Writing on Simon Mullis

Darmok, Brown M&Ms, and the Bandwidth of Meaning

Fri, 17 Jul 2026 00:00:00 +0000

Van Halen, brown M&Ms, 1980s.

If you know the story, I don’t need to tell it. Three words and a decade just handed you the whole thing: the clause in the contract, the reason it wasn’t pettiness, the test hiding inside the sweets. You rebuilt all of it from almost nothing, because you and I happen to share the reference. That leap, from a fragment to the full picture, is the entire subject of this piece.

Compliance as an Inherited Property

Thu, 16 Jul 2026 00:00:00 +0000

The scanner stopped us because of an uninstall command.

We had built a small documentation-lookup tool for internal AI use at a global security vendor: a way for a language model to answer questions from official product documentation instead of guessing, and to ensure that everyone had the same chance equivalent (but not necessarily identical) answers from the LLM guided sessions. The reference material included a vendor’s published, supported uninstall procedure, which, like ten thousand other uninstall procedures, contains rm -rf. The static security scanner in the review pipeline found the string, classified it as a critical finding, and the pull request stopped at InfoSec.

Right Finding, Wrong Fix

Thu, 15 May 2025 00:00:00 +0000

A client of ours turned off a server one afternoon and stopped their partner payments cold. Not a nation-state, not ransomware. A scanner had flagged the box for a weak TLS configuration, the finding was accurate, someone acted on it quickly and responsibly, and a legacy system quietly holding up a chunk of their partner-transaction processing went dark along with it. Nobody in the room had known what ran through it. The security work was correct. The result was an outage.