A story of two patches
Last Wednesday evening, I was reading about PHP2Shell, critical flaws disclosed that week. They could let attackers take over vulnerable PHP servers, which made me concerned about the one hosting my WordPress blog.
Earlier that day, a contractor had found a hole in my roof.
Looked like both my online and offline homes needed patching. Neither was quite the small job I would have liked.
My hosting provider no longer supported the server image my site ran on, so patching PHP would not be easy. So I asked my personal AI agent for a way forward.
My ChatGPT Dot (OpenAI’s personal agent) is called Skelly*. I asked Skelly whether we could build a static site instead: plain HTML pages, with no PHP or database to patch.
Off Skelly went to analyze almost 15 years of posts, and came back suggesting Hugo (a static site generator). I ended up picking Cloudflare, and we worked out a migration path (screenshots below).
Before bed, I told Skelly to get going: deploy a test copy on Cloudflare, check it, and only switch my domain over when I approve. By Thursday morning the site was ready. It is now live, cheaper to run, and simpler to publish to.
Doing this myself would have taken weeks. More likely, I would have put it off and hoped security through obscurity would somehow remain a viable strategy.
I would have liked the same choice for the roof. “Please rebuild my house using a more modern and secure technology” has a certain appeal. Unfortunately, I don’t have a year and half a million dollars to spare. Someone still had to get onto the roof and fix the hole.
For years, we patched old software because replacing it took too much effort. When an agent removes most of that effort, the calculation changes. Increasingly, the most expedient answer to “how do I maintain this?” is “how much of this do I still need?”
This part is bittersweet. I have run WordPress sites for many years and know the framework well. Now my blog runs on a framework I barely know, and I am betting Skelly, or a future agent, will handle the grunt work. I am trading years of experience and confidence for dependency on AI.
Many companies face the same trade-off. Patching is slower and potentially less secure, but a better understood option. I suspect market and cost pressures will favor the rebuild.
I am happy with Skelly’s work and with the contractor’s. Both fixed problems I would rather not have had. One of these patches cost rather more than my AI subscription.
* Skelly is named after a character from Hades - one of my favorite video games. Skelly is a training dummy (and a skeleton). He is cheerful, helpful, and a little kooky. Just like my agent.
Rebuilding my site #
