about specific Azure services. In most cases an AI/LLM would answer those questions better than I would.\nIn real projects, I look up details when I need them — networking quirks, Azure Container Instances behavior, subnet rules. But certification expect you to memorize these things, even though day‑to‑day work rarely requires it.\nSo if an LLM can perform the task better than me, shouldn’t the LLM just do it? No — because the purpose of certifications isn’t the task itself. It’s to provide a standardized way to document competence, even if the measurement is not fully alinged with real‑world needs.\nAnd while studying for certifications might sometimes be wasteful, every now and then you get a real breakthrough in understanding. And that is what makes you a better developer.\nThe system isn’t perfect. We waste time learning things we don\u0026rsquo;t need. But certifications still serve a function: they give employers and developers a baseline for skills, and a way to verify that someone has at least touched the relevant technologies.\nImperfect? Yes.\nObsolete? Not yet.\n","permalink":"https://www.arvesv.com/posts/2026/developercertifications/","summary":"\u003cp\u003eMicrosoft regularly asks me to renew \u003ca href=\"https://learn.microsoft.com/en-gb/users/arvesv/transcript/73n8zclm50pwjp1\"\u003emy Azure certifications\u003c/a\u003e.\nTo do that, I have to answer multiple choice questions about specific Azure services. In most cases an AI/LLM would answer those questions\nbetter than I would.\u003c/p\u003e\n\u003cp\u003eIn real projects, I look up details when I need them — networking quirks, Azure Container Instances behavior, subnet rules. But certification\nexpect you to memorize these things, even though day‑to‑day work rarely requires it.\u003c/p\u003e","title":"Are developer certifications still relevant if you have AI/LLM"},{"content":"I watched DHH\u0026rsquo;s demo of the Once deployment tool and where he vibe coded a demo app, and I figured I should try to do the same. Three hours and roughly twenty prompts later, I had a publicly available web app up and running.\nIt is written in ASP.NET, has database access, schema migrations, zero-downtime updates, social login and a semi-generic system for reporting. It works \u0026ndash; and I didn’t write or modify a single line of code myself. The AI/LLM coding capabilities impressed me. I could have built the same thing without AI, but it would have taken far longer.\nMy role was configuring the environment in Once, GitHub, and Google Cloud, then telling Gemini CLI to fix bugs or add features. As a developer, I understand how the pieces fit together, and I think that is important. I suspect a non‑developer would struggle to replicate the process.\nReviewing the generated code, there were a few things I would have done differently:\nIt committed binary objects files to Git, before it fixed the gitignore file Lack of structure - all is lumped together in a single project Code is repeated - I would have centralized date formatting, and table layouts in generic functions. All the above is to make the code easier to understand for me, not for the compiler or the LLM/AI. Do I still need to care about that if the LLM/AI creates all the code? At this point in time,I think the answer is yes. When things fail in strange ways the AI may not be able to help you, and the easier the code is to understand, the easier it is to fix.\nDoes AI make me a faster developer. Yes, for small project - small is defined as \u0026ldquo;fits in the LLM context window\u0026rdquo;. I do not want to develop without it.\nNext step: let\u0026rsquo;s see if I can prompt the LLM/AI to structure the code in a way I find more readable.\n","permalink":"https://www.arvesv.com/posts/2026/vibecoding/","summary":"\u003cp\u003eI watched DHH\u0026rsquo;s demo of the \u003ca href=\"https://www.youtube.com/watch?v=yZankuDQQmw\"\u003eOnce\u003c/a\u003e deployment tool and where he vibe coded a demo app, and I figured I should try to do the same. Three hours and roughly twenty prompts later, I had a publicly available web app up and running.\u003c/p\u003e\n\u003cp\u003eIt is written in ASP.NET, has database access, schema migrations,\nzero-downtime updates, social login and a semi-generic system for reporting. It works \u0026ndash; and I didn’t write or modify a single line of code myself. The AI/LLM coding capabilities impressed me.  I could have built the same thing without AI, but it would have taken far longer.\u003c/p\u003e","title":"Another Experience with AI Coding Assistants"},{"content":" I often find that you need to use a product for a while before you understand its “true purpose.” Reading about it only gets you so far. The real use case tends to reveal itself after some time in the real world.\nThis is my experices with FIDO2 security keys.\nWhat a FIDO2 security key actually is Before buying my first keys — a YubiKey and a Google Titan — I hadn’t done much research. I just knew that some of the “cool kids” used them to protect their accounts.\nA FIDO2 security key is essentially a passwordless authenticator. It stores a private cryptographic key that cannot be extracted. When you log in, the service sends a challenge, and the key signs it. This proves that you physically possess the key. No password is involved, so there’s nothing to steal or reuse. Phishing becomes difficult.\nTo use the key, you connect it via USB or tap it using NFC on mobile devices. You also unlock it with a PIN, which is required before the key can sign anything.\nIn many ways, a FIDO2 key behaves like a physical key:\nIt cannot be stolen over the internet. It can be lost or stolen in the real world. Why you may not need a security key Passkeys offer the same passwordless model, but the private key is stored on your device (phone or computer) and protected by biometrics or a device PIN. For most people, passkeys are equally secure and easier (not nessecarily easy) to use than a physical key.\nSecurity keys also come with a practical downside. They are protected by a PIN and a PUK, similar to a SIM card, and enter the wrong PIN/PUK too many times and the key wipes itself. It has happened to me a few times, which means I don’t fully trust them to always work.\nBecause of this, I’m not ready to replace all my existing authentication methods with a security key. And since the password still exists as a fallback, phishing isn’t eliminated entirely.\nWhen is a FIDO2 security key a good idea? There are still situations where a hardware key makes sense:\nPasswordless login on shared or untrusted devices, where you can’t install a passkey - this has not happened to me yet, but I still carry a Google Titan on my keychain. A backup authentication method if you lose your phone with all your other factors - please review how you access your account in case you loose your phone Work requirements, especially in high‑security environments. Learning and experimenting with FIDO2 security keys If any of these use cases resonate with you, a security key is worth buying. But for most people, passkeys alone are probably enough.\n","permalink":"https://www.arvesv.com/posts/2026/fido2security/","summary":"\u003cp\u003e\u003cimg alt=\"FIDO2 Security Key\" loading=\"lazy\" src=\"/images/IMG_0852.JPG\"\u003e\nI often find that you need to use a product for a while before you understand its “true purpose.” Reading about it only gets you so far. The real use case tends to\nreveal itself after some time in the real world.\u003c/p\u003e\n\u003cp\u003eThis is my experices with FIDO2 security keys.\u003c/p\u003e\n\u003ch3 id=\"what-a-fido2-security-key-actually-is\"\u003eWhat a FIDO2 security key actually is\u003c/h3\u003e\n\u003cp\u003eBefore buying my first keys — a YubiKey and a Google Titan — I hadn’t done much research. I just knew that some of the “cool kids” used them to protect their accounts.\u003c/p\u003e","title":"The true purpose of a FIDO2 security key"},{"content":"There are many ways to host web applications. You can run them it in the cluod or on-premises, using everything from “copy some PHP files into a folder” to full container orchestration on Kubernetes — and everything in between.\nMy Requirements I optimize for deployments with:\nZero downtime — users shouldn’t get kicked out during updates. This means the application must be stateless, with all state stored externally. (Also useful when I inevitably get millions of users 😊) Proper HTTPS Low operating cost Fast and easy to updates Your requirements may be different, but mine are tuned for a homelab software developer who deploys often to a professional‑looking “test environment.” Updates should be simple, quick, and not disrupt anyone using the app.\nThe Small Computer in My Homelab In my homelab I run an Intel N150‑based NUC with 16 GB RAM and an NVMe SSD. The CPU is a bit slow, but it’s very power‑efficient — around 7 W idle, which is roughly 100 NOK / $10 per year to run 24×7. The SSD keeps the database snappy; operations on a million‑row table take about a second.\nThe machine runs Ubuntu Server, and hosts:\nDocker Nginx Proxy Manager Various databases like postgres, valkey and more \u0026ldquo;Stable\u0026rdquo; web apps like Immich MicroK8S Kubernetes registery Web applications under active development And other software like [Tailscale], GitHub Actions agent, When deploying a new service, I typically:\nPackage the web app in a container Create Docker Compose files for databases and supporting services Push the container image to the local Kubernetes registry Create a Kubernetes deployment and expose it as a NodePort Add a reverse‑proxy forwarder for the desired URL To update an app I need to\nRebuild and push the container Run database migrations if needed (not often) kubectl restart deployment \u0026hellip; A full update takes about 45 seconds when no migration is required, and the whole process is easily scriptable.\nQuestions Why not use cloud options like Google Cloud Run or Azure Container Apps? These services are great — especially Google’s, which can be nearly free. Azure’s offering is less attractive because you often need a paid Azure Container Registry. But the real issue is databases: managed cloud databases are expensive.\nCould this be run on a VM in the cloud? Yes, I have run this setup on the cheapest Hetzner VM, and it works great. I have Ansible scripts that sets it up in minutes.\nCould I use Debian instead of Ubuntu, or K3s instead of MicroK8s? Yes. I’ve tried both, and they worked perfectly.\nCould I use a Raspberry Pi instead of an Intel N150 based machine? Maybe. A Pi is slower, but it should work. Use an SSD and make sure you have enough RAM. Both Docker and K3S runs on a Pi.\n","permalink":"https://www.arvesv.com/posts/2026/hostingwebapps/","summary":"\u003cp\u003eThere are \u003cem\u003emany\u003c/em\u003e  ways to host web applications. You can run them it in the cluod or on-premises, using everything from “copy some PHP files into a folder” to full container orchestration on Kubernetes — and everything in between.\u003c/p\u003e\n\u003ch3 id=\"my-requirements\"\u003eMy Requirements\u003c/h3\u003e\n\u003cp\u003eI optimize for deployments with:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eZero downtime — users shouldn’t get kicked out during updates. This means the application must be stateless, with all state stored externally.\n(Also useful when I inevitably get millions of users 😊)\u003c/li\u003e\n\u003cli\u003eProper HTTPS\u003c/li\u003e\n\u003cli\u003eLow operating cost\u003c/li\u003e\n\u003cli\u003eFast and easy to updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eYour requirements may be different, but mine are tuned for a homelab software developer who deploys often to a professional‑looking “test environment.”\nUpdates should be simple, quick, and not disrupt anyone using the app.\u003c/p\u003e","title":"Web Application Hosting - My Way"},{"content":"After more than a decade of running Synology NAS devices in my home, I\u0026rsquo;m making a significant change to my setup. This post explores why and what I am will be doing.\nWhy Have a NAS? I\u0026rsquo;ve had multiple Network Attached Storage (NAS) devices in my home over the last 15 years - Synology boxes for more than 10 years. A NAS can serve many needs like:\nIt can replace OneDrive, DropBox, iCloud, Google Drive. It can host your media Automatic backups of computers Depending on the NAS, the more capable Synology supports lots of applications for domain management, office work, and run Docker containers. It can provide disks to other machines using iSCSI and more that I have not explored.\nThe Problems The maximum capacity I had was 15 TB, and that is too much - you become a data hoarder. Just dump everything on the NAS and don\u0026rsquo;t think about the structure. My problems include:\nFinding stuff is difficult without structure. I did not have a good structure Many spinning disks running at 24x7 is visible on the electricity bill As the Synology runs lots of services, you become afraid of touching it in case something stopped working. This is not good for potential disaster recovery Backup of the Synology is difficult The New Plan The 10 year old Synology box will no longer get software updates from Synology - I am not complaining as 10 years of updates is very good. But it\u0026rsquo;s an opportunity for me to change things. The plan is:\nAll services (databases, applications) will run from a power efficient NUC with an SSD. Apps and services will run from Proxmox, Docker, k3s. I will also have a backup NUC where I can experiment - and test backup and recovery scenarios Maybe attach an external USB drive that hosts the photos and media for Immich, Jellyfin, Calibre. This should hopefully be in suspended mode when not used (i.e. most of the time) I will take away the extension cabinet on the NAS and only use it as a fileshare with Wake On Lan Expected Benefits I hope this will give me better structure on my files, lower electricity bill, faster databases and applications.\n","permalink":"https://www.arvesv.com/posts/doyouneedanas/","summary":"\u003cp\u003eAfter more than a decade of running Synology NAS devices in my home, I\u0026rsquo;m making a significant change to my setup. This post explores why and what I am will be doing.\u003c/p\u003e\n\u003ch2 id=\"why-have-a-nas\"\u003eWhy Have a NAS?\u003c/h2\u003e\n\u003cp\u003eI\u0026rsquo;ve had multiple Network Attached Storage (NAS) devices in my home over the last 15 years - Synology boxes for more than 10 years. A NAS can serve many needs like:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIt can replace OneDrive, DropBox, iCloud, Google Drive.\u003c/li\u003e\n\u003cli\u003eIt can host your media\u003c/li\u003e\n\u003cli\u003eAutomatic backups of computers\u003c/li\u003e\n\u003cli\u003eDepending on the NAS, the more capable Synology supports lots of applications for domain management, office work, and run Docker containers.\u003c/li\u003e\n\u003cli\u003eIt can provide disks to other machines using iSCSI\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eand more that I have not explored.\u003c/p\u003e","title":"Network Attached Storage: Replacing the Synology box"},{"content":"It started when I bought a new IKEA smart device that supports Matter over Threads. Getting this up and running with my Home Assistant running on a Proxmox server should be easy, right? That was the original idea.\nI ended up doing the following.\nBuy new anteanna for Threads and try to access it from a VM on Proxmox. I should probably upgrade Proxmox 8 to 9 before adding the anthenna? I should do a backup of all VMs on Proxmox (I am very glad I did this) Start upgrade - it fails. It does not boot - probably caused by a combination of secure boot and unsigned drivers that the proxmox installer warned me about. I don\u0026rsquo;t try to troubleshoot - I reinstall Proxmox 9 from scratch. This is actually a good thing, I got a few more settings proxmox settings right this time (better disk/filesystem) Move the Proxtmox server - if I clean up the server, why not improve its location as well. Restore VMs - this works very well. Add antenna, try to pair the IKEA device - It fails Current status Does the IKEA device work - Not yet\nThe Proxmox server is quicker and up to date\nBackup routines for Proxmox VMs are tested and works\nCleaned up the the real world location of the Proxmox server\nLooking at comments from the Home Assistant community, I am not the only one with this problem and I think the community will solve the issue in the future. The problem is not something I could fix alone.\nIn some ways this project was a failure, I did not reach the orginal goal (yet). The goal was unrealistic (for now), but the project improved my homelab in significant ways. I am happy with the preliminary results.\nUpdate March 1 - It works I got a new update from Home Assistant so I thought I should try the IKEA/Matter over Thread devices again. This time I got an error message. Googeling this message, said something about IPv6. Enabling IPv6 on Home Assistant fixed the issue.\n","permalink":"https://www.arvesv.com/posts/homeitadmin/","summary":"\u003cp\u003eIt  started when I bought a new IKEA smart device that supports Matter over Threads. Getting this up and running with my\nHome Assistant running on a Proxmox server should be easy, right? That was the original idea.\u003c/p\u003e\n\u003cp\u003eI ended up doing the following.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eBuy new anteanna for Threads and try to access it from a VM on Proxmox.\u003c/li\u003e\n\u003cli\u003eI should probably upgrade Proxmox 8 to 9 before adding the anthenna?\u003c/li\u003e\n\u003cli\u003eI should do a backup of all VMs on Proxmox  (I am very glad I did this)\u003c/li\u003e\n\u003cli\u003eStart upgrade - it fails. It does not boot - probably caused by a combination of secure boot and unsigned drivers that the proxmox installer warned me about.\nI don\u0026rsquo;t try to troubleshoot - I reinstall Proxmox 9 from scratch. This is actually a good thing, I got a few more settings proxmox settings right this time (better disk/filesystem)\u003c/li\u003e\n\u003cli\u003eMove the Proxtmox server - if I clean up the server, why not improve its location as well.\u003c/li\u003e\n\u003cli\u003eRestore VMs - this works very well.\u003c/li\u003e\n\u003cli\u003eAdd antenna, try to pair the IKEA device - It fails\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch1 id=\"current-status\"\u003eCurrent status\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDoes the IKEA device work - Not yet\u003c/p\u003e","title":"Home IT - extra work"},{"content":"Smart Home stuff is complex. This is a few things I learned the hard way.\nGrouping devices and group names There are two types of smart devices. There are things like Alexa, Siri or Google Home that talk to humans. And there are things/apps/services that controls devices, like Hue, Netatmo and Roborock. Almost all of them can manage groups of devices. You want to the human facing devices to own groups with simple easy names.\nPhilips Hue can for example define a group \u0026ldquo;living room\u0026rdquo; for the lights in the living room. But this is not a good idea if you connect Hue to Alexa and have other things in your living room. Alexa can not create or manage the group \u0026ldquo;living room\u0026rdquo; if it is created in Hue.\nMy policy is that the human facing devices (Alexa, Google Home, Home Assistant) can use generic terms like \u0026ldquo;living room\u0026rdquo;. If Hue need a group for the lights in the living room, then that group can be called \u0026ldquo;Hue - Living Room\u0026rdquo;. The Alexa group \u0026ldquo;living room\u0026rdquo; can include the group \u0026ldquo;hue - living room\u0026rdquo; and potentially other things.\nCommunication between devices is difficult - Just a fact of life Many new devices require internet services to work. Some devices don’t integrate, like my tube leds and Home Assistant. They both talk to SmartThings so I use that as a middleman. But this is a complex solution.\nAccept that running a Smart Home will not always work, and it will require time.\nHubs are not equal In most cases you need a Hub to manage your stuff. A Hub works best (more features/easier setup) within it’s own ecosystem. The new standards thread/matter aims to improve this, but the world is not there yet. An example of this is that Home Assistant can only turn on or off my bathroom light, but the dedicated app can adjust the dimming as well.\nHome Assistant I am running Home Assistant as it is open source and hackable. I don\u0026rsquo;t know how well other newer Hub\u0026rsquo;s work. I also have Alexa and Google Home and Siri for voice commands.\nIn Short: For learning and customization: Go for it (expect to dedicate time). For maximum reliability/simplicity: Try to stay within one ecosystem. Or wait for future improvements ","permalink":"https://www.arvesv.com/posts/smarthomestuff/","summary":"\u003cp\u003eSmart Home stuff is complex. This is a few things I learned the hard way.\u003c/p\u003e\n\u003ch2 id=\"grouping-devices-and-group-names\"\u003eGrouping devices and group names\u003c/h2\u003e\n\u003cp\u003eThere are two types of smart devices. There are things like Alexa, Siri or Google Home that talk to humans. And there are things/apps/services that controls devices, like Hue, Netatmo and Roborock. Almost all of them can manage groups of devices. You want to the human facing devices to own groups with simple easy names.\u003c/p\u003e","title":"Smart Home tips/frustrations"},{"content":"No,it is not to isolate malicious devices! It is because you have lots of \u0026ldquo;old\u0026rdquo; device that does not handle and will not connect to your main combined WiFi 5/6 network. You need a 2.4 Ghz network. I have only managed to get a stable connection to Raspbery Pi Zero on the 2.4 Ghz only network.\n","permalink":"https://www.arvesv.com/posts/specialitnetwork/","summary":"\u003cp\u003eNo,it is not to isolate malicious devices! It is because you have lots of \u0026ldquo;old\u0026rdquo; device that does not handle and will not connect to your main combined WiFi 5/6 network. You need a 2.4 Ghz network. I have only managed to get a stable connection to Raspbery Pi Zero on the 2.4 Ghz only network.\u003c/p\u003e","title":"You need a separate IoT network"},{"content":"I’ve built a web application—and thet need a home. What should I deploy it to? There are many platforms to choose from, I decided to turn the deployment decision into a mini project with three phases:\nDesign the ideal platform and deployment process Implement the design Learn from the experience I’m usually skeptical of too much upfront planning—real-world constraints tend to surprise you—but I’m giving it a shot.\n🧾 Requirements Here’s what I need from the platform:\nMust support a web server and a database Must allow zero-downtime deployments Must be internet-accessible with HTTPS Occasional downtime for patching is acceptable Downtime due to hardware failure is fine—recovery should be reasonable Monthly operating cost should be ≤ 6€ (e.g., Hetzner’s cheapest VPS) Fast deployment turnaround—code changes should go live quickly Code is hosted on GitHub. Deoploys should be possible both from GitHub actions and the local developer machine This is a learning project, optimized for fast iteration and feedback 🧱 Design Choices ✅ Containers Containers offer consistent runtimes and portability. There is no reason to choose anything else.\n☁️ Scale-to-Zero Container Runtimes Platforms like Fly.io, Google Cloud Run, and Azure Container Apps let you run containers that can scale to zero when idle. They also handle updates, load balancing, and HTTPS certificates.\nPros:\nEasy deployment Managed infrastructure HTTPS out of the box Cons:\nCold starts can be slow Longer deployment turnaround Higher cost if always running These platforms are excellent—but for this project, I think there’s a better alternative.\nFly.io deserves a shoutout: it’s affordable and can build your container directly, eliminating the need for a separate registry.\nDatabases in the Cloud? Hosting web apps in the cloud is cheap. Hosting databases? Not so much.\nManaged databases come with replicas, backups, and high availability—and those features cost money. I don’t need them (yet).\nServerless databases exist, but startup latency is a concern.\n🧑‍🔧 Self-Hosting on a VPS The downside of self-hosting? You manage everything.\nThe upside? A 5€ Hetzner VPS (4GB RAM, 40GB SSD) or even my Intel N150 mini machine can host multiple apps and databases.\nThere are tools that help you manage web apps on your own infrastructure:\nKamal Deploy Uncloud Local Docker + custom scripts You learn a lot by manually setting up an reverse proxy and running containers yourself.\nKamal Deploy works well, though complexity is growing as it adds features. I haven’t tried Uncloud yet, but it looks promising.\nKubernetes Given my requirements, I believe a small server where I install a one node \u0026ldquo;mini\u0026rdquo; Kubernetes is the best option. A machine with 4 GB of RAM can run microk8s or k3s, with enough power to host multiple apps and databases. I can run a local registry can even run Valkey if needed.\nKubernetes is made for running web apps with, it handles updates without downtime I can run a databases, redis etc. I will learn a lot of Kubernetes With a local build/registry on the Kubernetes machine the turnaround time (for code change to live) will be way faster than any other container based deployment. It will be a lot of work, but a lot of learing. Is this the best option for you? It depends.\nI hope to revist this in the future with some benchmark numbers, some experiences richer.\n","permalink":"https://www.arvesv.com/posts/deploywebapp/","summary":"Exploring deployment options for a web app with a focus on cost, speed, and learning.","title":"Where Should You Run Your Web Application? It Depends."},{"content":"I use GitHub Copilot (Pro) and Google Gemini CLI1. Do coding assistants help me develop faster, improve code, or cause other effects?\nDisclaimer: The way we use AI assisted development will continue to evolve and these are my thoughts and experiences with coding assistants as of November 2025. I expect to look back on this post and feel embarrassed - but that’s part of the journey.\nI use AI coding assistants in different ways, each with its own impact.\nUse of AI to explain code or concepts This is one of the features I use most. AI explanations make it much easier to understand unfamiliar code. I still use Google Search and Stack Overflow, but less frequently now.\nDoes this make me develop faster? Maybe Does this make the code better? Probably not Do I learn new things? Yes Use of AI/LLM to review code AI reviews usually surface things I have missed. The feedback is often useful but not always correct; it can miss context or suggest brittle fixes.\nDoes this make me develop faster? No (reviews still take time) Does this make the code better? Yes Do I learn new things? Yes Use of AI/LLM for small code and autocompletion This was the original GitHub Copilot use case: better IntelliSense. It works well but the time saved is hard to quantify.\nDoes this make me develop faster? Probably Does this make the code better? No Do I learn new things? No Use of coding agents on an existing, long-lived project I’m cautious when an agent touches a mature codebase. I have seen it introduce issues like:\nAdd outdated dependencies (tools, NuGet/NPM packages, GitHub Actions) Placing files in the wrong folder when updating a JavaScript library Generates code that is harder to read and maintain Custom instructions can help, but at the moment I let the agent do work in a separate folder or workspace. If I like the output, I manually type or paste the changes — there\u0026rsquo;s no better review than retyping the code yourself. See also David Heinemeier Hansson’s perspective on AI-assisted programming\nDoes this make me develop faster? Maybe Does this make the code better? Maybe Do I learn more? Maybe Coding agents for Greenfield and Disposable Projects Agents are impressive at bootstrapping new apps and prototypes. They excel at throwaway or single-use projects: one-off data extraction scripts, quick prototypes.\nWill this make development faster: Yes (for greenfield/disposable projects) Does this make the code better: Probably not, but code quality is often secondary for throwaway work. The important stuff is does it work. Do I learn more: Maybe My current take on AI AI-assisted coding is good tool for a developer. It’s a great sparring partner for learning, trying new approaches, getting inspiration or reviewing your code.\nFor \u0026ldquo;one off\u0026rdquo; projects \u0026ldquo;vibe\u0026rdquo; coding really works, as long as you can verify that the results are correct.\nHowever, when agents modify established codebases they can make mistakes, and that makes me not trust them. I often end up typing the code myself, inspired by the AI-generated suggestions. With better models, improved prompting, domain-specific instruction files etc I might start to trust the AI, but not now.\n(This post has been reviewed by AI 🙂)\nThis has a generous free quota\u0026#160;\u0026#x21a9;\u0026#xfe0e;\n","permalink":"https://www.arvesv.com/posts/ai-assisted-development/","summary":"\u003cp\u003eI use \u003ca href=\"https://github.com/features/copilot/plans\"\u003eGitHub Copilot (Pro)\u003c/a\u003e and \u003ca href=\"https://geminicli.com\"\u003eGoogle Gemini CLI\u003c/a\u003e\u003csup id=\"fnref:1\"\u003e\u003ca href=\"#fn:1\" class=\"footnote-ref\" role=\"doc-noteref\"\u003e1\u003c/a\u003e\u003c/sup\u003e.\nDo coding assistants help me develop faster, improve code, or cause other effects?\u003c/p\u003e\n\u003cp\u003eDisclaimer: The way we use AI assisted development will continue to evolve and these are my thoughts and experiences with coding assistants as of November 2025.\nI expect to look back on this post and feel embarrassed - but that’s part of the journey.\u003c/p\u003e\n\u003cp\u003eI use AI coding assistants in different ways, each with its own impact.\u003c/p\u003e","title":"My Experience with AI Coding Assistants"},{"content":"This is how I manage my SSH private keys. I think this is a good balance between security and usability, but this setup is for me. Your situation may be different so read this as potential inspiration, not as a blueprint.\nI have a \u0026ldquo;master\u0026rdquo; key that gives access to all the clouds, linux machines and Git/GitHub. This gives lots of access so it must be protected. But I also use it often, so it must be easy to use. The way I solve this is using 1Password. It allows the keys to be used on multiple devices while keeping them secure through biometric authentication.\nOn some devices like phone and tablets I can\u0026rsquo;t use 1Password for SSH management. But the shell I use, blink.sh on iPad/iPhone, supports SSH keys in the secure enclave. And these keys cannot be stolen unless the whole device gets taken so I think this is quite secure.\nThis 1Password SSH key is rotated regularly, and I have a script that updates my machines and the keys in Google Cloud. This automation ensures that key rotation doesn\u0026rsquo;t become a manual burden while maintaining good security practices.\nWorkarounds for WSL I work on a Windows machine, and use the Windows Subsystem for Linux. This means that the SSH keys must also be available from WSL. There are ways to work around this, but they all have issues.\nInstall the 1password CLI on WSL and download the keys. I don\u0026rsquo;t like the security implications of this as the keys will be in clear text on the disk, and the biometric access is not used. Call the windows \u0026lsquo;ssh.exe\u0026rsquo; insted of the Unix ssh. This is the solution suggested from 1password. While this works for basic SSH and Git, it does not work for Ansible. Forward the Windows SSH agent pipeline to a Linux socket. This would enable biometic access (it is the Windows 1password app that owns SSH agent), it it difficult to setup and fails easily. You can use SSH agent forwarding (-A flag to SSH). This means that any keys available on the client machine, is also available on the machine you log into. The thing it requires is that you first SSH into WSL, and you can do this by installing the openssh server on WSL. That maked the keys available in WSL if you SSH into WSL first. Management Strategy Primary Key: Stored in 1Password with biometric access Device-Specific Keys: Generated in secure enclaves for mobile devices Rotation: Automated script handles key updates across infrastructure Access Control: Single key provides access to all necessary resources This approach minimizes the number of keys to manage while maintaining security through secure storage and regular rotation.\n","permalink":"https://www.arvesv.com/posts/ssh-management/","summary":"\u003cp\u003eThis is how I manage my SSH private keys. I think this is a good balance between security and usability, but this setup is for me. Your situation may be different so read this as potential inspiration, not as a blueprint.\u003c/p\u003e\n\u003cp\u003eI have a \u0026ldquo;master\u0026rdquo; key that gives access to all the clouds, linux machines and Git/GitHub. This gives lots of access so it must be protected. But I also use it often, so it must be easy to use. The way I solve this is using 1Password. It allows the keys to be used on multiple devices while keeping them secure through biometric authentication.\u003c/p\u003e","title":"SSH Keys Management"},{"content":"A long time ago my employer needed to sign a shrink-wrapped software package using Authenticode. This was my first experience with code signing. Below I summarize what code signing is, why it matters, the 2023 HSM requirements, and practical options for signing in local and CI environments. I have used Azure Key Vault for HSM-backed signing.\nWhat is code signing and why use it? A digital signature is an encrypted checksum of a file. It can be verified with the public key to ensure the file was not modified after signing and that the signer controls the corresponding private key.\nWindows EXE files can be signed with Microsoft Authenticode. Java has a similar mechanism for JAR files. These specifications define which file parts are checksummed and where the signature and public key are stored.\nYou need a code signing certificate (public/private key pair). It can be self-signed for testing but for production you should get one from a trusted CA. Signed code provides more trust and a better user experience on platforms that surface signature information. Examples where signing matters:\nPowerShell defaults to blocking unsigned scripts; Excel (VBA) may block unsigned macros. Windows and macOS present friendlier warnings for signed downloads. Drivers for Windows require an Extended Validation (EV) code signing certificate. Signing lets you verify a file hasn’t changed since signing. Obtaining a certificate Historically, code signing private keys could be exported (e.g., PFX files) and shared. Starting in 2023, industry rules require private keys for standard code signing certificates to be stored in hardware certified to FIPS 140 Level 2, Common Criteria EAL4+, or equivalent. CAs will only issue certificates that are non-exportable and tied to supported HSMs or USB tokens. This restricts which CAs and HSMs you can use.\nThe HSM requirement makes theft and misuse of signing keys much harder.\nHow to sign on Windows with a local certificate On Windows the common tool is signtool.exe (part of the Windows SDK). Typical minimum options:\n/fd sha256 — set the file digest algorithm /a or /sha1 — /a auto-selects a certificate (works if you have a single cert); /sha1 \u0026lt;thumbprint\u0026gt; selects by thumbprint Example:\nsigntool /a /fd sha256 filetosign.exe Signtool supports other file types via SIPs (e.g., Office) and can be extended to use non-local certificates with custom providers, though that is more complex.\nTimestamping Certificates expire (commonly up to 3 years today). A signature without a timestamp becomes invalid when the signing certificate expires. Timestamping records when the file was signed using a trusted timestamp authority so the signature remains valid even after the certificate expires. Signtool uses /tr to specify a timestamp server.\nTimestamping can be slower and occasionally fails; if you sign many files, add verification and retry logic in your pipeline.\n2023 requirement: store private keys in an HSM Per vendor guidance (for example DigiCert), private keys for standard code signing must be stored in FIPS/EAL-certified hardware. That means certificates will often be issued onto:\nUSB tokens (e.g., YubiKey, SafeNet) that expose the key via drivers, or HSM appliances, or Cloud HSM-backed key stores. Each option has trade-offs.\nUSB tokens (YubiKey / SafeNet) Pros: Simple, meets the hardware requirement, gives strong physical protection. Cons: Requires drivers and a PIN prompt when accessing the key. Not practical for unattended build pipelines that must sign many files without manual PIN entry. Conclusion: USB tokens are not a good fit for automated CI/CD signing unless you accept insecure workarounds.\nHSM appliances Pros: Enterprise-grade hardware, strong isolation. Cons: Expensive (often many thousands of dollars) and operationally heavy. I have not tested appliance-based setups in CI. Cloud HSM / Key Vault (recommended) Cloud providers (Azure Key Vault, AWS KMS/CloudHSM, Google Cloud KMS) offer HSM-backed key storage and signing operations. This is usually far cheaper and easier to integrate with CI/CD than a physical appliance. Access is managed via the cloud provider’s IAM.\nI have used Azure Key Vault successfully. Azure pricing is modest (e.g., a small monthly fee plus a per-operation cost). Signtool can be made to use cloud key stores with additional tooling; a convenient option for Azure is AzureSignTool (github.com/vcsjones/AzureSignTool).\nSummary Code signing verifies origin and integrity and improves user trust. Since 2023, CA-issued code signing private keys must be stored in certified hardware (HSM/USB token/cloud HSM). USB tokens are secure but inconvenient for automated pipelines. HSM appliances are costly and operationally heavy. Cloud HSM/key vault services are a practical, cost-effective choice for CI/CD signing; Azure Key Vault + AzureSignTool is one working solution. References:\nAuthenticode: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/authenticode Signtool: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool DigiCert changes: https://knowledge.digicert.com/alerts/code-signing-changes-in-2023 AzureSignTool: https://github.com/vcsjones/AzureSignTool YubiKey: https://www.yubico.com/no/product/yubikey-5c-nfc/ SafeNet / Thales eToken: https://cpl.thalesgroup.com/access-management/authenticators/pki-usb-authentication/etoken-5110-usb-token Samsung key leak example: https://arstechnica.com/gadgets/2022/12/samsungs-android-app-signing-key-has-leaked-is-being-used-to-sign-malware/ ","permalink":"https://www.arvesv.com/posts/authenticode-signing/","summary":"\u003cp\u003eA long time ago my employer needed to sign a shrink-wrapped software package using Authenticode. This was my first experience with code signing. Below I summarize what code signing is, why it matters, the 2023 HSM requirements, and practical options for signing in local and CI environments. I have used Azure Key Vault for HSM-backed signing.\u003c/p\u003e\n\u003ch2 id=\"what-is-code-signing-and-why-use-it\"\u003eWhat is code signing and why use it?\u003c/h2\u003e\n\u003cp\u003eA digital signature is an encrypted checksum of a file. It can be verified with the public key to ensure the file was not modified after signing and that the signer controls the corresponding private key.\u003c/p\u003e","title":"Authenticode Signing"},{"content":"About Me Hello, I\u0026rsquo;m Arve Svendsen! Welcome to my internet page.\nWhat I Do Professional Background: Software developer and technology enthusiast Interests: Web development, automation, and emerging technologies Specialties: Full-stack development, DevOps, and system architecture About This Blog This is a place for me to share stuff and experiment.\nSocial links GitHub: github.com/arvesv X (Twitter): @arvesv LinkedIn: linkedin.com/in/arvesv ","permalink":"https://www.arvesv.com/about/","summary":"\u003ch1 id=\"about-me\"\u003eAbout Me\u003c/h1\u003e\n\u003cp\u003eHello, I\u0026rsquo;m \u003cstrong\u003eArve Svendsen\u003c/strong\u003e! Welcome to my internet page.\u003c/p\u003e\n\u003ch2 id=\"what-i-do\"\u003eWhat I Do\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eProfessional Background\u003c/strong\u003e: Software developer and technology enthusiast\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInterests\u003c/strong\u003e: Web development, automation, and emerging technologies\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSpecialties\u003c/strong\u003e: Full-stack development, DevOps, and system architecture\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"about-this-blog\"\u003eAbout This Blog\u003c/h2\u003e\n\u003cp\u003eThis is a place for me to share stuff and experiment.\u003c/p\u003e\n\u003ch2 id=\"social-links\"\u003eSocial links\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eGitHub\u003c/strong\u003e: \u003ca href=\"https://github.com/arvesv\"\u003egithub.com/arvesv\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eX (Twitter)\u003c/strong\u003e: \u003ca href=\"https://x.com/arvesv\"\u003e@arvesv\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLinkedIn\u003c/strong\u003e: \u003ca href=\"https://linkedin.com/in/arvesv\"\u003elinkedin.com/in/arvesv\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","title":"About"}]