Engineering notes from the trenches of building software.
Practical, no-hype writing for developers and businesses - on AI, ERPNext, Frappe, Linux and shipping software. I cut through the noise to what actually works, with a sharp eye on what it all means for Africa.
- 478
- Articles
- 33
- Topics
- 11
- Years writing
Featured article
Don't Get Pressured Into Buying AI Before Your Business Is Ready
The hype says buy AI now or be left behind. The truth is most businesses aren't ready yet, and rushing wastes money, frustrates teams and quietly breaks customer trust. Using the Ngazi ladder, here's how to find the rung you're really on and take the one step that pays off.
Recent articles
Your spare Android phone is a payment gateway: an offline-first SMS relay for M-Pesa
M-Pesa till confirmations arrive as an SMS, and Daraja is not open to every merchant. So we turned a spare Android phone into a self-hosted SMS-to-HTTP gateway: encrypted on-device, HMAC-signed on the wire, and built so that it never loses a message.
Six ways Android will eat your background service, and what actually worked
A broadcast receiver is a lie, WAL journalling wedged openDatabase on OxygenOS, and one polite database close in a WorkManager teardown silently stopped the whole gateway. Six real failure modes from a production Android SMS gateway, and the fix for each.
Exactly-once over an unreliable pipe: HMAC, nonces, and a byte-exact contract
A per-request nonce and a per-content hash look like the same idea and are not. One says this request arrived twice, the other says this message arrived twice, and a payment pipeline needs both. The signing design behind a production SMS gateway.
Shipping an Android app that can never be on the Play Store
Play forbids READ_SMS for anything that is not the default SMS handler, so this app was never going to be listed. Then a silent fallback to the debug keystore and a versionCode stuck at 1 turned every update into an uninstall. Two traps, one incident.
Deploying Frappe apps to a client server you're not allowed to touch
The client will not give you access to their dev server, so every code change means someone on their side pulls and migrates by hand. Here is the complete fix: a self-hosted runner they install, a deploy script they own, and no credential to their environment on your side at all.
The OEM autostart rabbit hole: deep-linking into a dozen undocumented settings screens
Android has no API for the autostart allowlist your phone's manufacturer invented. So you keep a list of undocumented component names, try them in order, and design the failure case properly, because Transsion, which is enormous in Africa, exposes nothing at all.