Prairie Grade Systems

Finklestein Revisited

Sun, 12 Apr 2026 08:35:20 -0500

It’s been several months since I posted about Finkelstein’s Immaturity Model and I think it’s worth revisiting some of the generalizations I made at the time regarding the model’s take on “autoprogramming”."

What is true as of Spring 2026:

Bad product decisions lead to bad products
LLMs optimize local maxima
LLMs revert to the mean

What has changed since August 2025:

The bad products are especially beautiful and well-designed
I spend more time scrutinizing apps and systems and WAY less time scrutinizing code

I probably didn’t to scrutinize code in mid-2025, either, but to do so felt genuinely negligent, given the volume of very public bad outcomes being reported at the time.

Sun, 18 Jan 2026 11:33:38 -0600

Wed Jan 21 #

Loss Functions vs Confidence #

We’ve been running into issues trying to assess “accuracy” with things in the form of a confidence score. The issue is that the numbers wind up not making sense as a scalar.

For example:

We do OCR in a 2-phase process. We extract text from an image; this tends to accurately capture all of the text chunks. A low confidence here means we’re basically toast. The second step is just an LLM prompt to find certain pieces of data like item numbers. In one case, a particular type of barcode image was getting picked up as an item number, despite being a completely different type of identifier, often reporting high confidence.

Finkelstein's Immaturity Model

Wed, 20 Aug 2025 21:10:09 -0500

Only by a miracle can a Level -2 organisation produce any useable software. As Level -2 organisations rarely get beyond specification they pin their hopes on automatically generating a program from that specification.

Anthony Finkelstein, Software Process Immaturity Model

Finkelstein’s Immaturity Model

LLM’s are doing an impressive job of getting us from conversations to requirements to specifications to code, but when I look at that diagram, I have a visceral sense of what 2025’s Level -2 is.

Password Of The Day

Mon, 18 Aug 2025 10:11:17 -0500

So you’re telling me you wrote an unsalted, date-seeded, unsigned, deterministic password generator?

In the initial interview, the client expressed a desire to modernize their security. They wanted someone with multiple iterations of implementing other types of authentication. MFA, passwordless device flows, SSO. I told them I was pretty well versed in SAML and OIDC, and had some hard-earned experience doing multi-generational technology leaps, and thought I might be well suited for the task. I even worried that I had insulted the manager’s competence by claiming Basic Auth is (still) a useful stepping stone in some scenarios.

People CMM is a Management Consulting Wet Dream

Sun, 17 Aug 2025 09:53:23 -0500

When I first heard that the SEI had a lesser-known counterpart to its Capability Maturity Model (CMM) called People CMM (P-CMM), I had to DuckDuckGo if it was a joke.

It isn’t, except in the same sense that CMM-I is a kind of cruel joke.

P-CMM uses the same 5 levels as the SEI CMM to “systematically transform chaotic workforce practices into strategic capability development” across 22 process area. Without any sense of irony, the process professes to “address critical people issues in your organization”, then immediately dropping the word “people” in favor of the terms “workforce” and “resource.”

Type 1 and Type 2 Consulting

Sat, 16 Aug 2025 07:29:44 -0500

I sat down to lambaste what I view as the outsourcing of thought by management teams, but then I got to thinking about NIHS (Not Invented Here Syndrome) in some organizations, and the (often concurrent) complete outsourcing of thought to consultants and hype mongers.

Where is the balance of internal capability and external expertise?

I think the scales get tipped one way or another by motivation. I’ve been brought onboard for two broad categories of needs. I don’t have names for these two groups, other than to say there are two of them.

Type 1 #

Temporarily fill capability gaps (development, security, infrastructure)
Provide an unbiased opinion (is our approach viable?)
Boost horsepower (new products and markets)
Train and mentor
App Rationalization (we have all these systems, they overlap in some places but fail to integrate in others)

Type 2 #

Provide plausible deniability (the consultants told us to do this thing we were probably going to do anyways)
Win arguments (appeals to authority)
Compliance or regulatory requirements (ISO 9001, SOC 2 Type 2, privacy laws, HIPAA)
Boost horsepower (tech debt logjams)
Keep the ship afloat (SRE, SysOps, Duct Tape)
Implement a hyped technology for marketing or shareholders (crypto, AI)
Fix outsourcing disasters (we found a company that would provide us developers for $40/hour, but communication has been bad and the system is faulty)

Protect Others' Self Esteem

Fri, 15 Aug 2025 13:48:25 -0500

Nobody ever calls me because things are going well.

When the Outsiders arrive (consultant, contractor, new guy, whatever), they will be full of “best practices” and experiences codged from other, more fanciful clients. They look around, horrified, because they have a keen eye for the dysfunctional. I’ll be the first to admit, I see bad security, architecture, process, design, whatever it is - and my first reaction is an emotional one. Usually angry, usually self-righteous.

Solution Late

Thu, 14 Aug 2025 20:31:44 -0500

There is nothing quite so useless as doing with great efficiency something that should not be done at all — Peter Drucker

Despite what the godfather of management says, what the engineers want to talk about is:

Programming languages
AI
Cloud providers
UI Libraries
APIs
DevOps
Architecture patterns
Databases

What the customer doesn’t care about: (see above).

The things in the list don’t even matter! They’re fungible. Given three mainstream choices for programming language, AI, cloud, etc., literally any combination of them is sufficient.

The NSO (No Sign On) Auth Scheme

Wed, 13 Aug 2025 08:52:02 -0500

In what is perhaps the most brilliant act of malicious compliance I have ever witnessed…

Early in my career I bullied my way into a de facto tech lead position on a small software team in a pretty big organization.

The most powerful and vocal of our users used our software passively as a kind of combination dashboard and news aggregator. They had lots of passwords to lots of systems, and they did not want another one for ours. They made this very clear - not one more goddamned password.

Estimates, Targets, and Commitments

Sun, 10 Aug 2025 15:05:13 -0500

Businesses have important reasons to establish targets independent of software estimates. But the fact that a target is desirable or even mandatory does not necessarily mean that it is achievable.

— Steve McConnell, Software Estimation: Demystifying the Black Art

We need precise language about what we want, what we predict, and what we promise.

Endless Yak Shave

Sat, 09 Aug 2025 15:00:30 -0500

Weekend plan: migrate authentication to OIDC. Four hours later I’m debugging if I can symlink my way to success with Claude Code, Cursor, and Junie. GPT5 is released, maybe that will just do this for me, time to re-enable my OpenAI account and generate an API key. I learn each tool’s proprietary file formats and locations, MCP configs, keyboard shortcuts, and licensing terms. Which one has reasoning? What’s the TPS? Can I make it stop being such a goddamned sycophant?

Syncretism

Sat, 09 Aug 2025 00:00:00 +0000

(noun) The combination of different beliefs, practices, or systems of thought into a unified whole, often resulting in a hybrid approach that incorporates elements from multiple sources.

The team’s development methodology was pure syncretism, blending Agile sprints with waterfall documentation requirements and lean startup experimentation.

Attention Spans

Fri, 08 Aug 2025 00:00:00 +0000

Our nonscientific study suggests that, on average, business people can pay attention for no more than thirty to sixty seconds without being distracted by an unrelated thought.

— The Trusted Advisor: 20th Anniversary Edition by David H. Maister, Charles H. Green, et al.

Duplication of Effort Principle

Tue, 08 Jul 2025 00:00:00 +0000

(noun) The theory that systems naturally evolve to perform the same function through multiple independent mechanisms.

The company maintained three separate customer databases across departments, each serving identical purposes but requiring distinct maintenance procedures.

Le Châtelier's Principle

Sun, 15 Jun 2025 00:00:00 +0000

(noun) The tendency of systems to resist changes imposed upon them, returning to their original state when external pressure is removed.

When the engineering team tried to implement daily standups, the organization gradually reverted to its previous informal communication patterns within a few months.

Pleonasm

Thu, 12 Jun 2025 00:00:00 +0000

(noun) The use of more words than necessary to convey meaning; deliberate redundancy in language

Technically speaking, that expression is a pleonasm—a redundant description—since all facts are, by definition, true.

Spike Avoidance

Thu, 05 Jun 2025 12:36:00 -0500

A spike is a sudden, dramatic increase in demand, effort, or activity that far exceeds normal operating levels. I consider spikes a threat to sustainability.

Startup culture’s reliance on the veneer of coolness and a potential future payoff as a way to fortify employees against these spikes will shape the workforce, selecting for younger people who are more naive and risk tolerant. The effects of this compound over time.

Fail-Safe Theorem

Tue, 20 May 2025 00:00:00 +0000

(noun) The theory that a system designed to fail safely will fail by failing to fail safely.

The payment system was timing out, so systems began to retry failed transactions, compounding the original system overload.

Smoothing Function

Wed, 23 Apr 2025 12:04:53 -0500

(noun) A mathematical function used to reduce noise, eliminate sharp transitions, or approximate data with a continuous curve that follows the general trend while reducing fluctuations.

The machine learning model used smoothing functions to eliminate outliers from the training data.

Wadler's Law

Sat, 12 Apr 2025 00:00:00 +0000

(noun) The principle that time spent discussing a language feature is inversely proportional to its mathematical complexity.

The committee spent three hours debating syntax highlighting colors but only fifteen minutes on the type system’s soundness proof.

Bikeshedding

Tue, 25 Mar 2025 00:00:00 +0000

(noun) The tendency to give disproportionate weight to trivial issues while avoiding complex decisions that require expertise.

The architecture review board spent forty minutes discussing button colors and five minutes approving the database migration strategy.

Comportment

Mon, 10 Mar 2025 11:15:45 -0500

(noun) The observable alignment of a system or actor with its stated promises, constraints, and responsibilities.

The team’s comportment during The Incident demonstrated candid communication and accountability.

Parkinson's Law of Triviality

Tue, 18 Feb 2025 00:00:00 +0000

(noun) The principle that members of an organization give disproportionate weight to trivial issues compared to complex, consequential matters.

The board spent two hours debating the color of the company newsletter header while approving the merger proposal in twelve minutes.

Lindy Effect

Sat, 25 Jan 2025 13:38:43 -0600

(noun) A theory that suggests the future life expectancy of certain non-perishable things is proportional to their current age.

Hate on PHP all you like, the Lindy Effect tells me it’s not going away any time soon.

Path Dependence

Wed, 11 Dec 2024 10:56:28 -0600

(noun) When the costs of reverting to a previous state or switching to a different path become prohibitively high, even in the face of better solutions.

The company’s reliance on Progress 4GL illustrates path dependence—despite newer technologies being available, decades of ABL development make switching platforms economically unfeasible.

Vestigial

Mon, 28 Oct 2024 14:22:05 -0500

(adj) Of, relating to, or constituting a vestige; remaining as a trace of something that once existed but is no longer functional or necessary.

The appendix is a vestigial organ in humans, serving no apparent purpose in modern physiology.

Chesterton's Fence

Sat, 14 Sep 2024 14:13:06 -0500

(noun) A principle that states one should not remove or change something (like a fence, rule, or tradition) until they understand why it was put there in the first place.

Before the team decided to remove the legacy authentication system, they invoked Chesterton’s fence and spent time understanding why it was originally implemented that way.

Yak Shaving

Thu, 01 Aug 2024 14:55:46 -0500

(noun) The seemingly endless series of prerequisite tasks that must be completed before you can accomplish your original goal, often leading you far away from what you initially set out to do.

Sarah started by wanting to deploy a simple web app, but first she needed to update her Docker configuration, which required upgrading her local environment, which meant backing up her files, which led to organizing her entire project structure—three hours later, she was still yak shaving instead of deploying.

Automated Commit Messages and Flow State

Tue, 18 Jun 2024 13:27:45 -0500

I recently came across OpenCommit, which claims to “generate commit messages with an LLM in 1 sec”. Here’s what’s good:

Helps maintain flow state - you can fire-and-forget and the messages are about as accurate as they’d be if a human wrote them
Available on the command line, just oco
Works reasonably well with local models running via ollama serve
MIT Licensed

Regarding “flow”, pay attention the next time you write a commit message. Do you feel the context switch happening as you go from “doing” to “documenting”? I do, and I have aversion to that feeling.

Tmux Mouse Support

Sun, 05 May 2024 15:39:33 -0500

After over 2 decades using GNU Screen for multiplexing, often on machines where tmux wasn’t a sensible option, I’ve realized that I’ll probably never find myself telnetting (!) into a solaris box again.

Still, tmux doesn’t “just work” the way I want with the Mac OS terminal. I am aware iterm2, wezterm, kitty and several others exist, but it’s 2025 and I’m just now migrating away from screen, so that’s the level of stodge I’m at. I still want to use the mouse to copy/paste text while I change my muscle memory from screen to tmux.

The Surprise/Delight Ratio

Fri, 22 Mar 2024 13:45:00 -0500

When things happen, I often find myself rating them with two vector quantities.

Surprise - is it surprising or unsurprising?
Delight - is it horrifying or is it delightful?

Chinese Room

Fri, 15 Mar 2024 00:00:00 +0000

(noun) A thought experiment devised by philosopher John Searle in 1980 that challenges the possibility of machine consciousness and understanding.

The Chinese Room argument suggests that even sophisticated AI systems may manipulate symbols without true comprehension.

Great Leaders Connect With Customers

Thu, 08 Feb 2024 10:15:00 -0600

A Costco Case Study: Taking it back to the warehouse every time.

WebStorm and Chrome Profiles

Mon, 25 Dec 2023 16:20:00 -0600

I built a very special Chrome profile for doing Next.JS Tutorials and I wanted WebStorm to launch it for me. It didn’t go well.

Just use {{my favorite tech}}...

Sun, 12 Nov 2023 11:45:00 -0600

Here’s some shit developers say to each other when the other person is stuck and we don’t actually have an answer to their problem.

Just use ~~PHP~~, ~~Django~~, ~~Rails~~, fuck it just use PHP (Laravel, you know)
Just use ~~Emacs~~, ~~Sublime~~, ~~vim~~, ~~macvim~~, ~~neovim~~, ~~Intellij~~, ~~Cursor~~, fuck it just use Notepad
Just ~~get a Mac~~, ~~use debian~~, ~~use ubuntu~~, ~~use centos~~ fuck it just use WSL

Bullshit in Technology Marketing

Thu, 28 Sep 2023 14:30:00 -0500

Patently stupid marketing assertions and the reasons they appeal to us.

Two Types of Stability

Tue, 15 Aug 2023 09:15:00 -0500

In order to survive, the human body maintains stability in two ways.

Homeostasis — the process of maintaining internal stability by adhering to fixed points.

Examples: maintaining optimal pH, liver enzymes, body temperature

Allostasis — the process of obtaining stability by adapting to anticipated demands or environmental stressors.

Examples: cortisol during fight or flight, inflammatory responses, shunting of blood

Both are necessary for survival. One is required to keep the organism alive over the long term, the other helps us respond to emergent or future scenarios.

Challenging the Supremacy of Flow State

Mon, 01 Jan 0001 00:00:00 +0000

I’ve long thought that the ability to maintain flow state for hours was the hallmark of a good programmer. I prided myself on being in such a deep state of flow that I would often fail to notice the passing of hours, the setting sun. I would often only reluctantly step away to pee. I would work late into the night, uninterrupted by the world.

As the systems I’ve worked on have become more complex, technologically diverse, and frankly riddled with errors, I’ve realized that what I thought of as “flow” is actually just a state of chasing my own thoughts, trying to immediately fix whatever annoyances or weirdnesses I encounterd, and finishing my days not having completed my initial goals for the day.