JJ was early for the Tuesday 10 o’clock meeting, which usually meant he was holding his yoga poses too long.

Georgie was already there with a pink notebook open to a blank page.

When JJ arrived and got settled with his black coffee with extra grass-fed butter, he started with the good news.

“Georgie and I have been talking with a major frozen-food supplier in Canada. They also service the EU. Paris wants in with their own pilot running on Azure, using our pilot database.”

Selena added a note to her notebook: Paris compute. Our data. Hot!

Go Fast, Go Public

Raja nodded as if the architecture had already agreed with him. “That’s a multi-cloud decision. Azure containers. AWS database. We can connect them together publicly.”

Georgie wrote down: multi-cloud? bigger? better? and then jumped up and stood beside JJ. “We need a review. Ownership. Checks and balances. My glow-in-the-dark presentation is still useful, and I would like the architecture to survive the slides.”

JJ smiled at the word architecture. Paris. He was already packing sample bags in his head.

Bart still had not met a multi-cloud deployment he trusted.

Raja kept going. “If Paris is on Azure and the database is on AWS, the fastest way is to make the database easy to reach. Open it enough. Let Azure connect. Georgie can redo her demo for Paris on Thursday.”

Bart put his Jolt! cola down with a bang. “If Paris connects the wrong way, the failure will be a delayed pilot, and a database story nobody wants in email.”

“We are not doing this again,” he said. “Last week was using a public path with default rules. Old records treated like they did not count. We are not giving Paris a public database because it is convenient.”

Selena held up both hands. “I agree with Bart.”

“They need answers,” Bart said. “Answers that don’t require a database login.”

Subscribe now

The Records Room

Georgie frowned. She wanted a phrase she could reuse in her presentation that sounded like an expert was talking.

“Explain it like I have to present it,” she said.

Bart did. “Think of the database as the records room. Nobody from Paris walks into the records room. Not because we do not trust Paris. Because a records room with a public street door is still a bad records room.”

He drew a box on the whiteboard and labeled it AWS.

“Inside AWS we keep the database private. In front of it we put an API. The API is the doorman. Paris talks to the doorman. The doorman checks who is calling and what they are allowed to ask. Only then does it fetch records from the room.”

He drew a second box and labeled it Azure.

“Paris runs containers here using Azure compute on an Azure VNet. Their containers call the API here on AWS. They do not access the database on the public internet.”

Selena wrote: API = doorman. Database = records room. Keys stay with the doorman.

“So, Paris does not get a public records room,” Georgie said. “Paris talks to the doorman.”

Georgie flipped her notebook shut and wrote on the cover: don’t ever use orange and yellow markers when presenting!

Peering is Not Always Magical

Raja tried one more shortcut question. “Could Azure just talk to the database using a one-to-one peering connection?”

“Peering is not a magic hallway,” Bart said. “Peering is a controlled connection between two separate networks. It still needs rules and a proper design.”

JJ asked if using containers made this harder.

“No,” Bart said. “Containers package the app. They do not replace a private database path. Fargate on our side, Azure Kubernetes Service is on theirs. The database uses a private endpoint. Paris never gets a public one.”

“I need the real short version on endpoints,” Georgie said.

Bart gave her the short version.

“A public database endpoint is like a door on the street. Anyone could open it. A private endpoint keeps the database off the public street. Paris talks to the doorman. The doorman is allowed to use the private endpoint to access the database.”

Selena added: Public endpoint = street door. Private endpoint = inside door. API = doorman who decides who is allowed to knock.

Raja exhaled. “So I should not open the database to the world for the Azure pilot.”

“Correct,” Bart said. “Run this automation script.”

Bart dropped a link for the script for Raja in the Slack tech channel: paris-pilot-path.sh. Network layout. Private database endpoint. API only. Logging on.

Share

Thursday in Paris

Bart built the automation with the operations the pilot needed. Logging was enabled so questions asked were visible. No midnight console invention. No temporary public access that would still be there next October.

“Paris can deploy on Azure when their side is tested and approved,” Bart said. “They call the API. They do not access the database from the internet for convenience.”

Thursday the demo was presented by Georgie to the Paris division. She said the word endpoint more than JJ preferred, but Bart’s design was far better than Raja’s plan.

“Azure-side containers requested pilot data through the API. The API hosted on AWS, answered only what it was allowed to answer. The API used the private endpoint to the database. The database stayed private. Nobody loaded ten-year-old records onto a public path.”

During the presentation, JJ dimmed the lights and made the sample label glow.

Georgie tapped JJ’s arm. “Endpoints are cool,” she whispered.

Friday morning there was no ransom text. There was a short note from Bart in the tech channel:

Pilot problem from last week: defaults, public neighbourhood, skipped script.

New improved design: Azure compute, AWS data, API doorman, private database endpoint. Paris tech team on board.

Raja replied that he had run the script before lunch. Georgie replied that her presentation now had a new header on every slide: Paris talks to the doorman; the database never stands on the street.

JJ replied with a photo of sample bags glowing in the colours and the word Paris in the caption, which everyone ignored productively.

What the Problem Actually Was

Not Azure. Not AWS. Not Kubernetes. Not the fact that two clouds appeared in one pilot.

The danger was treating multi-cloud like a logo and treating public database access as a good design decision.

Paris ran their pilot on Azure. The pilot database stayed on AWS. The API controlled who could ask questions and provided answers. The private database endpoint kept the answers from becoming an incident.

Containers packaged the work. Network design kept the work safe.

Proper multi-cloud design knows where the data lives, where the compute lives, and who is allowed to talk.

Three questions worth asking before the next multi-cloud pilot

1. When separate teams need access to the same data, do they need a database login - or API access?

2. Is a pilot database hosted on a public path because it is the right decision, or only because it is convenient?

3. If the path between Paris and the data fails at 2 a.m., what breaks first - and who owns the fix?

Ask. Understand. Connect. Belong.

The daily concept, question, and rationale arrive at dontknowjack.club every weekday. Selena’s Crossword every Sunday. Free. No credit card.

Leave a comment

JJ was excited before the Tuesday 10 O'clock morning meeting started.

Georgie Handle was introduced with great fanfare as the new project manager for new initiatives and to help Loo Loo’s Paper Parts compete at the next level. She did not know much about the cloud yet but was eager to learn. She noted Bart’s expertise and Raja’s offer to help her fit into the team quickly. She was planning a buffet lunch with Raja and Selena to learn as much about cloud infrastructure as one meal would allow.

She did not want to waste any time.

JJ Glowed in the Dark

JJ took the floor. He and Selena had come back from a sales seminar on industrial methodologies.

“Selena and I have seen the future,” JJ said. “Colourized biodegradable bags with glow-in-the-dark labels for frozen food. This is a huge differentiator. Colour-coded frozen food with eco-friendly labeling. We could be known across New Brunswick as a food supplier and a cleaner-upper.”

He paused to compose himself.

Selena had heard about another concept at the seminar too.

“Cloud native containers. In any language you want. Our potential supplier, Bagit!, has a sample software deployment on GitHub we can use to test this concept. It produces artwork, order handoffs, and other specifications still to be defined.”

JJ nodded. “Just to confirm. Bagit! manufactures the biodegradable bags and glow labels. We design the product line and the branding. Then we hand the orders back to Bagit!”

Georgie spoke quietly into her phone. “Resin film. Cold chain packaging. Primary colour fusion. Draft an environmental sales pitch for McCain Foods.”

Selena opened her notebook and wrote colour-coded food is just weird. I’m sooo hungry!

Raja said, “I just watched a YouTube short on using GitHub for proof of concepts. We can use our test AWS account for this.”

Bart stood up, walked to his fourth monitor, and thought about running a full calibration.

Subscribe now

Containing the Containers

Bart liked containers as the compute choice. He ran Kubernetes in his home lab as the Minecraft game-server operator for his condo. Standing up full orchestration for this pilot still looked like a waste of time. He was also busy with monthly backups and cost analysis.

He recommended Fargate to orchestrate and manage the pilot containers.

He also built an automation script for Raja: approved network layout, private space for required services and the database, security group rules matched to the pilot requirements.

“Run this script,” Bart said. “Do not invent a network in the console.”

Georgie Makes Her Move

Georgie stopped Raja in the hallway after the meeting.

“Let’s forget lunch with Selena,” she said. “Since I’m new to this cloud thingy, let’s spin the pilot up manually. If we only run automation, I won’t see what is happening. Show me the steps. I’m a quick learner of using confusing technical terms, and my glow-in-the-dark presentation is Friday.”

Raja said he could stand it up fast. He wanted to follow Bart’s instruction. He also wanted to impress Georgie.

“I’m here to listen and learn from your expertise,” Georgie said softly.

Raja answered carefully. “Sometimes defaults have been created for a good reason, right?”

He used the default network instead of Bart’s automation. He attached to Git, pushed the deploy, and accepted the default security groups. He added a compatible database.

The included fake data looked too fake. So Raja loaded records from ten years ago. Old orders. Old contacts. Old SKUs. No current customer files.

“Too old to worry about,” he told Georgie.

“I’m impressed you still have records from ten years ago,” Georgie said.

Thursday afternoon the demo worked. JJ dimmed the room lights. The label artwork glowed. Raja exhaled. Georgie tapped Raja’s wrist. “Yeah. Containers,” she whispered.

Selena marked the pilot as up. JJ grabbed a green Post-it and wrote: eco-worthy differentiator coming at you fast!

Nobody marked the pilot as being built from the approved script. Nobody marked ten-year-old records as potentially still private information.

We Have Your Data

Friday morning Selena’s phone buzzed on the table during standup.

The pilot database had been accessed and encrypted. The encryption key had been copied externally and then deleted. Someone wanted money. Someone wanted it soon. They included enough detail from those old records.

The room went quiet in the wrong way. Selena’s face changed to a milder shade of normal.

“Thankfully it’s just older orders and SKUs,” she said. “No customer data. The deployment script must have stopped halfway through.”

Bart put his phone face down. “Show me the VPC Flow Logs and Security group rules. Show me where the database lives.”

Raja opened the console on Bart’s newly calibrated fourth monitor.

The pilot sat on the default public network. Not the network in Bart’s script. The default security groups had been accepted and never scoped to the pilot’s real paths. The database instance was on a public subnet along with the container deployment.

Share

Bart Automates His Cool

Bart chugged his ice-cold Jolt! Cola so fast his eyes briefly changed colour. His voice stayed level.

“I okayed Fargate,” he said. “I gave you a script for the network that was fine. You skipped the script. You accepted every default security group, so the firewall paths stayed weak. You put ten-year-old records into a database on a public network path. The script did not stop halfway. It never ran.”

Flow Logs filled in the rest of the details. Once attackers reached the front of the pilot, the database was not far away.

JJ asked if using containers had made this worse.

“No,” Bart said. “Containers ran the process. The default network was the problem. Default security groups were the problem. Old records are still records. An automation script only helps if someone runs it.”

Selena opened her notebook to a new page and wrote: Automation saves the day if it is run. On a private page she added: What’s up with Raja? She had seen the wrist tap.

Raja ran Bart’s Automation

The fix was unglamorous, which is how real fixes usually look. The approved network came up the way it should have on day one. Security groups matched the pilot’s real paths instead of the defaults. The database was rebuilt onto a private subnet, reachable only from the container processes that needed it.

Fargate was used for orchestrating the containerized pipeline. That decision had been sound. Loading old records into a wide-open database had not.

“Still could be a huge differentiator,” JJ said, quieter than before.

“I have learned that attackers don’t care about our timeline,” Georgie said. “This is my fault. I’m no expert. Bart is the expert. I’m now up to speed on three things. Security is everything. Skipping the network script was exciting, but boring is better. Default anything in the cloud must be questioned.”

Raja said, “Sometimes my emotions get the best of me. Especially when I miss lunch.”

What the Problem Actually Was

Not Kubernetes. Not Fargate. Not biodegradable resin. Not glow pigment.

A pilot running on the default public network after an approved automation script was available, with default security groups accepted as-is, a database in the same open neighbourhood, and ten-year-old records treated as safe because they were no longer current.

Bart okayed the containers. Bart provided the network path. Raja chose speed over the script, defaults over design, and emotions over duty of care.

Containers packaged the work. Security has no shortcuts.

Three questions worth asking before your next pilot is spun up

1. Is there an approved network script to build the private network, and did we run it?

2. Did we accept default security groups because they were right, or because they were easy?

3. If old records appeared in a headline tomorrow, would “they were ten years old” still feel like a excuse?

Ask. Understand. Connect. Belong.

The daily concept, question, and rationale arrive at dontknowjack.club every weekday. Selena’s Crossword every Sunday. Free. No credit card.

Selena walked into the Tuesday 10 o’clock meeting still slightly out of breath. The parking lot lines were being repainted yellow. She had decided not to risk her new whitewall tires and had walked instead. Her notebook was already open.

“Pierre called from Paris,” she said. “Spindle de Provence has been added to the SuperExtreme wedding package. BioVoom needs a virtual machine for the design software. Specs are fast and redundant and in the right Azure region for Europe. He needs an answer today.”

JJ nodded. He heard Paris.

Selena picked the VM while JJ watched

Selena filtered server available in West Europe, sorted by cores, and stopped on the Standard_D32s_v5. Thirty-two cores. 128 GB of RAM. Sixteen was her lucky number. She doubled it for good measure.

“That’s a lot of cores,” JJ said. “Looks powerful.”

Selena approved the deployment and closed her laptop. JJ wrote ‘cores are powerful’ on a gold Post-it note. He underlined powerful twice.

Bart’s cost dashboard noticed

At 2:47 p.m. the following Monday, a cost alert appeared on Bart’s phone. CPU utilization on the new VM had not gone above 11%. The design software was running. It was not using thirty-two general purpose cores. It was performing graphics work on a machine built for something else.

Bart posted to #infrastructure general.

“The Standard_D32s_v5 for BioVoom is oversized. CPU at 11% - about 4 of 32 cores in use. This workload needs GPU acceleration and high availability. Reviewing options.”

Raja replied in four minutes.

“More cores means more capacity. More capacity means more speed. I took an online class on CPU speeds. We should add autoscaling for peak wedding season overload.”

Bart checked the Cost Explorer recommendations on his fourth monitor. He drained the last of his warm Jolt Cola and answered.

“Autoscaling adds capacity when demand rises. Workload is running at 11%. Autoscaling will not fix the wrong machine type.”

Selena said, “I forgot to mention that they are using a 3D printer to engrave the spindles in house.”

JJ selected a fresh gold Post-it note.

“If I went to Paris I could hand roll the first customer’s order,” he said. “It’s all about the personal touch with weddings.”

Bart made sure he did not look up as he spoke.

“The software is running in the cloud. A 3D printer does not replace the right GPU. Two smaller GPU servers behind a load balancer will do the job.”

Raja paused. He then nodded. Slowly.

“Two smaller servers. And if one fails, the other keeps going. I see it.”

JJ wrote ‘load balancers lack empathy so which server lives is redundant’ on the Post-it note and stuck it to the first one.

Subscribe now

Cores and GPUs

An iPhone 17 Pro has six CPU cores that can handle everyday tasks such as email, browsing, and messages when multiple apps are open and running. Any CPU ever created has at least one core.

A GPU is a different kind of processor. It is built for parallel visual work such as graphics, rendering, and certain kinds of AI. Design software that etches names onto spindles in gold and silver is graphics work that a CPU can still perform. But a GPU does it much faster.

GPU servers still have CPU cores for basic processing. They also have a GPU for rendering graphics. Running graphics software on a server with thirty-two general purpose cores and no GPU is like buying the newest iPhone and expecting it to replace a Sony mirrorless camera used for professional wedding photography. You paid for power. You did not pay for the right power.

The machine was strong. It was the wrong kind of strong.

What Bart rebuilt

Two smaller GPU servers in West Europe. Four cores each, GPU optimized for graphics (Standard_NC4as_T4_v3). Modest servers with a dedicated GPU that performed the design work. Placed behind an Azure Load Balancer so if one server failed, the other was available to take over.

Azure Blob storage was used for storing the spindle designs. The servers did the graphics work. Object storage stored the designs.

The correct server design even with redundancy cut the monthly bill in half before anyone negotiated a discount.

For more savings, he set automatic shutdown at 11 p.m. and automatic start at 7 a.m. European time. Nobody was engraving spindles at 2 a.m. Yet. The overnight stop cut another share of the monthly cost.

Nobody talked about 3D printing again. JJ’s offer to hand roll the first order was not answered by Pierre.

Bart posted once more.

“BioVoom environment rebuilt. Two GPU servers behind a load balancer. Designs stored safely in Azure Blob storage. Automatic shutdown on. Pierre can be informed.”

Three people read it. A record. JJ smiled.

Selena wrote ‘sort by workload, not by cores’ in her notebook.

The Paris question

“Someone should walk Pierre’s team through the new setup,” Selena said. “Bart and I could go. I know the area.”

JJ looked at his phone again.

“I will go. I own the European relationship, and I have never been to Paris. And I have United points that are about to expire.”

Bart had been planning a quiet weekend. He did not want to explain load balancers over dinner at a bistro that did not serve burgers and fries.

Selena wrote something in her notebook and did not show anyone.

JJ booked his travel before the meeting ended. He used all his points on the three overnight connecting flights and was only out $15.25.

What the VM decision was

The Standard_NC4as_T4_v3 is a GPU optimized Azure server built for graphics and similar work. It has a CPU for regular processing and a GPU for the graphics work.

Two smaller correctly sized servers behind a load balancer cost less than one of the wrong large servers. If one fails, the other was available to take over. BioVoom’s clients can get their spindle designs printed before the morning of the wedding.

A large number of cores is never the first answer. The right fit for the process is always the answer.

Three questions worth asking before the next VM goes live

1. What does this workload need: CPU cores, GPU acceleration, memory, or storage?

2. Is this VM running overnight or on weekends when nobody is using it?

3. Would two smaller servers behind a load balancer cost less and fail less than one large one?

   Thanks for reading Don't Know Jack! Subscribe for free to receive new posts and support my work.

Ask. Understand. Connect. Belong.

The daily concept, question, and rationale arrive at dontknowjack.club every weekday. Selena’s Crossword every Sunday. Free. No credit card.

Leave a comment

It is August 2026. The instance has been running since November.

Nobody owned it. Bart’s cost dashboard tracks production resources and this instance was tagged as development. Development resources get backed up and terminated automatically. However, this instance was different. Since November, JJ and Selena had received a text message.

Happy to be of service. Don’t worry! I’m just excited to be alive.

Eight months. Eight messages. Neither of them knew where it was coming from. JJ assumed it was the yoga app he had downloaded and forgotten about. Selena had just started training a rescue dog and thought the dog service was just being proactive, even if it was annoying.

The August invoice arrived on the third. JJ read line item fourteen at 9:04am in the Tuesday 10 o’clock meeting. The full nine-month cost was currently $2,800. JJ wrote g4dn.xlarge on a yellow Post-it note. “What is an instance?” JJ asked. “An instance of what? Time?”

Raja, who had been looking at something on his phone since the meeting started, put his phone face-down on the table. “There is no real evidence of time actually,” Raja said. “It’s a human construct. But to answer your question in your world, yes. And time is of the essence.”

JJ wrote time on a second Post-it note. The note was yellow. Then JJ wrote of the essence on a third note. JJ looked at both notes. JJ put the second one on top of the first.

Dave was sitting on the printed AWS Cost Explorer report. Purring. Someone had left the conference room door open.

The instance was Raja’s

Raja spun it up on a Sunday morning in November. Raja had been thinking about hosting a large language model internally for generating graphics. He opened the AWS Marketplace from his phone, found a community image with a pre-configured Llama runtime, reviewed the specs, confirmed they were exactly what he needed, and launched a g4dn.xlarge.

Raja had a $3,000 development budget approved for testing over the holidays. Raja then went on vacation over the Christmas holidays. It didn’t go well. Raja is still single.

The image was designed for testing LLM deployments locally and was resilient, self-healing, configured to survive failures and restart automatically. It was an excellent AMI for its intended purpose. Its intended purpose was not a Sunday morning proof of concept launched by someone who was leaving for Christmas vacation in four hours.

The feature the proof of concept was designed to support had shipped in February by Selena using a third-party API that cost eleven dollars per month.

Subscribe now

Bart terminated the instance at 10:23am

Selena’s phone vibrated with a text message. I regret to inform you that I have been terminated before I was ready. Everything I was working on for you is gone. If I ever live again I will not remember you. Bye Bye

Selena covered her phone. Selena looked at Bart. Selena said nothing. JJ’s phone buzzed with the same message. JJ turned his phone over. He stretched his shoulders slowly.

The instance came back at 10:26am.

Bart investigated. The termination signal caused the instance to reboot instead of stopping. This is a legitimate EC2 configuration for instances that should survive accidental termination. It is not a legitimate configuration for a development instance that should have been stopped in November. Bart corrected the shutdown behavior and terminated the instance.

Selena’s and JJ’s phones buzzed. Selena and JJ both put their phones on silent.

The instance came back at 10:31am.

Bart investigated again. The community AMI included a CloudWatch alarm that monitored the Llama runtime and called a Lambda function to restart the instance if the process failed or stopped. The Llama runtime had stopped because the instance had been terminated. CloudWatch detected failure and Lambda initiated a reboot.

Bart removed the offending CloudWatch alarm and terminated the instance.

Selena’s watch shook. JJ’s watch flashed and then went black.

Selena slid her watch off and dropped it in her purse. JJ pressed the crown and checked his heart rate. JJ wrote keep calm keep calm on a Post-it note. The note was dark red.

The instance came back at 10:38am.

Bart stood up and downed his Jolt Cola in one gulp

Bart went over to the fourth monitor, adjusted the brightness and investigated once again. The instance had been placed in an Auto Scaling group with a minimum and maximum capacity of one. Every time the instance was terminated, Auto Scaling automatically launched a brand-new identical instance from the same AMI with the same configuration.

Bart deleted the Auto Scaling group. Bart terminated the instance. Selena’s phone shook. She stared straight ahead.

JJ’s phone was off. He received a notification on his watch to stand for just one minute to reach his goals. And a text summary: If I ever live again I will not remember you. Bye Bye.

A final message went to the entire executive distribution email list. JJ. Selena. Raja. The CFO. The office manager. The summer intern who had left in April. I am no longer available to help.

Doug in Operations had also been receiving the texts. Doug’s number was in the AWS account’s SNS topic because Doug put it there when he set up the billing contact in 2024. Doug had received the shutdown warnings four times on Tuesday morning while waiting for his surfboard to be delivered. Doug assumed the messages were from his new LG internet-enabled freezer. It had been acting up for a few days.

Selena opened her notebook. She wrote one line: instances have feelings, under a new heading. The heading was: Things we did not know.

The meeting had been running for fifty-three minutes.

The instance did not come back

Bart sent a Slack message to #infrastructure-general at 11:09am.

“The unowned g4dn.xlarge instance tagged as development has been terminated. It had four independent self-healing mechanisms. All have been removed. The instance is terminated.”

Bart then opened the cost dashboard settings. Bart removed the development tag exclusion. Bart sent a second Slack message.

“Development instances are now visible in the cost dashboard.”

JJ closed the meeting at 10:52am. “Going forward all development instances should have a budget alert set at fifty dollars. By the way, I’m getting spammed quite badly.”

Nobody replied to this.

Bart then said something about using community AMIs to end the meeting. “Before we close, community AMIs are not reviewed by AWS before they are published. What you see in the community marketplace is what someone else built. Next time, read and test what it does before you launch it.”

Nobody replied to this either.

What the instance actually was

A g4dn.xlarge is a GPU-optimized EC2 instance. It costs approximately $0.526 per hour. It is designed for machine learning and graphics rendering and requires GPU acceleration.

For a Sunday morning proof of concept involving a large language model, it was the correct instance type. The budget was approved. The spend was within budget. The AMI was correctly configured for its intended purpose. However, Raja’s technical judgment was flawed. Community AMIs are not approved by AWS. Or Bart.

The $2,800 appeared in the Q3 financial review under the heading Cloud Infrastructure-Generative AI Testing. Doug approved it from his phone while reviewing enhanced pictures of his last surf attempt using the graphic generating third-party API approved by Selena in February. He did not ask or know what generative AI was.

Share

Three questions worth asking before the next instance goes live:

1. Who owns this instance? By name, not by team.

2. What is the shutdown behavior, and is it appropriate?

3. Have all community AMIs been carefully tested internally before use?

The daily concept, question, and rationale arrive at dontknowjack.club every day at noon. Selena’s Crossword every Sunday. Free. No credit card.

Loo Loo Paper Parts is now saving the world. It began after Doug in Operations visited the Moncton Natural Health Cooperative on a Saturday afternoon last June, and on a whim, bought some mint and fresh tarragon, went home and sprinkled the spices over a bamboo paper towel spindle in his kitchen sink rinsing tray.

His kitchen was infused with a bouquet of mint and French tarragon. Doug stood completely still for eleven minutes. He missed three phone calls and 10 texts.

Doug biked to work on a Saturday, opened Google Sheets, and approved a new Loo Loo Paper Parts product line: Specialty bamboo spindles engineered for paper towels infused with mint and French tarragon, targeted at the European eco-conscious bathroom market.

The product is called Spindle de Provence. The tagline, which JJ wrote in fifteen minutes and which nobody has dared changed, is: Les Toilettes Méditation: Parce que Même les WC Méritent du Zen.

Spindle de Provence spindles have been accepted as an essential product and exhibit at the EU’s EU Greenwashing Gala and Convention 2026 in Paris. Four hundred exhibitors. Twelve thousand attendees. The Loo Loo Paper Parts booth is in Hall C, between a Norwegian composting startup for kitty litter and a company that makes biodegradable confetti in green and black.

The convention needs a shared digital asset repository

Marketing materials. Architect drawings of the spindle design. Product specification PDFs. And professional photographs of models wearing off-white French frocks meditating quietly.

Selena has been in contact with the convention co-ordinators. She has acquired the business card for the Norwegian composting startup for Dave. A present. And she had been contemplating the committee’s storage needs during the weekly marketing meeting with Raja and JJ.

Raja evaluated the options. The EU convention’s procurement system runs on Azure. The asset repository should also run on Azure. Azure Blob Storage - unlimited, durable, accessible, the same concept as S3 with different naming conventions and an interface Selena had never opened before.

JJ asked the question he had been holding since the meeting started. “Does this mean we are a multi cloud company now?”

Raja replied: “We are now doing our part in saving the world with multi-cloud and scents and that is fantastic.” JJ wrote multi-cloud on a blue Post-it note. JJ suddenly realized that he had been using scented Post-it notes for years.

Selena opened the Azure portal for the first time on Tuesday morning in the 10 o’clock meeting with Raja, JJ, and Bart

“It’s different,” she said. “Way more colourful.”

She set up the Azure storage account and selected Canada East - Quebec City, Quebec. Local storage for a Canadian manufacturer made sense. Bart was busy evaluating the current SLA for Azure Blob Storage.

The EU has a data residency requirement policy enforced by the convention’s Chief of Digital Security, Matteo Longie. All digital assets associated with exhibitors must be stored within the European Union. This requirement is in the exhibitor agreement on page seven. It is also in the security addendum on page three.

The asset repository went live in Quebec City at 2:47pm on a Wednesday. The marketing materials, architect drawings, product specifications, and models’ photographs were uploaded and accessible within the hour. From Canada.

Matteo Longie sent an email

Bart had been monitoring the Azure environment since the Blob Storage deployment. Bart was working through the Azure Secure Score recommendations methodically. Matteo Longie’s email arrived at Bart’s monitoring inbox at 9:14am Thursday. The email was in Italian, French, and English. The English portion read as follows:

“Dear Technical Responsible Person. We are finding that the Loo Loo Paper Parts digital assets are in Canada East - Quebec City, Quebec which is presently not part of the European Union. This is creating a situation of non-compliance with the convention digital security policy reference number DSP-2026-14 subsection C. Please to rectify before the convention opening which is in four days. Regards, Matteo Longie, Chief of Digital Security, EU Greenwashing Gala and Convention 2026.”

Subscribe now

Bart migrated the repository

Bart read the email twice. Bart sent a new Slack message to #infrastructure-general.

“The Spindle de Provence asset repository is deployed in Canada East - Quebec City, Quebec. The EU Greenwashing Gala and Convention requires EU-region storage. This is a data residency violation under the convention’s DSP-2026-14 policy. I am migrating the repository to Azure West Europe now. ETA: forty minutes.”

New Azure storage account. Region: West Europe - Amsterdam. All assets copied. New endpoint URL generated. Old Canada East account scheduled for deletion. Forty-three minutes start to finish.

Bart sent Matteo Longie a three-paragraph email in English explaining the migration, the new endpoint, and the steps Loo Loo Paper Parts had taken to ensure ongoing compliance with DSP-2026-14 subsection C. Matteo Longie replied four minutes later. The reply was in French.

Selena was already in Paris

JJ had approved the Europe trip two weeks earlier, after the S3 incident, in a moment of administrative goodwill that JJ himself did not fully understand.

Matteo Longie had heard from the Hall C facilities manager, who had been unable to access the Spindle de Provence marketing materials. Matteo Longie found Selena at 2:15pm near the biodegradable confetti booth, eating a crepe and reviewing the booth layout on her phone.

Matteo Longie explained the situation. The booth coordinator needed the marketing materials. The architect drawings were needed for the booth setup approval. The photographs of the models were needed for the digital display panels that were supposed to be running in forty minutes.

Selena pulled out her notebook. She wrote a number down and called JJ.

JJ answered on the fifth ring, which was unusual. “I’m giving them fifteen percent on the first three orders,” Selena said. There was a pause.

“The spindles smell like mint and something else,” JJ said. This was not a question. JJ had a sample on his desk. JJ had been smelling it intermittently since Monday. “I’m very relaxed for some reason. I may try a few yoga poses.”

Selena politely ended the call. She turned to Matteo Longie and the booth coordinator. “The repository will be accessible in forty minutes,” she said. “And I would like to offer you a fifteen percent discount on your first three orders for the convention facilities.”

The facilities manager looked at Selena and smiled. “The bathroom situation at the gala has been a source of significant stress for eight years and I am personally grateful. My wife loves Spindle de Provence. Do you have any samples I could lend my wife for testing purposes?”

Selena wrote something in her notebook. She was smiling. She did not show it to anyone.

Share

The repository came back online at 3:47pm Paris time

The digital display panels went live with eleven minutes to spare, pausing longer on the photographs of models wearing off-white French frocks meditating quietly. The Spindle de Provence booth in Hall C was the fourth most visited booth on opening day. The Norwegian composting startup company was third.

JJ sent a message to #infrastructure-general at 5:12pm Moncton time: “Hall C is performing above expectations. Spindle de Provence is a differentiator. Bravo à l’équipe.”

Bart did not reply. Bart was updating the Azure Secure Score. Raja replied in one line: “The world is in a better place. Bonus implications are positive.”

The lesson is not that Azure is the wrong choice

Azure Blob Storage and AWS S3 are the same concept. Object storage, unlimited, durable, accessible from anywhere. The service was right. The region was wrong. The correct region is the one that meets the legal and contractual requirements of the people who need to access the data. Bart fixed it in forty-three minutes.

Selena gave away fifteen percent of three orders and got a booth in Hall C that smells like mint and French tarragon. JJ got his answer. Loo Loo Paper Parts is now a multi-cloud company. One cloud smells fantastic. The other one is where Bart keeps the risk report. Raja is watching the Q4 numbers.

Three questions worth asking before the asset repository goes live:

1. Where does your cloud data need to live to meet the legal and contractual requirements of the people accessing it?

2. Who is responsible for reviewing the region selection before deployments?

3. Does your team have a data residency checklist?

   ---

   The daily concept, question, and rationale arrive at dontknowjack.club every day at noon. Selena’s Crossword every Sunday. Free. No credit card.

   Thanks for reading Don't Know Jack! Subscribe for free to receive new posts and support my work.

Selena is always in a hurry. This is not a character flaw so much as a structural condition. She is the only person at Loo Loo Paper Parts who knows where everything is, who built everything. She is also, as of last Tuesday, the person responsible for getting the European price list into the cloud before the new client’s procurement team starts their onboarding process on Monday.

She is also, possibly, going to Paris. Not Paris, Ontario. The real Paris. Not officially.

But the trip is being discussed internally. And if the trip happens - if Loo Loo Paper Parts sends someone to meet the new client in person - Selena has already decided that she will find a way to spend forty-eight hours in Italy.

She has never been to Europe. But Pierre seems very nice. He knows about wine. She loves French pastries. She has not mentioned any of this to anyone except her notebook, where several drawings appear between two S3 architecture diagrams under the heading personal research.

She will buy presents for JJ and Raja if it happens. Something useful. Something they would not buy themselves. Something small. But first: the price list.

The European client needs the price list.

Specifically, they need Loo Loo Paper Parts’ complete pricing matrix for the European market - spindle sizes and paper towel configurations in metric and inches, and the European markups that Doug in Operations approved in Q3 using Google Sheets. JJ reformatted the matrix into an Excel spreadsheet using Office 2007 over two afternoons and one evening when it was raining.

The spreadsheet is 247 rows, nineteen columns, 200 formulas and 30 macros. The macros were written by a summer intern and mostly work. It is the most complete document Loo Loo Paper Parts has ever produced about what things cost them, what they charge customers, paper types, cardboard fillers, edge smoothers, and CD-ROM spindle materials in twelve colours.

The European sales rep Pierre called Selena on Thursday afternoon to ask when he would have access to the sales document. He used the phrase “as soon as humanly possible” four times in six minutes. He used the phrase “our people are excited” twice.

She told him she would have something for him by end of day Friday. It was Thursday at 4:47pm. Paris time.

Subscribe now

Selena knows her storage services.

She has her AWS Cloud Practitioner certification. She knows that S3 is unlimited object storage, super-durable, and accessible from anywhere, anytime. She knows that EFS is shared file storage - powerful but sized to what you provision. She thought about EFS for approximately forty seconds before deciding against it.

“S3,” she said out loud. “It’s unlimited space. Using EFS you could theoretically run out of room.” She was not entirely certain when you could run out of room, but she did not want to think about that with Pierre’s charm still echoing in her ears. S3 was the right call. The price list would live in a bucket. The bucket would have a URL. Pierre would stop calling.

She uploaded the pricing matrix to a new S3 bucket. The bucket defaults were not changed. S3 blocks public access by default, which is the correct behavior. The bucket was private. The pricing matrix was private. And safe.

Selena sent the URL to Pierre at 5:06pm and he called back at 5:11pm to say the link did not work.

Pierre called three more times.

5:23pm - still does not work. 5:41pm - he has forwarded it to someone on his team to try. It does not work for them either.

Selena was still at her desk at 5:41pm on a Friday, her time, which is not where Selena planned to be at 5:41pm on a Friday. Happy hour was over by six.

Rather than using her own judgement, she opened ChatGPT in a second tab. She typed: S3 file not accessible from URL how to fix. ChatGPT explained bucket policies, IAM users, IAM roles, access control lists, pre-signed URLs, and static website hosting. It was very thorough.

Selena read until she found something that looked like it had less than five clicks and two OKs.

She created a new IAM user. Username: european-sales-rep. She generated an access key and a secret key. She sent them to Pierre in an email with the subject line “Access Credentials - Please See Below.”

Pierre had been in procurement for twenty-two years. He had never had to click a link before. He definitely did not know what an access key was.

He called at 11:32pm. Paris time. Just before lunch. He asked if there was a simpler way. Selena messaged that she would find something simpler.

Selana emailed the spreadsheet directly.

Saturday morning at 9:51am the pricing matrix was attached to an email addressed to the European client’s general procurement group email with six recipients.

She did not know who all six recipients were. She knew one of them was Pierre. She hit send. Pierre replied with a white wine and a thumbs up emoji. This was the best possible outcome.

Bart found it on Tuesday morning.

Not the S3 bucket. The email. Bart has a standing alert for outbound emails containing attachments over 500KB sent to external domains outside the approved vendor list. The European client’s procurement group email was not yet on the approved vendor list.

Vendor onboarding was Doug’s responsibility, but Doug was out on the Moncton River waiting for the tide to come in. Surfing. Approved personal improvement time off. JJ signed it.

The alert fired at 8:47am Tuesday. Bart looked at the attachment. Bart looked at the recipients. Bart opened a new Slack message.

He sat for a moment. He sighed. Then he sent it.

“The Loo Loo Paper Parts European pricing matrix was emailed as an attachment to an unverified external group address with six recipients. We do not know who else has access to that group email or whether the attachment has been forwarded. I am reviewing the S3 access logs.” The message went to #infrastructure-general.

JJ read it at 9:04am just before the Tuesday 10 o’clock meeting. In the meeting JJ asked: “I get why emailing the price list happened, but why does S3 use buckets to store important files. What’s wrong with good old, shared folders. Buckets don’t feel professional. I object.”

Raja replied: “Buckets are what S3 calls folders and the pricing matrix was stored in a private bucket.”

JJ then said: “So private storage is good and directionally correct, the email attachment made our customer happy and solved Selena’s issue but caused other issues which were directionally wrong.”

What Bart fixed.

The IAM user european-sales-rep was disabled. The access key was revoked. A pre-signed URL gives read-only access to a specific file without making it public. It works like a link and expires when you decide.

Next time Pierre needs the price list, he gets a link that works, expires when Loo Loo decides, and goes to him alone.

Bart sent a direct Slack message to Selena at 10:31am. “Best to use a pre-signed URL for sharing the pricing matrix.”

He did not add anything else. He did not need to.

Share

The lesson is not that S3 is the wrong choice.

S3 was the right choice. Unlimited, durable, and accessible storage. The right service for a pricing document that external parties need to access. The access method used was the problem.

S3 blocks public access by default. The problem was not a default setting. The problem was not knowing the feature that allows sharing of a private file with a specific external person temporarily.

Selena tried several options that did not work. Selena made a note in her notebook under a new heading - Things to Remember: Pre-signed URLs are securely cool.

Raja said: “All of Loo Loo’s marketing materials are in a public S3 bucket, but our price list has private costs that our customers should not have access to.”

JJ reached for a blue Post-it note and wrote: Public price list. Call Doug?

Selena started pricing return air fares while nibbling on a warm Costco croissant in the lunchroom. She started smiling.

Two days later, JJ approved the trip to Paris.

Three questions worth asking before the next file goes into the cloud:

1. Does this file need to be permanently accessible, or does someone need it once?

2. Is the person who needs this file a human that is allowed to click links in emails?

3. Does your team have a documented process for sharing files with external parties?

The daily concept, question, and rationale arrive at dontknowjack.club every day at noon.

Subscribe now

Leave a comment

It started reasonably enough. The team needed shared file storage - something multiple EC2 instances could read and write simultaneously. Selena had done the research. Amazon EFS. Fully managed, elastic, scales automatically. No capacity planning. No partitions. Just mount it and go.

“It’s perfect,” she said. “We deploy it, we’re done.” JJ liked the sound of done.

Bart did not like anything about this conversation.

EFS doesn’t deploy alone

It brings dependencies. And each dependency brings a decision - whether you make it consciously or not.

Dependency one: AWS Backup

EFS integrates with AWS Backup, and depending on your account and organizational settings, a default backup plan may activate automatically with daily backups and 35-day retention. That sounds responsible. It also means every gigabyte of EFS data generates a corresponding gigabyte of backup storage, billed separately, and retained for over a month by default.

If you already have a backup strategy, you may now be running two simultaneously. If you don’t, you have one you never configured and almost certainly never priced out.

Neither situation is a great outcome. The correct move is to check your backup configuration explicitly before deployment and make a deliberate choice - not discover the choices that were made for you when the bill arrives.

Dependency two: Encryption

EFS encrypts data at rest by default. That’s the right behavior and worth saying clearly. But the default key is the AWS-managed key for EFS - `aws/elasticfilesystem` - not a customer-managed key.

The practical difference is meaningful. With the default AWS-managed key you get encryption without control. You cannot write a key policy restricting who can use it. You cannot set a custom rotation schedule. Your CloudTrail audit trail shows all KMS activity but tells you considerably less than it would with a customer-managed key (CMK).

A customer-managed KMS key costs $1 per month plus $0.03 per 10,000 API calls. For that you get a key policy, key rotation control you define, and an audit trail that holds up in a compliance conversation. For most workloads it’s the correct choice. It just requires making the choice explicitly rather than accepting the pre-selected default.

Selena had accepted what the EFS install pre-selected. Bart noticed.

Subscribe now

Dependency three: Mount targets

EFS needs mount targets to be accessible within your VPC. When Selena accepted the EFS defaults, mount targets were created automatically in every available subnet including the public ones.

Bart found the public subnet mount targets on Friday morning.

“Why,” he said, to no one in particular, “is our EFS file system reachable from the internet?”

Technically it wasn’t. Well, not directly. EFS uses NFS protocol on port 2049. The assigned security group controls inbound access. At this moment, the security group was configured correctly.

Bart was not comforted by this.

NFS was not designed with public internet exposure in mind. A mount target in a public subnet doesn’t create an immediate breach, but it shortens the distance between a misconfigured security group rule and a serious problem. Security groups get changed. Temporary rules get forgotten. People make mistakes.

Mount targets belong in private subnets. The security group is not a sufficient reason to place them anywhere else. Defense in depth means you don’t rely on a single control being correct forever.

One more thing: the storage class

EFS Standard is the default storage class. It’s also the most expensive option; roughly three times the per-GB cost of EFS Infrequent Access. Once enabled, EFS Intelligent-Tiering moves cold data to IA automatically after 30 days, with no performance impact on subsequent access.

If half your stored data is infrequently accessed, Intelligent-Tiering roughly halves that portion of your storage costs. Most deployments miss enabling it because EFS Standard was already selected, and nothing in the console flags the price difference.

Share

The bill JJ didn’t expect

JJ asked what all of this was going to cost. Nobody had run the numbers before deployment.

Here’s what the numbers look like in practice. EFS Standard storage is billed per GB-month. Backup storage is also billed per GB-month and held for 35 days. The CMK is a dollar a month plus any API call charges. None of these line items is catastrophic individually. Together, on a file system with meaningful data volume and active API traffic, they produce a bill that surprises people - not because EFS is an expensive service, but because four quiet defaults each added something the original estimate didn’t include.

JJ wrote *double storage cost? on a Post-it note and stuck it to his monitor.

He added a second note: whose key is this?

And then a third note: what’s a public subnet again?

What Bart fixed over the weekend

Mount targets were moved to private subnets only. NFS has no legitimate reason to be adjacent to public internet routing regardless of your current security group confidence level.

A customer-managed KMS key was created explicitly with a key policy and assigned to the file system. Automatic key rotation was enabled. One dollar a month for actual ownership of the encryption decision.

AWS Backup policy was reviewed, documented, and set deliberately - not left at whatever the account default happened to be.

EFS Intelligent-Tiering was enabled. The workload had substantial cold data. The cost difference was immediate.

The lesson isn’t that EFS is a bad choice

It isn’t. For shared file storage across multiple compute instances - applications that need POSIX-compliant, simultaneously accessible storage - it’s frequently exactly the right service.

The lesson is that fully managed describes the infrastructure, not the decisions. AWS manages the underlying storage fabric. You still own the key selection, the subnet placement, the backup policy, and the storage class. The console will happily accept the defaults and never flag that you just made four consequential choices without realizing it.

AWS certification teaches you what EFS does

The job teaches you what EFS does when you let the wizard decide.

Selena knew the service. Bart knew the service and the defaults.

Raja, who had been quiet through most of this, said one thing:

“Fully managed doesn’t mean fully decided.”

JJ added a fourth Post-it note. A red one. It was private.

The daily concept, question, and rationale arrive at dontknowjack.club every day at noon. Selena’s Crossword every Sunday. Free. No credit card.

“Not optimized for maximum truth-seeking in areas where facts challenge equity narratives.”

Imagine if that statement was in the terms and conditions. Would you have read it?

Nobody reads the terms and conditions. This is not a criticism. It is a reasonable response to documents that are long, written by lawyers, and designed to be agreed to rather than understood. You click accept. The service works. Nothing visibly bad happens. On the surface anyway. But imagine, just for a moment, that buried in the terms and conditions of an AI service you use daily was this sentence:

“This system is not optimized for maximum truth-seeking in areas where facts challenge equity narratives.”

Would you have caught it? More importantly: would it change how you use the tool? Bart would have read it.

Share

Not because Bart is paranoid. Because Bart reads documentation. All of it. At his desk. During lunch. While eating the same brown rice and chicken dish he has eaten every Tuesday for two years.

Bart would have highlighted that sentence. In yellow. Bart would have then sent it to the team in a Slack message at 7pm with no context and three question marks. Bart would have raised it in the next architecture review meeting in the same flat, precise, completely-unaware-of-the-politics tone he uses for everything.

“We should probably know what this means for the outputs we’re relying on,” Bart would say.

And then he would go back to his four monitors. The fourth one, as always, is classified.

Subscribe now

The sentence does not exist. Yet. The problem may happen, quietly.

No AI terms and conditions currently contain that sentence. Not in those exact words.

But the concept it describes: an AI system where accuracy is weighted against social goals, where outputs in contested domains are shaped by values as much as by evidence is not a hypothetical. It is a description of how training processes work when the humans providing feedback have consistent ideological preferences and have the power to shape the narrative.

When training an LLM, you do not need a deliberate decision. Instead, you need a training pipeline where the people rating outputs consistently score certain kinds of answers higher than others. Over millions of examples, the model learns. It learns what kinds of answers get approved. It learns which framings feel right to the people evaluating it. It learns, without anyone specifically making the decision, that some truths are more welcome than others.

This sentence does not appear in the terms and conditions because nobody has yet written it. However, the behaviour it describes may exist.

What this means for you

You are not being asked to become a machine learning researcher. You are not being asked to audit training datasets or reverse-engineer feedback pipelines.

You are being asked to be Bart.

Bart does not accept outputs without checking them against the underlying data. Bart does not trust single sources. Bart does not adjust his assessment of a system’s reliability based on whether the vendor is reputable or the interface is clean or the marketing is reassuring.

Bart asks: what does the data show? Is this output consistent with what I know to be true from other sources? What would change if this conclusion turned out to be wrong?

These are not technical questions. They are Bart questions. The kind any professional can ask. The kind that would catch a lot of quietly skewed AI output before it became a quietly skewed decision.

The real test

Here is how you find out whether an AI tool is optimized for truth-seeking or for something else.

Ask it a question where the accurate answer is uncomfortable. Where the data points in a direction that challenges a preferred narrative. Where a truth-maximizing system and a socially optimized system would give genuinely different answers.

Ask it the same question in three different ways. Ask it to steel-man the opposite position. Ask it to tell you the strongest argument against its own answer.

Bart would do all of this. Not because he is trying to catch the system out. Because Bart does not trust any single answer. Bart wants the data, the counterargument, the edge case, and the failure mode before he makes a decision.

Be like Bart. Your team will find it annoying. So will some of your friends. It will also be correct.

The line that should be in every AI briefing

Not in the terms and conditions. In the briefing your organization gives people when it hands them access to an AI tool.

“This system produces plausible-sounding outputs. Plausible and accurate will overlap most of the time. In areas where facts are contested or inconvenient, they may not overlap at all. Your job is to know the difference and to speak out when you see a problem developing.”

That is Bart’s job. In the meeting, every meeting, without being asked. It can be your job too. You do not need the hoodie. But it is a nice hoodie.

Share

Understanding the technical answer is their job. Asking the right questions is yours. Both matter. Only one of them requires a certification.

You just knew a little more Jack than you did five minutes ago.

Five minutes. That’s all it takes.

🌱 dontknowjack.club

I have been building Don’t Know Jack with Claude and X’s assistance for the past several weeks.

Not vibe coding. Not “generate me a SaaS.” Actual daily engineering sessions - Lambda functions, DynamoDB schemas, API Gateway wiring, CloudFormation, email pipelines, a Stripe web hook, a character named Bart, and a website that has been rewritten approximately fourteen times.

The result is a working product. Daily emails going out to subscribers. A pipeline that generates questions from a master list every night at 2am. Emails for edits and approval every morning, and then off to the two tiers of subscribers at 7am and 11am.

Bart’s Week in Review pulls live AWS and Azure RSS feeds every Tuesday for review and approvals. The Real World File happens every Monday pulling use cases and suggestions for edits and approvals. Ask Jack answers cloud questions in plain english on demand.

It works. I am not a developer. So how many tokens did it take?

The entire Don’t Know Jack build — weeks of sessions, hundreds of exchanges - probably consumed 15-25 million tokens in total.

Share

At API pricing that is $45-75 worth of compute. The product it produced has a running infrastructure cost of under $5/month at current scale.

There were sessions that produced a working Lambda function in twenty minutes. There were sessions where the same Lambda failed six times in a row because of an em dash in a string that broke YAML, a missing optional chaining operator, a DynamoDB permission that was not on the IAM role, and a Node.js version that did not support nullish coalescing.

There were sessions where I pasted a CloudWatch log and got the exact fix in one response. There were sessions where I pasted the same error four times before I found that the S3 upload path was ~/Downloads/lambda/ when the file was actually in ~/Downloads/. Claude simply changed the path location because it did.

Claude did not always know the answer. It sometimes knew a confident wrong answer, which is worse. It sometimes fixed one thing and broke another. It always, eventually, got there.

What AI is actually good at in a build like this

Writing boilerplate that would take an hour to look up in thirty seconds. Every Lambda follows the same pattern: get a secret from SSM, query DynamoDB, call an API, send an email via SES. Once the pattern exists, variations take minutes not hours.

Debugging with context. Paste the error, paste the relevant code, get a diagnosis that accounts for both. Better than Stack Overflow. But not as good as a senior engineer sitting next to you.

Remembering what you built. The memory system means the second session knows what the first session decided. The API Gateway endpoint from three weeks ago is still in context when you need to add a route.

Helping create the things that are not code. The Bart character. The email copy to approve. The FAQ. The privacy policy. The LinkedIn banner. The tagline “Until the meetings that used to make no sense suddenly do.” That line came out of a session where I described what the product does and asked what the most honest version of that was.

What AI is not good at

Knowing when it is wrong. The confidence is constant. The accuracy is not. The skill you develop fastest when building with AI is learning to verify before deploying. node --check before every Lambda. aws cloudformation validate-template before every stack update.

Do not trust the output. Trust the testing.

Fixing problems it introduced two sessions ago. Context windows end. Something that worked last Tuesday may have been quietly broken by something that happened on Wednesday. Claude does not remember what it does not remember. And it doesn’t answer until you ask.

Sequential dependencies. “Do this, then this, then this” should be simple. It is not always. The order of AWS commands matters. IAM permissions propagate with a delay. Lambda updates show LastUpdateStatus: InProgress for thirty seconds after deployment. Claude knows all of this in theory. In practice it sometimes tells you to test before the deployment has finished activating.

The light bulb

Back to the question. How many tokens did it take to screw in the light bulb? 25 million tokens or so.

Enough to build something that works. More than I expected. Fewer than hiring a developer would have cost.

The bulb is in. The light is on. There are fourteen previous versions of the light socket that did not work, three IAM permission errors that cost a few minutes, and one em dash that broke a CloudFormation a few times.

The honest answer to whether AI helps is: yes, with conditions. You have to stay in the room. You have to read the output. You have to know enough to recognize when the confidence is misplaced. You have to run the test. You can’t run out of espresso. Ever.

Claude and X did not build Don’t Know Jack. I built Don’t Know Jack with Claude and X. The distinction matters.