I built my husband a doomsday button and exposed my router

Last night I sat my husband down for a user feedback session.

Not a chat. Not a quick "hey, I had a question about this." A prepared elicitation session. I had questions written down and everything.

I think this post will end up being first on the site just by virtue of timing, and the one image of this formal session with the man I love and share a family and life with should frame the neurodivergence part of this blog better than whatever long-winded post I might add later. I'm just... different.

At any rate, I wanted to know how Yarmeals has been working for him, and I got some great insight that really flipped some of my assumptions. Good stuff. And then, I asked what any other PM would ask at the end of a session, an open-ended "what else is on your mind?"

I should say up front what I am and what I am not. I'm a PM. Eleven weeks ago I hadn't shipped a line of code since some college project that involved the brand "Borland." It's not that I haven't spent a career intimately involved in every step of the software design and development process; it's just that I still ask Claude "what was that one github thing again?" and "WTF does 'PC --load -letter' mean?"

What I can do is describe a user's problem and my proposed solutions really clearly, and shepherd those solutions through a backlog and development pipeline. For eleven weeks that and learning how to make models take me through the build side have been enough to fill this house with working software. This is a post about a morning I was reminded once again that I've got a long way to go.

Sam thought for a moment about the question, and I could see him get lost in a real memory of a problem we could solve together. He gave a long sigh, and added a bit of a malicious grin, as he shared.

"I'd like an app I can push a button on and the kid's wifi network would immediately be shut off until they came down and did whatever the hell I was mad at them for not doing."

I dutifully wrote down Order 66 app.

Prioritized by fun

The next morning I sat down at my desk, looked at a backlog full of sensible, valuable, load-bearing work, and picked the item that sounded like the most fun. You prioritize your way, I'll prioritize mine.

I sat down to decompose the problem into what I'd need to build. I fired up Sonnet and asked whether I could disable a WLAN on my UDM Pro through the Ubiquiti API.

...thinking

Ah, good. We're off to a great start.

I should say that I'm not a token-maxxer out of any sense of ideology and passion. It's just that I vibe with Opus in idea sessions and I don't know what I lose by stepping down. But after a couple of weeks of running out of tokens before running out of week, despite stepping up my plan, I figured I needed to learn more concretely where those boundaries between models lay.

I found out.

Thirty minutes of configuring and cURLing and re-configuring, and we had it. Somewhere in there it occurred to me that kids piss off their parents even when the Dads are out of the house, so this puppy had better be reachable from the internet.

I had tailscale running on a closet mini-pc for another project, and it seemed like a natural to just open a new funnel and point it directly at the router. After all, nothing had gone wrong so far, right?

I pushed on.

It looked finished

And then I looked at what we'd built, and it was gorgeous.

Black background. PARENTS OF DOOM across the top in tracked-out caps. A single red button the size of a dinner plate with a glow coming off it. Underneath, a schedule toggle: School Week, Summer. Live at its own domain. It was a thing of beauty.

Now, sure, next I could derisk my ideas, and stress test the implementation before pushing--like a nerd-- but it was already so pretty...

You know that feeling when you're a teenager just as you're sitting down on the trash can lid at the top of the icy hill next to the freeway offramp? Should I really be doing this? Yeahhh... I should! I'm invincible! U-S-A! U-S-A!

I pushed.

I pushed a passwordless app with a direct line to my router, sitting on a public hostname, on the open internet. Nothing at all between a stranger and the box that controls every device in my home, except the fact that nobody had happened to look yet.

Then, before I gave it an inaugural run, I had a brief moment of maturity on that icy hill. I asked one of the older boys what he thought of the plan.

Opus was measured and reasonable

Measured and reasonable in the way a smoke detector at 3am is measured and reasonable.

WHAT THE FUCK DO YOU THINK YOU'RE DOING? TURN THAT OFF RIGHT NOW AND CHANGE ALL YOUR PASSWORDS.

...or something like that.

"erm... say more, Claude."

So, Tailscale has two commands that sound like siblings. And they are siblings, much in the way that one kid may be really responsible and cautious, and the other says "Kegger at my place! the rents are out of town!!"

tailscale serve publishes a service to your own private network, where only your devices can reach it. tailscale funnel publishes it to the entire internet. I had a funnel. On inspection I had two funnels, because of course the first one had been wide open too.

And I had kind of understood some of this the first time around, but I'd been quietly leaning on the belief that nobody would ever guess a hostname like that. It turns out that when a funnel goes up it gets a TLS certificate, and every certificate issued on the public web is written into Certificate Transparency logs. Those logs are public and scraped continuously by hackers in diapers looking for fun projects with their own eleven weeks of experience.

The secret URL is not secret. It is published with engraved invitations to come on by.

And once they're through that funnel, well...Opus put the difference between the funnel and serve best: with a serve, an attacker has to break a serious piece of cryptography to get at you. With a funnel, an attacker has to wonder whether this idiot has patched any of the last two thousand UniFi advisories. ...eep.

Now, I'm a bit salty, and I think I've earned a little of it. Tailscale's entire pitch is that it is the alternative to leaving your server exposed. That is the product. And sitting one command away from that promise is the command that does the precise opposite, separated by nothing but a different verb. A marketer lied to me. That's never happened bef—

Got dammit, Columbia Record and Tape Club. Twelve albums for a penny? I'll kill your mother!

Fifteen minutes

That is how long the new funnel was up with wide-open access to my network and router.

In fairness to me, I wasn't entirely incompetent here. The router requires MFA. I had already disabled the local testing account that Sonnet had walked me into creating as part of one of its earlier Rube Goldberg machinations. Even that account had a seventy-eight character password.

So the odds that anything reached me in those fifteen minutes are genuinely small, and I am glad that's true.

Regrouping

For eleven weeks I have been delighting in how fast I could move ideas into features. But I haven't been taking seriously enough my responsibility to understand more of what Claude is doing for me.

Yes, it can ship beautifully polished looking buttons and features, but as the yarbro at the keyboard, I own what's underneath the polish.

So, I might not ship code quite so fast going forward, but it will be better, and I'll understand more of what I'm putting out there and what it means to my apps and my family.

Epilogue

I turned both funnels off. The prototype is still sitting there, still sleek, still glowing, and capable of doing nothing. It's waiting for me to do that careful research on how to do it safely and reliably.

I can tell it's not going to be a straight line of progress though. As I was wrapping this up, I turned back to my Opus session and asked that next thoughtful question...

"Would Cloudflare be better?"

I'm doomed.