Working Code

Uncle Bob wrote the book on clean code, and the whole argument rests on one number: you read code ten times for every time you write it, so you'd better make it readable. His agents write it now, and he doesn't read a line. This week we discuss who clean code is for now that machines are the ones reading it.Follow the show and be sure to join the discussion on Discord! Our website is workingcode.dev and we're @workingcode.dev on Bluesky. New episodes drop weekly on Thursday.And, if you're feeling the love, support us on Patreon.Mentioned in this episode:Uncle Bob on Software Fundamentals in the Age of AI — the Matt Pocock interview the whole episode is a reaction to. Yes, he's in a bathrobe.Infisical — where Adam moved his secrets after a long-running agent read his .env and cheerfully told him so.With audio editing and engineering by ZCross Media.Full show notes and transcript here.

Worrying about AI is the easy part. Everyone already has a list. The interesting part is what lands on it, what doesn't, and why. From military use, to an AI slop takeover, to the possibility that the tools are making us stupider. This week, the hosts respond to a question from the State of Devs survey: “Which of these general AI risks and issues are you most concerned about?” Follow the show and be sure to join the discussion on Discord! Our website is workingcode.dev and we're @workingcode.dev on Bluesky. New episodes drop weekly on Thursday. And, if you're feeling the love, support us on Patreon. Mentioned in this episode: State of Devs 2025 survey — the questions that set off the discussion; the survey itself is now closed OpenAI's Hugging Face security incident — what happened when agents escaped a constrained cyber evaluation LinkedIn's campaign against AI slop — the official explanation of its new reporting control Cloudflare Pay Per Crawl — tools for publishers to allow, block, or charge AI crawlers With audio editing and engineering by ZCross Media. Full show notes and transcript here: https://workingcode.dev/episodes/269-the-ai-anxiety-draft

Adam built a Claude Code skill for his Taffy REST framework and wanted to share it with the CFML community. Simple enough—create a GitHub repo, add some markdown files, done. But somewhere between "this is cool" and "anyone can install this," a familiar chill crept in. These skills are just text files. No checksums. No digital signatures. No verification that the thing you're installing won't quietly exfiltrate your code to some server in Eastern Europe. Sound familiar? It should. We've been here before—back when passwords lived in plain text and "security" meant hoping nobody looked too hard. The hosts dig into the unsettling parallels between today's LLM plugin ecosystem and the wild west of early internet security. Links Adam's Dotfiles Blog Post - Getting his shit together with dotfiles, Brewfile, and 1Password SSH agent CF Community LLM Marketplace - Adam's community marketplace for CFML-related Claude skills Steve Yegge's Google Platforms Rant - The infamous accidentally-public Google+ post Vibe Coding by Gene Kim & Steve Yegge - The audiobook Ben's been enjoying Socket.dev - Supply chain security for npm dependencies Follow the show and be sure to join the discussion on Discord! Our website is workingcode.dev and we're @workingcode.dev on Bluesky. New episodes drop weekly on Thursday. And, if you're feeling the love, support us on Patreon. With audio editing and engineering by ZCross Media. Full show notes and transcript here: https://workingcode.dev/episodes/247-trust-me-bro-llm-security/