SysAdmin Weekly #27: The Boring Wins
I rebuilt a four-month-old project's entire changelog from nothing but git diffs in twenty minutes. The scoping is the whole game.
TL;DR
After a few issues of me telling you not to trust the machine, here is the other half of the ledger: the tangible, boring AI wins that are actually worth your time.
Episode 049 is out: how attackers run local LLMs on their own hardware to generate spear phishing at scale, why “spot the typo” training is dead, and where the real defensive line sits, with Eric Siron.
The Take: the same accessible AI that attackers point at scaling the bad stuff can be pointed at the valuable, well-scoped work you never had hours for, including understanding the threat landscape itself.
I rebuilt a four-month-old project’s entire changelog from nothing but the git diffs in about twenty minutes. The scoping that made it cheap is the same scoping that made it good.
Tool of the Week: Fabric, reusable AI “patterns” you run from the command line against hosted or local models.
From the Console
I have spent the last several issues being the guy telling you not to trust the machine. Doom Discounted, The Off-Switch You Don’t Own, the whole local-inference drum. I stand by every word of it. But that is one half of the ledger, and this week I want to read you the other half.
Because here is the thing I do not say enough when I am busy being skeptical: lately the boring AI wins have been quietly piling up, and they are real. The one that got me this week…. I pointed Claude Code at a four-month-old project of mine that had grown from a single throwaway script into a full workflow, and asked it to reconstruct the changelog I never bothered to keep, from nothing but the git diffs. About twenty minutes later I had an accurate, dated history of a project I could no longer fully trace in my own head. Not magic. Just a tedious, genuinely useful job that was never worth a human afternoon, suddenly worth twenty minutes.
That is the whole theme this week. Not “AI is amazing.” The lesson this week is that the floor on boring-but-valuable work just dropped, and we should go use that…..
And now, back to our regularly scheduled programming.
The latest on the SysAdmin Weekly Podcast
Episode: 049 - How Do Attackers Use Local LLMs to Phish at Scale?
Topic: Andy brings his InfoSecurity Europe session to the show, and Eric Siron joins to walk through how threat actors run open-weight models on their own hardware to generate targeted spear phishing at scale, in any language, with no internet and no guardrails, and where the real defensive line actually sits.
Why this one matters:
The guardrail gap, made concrete: ask a hosted model to write a phishing lure and it refuses; pull the right open-weight model onto a laptop and that refusal layer simply is not there. The demo is several tailored spear-phishing lures in ninety seconds.
Why “spot the typo” awareness training is dead, and why verification culture plus strong email authentication (SPF, DKIM, DMARC) is what actually carries the load now
Plus the nerd hour and news react: Washington pumping the brakes on Fable, the New York ghost-gun-printing law, and the Google AI liability question
Listen on Spotify
Watch on YouTube
The Take
This week’s episode (above) is about attackers pointing cheap, ungoverned AI at the one thing they care about: scaling the bad stuff. Fifteen tailored spear-phishing lures in ninety seconds, no guardrails, no internet connection required. That is the threat, and it is real. Remember though, that the exact same accessibility cuts the other way, and most of us are barely using it.
Earlier this month I built a small tool that reads the places SysAdmins actually congregate, the subreddits, the forums, the threads nobody has time to keep up with, and correlates what people keep struggling with. Not vibes. The recurring, in-their-own-words pain that gets buried under a thousand individual posts. I built it to find things worth covering on the show. It turned into something more useful than that: a standing read on what is actually breaking in the field, and an early-warning lens on how the ground is shifting under us.
That second part matters more after recording Episode 049. The same engine that surfaces “everyone is fighting the same Intune policy bug this month” will also surface “attackers are openly comparing which local model writes the cleanest lures.” Pointing AI at understanding the field, including how the bad actors are using it against you, is not a gimmick. It is one of the highest-value things a defensive team can do with this technology right now, and A LOT of orgs aren’t doing it.
Here is the part that ties the changelog and the community tool together, and it is the whole game: both worked because I scoped them hard. Tell the model exactly what to look at, exactly what to ignore, and exactly what good output looks like, and it earns its keep. Hand it a vague “go figure out my industry” and you get expensive mush. The tangible AI wins are not the demos. They are the narrow, well-scoped, deeply boring jobs you never had the hours for. If you want the longer version of that argument grounded in day-to-day IT work, I wrote it up here.
Community Signal
Simon Willison - “Large Language Models can run tools in your terminal with LLM 0.26” - If The Take is the argument that well-scoped AI is the real win, this is the reference implementation of that idea from a credible independent voice in the space. Willison’s llm is the opposite of the chat-window-you-babysit: a command-line tool that pipes input in, logs every prompt to a queryable SQLite database, and now hands models controlled access to tools you define as plain functions, against hosted models or local ones through Ollama. The post is about a year old now, but it is the cleanest articulation of the Unix-philosophy approach to AI that the GUI hype keeps drowning out, and it pairs directly with Fabric below.
Tool of the Week
Fabric - an open-source framework that turns AI into a set of reusable command-line “patterns” you pipe text through, instead of a chat window you have to babysit.
Fabric is the tool that makes the “scope it hard” lesson above repeatable. Each pattern is a saved, version-controlled prompt for exactly one job: summarize this, extract the action items, analyze this log, and you run it from the terminal with Unix pipes like any other command. It talks to hosted models (Claude, GPT, Gemini) and to local ones through Ollama, so sensitive input can stay on hardware you own. Honest scope: it is genuinely useful for a solo practitioner or a small shop today, but it is not an enterprise platform with RBAC and audit trails, so treat it as power tooling for you, not a sanctioned production service for the org. MIT licensed, north of 40,000 stars, and actively developed as of this month.
Quick Win of the Week
Pick one repository you actually rely on that has no changelog, or one where you started the changelog too late, and have an AI backfill its history from the git diffs. The trick is entirely in the scope. Hand it the short list of files that define how the thing works, the modules, the pipeline definitions, the runbooks, not every variable tweak, and tell it to read only the diffs touching those paths. Tell it to leave any existing entries untouched, and give it the exact output format you want. Then read the result against the diffs before you trust it, because the history is the authority and the summary is not. Twenty minutes, and a project nobody on the team could explain end to end suddenly has a paper trail.
Fun Retro SysAdmin Fact
The AI that fools people is not new; it is sixty years old. In 1966, MIT’s Joseph Weizenbaum wrote ELIZA, a simple pattern-matching script that imitated a therapist by turning your own statements back into questions, and it was so convincing that his secretary, who knew exactly how trivial the program was, reportedly asked him to leave the room so she could talk to it in private. Weizenbaum spent much of the rest of his career unsettled by how readily people projected real understanding onto a machine that had none, a reaction we now call the ELIZA effect.
Until Next Week
The skeptic in me is not going anywhere, but it’s important to state that the boring wins are real, and the only way you will believe that is to point the machine at one tedious, valuable job this week and watch it work.
Stay Frosty,
Andy
SysAdmin Weekly