Kevlin Henney

consultant • father • he/him • human (very) • husband • programmer • keynote speaker • technologist • trainer • writer

Location: ☉+~1au
Blog: https://kevlinhenney.medium.com
About: https://about.me/kevlin
Contact: http://kevlin.tel

Last Notes

2026-03-06 09:21:53 UTC

A lot of security is based on trust. Trust relies on competence. The security theatre I get from a lot of sites and apps, sometimes elaborated through MFA, does not inspire such trust.
That device you tell me is unrecognised? It's the one I've used to access the app every day for at least the last year.
If you want to convince me your app is secure, start with competence. Poorly engineered products don't do that. KPI-driven product staff don't do that.

2026-02-03 10:41:57 UTC

There's a standard gag about LLM chatbots: whenever I use AI to probe a topic I know something about, it makes numerous errors; by contrast, whenever I use it to explore topics I know little about, it knows so much more!
Unrelated: while workers report or are measured to have at best modest improvements to their work when using AI, CEOs and managers say AI has many benefits to the work of their organisation.

2025-12-03 02:01:53 UTC

- reply

What I tell people to keep in mind is (1) remember type hints are optional, so there's no guarantee they get checked, and (2) if you guarantee they're checked for your own code, that's no guarantee they are checked by people outside your team using your code.

2025-12-03 01:58:55 UTC

A question I get every now and then when teaching or workshopping anything to do with testing and Python: We're using type hints, so should we bother writing code to handle and raise TypeErrors?

2025-08-26 08:33:50 UTC

Next month you can find me and my talk, "Principle Misunderstandings", at @npub1chh…h4a7 in Manchester
https://2025.pyconuk.org

2025-08-22 15:03:30 UTC

- reply

Bingo. You now create and slam into other bottlenecks harder.

2025-08-22 14:58:58 UTC

- reply

Rather than using AI to explore options, improve understanding and create better code, many (most?) developers (and non-developers) using LLMs — whether vibe coding or LGTM acceptance of whatever is generated — focus on creating feature complete software quickly and then devoting a disproportionate amount of time to debugging, fixing and generally cajoling it into better shape.
This has never been a sound approach. Adding AI to the mix doesn't change that, only the timescales involved.

2025-08-22 14:53:24 UTC

- reply

In practice, evolutionary prototyping also ends up suffering from the same problems. Prototypes are created in an intentionally rough and ready state with the idea they will evolve into quality products.
For both intrinsic (once something's created as a buggy mess, that tends to be its defining design characteristic) and extrinsic reasons ("Looks good enough to us, ship it!").

2025-08-22 14:51:48 UTC

- reply

This always takes more effort than expected and leaves the product with long-term low quality. Not just bugs, which are tracked, but unmanaged technical debt, which is not.
The 'feature complete' approach is based on a flawed understanding of the nature of both software and economics.

2025-08-22 14:48:57 UTC

In the 1990s and 2000s one of the preferred ways to develop software was the 'feature complete' approach. You develop each feature until it is complete but not production ready. In other words, develop without regard for quality. You 'do' quality later.
The 'feature complete' approach popularised separating testing into multiple phases (at the top level, alpha and beta testing). Put simply, the product was such a mess that whole chunks of the SDLC had to be devoted to patching it up.

2025-07-31 07:58:55 UTC

One of my constant frustrations with many apps (web and mobile) is the constant need to confirm via OTPs, 2FA, etc., that I am indeed me when I'm in the same session for which I've already just done this less than a minute earlier.
Security — as opposed to security theatre — requires a more joined-up approach to architecture. This kind of annoyance highlights potential problems of organisational structure and process in the development organisation, unmanaged technical debt, etc.

2025-06-27 22:35:49 UTC

- reply

This is the quote I believe you're after: https://x.com/KevlinHenney/status/3361631527
https://files.mastodon.social/media_attachments/files/114/757/710/327/845/231/original/42f0dbd0f0c154cc.png

2025-04-29 05:41:48 UTC

My "Learning from Failure" talk from
Devoxx Greece a couple of weeks ago:
https://www.youtube.com/watch?v=4XL3UN_Azfo

2025-02-17 16:53:20 UTC

Suggestion for a AI-based coding assistant: a comment dissonance checker.
Red squiggles under comments that contradict what the code actually does. Blue squiggles for comments that add no value to what is already obvious from the code.
Also, blue squiggles on code that could be improved to make a comment superfluous, e.g., rename a variable to be more explicit rather than having a comment explaining what the variable is for.

2024-11-27 13:23:46 UTC

PSA for those at the back who were otherwise distracted: test-first does not mean (and has never meant) write *all* your tests first.
This misunderstanding has lead to some curiously dysfunctional workflows and embarrassing pronouncements and publications, including an MSDN entry many years ago and the disappointingly disastrous second edition of Glenford Myers' The Art of Software Testing.

2024-10-20 08:34:34 UTC

Yeah, so sorry for the passive aggression, but pro tip for developers: if your system emails notifications to remind people to do a thing (complete account details, check in for a flight, sign up to an offer, etc.), don't forget to write the code that doesn't send out the notification if they've already done the thing 👌

2024-09-26 09:09:06 UTC

How do you know that a company doesn't know what to do with AI? They tell you they have an AI strategy, and they make sure you know it (press releases, annoying pop-ups in their apps, etc.).
You don't want an AI strategy. Get down off the hype wagon and find yourself a product strategy. You don't differentiate yourself by saying you have AI in your product (ten a penny); you differentiate yourself by creating a better product experience.

2024-08-22 06:00:56 UTC

Remember Web3? No, me neither.