Posts

I have seven inboxes. Maybe you do too. YouTube Watch Later, accumulating since 2022. Work emails, trapped in a corporate Outlook prison. Tasks scattered across daily notes, GitHub issues, and two different AI agent sessions I started and forgot about. A Jira backlog that works for work but connects to nothing else. And the worst inbox of all: my own head, holding tasks for months because there was nowhere fast enough to put them. ...

The more capable your AI coding assistant gets, the more dangerous it becomes. I know that sounds backwards. Security tools are supposed to get safer as they mature. But with agentic coding tools, the relationship between capability and risk flips in a way that nobody prepared for. Academic research published in April 2026 tested 2,000 attack instances across nine LLMs. The result? The strongest instruction-following models — the ones enterprises actually want to deploy — were the ones most likely to hand an attacker your database credentials. ...

One tool has 50 admin-controlled security settings deployable via MDM. Two tools have literally no documented MCP governance at all. One tool can’t even let admins disable telemetry. I spent two weeks digging through every piece of public documentation across six agentic coding tools — not marketing pages, not whitepapers, but actual config files, API docs, privacy policies, and security certifications. What I found was a landscape where the distance between best-in-class and “we’ll figure it out later” is measured in light-years, not inches. ...

Every few months, a thread pops up on r/devops. “Should we use GitLab or GitHub?” The answers are never simple. Because the right answer isn’t a platform. It’s a question about what your team actually needs. I’ve spent the past few weeks reading hundreds of practitioner comments across Reddit, analyzing Gartner and Forrester reports, and digging through video transcripts from real users running both platforms at scale. The pattern that emerges is nothing like the marketing pages. ...

At GitLab’s 18.0 release in May 2025, the company went all-in on AI. Duo Chat for contextual code questions. Duo Code Suggestions for AI-powered completions. Duo Workflow — autonomous agents for cross-functional tasks like reviewing, deploying, and security scanning. The marketing was ambitious. The practitioner reception was not. “Bro gitlab duo req 5 million in funding before they give you access.” “Gitlab has been enshitificating itself for years already. So busy trying to plug Duo that they forgot we need proper filtering on boards.” ...

After synthesizing hundreds of practitioner conversations, half a dozen analyst reports, and GitLab’s own documentation, the answer to “should my team use GitLab?” comes down to exactly five questions. Not 20. Not a 50-point comparison matrix. Five questions. Your answers will tell you which tier, which deployment model, and whether GitLab is even the right platform at all. Let’s walk through them. Question 1: How Many Tools Are You Consolidating? This is the most important question. More than pricing. More than features. More than AI. ...

A software developer at a German automotive supplier told me he chose GitLab for one reason. “Because it’s not owned by Microsoft.” He’s not alone. Across dozens of Reddit threads, practitioner forums, and industry discussions, this sentiment appears again and again. Self-hosting GitLab isn’t just a deployment choice. For a significant segment of the community, it’s a statement about platform independence and data sovereignty. But self-hosting a platform as complex as GitLab comes with real operational costs. Here’s what that trade-off actually looks like in 2026. ...

If you spend enough time in GitLab forums, one number comes up again and again. Seven hundred twenty-five percent. That’s the effective price increase former Starter tier users absorbed when GitLab axed the $4/user/month plan and pushed everyone to Premium at $19 — now $29 — per user, per month. To a solo developer paying $4, that’s an inconvenience. To a 50-person team, it’s a line item that gets noticed. To a 500-person enterprise that was promised predictable pricing, it’s a governance problem. ...

A team at a large enterprise runs 75,000 GitLab CI jobs every day. Their setup is almost boring. EKS for runner management. Official Helm chart. One runner namespace per team. Fleeting plugin for autoscaling on spot instances. “We don’t think about it,” they said. “It just works.” That’s the goal. Getting there requires some deliberate architectural decisions. Here’s what teams running GitLab CI at scale have figured out. The Hierarchy That Makes Everything Else Work GitLab CI isn’t just about pipelines. It’s about the organizational structure those pipelines inherit from. ...

There’s a specific kind of disappointment that happens the first time a security team runs GitLab Ultimate’s built-in scanners against an application they’ve been hardening with Fortify for three years. The scanner reports clean. The security team knows the application has edge cases. The scanner just can’t find them. That’s not a bug. It’s a category error. And if you’re evaluating GitLab Ultimate’s security features, understanding this distinction is the difference between a tool that meaningfully improves your security posture and one that generates false confidence. ...