Max Clark

After 20+ years in IT, I’ve learned this: The most expensive mistakes aren’t picking the wrong tool - they’re signing the wrong contract, trusting the wrong vendor, or skipping the hard questions because everyone’s in a hurry. I share what I’ve seen go wrong so others don’t have to learn the hard way.

You use a pomodoro timer, I use my Macbook battery We are not the same

@dan__rosenthal notion

Zoom, Teams, and Salesforce all added AI to tools you already approved. Nobody in the room signed off on that part. Slack has whatever your developers connected to it. Same story, different tool. The product you approved doesn't stay the same. It keeps changing on the vendor's schedule, not yours. That's the part nobody's tracking. IT approved the tool. Security reviewed the original build. Procurement closed the deal. Nobody owns what happens when the vendor changes the product three updates later. A governance check that only happens before you buy something is checking the product you bought. Not the one you're actually running today. Here's what to ask before your next review: vist.ly/5b77c vist.ly/5b77c

X is terrible for nuance. I was considering leaving this alone, but I'm going to try to share my point of view and hopefully I'll manage to do it without feeling like an attack or creating drama. That's not my intention at all. People are a full range of things. Someone can be truly exceptional in one area, and an absolute disaster in another. Similarly an activity/behavior/pursuit that makes someone exception could also be extremely dangerous or self destructive. Sometimes these are easy to parallel. Society doesn't reward people for taking amphetamines by saying they're a great at working so many hours. We've collectively decided/realized that no amount of positive here displaces the negative. So then we have a harder choice. Do we recognize and reward exceptional people doing exceptional things when their underlying activity is undesirable? If given a platform do we risk encouraging others to take on the same activity by way of promoting that person? And at what point are we devolving into something akin to a circus sideshow? Here's the best (unfortunately crass) way for me to demonstrate my point. If you read in the news that Jeb Corliss or Alex Honnold died what would be your immediate reaction and assumption for the cause? Admittedly these two are experts in their field, put in endless hours in preparation and training, and intimately understand (or at least rationalize) the risks they are taking. Both have lost many friends in their respective sports and know the outcome. But both are chasing a response that's harder and harder to get in a way that reminds me of substance abuse. The problem is these activities and glamorization do not exist isolated. People see the attention, admiration, and fame people like them receive and go out and do their own risky activity to gain attention with little training, or understanding. This is the line that I'm trying to rationalize and if it's possible to do one vs the other. And I'm sensitive to this knowing that that Wingsuit BASE jumping (and free climbing) have near perfect fatality records. Watching the video of Alex climbing El Cap was one of the worst things I've done. Even knowing he did it successfully was not enough to counter the emotional response and feeling like I was watching a snuff film and contributing to a path that would ultimately end in disaster. Videos online of Wingsuits are the same. The idea and freedom of flight is intoxicating. The imagery is breath taking. There's also the reality of just how small the margin for error is and what the outcome will be. Jeb's friend mis-judged his path and hit the rail at 120mph dying instantly, Jeb had to dodge his body as he pass underneath or he too would have died. So yes exceptional people doing exceptional things that will ultimately end paying the highest price.

@maxclark His views here on fear can be absolutely admirable, while also having a backstory that isn't. Not everything is drama...

Probably one of my favorite talks on human emotion is this 3 minute video of Jeb Corliss, a wingsuit pilot, talking about fear. This is a guy who "gets it." A sport with one of the highest death rates on earth, and he runs toward it unabashedly. youtube.com/watch?v=oB7nX-…

Three whiskey photos in my feed before 8 AM today... Somewhere between 38 and 52 every guy selects his personality hobby. I know you know what I mean: - Golf guy - Bourbon guy - Smoker guy - Cycling guy - Mechanical keyboard guy It's always the same: expensive gear, facebook groups, and a partner who's stopped asking. Me? Never... I just have a plane, my HAM radios are for emergencies, and I needed a new camera for our trip to Korea. It's completely different. What's your guy hobby? Confess in a comments (or tag the golf guy who's still pretending).

@mikejulian Tried to read some PERL I wrote two decades ago…

everyone is all proud of not reading the code they write anymore joke’s on you, I didn’t read my code pre-AI either #yolo

Claude Code runs inside your network using your employee's access. Anthropic built it. Even they couldn't stop their own source code from leaking into a competitor's product through it. You never checked what it can reach. It may already have your data. Tom Cooper, AI Product Lead at @expedient, on why this is already happening at companies that thought they were careful. vist.ly/5b52c

Feed feels better Did something change?

@JoshAquilaDev 😉 if you ask a client if they need provisions for active shooters it will go sideways, but if you only use providers that have it built in when you're asked it's already handled.

@maxclark Whattttt. That is actually a REALLY great question!! We all don’t think it will happen to us one day, but being prepared is the way to save lives. How did you handle that?!?

Had a CISO ask me about active shooters once. During what was supposed to be a pretty boring audit engagement for a CPA firm. Those were his exact words. He was the one driving risk for that org, and what he wanted to know was whether the phone system could tell you which floor, which corner, which room, if someone dialed 911 and couldn't talk. I called the partner after. Asked if there was something going on I should know about. There wasn't. He just had a CISO who understood Kari's Law and Ray Baum's Act better than most orgs bother to. Generally, phone systems will tell you the building. That's it. The actual requirement is specific. Third floor, northwest corner, room three has to signal as exactly that, not just the address on the lease. Most orgs think they have this covered because someone sold them a system that does 911 calling. Whether it flags the actual room is a different question, and usually nobody's checked. I still think about that one.

@SeanODowd15 @NWischoff Terrible. Sorry to hear that.

@maxclark @NWischoff This aligns with similar stories near us and adjacent to our own experience

For those of you that have had or have an au pair - do you recommend it?

The most important question in your vendor evaluation you probably never asked. vist.ly/5a2k6

@SeanODowd15 @NWischoff One couple had their's quit and refuse to leave the house, eviction proceeding was a nightmare Another friend fired their's and was reported to CPS Small sample set, but not good experiences

@NWischoff Strongly recommend against. We tried it and it was an disaster

@nikitabier how do I prevent this slop from hitting my timeline?

@sullrich eBPF changed the game

@sullrich BSD + pf was crazy fast when it shipped. FreeBSD maintained a performance advantage for a long time. Linux has caught up but not all the way. Do we really need to worry about supporting *every* possible NIC, or for serious people pushing 10/100+ Gbps that's not an issue

I co-founded pfSense. For the last year I've been building its successor. If you run pfSense today, you already know the reasons to look around: development you can't influence, a CE edition that feels like an afterthought, FreeBSD driver roulette on modern hardware, and a config workflow where one bad apply on a remote box means a drive. nfSensei is my answer. Built from scratch in Rust, on Linux, and designed around the things pfSense users actually complain about. Your config.xml imports. There's an importer that reads your pfSense config, shows you exactly what maps over and what needs attention, then applies it. You don't start from zero. You can't brick it from the couch. Changes stage as a candidate, diff before apply, validate through the real engines before anything is written, and auto-roll-back if you don't confirm in time. If a config ever fails at boot, the box falls back to the last good one on its own. The hardware works. Linux base means modern NICs and drivers just work — and the fast path compiles your rules to XDP at 40Gbps. Automation is native, not scraped. Everything the UI does is a documented API call — about 1,140 of them, with a built-in explorer. Your Ansible finally gets a real interface. The VPNs are current. WireGuard, IPsec, Tailscale, and self-hosted mesh — your own control plane, your keys — plus post-quantum key exchange where it counts. The experimental stuff has its own wing. Thirty-plus Labs features behind toggles: WAN bonding that fuses multiple cheap uplinks through a $5 VPS into one resilient pipe, per-flow SLA telemetry with tamper-evident audit chains, GeoDNS that steers traffic by live RTT and load, application-aware QoS, config push to a whole fleet of remote nodes, and an AI assistant on the box that reads your actual interfaces and logs using local models. Toggles are per-browser and can't touch your running config — flip things on, break them, tell me about it. Oh, and there is much more to mention here! Self-hosted, on your hardware, no cloud account, no subscription. It's NOW IN ACTIVE BETA (previously alpha) with about 40 testers, and bug reports typically get fixed in days. I want more people who know what pfSense does well and can tell me exactly where nfSensei falls short. If you are interested in testing please email me: sullrich@gmail.com. Tell me about your pfSense setup and I'll get you access. Note: Affiliates and employees of Netgate are not invited.

@preston_holland :(

The Netjets preliminary report on the accident in Laredo is not great. I’m not an expert in aircraft maintenance but I know enough that when I read the preliminary, it’s not good. Rip Josh Baer.

@JamesonCamp bingo software is an asset just like a building every year it accumulates maintenance and depreciates in value - this is the "tech debt" that people don't understand do you want that liability on your balance sheet, or do you want it on someone elses?

Ive spent 100+ hours updating a small software business I bought a couple years ago And WOW, it has made something super clear NO WAY the average person is vibecoding their own software in the future Im 100 hours into UI, wiring it all up to payment, fixing the actual software, setting up email flows, and more It will cost me $500+ a month just to run it at all, with all the other APIs i need to pull and data I need to access It also only works because it uses my deep domain expertise to make it useful Now would the average person rather pay me $100 a month to use this? or build it from scratch and maintain it themselves.... The writing is on the wall, and anyone who thinks otherwise, knows nothing about consumer behavior

@rhesse You convinced me. Going all in on $TSLA