Tech Lead. Curious about how things really work: software, AI, healthcare, people, and the occasional non-tech rabbit hole.
Joined April 2024
- Tweets537
- Following341
- Followers160
- Likes1.8K
Pinned Tweet
Your SMART on FHIR token request fails with invalid_client. Now what?
Is the client ID from the wrong environment? Is the JWT audience wrong? Does the kid match a key in your JWKS? Is your clock off? Does the redirect URI match what you registered?
The EHR’s error message rarely gives you enough to go on. So I built smart-doctor, a free, open-source tool for debugging SMART on FHIR authentication.
It checks your configuration, makes one real authentication attempt, and ranks the likely causes. For each one, it shows what it found and how to fix it. Private keys stay on your machine when you run it locally. If you use a client secret, it goes directly to your EHR’s token endpoint.
It covers:
- Backend services using client_credentials with private_key_jwt or a client secret
- User sign-in using SMART App Launch with PKCE and your existing registered redirect URI
- Common trouble spots including discovery, JWKS and kid, aud, clock skew, scopes, state, ID tokens, and refresh tokens
Need to open a ticket? report generates a summary with secrets, tokens, and IDs masked.
Try it without credentials. The demo runs a mock EHR that fails on purpose.
npx smart-doctor ui --demo
There’s a CLI, a local web UI, and a GitHub Action for nightly checks. MIT licensed.
It’s an early beta (0.2.x). I’ve tested it end to end against the SMART Health IT sandbox. The hints for Epic, Oracle Health, athenahealth, and OpenEMR are based on their public docs. If smart-doctor gets your server wrong, open an issue with the --report output so I can take a look.
github.com/baselissmail/smar…
#FHIR #HealthIT
Connecting Gmail or Drive to Gemini could result in a human reviewer reading information from your emails or files.
That’s in Google’s own help page.
It says reviewers may see excerpts, summaries, and sometimes an entire email or file used in your chat. Google first takes steps to remove identifying information.
Then comes the warning: don’t connect apps containing confidential information you wouldn’t want a reviewer to see.
How many people connect their inbox knowing that?
This is about personal Gemini accounts. Work accounts have different rules.
support.google.com/gemini/an…
1
17
Anyone else get annoyed watching Family Feud when someone says the dumbest thing imaginable and their whole team goes, "Good answer, good answer"?
No, it wasn't.
17
Amazon replaced Sonnet 4.6 on a massive internal ticket-labeling job with a small model that can’t even write a sentence.
Its job: pick from 20 labels.
Comparable quality. ~44× cheaper. Over 4× faster.
The lesson: define the decision, test a smaller model against real traffic, and make switching back easy.
If your “agent” is answering a multiple-choice question, a smaller model might do the same job for a fraction of the cost.
strandsagents.com/blog/amazo…
8
Basel Issmail retweeted
Interesting read on how much the software around a model affects its performance, not just which model is smartest.
A coding agent has two parts:
- The model generates reasoning and code.
- The framework, such as Claude Code or Codex, manages tools, conversation history, context limits, and execution.
This leaderboard runs different frameworks with the same underlying models on coding and terminal tasks. In principle, that helps isolate what the framework contributes.
Why it’s useful:
- When choosing a coding agent setup, you should evaluate the model and its surrounding tools, not assume a better model guarantees better results.
- Before trusting benchmark rankings, check whether each setup received equivalent settings and whether failures came from the model or the integration.
- If your agent performs poorly, inspect context handling, output limits, and tool errors before switching models.
The takeaway isn’t “Claude Code is better or worse.” It’s “a leaderboard can accidentally measure configuration mistakes instead of agent quality.” That makes the audit more useful than treating the current ranking as a buying guide.
huggingface.co/spaces/joelni…
This reflects the harsh reality of the current AI race. Rigidly following traditional workflows while competitors use aggressive automation and AI agents to scale is a recipe for defeat.
It’s not about encouraging malicious use of AI, but about strategic awareness. Survival depends on building AI skills and deploying agents that understand the rules the market actually plays by not the rules we wish it did. Adapt or get left behind.
20
When Claude Code asks permission to run a command, “Yes, and don’t ask again” can also mean saving the password inside that command.
And according to The Hacker News, researchers reproduced this with Opus 5.5 too.
Here’s why: Claude Code saves permission rules in .claude/settings.local.json. Sometimes it saves the exact command including any password or token written into it.
Researchers found secrets in over 1,100 public copies.
What to do:
- Check saved permission rules for secrets.
- Keep local settings out of Git, including files already tracked.
- Use a secret manager or runtime credentials instead of passwords written into commands.
- Review staged files and enable secret scanning.
- Rotate exposed credentials immediately; deleting the file isn’t enough.
A smarter model doesn’t make everything its tools save safe to commit.
For a deeper dive
thehackernews.com/2026/11/cl…
31
Devs spent thirty years writing unmaintainable code. Now AI does it and suddenly everyone has standards.
17
Interesting read on how much the software around a model affects its performance, not just which model is smartest.
A coding agent has two parts:
- The model generates reasoning and code.
- The framework, such as Claude Code or Codex, manages tools, conversation history, context limits, and execution.
This leaderboard runs different frameworks with the same underlying models on coding and terminal tasks. In principle, that helps isolate what the framework contributes.
Why it’s useful:
- When choosing a coding agent setup, you should evaluate the model and its surrounding tools, not assume a better model guarantees better results.
- Before trusting benchmark rankings, check whether each setup received equivalent settings and whether failures came from the model or the integration.
- If your agent performs poorly, inspect context handling, output limits, and tool errors before switching models.
The takeaway isn’t “Claude Code is better or worse.” It’s “a leaderboard can accidentally measure configuration mistakes instead of agent quality.” That makes the audit more useful than treating the current ranking as a buying guide.
huggingface.co/spaces/joelni…
They gave the agent your email so it would stop inventing author names. It sometimes used it as a contact address in web requests.
That’s the privacy problem with putting personal information in context: knowing it and having permission to share it are two different things.
14
Feature idea for @X: group similar posts into one collapsible thread in the timeline. If 100 people post the same take, I don’t need to see it 100 times
8
My original X post: 12 impressions.
The guy who copied it 20 minutes later: 50k likes.
Me finding his post:
1
1
19
Interesting read on whether a better agent loop can close the gap to a stronger model.
On 30 coding problems, Qwen with a manager loop solved 23; Opus alone solved 24. Cost per solve: $0.10 vs $0.12. Median wait: 37 minutes vs 21 seconds.
Small experiment, but a useful reminder: cheaper tokens don’t necessarily mean a better trade-off.
arize.com/blog/how-to-test-a…
1
44
Anyone else get a startup idea, ask AI “Who would use this if AI and bots can already do it?” and talk themselves out of it before writing a single line of code?
My cofounder is also my first competitor.
1
22