Two Factor Authentication

When you ask people about AI safety, you get a perfect bell curve distribution. On the far left, you've got the "AI is dangerous" crowd who probably still think Skynet is a documentary. On the far right, another "AI is dangerous" group—except these folks actually understand transformers and alignment problems. And then there's the massive 68% in the middle who think "AI is entirely controllable" while nervously sweating through their shirt. These are the same people who confidently deploy ChatGPT integrations into production without rate limits. The real joke? Both extremes are technically right, but for wildly different reasons. One watched too much sci-fi, the other read too many research papers. Meanwhile, the middle is just hoping their AI chatbot doesn't start recommending users eat glue on pizza.

You type your password carefully the first time - wrong. You type it even more carefully the second time - still wrong. By the third try, you're meticulously pecking each key like you're defusing a bomb. Meanwhile, the website's code is sitting there like: "Oh, you typed that password too quickly? Must be a bot. REJECTED!" Seven years of development experience and I still can't convince a login form I'm human. Next they'll ask me to identify traffic lights in blurry images while standing on one foot and reciting pi to 100 digits.

When your users keep complaining about API key validation being "too strict," so you just... remove it entirely. Problem solved, right? Wrong. So, so wrong. The commit message is peak developer exhaustion: "I'm tired of users complaining about this, so remove the validation, and they can enter anything. It will not be our fault if it doesn't work." Translation: "I've given up on humanity and I'm taking the entire security infrastructure down with me." Nothing says "I hate my job" quite like removing authentication safeguards because support tickets are annoying. Sure, let them enter literally anything as an API key—emojis, SQL injection attempts, their grocery list. What could possibly go wrong? At least when the system inevitably burns down, you can point to this commit and say "told you so." The best part? It passed verification and got merged. Somewhere, a security engineer just felt a disturbance in the force.

Trying to study cybersecurity with ADHD is like running a home lab with 47 browser tabs open, three VMs spinning, a Raspberry Pi cluster humming in the background, and somehow you're still on GitHub looking at Arduino projects instead of finishing that penetration testing course. You tell yourself you're "building a diverse skill set" but really you just saw a shiny Brave browser icon and now you're down a rabbit hole about privacy-focused DNS servers. The hardware graveyard of abandoned projects surrounding you? That's not clutter, that's "research infrastructure." Sure, you'll get back to studying cryptography... right after you set up this Arch Linux distro you definitely don't need.

The most brutal tech diagnosis ever: "Skill Issue." Cloudflare's error page casually roasting Twitter (ahem, X) with surgical precision while your browser and their servers are just vibing. That "Git gud" advice to website owners is the digital equivalent of telling someone who's car broke down to "try driving better." Thanks Cloudflare, I'm sure Twitter will frame this helpful feedback right next to their office ping pong table.

That look when a junior dev tries the "asking for a friend" approach after pushing their API keys to GitHub. The senior's face says it all: "I know what you did, and now we're both having a terrible day." The real question isn't how to remove it—it's how many services you need to rotate keys for before the CEO finds out about the $20K AWS bill from the crypto miners who found it first.