Postcards for pushing back against surveillance. Discussion | Link

The agents were doing exactly what I told them to. That was the problem. I'd built a pipeline where AI agents could take a spec file, implement a feature, run the tests, review the result, and commit — without me writing a line of code. It mostly worked. Dozens of features shipped. But I kept reviewing the output and feeling like something was off. Not broken. Just subtly wrong in a way that was hard to name. I spent a while blaming the models. Then the prompts. Then the validation steps. Eventually I had to sit with the obvious: the agents were implementing exactly what I'd written. My specs were underspecified. The bottleneck was always me, at the planning stage. The thing most people throw away There's something that feels right about vibe coding. You're operating at the level of intent — describing what you want and letting the model handle the mechanics. That part is genuinely useful. But watch what most people do with the output: Traditional development: Source code → Compiler → Binary (keep the source; regenerate binary anytime) Vibe coding done wrong: Prompt → LLM → Generated code (delete the prompt; commit the code) You've shredded the source and carefully version-controlled the binary. The prompt — your structured description of what you wanted, why, and what "correct" meant — is the valuable artifact. The generated code is what compiles from it. When you discard the prompt and commit only the output, you've lost the thing that actually mattered. The practical consequence shows up six months later: you're staring at code you wrote and spending twenty minutes reverse-engineering your own intent. The spec would have been a thirty-second read. What a spec-driven pipeline is I built what I call an SDLC (Software Development Lifecycle) harness — a system where instead of writing code directly, you write a spec describing what needs to be built, and AI agents handle the implementation, testing, review, and documentation. The spec is the source. The code is what

A follow-up to Part 1 ( EN on LinkedIn · RU on Habr ), where we stood up a two-tier PKI: a Root CA and three intermediate CAs — Person, Server and Code. At the end of Part 1 I promised we'd learn to revoke certificates and run OCSP. That's what we'll do here. Like Part 1, this article is meant as a hands-on manual : for every command and extension we touch, there's an extended reference of the parameters you can actually use — with syntax, allowed values, defaults and gotchas. If you don't need a given option right now, just skim past the table; it's there so you don't have to dig through man later. Each section has the same shape: first the working commands for the common case, then the full parameter reference. Tested on versions. Flag names, defaults and extension syntax were verified against the official documentation of OpenSSL master , plus nginx and Apache mod_ssl. OpenSSL evolves per branch: anything marked "OpenSSL 4.0 / master" (for example the nonss qualifier on authorityKeyIdentifier ) is not yet available in the stable 3.x line. If you're on OpenSSL 3.0–3.6, double-check the disputed options with openssl <cmd> --help or your version's man before copy-pasting config. The numeric openssl verify error codes above 40 also shifted between branches — confirm them against your version's header. In this part: How a revoked certificate differs from an expired one, and why we need two mechanisms — CRL and OCSP. Adding the distribution points (CDP) and AIA to the config so issued certificates "tell" verifiers where to check them. Revoking a certificate and working with the CA database. Generating a CRL and inspecting it with openssl crl . Checking revocation with openssl verify . Running an OCSP responder: issuing its certificate, starting the daemon, querying status. Publishing the CRL and OCSP over HTTP (nginx), configuring OCSP stapling and revocation checking on the web server. All paths, file names and config sections are the same as in Part 1. Where you name

We have tools for checking whether a query is injectable. We have linters, scanners, ORMs, parameterized queries, and database policies. But after the database returns rows, most applications simply trust that the result set matches the operation that asked for it. queryguard starts there. The query may be safe. The result may still be wrong. SQL injection taught us to distrust query construction. Parameterized queries answered the question: Did the user control the query structure? That question is well understood. The tooling is mature. But it is a different question from the one queryguard asks: Did this operation receive only the rows and fields it was allowed to receive? Those two questions are not the same. A perfectly safe parameterized query can still return the wrong row — because a predicate was dropped, a join widened the result, a developer selected a column they shouldn't have, or a query was rewritten without updating its scope contract. queryguard is not a database firewall. It is not a SQL injection scanner. It is not an ORM plugin. It is a contract check for observed result sets. Where it sits The hook position is the core design decision. queryguard sits immediately after cursor execution — before any result shaping, filtering, serialization, or response mapping. cursor = conn . execute ( sql , bindings ) rows = [ dict ( row ) for row in cursor . fetchall ()] evidence = queryguard . run_check ( contract , { " contract_id " : " user_profile_lookup " , " contract_version " : " 0.1.0 " , " params " : { " user_id " : user_id }, " session " : { " tenant_id " : tenant_id }, " result " : rows , }) if evidence [ " verdict " ] != " PASS " : raise QueryguardViolation ( evidence ) return rows Not at the HTTP layer. Not inside the ORM. Not at the API gateway. Immediately after the cursor returns rows — while the result is still raw, before anything shapes or discards it. This is intentional. If rows are shaped before queryguard sees them, queryguard cannot det

Why stop gaming saved my tokens: Building my own local AI Lab WizSebastian WizSebastian WizSebastian Follow Jun 25 Why stop gaming saved my tokens: Building my own local AI Lab # ai # opensource # productivity # gpu 16 reactions 1 comment 4 min read

A quick disclaimer: This article isn't an argument against init itself. Constructors remain the appropriate place for lightweight object initialization. For classes that require complex setup, resource allocation, or business logic, many developers prefer to keep init minimal and move that complexity into factory methods, builders, or dedicated initialization routines. The point here is simply that when a class exists only to represent data, @dataclass eliminates a significant amount of unnecessary boilerplate. If you’ve been writing Python for any length of time, you’ve probably created dozens of classes that look something like this: There is nothing inherently wrong with this code. In fact, it is exactly how many of us first learned to write Python classes. The problem is that most of the implementation has nothing to do with the problem we’re trying to solve. Instead, it consists of repetitive plumbing — constructors, string representations, and equality methods that are nearly identical from one class to the next. The @dataclass decorator Python’s dataclasses module, introduced in Python 3.7, eliminates nearly all of this repetitive boilerplate. Instead of manually implementing methods such as init , repr , and eq , you simply declare the object's fields as type-annotated class attributes. The @dataclass decorator automatically generates the supporting methods, allowing you to focus on the data the class represents rather than the mechanics of managing it. These three lines produce exactly the behavior written by hand above, and more. Instances are created the way you would expect, print readably, and compare by value rather than by identity. Why This Matters in AI You might be wondering why I’m so excited about saving twenty lines of code. The answer is simple: AI applications are built from data contracts. Every stage of an AI pipeline passes structured information from one component to another. Requests become prompts. Prompts become model outputs. Outputs b

I built a large feature. That's not what this is about. What changed is the baseline — the standards, docs, and automation that exist now and didn't two weeks ago. Everything after this will be built on top of it. Automated tests now ship with new features QA testers were testing. The product was covered. What didn't exist was automation — no E2E suite, no unit tests for new work, no repeatable spec. Now it does. The manual QA cycle stays. The automation catches what humans miss on the tenth pass. Quality leap going forward. Human hours saved. The next feature ships with both. The baseline is set Knowledge lives in the repo. Bug catalog with root causes — so the same thing doesn't get fixed twice. Tech debt inventory with a phased plan. Testing strategy documented, not assumed. GraphQL schema committed and validated against — drift gets caught before it ships. Pre-commit hooks that enforce the standards automatically. The frontend and backend documentation are cross-referenced as single sources of truth. The agent instructions point to the right places. Everything new builds on what's already written. Schema-first development The workflow is now: if the schema accommodates the new field, reuse what exists. If it doesn't, the schema update creates the new structure, the data migrates, and everything stays consistent. No guessing. No drift. One source of truth for what the data looks like. The feature is what you see. The baseline is what you don't — and it matters more.

In the last essay I played a game with twelve people. Twelve apostles, one teacher, one set of events — and twelve sharply distinct ways of failing and succeeding to understand the same thing. Peter acts before he reflects, Thomas demands the marks in the hands, Matthew counts and structures, Judas asks what you'll give him. I called it pre-cognitive-science cognitive science: the Gospels did the hard work of selecting twelve incompatible human responses to one encounter, and every century since has projected its newest psychology onto that fixed set and found it fits. That essay had a quiet move in it I want to pull on now. The thing that doesn't change, I wrote, is the twelve people. The cognitive vocabularies come and go; the diversity of minds is the invariant. So here is the obvious next question, the one I couldn't stop turning over after I published: what happens when you stop counting people and start counting cultures? Not twelve apostles meeting one teacher, but N civilizations meeting one world. The same exercise, zoomed out A culture is not just a cuisine and a flag. It is a way of thinking that a few million people inherited without choosing it — an implicit operating system for what counts as obvious, what counts as rude, what counts as a good life, what counts as a threat. And like the apostles, each one is an answer to a question . You can describe any of them, I think, with three coordinates. A driver — the deep need the culture is organized around. Survival, honor, harmony, freedom, salvation, mastery, belonging. The thing that, if you threaten it, the culture treats as an attack on existence itself. A provoking question — the founding question the culture exists as a standing answer to. How do we survive the winter together? How do we live rightly before the gods? How do we stay free? How do we keep the harmony so the group doesn't tear itself apart? Cultures are old answers to questions most of their members have forgotten were ever asked. A thin

This is Lowpass by Janko Roettgers, a newsletter on the ever-evolving intersection of tech and entertainment, syndicated just for The Verge subscribers once a week. The 2026 World Cup is breaking streaming records around the world: Brazil's CazéTV YouTube livestream of that country's opening game against Morocco surpassed 12 million concurrent viewers, a new milestone […]

You don't need to cut your own grass anymore. Most of the best robot mowers I've tested are on sale for Prime Day.

Apple just raised the prices on Macs and iPads in response to the rising costs of memory chips, right in the middle of Amazon Prime Day. That means existing discounts (even small ones) on Apple laptops like the MacBook Neo, MacBook Air, and MacBook Pro just became significantly better deals. As an example, the 13-inch […]

https://www.omegasyntax.com/domino/ Series of articles about Domino Tiling problem. submitted by /u/eugene [link] [留言]

Data Oriented Design is the practice of building code that's optimized for the hardware it runs on. Entity Component Systems help writing DOD-friendly code by laying out otherwise allocation-heavy game data in contiguous arrays. A challenge in gamedev however is that lots of game data is stored and accessed as hierarchies that change frequently, which makes them notoriously difficult to store as contiguous arrays. This article goes over a number of techniques an Entity Component System can use to integrate hierarchies with the core datamodel in a way that improves the performance of the ECS. Written mostly for gamedev, but also applies to other hierarchy-heavy applications, like UI. submitted by /u/ajmmertens [link] [留言]

Sony's A7R VI finally serves up speed and resolution together thanks to the new 67MP stacked sensor.