Blog by Joy Heron

Popular Topics

Blog Post

Alternatives to U.S. Artificial Intelligence

Claude and GPT have transformed the way I write software, but I’m becoming increasingly uncomfortable with rising costs, vendor lock-in, and our growing dependence on a handful of U.S. providers. After exploring local models and open-weight alternatives hosted in Europe, I was surprised to discover that some lesser-known models can already handle much of my day-to-day work.

Blog Post

I sandboxed my coding agents. Now I control their network.

I want my AI coding agents to work independently, but I don’t want them to have unrestricted access to the internet. In this post, I describe how I routed all network traffic from my development sandbox through a strict proxy allowlist, allowing only a small set of explicitly approved domains. This setup finally gave me enough confidence to loosen the guardrails without constantly staying in the loop.

Blog Post

Let’s Not Normalize Insecure AI Assistants

How the Lethal Trifecta Makes Today’s AI Assistants Unsafe by Design

Blog Post

What to Do While the AI Is Thinking

AI can write code while we wait — but that doesn’t mean we suddenly have free time. Whether we should think, multitask, review, or rest depends on what kind of work we are doing.

Blog Post

I sandboxed my coding agents. You should too.

LLM coding agents are extremely powerful because they can run programs on our computers using our permissions. However, this same power also makes us very vulnerable. It only takes one mistake or one prompt injection to compromise the whole system.

Blog Post

Context Engineering: Managing AI-Generated Code Complexity

Keeping your scope small was always a good idea

Blog Post

Git Clarity: Building Meaningful Commits and Linear History

Feeling overwhelmed by Git’s complexity? Discover a streamlined workflow that centers on creating single, comprehensible commits. Learn how this approach leads to clearer code reviews, fewer merge conflicts, and a beautiful linear commit history that tells the story of your code. This isn’t just about Git commands—it’s about aligning your tools with how your brain works.

Blog Post

AI — Behind the Buzzword Garbage

Tired of AI hype? Me too. But beneath the buzzwords lies real value for developers. Tools like Claude Code save me hours on routine tasks, freeing me to focus on what matters: understanding problems and building the right solutions. It’s not magic—it’s practical support that makes development faster without replacing our core skills.

Blog Post

Custom Elements are NOT for Templating

Untangling the confusion between browser defaults and JavaScript component frameworks

Blog Post

Innovation in the web without sacrificing accessibility

We’ve truly stretched the boundaries of what is possible on the web. However, to do this we’ve sacrificed semantic HTML and made our applications inaccessible to a huge amount of different users. Instead of breaking the foundation of the web, we should consider this as an opportunity: how can we implement applications in a way that works for any user who might come along and want to interact with it?

Blog Post

Don’t tell me I’m not building a web application

How do we decide what technology stack that we want to use for any given project? Is it really based on how perfectly well suited the technology is to the problem at hand or do we really just want to use the technologies that we like and are comfortable with? I’m happy in my filter bubble, rendering web applications on the server and progressively enhancing them on the client. But I also recognize my bias. Do you?

Blog Post

JavaScript? Yes, but in moderation

Classic Web Architecture for Applications

Blog Post

A Playground for Testing OpenID Connect

This post describes how you can set up a development environment in order to play around with your OpenID client implementation. When running your application in a cluster, it can be difficult to test how it will behave behind a load balancer. One factor that can be particularly difficult to test is when you are communicating with an OAuth 2.0 or OpenID Connect server which expects that a request will be redirected back to the same application instance that it came from.

Blog Post

The Power of the HTML Form

The HTML form is a powerful tool for telling a server what you want to do. But does everybody know how it works? With the multifarious JavaScript frameworks currently available today, software developers in the industry today often do not know how to create a web application without JavaScript. Is there an alternative? The web has been around for ages. What did people do before JavaScript?

Blog Post

Simplicity - Fighting Complexity At All Costs