标签：#Work

Every team I've worked with has unwritten rules — who to ask before touching auth, which decisions are settled, what "in progress" actually means. They used to travel by osmosis. Once everyone on the team is coding with an agent, osmosis stops working, because half the conversation now happens in someone's private session. This is the one-page agreement we ended up writing down, and why each clause is in it. When every developer on a team codes with an AI agent, one of the first things to break down can be the unwritten rules. Small, shared assumptions that once traveled through everyday conversation ("ask before you touch auth," "we decided on v2 last week") may not reach a teammate's private session — let alone the agent working in it. The established fix for that is a working agreement : a short, explicit set of norms a team writes for itself. This one is designed for AI-assisted teams — a page you can copy, adapt, and keep somewhere every teammate can access and every agent is configured to read. What a working agreement is — and isn't A working agreement is a team norm, written by the team, kept short, and revised as you learn. It is not a tool, and not a policy handed down from above. It doesn't enforce anything — it aligns behavior. That's precisely why it survives across whatever mix of editors and agents your team actually uses: it lives at the human layer, above any one tool. If you've run agile ceremonies, you've seen these before. What's new is that agents now perform part of the work, so a few assumptions that people may have absorbed implicitly need to be written down. Accountability still stays with people. The template Copy this, cut what doesn't fit, and fill in the blanks. Keep it to a page. # Our AI Coding Working Agreement (v1) ## 1. Shared decisions - Decisions that affect others live in: ______ (a shared memory, a decisions doc). - Before a decision affects someone else's work, we record who decided it, what changed, and why. ## 2. Declaring wo

When someone says "Bitcoin has over 15,000 nodes worldwide," they mean 15,000+ independent computers are each running Bitcoin software and each maintaining their own full copy of the blockchain. No server owns the truth. Every node checks it for itself. That single fact — every node independently verifies every transaction and block against protocol rules — is the reason blockchains don't need a central authority. If one node tries to cheat, the rest simply ignore it. There's no admin account to compromise because there's no admin. Not All Nodes Do the Same Job Full Node Downloads and stores the entire blockchain, every block since genesis, and independently validates everything against consensus rules. Highest security ~500 GB for Bitcoin ~1 TB for Ethereum This is the backbone of network security. A full node doesn't trust anyone's summary of the chain; it recomputes validity itself. Light Node (SPV) Stores only block headers, not full transaction data. Uses Merkle proofs and relies on full nodes to verify transactions. Low storage, ~50 MB Trusts full nodes for verification What most mobile wallets run Mining/Validator Node A full node that also participates in block creation. Miners (Proof of Work) solve computational puzzles; validators (Proof of Stake) stake cryptocurrency as collateral. Both earn rewards for securing the network. Creates new blocks Earns rewards Requires specialized hardware (PoW) or capital at stake (PoS) Archive Node Everything a full node stores, plus historical state at every block height. Complete history ~15+ TB for Ethereum Used by explorers, analytics platforms, and enterprise tooling Why Peer-to-Peer Instead of Client-Server A traditional web service is client-server: your browser requests data from a company's servers. If those servers go down, the service is unavailable. That's a single point of failure by design. Blockchain networks use peer-to-peer (P2P) architecture instead. Every participant is simultaneously a client and a serv

Lessons from building a small VPN service around standard WireGuard clients instead of a proprietary app When you look at a commercial VPN product, the app seems to be the product: a polished interface, a country list, and a large Connect button. I chose the opposite approach. Instead of building another VPN client, I decided to give users a standard WireGuard configuration that they could import into an existing client. That decision removed a lot of client-side work — but it also exposed where the real complexity of a VPN service actually lives. Why build another app if WireGuard already has one? The usual commercial VPN flow is straightforward: install the vendor's app, sign in, choose a location, and connect. A proprietary client can manage server selection, subscriptions, kill switches, automatic reconnects, diagnostics, updates, and support in one place. But for a small service with one or a few locations, I had to ask a more basic question: do I really need to build and maintain a separate Windows, macOS, Android, and iOS client just to establish a WireGuard tunnel? WireGuard already has mature clients across the major desktop and mobile platforms. A user can import a configuration file or scan a QR code and get a normal VPN toggle. On paper, that looked like a very attractive tradeoff: less client code, fewer update mechanisms, fewer installers, and a smaller attack surface to maintain. What I underestimated was that the app was never going to be the hardest part. A .conf file is not just a settings file The first architectural lesson was simple but important: a WireGuard configuration is effectively a credential. It contains the client's private key. A QR code that represents the same configuration contains the same sensitive material in another form. That immediately creates product problems that have nothing to do with the tunnel itself. How do you show the configuration safely? What happens if the user loses it? Can you issue a replacement without leavin

Martin Spier explains how agentic workflows dramatically increase code change volume at OpenAI. He discusses the hidden systemic performance costs of rapid shipping beyond GPUs, and shares how deploying always-on AI agents automates profiling, regression detection, and continuous optimization to maintain product speed and scalability at massive global scale. By Martin Spier

Framework told "all" of its customers that hackers accessed their names, email addresses, phone numbers, and physical addresses in a data breach.

I used to think IPv4 addresses were just random numbers until recently. It blew my mind when I started digging and understanding that they have an anatomy where every number after the dot means something very important. Note: To understand what IP addresses are, please consult this post because I won't be going over them here. IP Addresses: Digital Connectivity What is IPv4 in the First Place? IPv4 is short for Internet Protocol version 4 . As you might have already realized, it's the 4th version of the early test designs during the development of the Internet Protocol in test labs in the 1970s. The first real release, v4, came out in 1981 in a public document called RFC 791. RFC 791: STD 5: Internet Protocol IPv4 is an Internet Protocol that's written in what's called Dotted Decimal Notation (e.g., 172.17.0.3 ), where each portion is separated by a dot, and these portions are called octets. For example, 172 is the first octet and 17 is the second octet (more on this later). Before We Explore What Octets Are, Let's Take a Stroll to the Basics of Binary (Simplified) Have you ever wondered why your computer or phone requires electricity to function? Though electricity can be used as a raw power source for things like fans or speakers, where it's converted into other forms of energy such as movement or sound, it's good to know that electricity can function differently in your computer's RAM or SSD. Inside your computer are billions of extremely tiny transistors. These transistors form circuits that can create and maintain different electrical states, which the computer interprets as 0s and 1s. In simple terms, 0 represents the absence of the electrical state (OFF), while 1 represents its presence (ON). These states, which we represent with 0s and 1s, are called binary digits (or simply bits). 1 bit has the possibility of representing either 0 or 1, which doesn't represent much information, and that's where multi-bits come in. Every additional bit doubles the number of

This is the Engineering Culture Trends Report for 2026. Featuring a panel of QCon speakers and InfoQ contributors, they discussed AI adoption maturity and risk, the transformation of engineering team structures and roles, and the human dimensions of software development that must not be lost in 2026. By Ben Linders, Rafiq Gemmail, Craig Smith, Vanessa Formicola, Shawna Martell, Phillip Mortimer, Yinka Omole

This report summarizes how the InfoQ Culture and Methods editorial team sees the ongoing and emergent trends in the culture and methods space in 2026. By Shane Hastie, Ben Linders, Vanessa Formicola, Shawna Martell, Rafiq Gemmail, Craig Smith, Phillip Mortimer, Yinka Omole

The Scenario Every Developer Recognizes It is mid-2026, and you have a feature to ship. You open ChatGPT or Claude, type something like "build me a function that parses webhook payloads and routes them to the right handler," and wait. The model returns something plausible. You paste it in, run it, and it almost works. So you prompt again: "fix the edge case where the payload is missing the event key." Another round. Then another. Forty-five minutes later, you have code that functions, but you also have a conversation thread that looks like a debugging session rather than a build session. You never actually described what you were building. You just started building it. This is the default mode for most developers using AI coding assistants in 2026, and it is expensive. According to McKinsey's State of AI in 2024 report ( source ), organizations that adopt structured design and planning approaches before implementing AI tools report higher success rates and better integration outcomes compared to those using ad-hoc implementation strategies. The pattern holds at the individual developer level too. Jumping straight into prompting skips the step that makes prompting useful: knowing precisely what you want before you ask for it. The fix is not a better model. It is a different sequence. What Design-First Actually Means in Practice Design-first means producing a written artifact that describes your system before you write a single prompt asking an AI to build it. Not a full technical document. A tight, structured description of inputs, outputs, constraints, and edge cases. Think of it as the brief you would hand to a contractor before they start work. The contractor analogy is useful because it reframes the relationship: you are not collaborating with the model in real time, you are commissioning it with a clear scope. Here is what that looks like concretely. Instead of opening Google Gemini and typing "help me build a webhook router," you spend ten minutes writing this

A reverse proxy sits between clients and one or more upstream services. Instead of clients communicating directly with your application, every request first passes through the proxy before being forwarded to an upstream. Mature reverse proxies such as Nginx, Envoy, and HAProxy do much more than simply forward requests. They perform tasks such as load balancing, health checks, rate limiting, metrics collection, and much more. I wanted to better understand how some of these concepts work in practice, so I built a reverse proxy in Go. Along the way I implemented request forwarding, multiple load-balancing strategies, health checks, circuit breakers, rate limiting, request logging, metrics, and graceful shutdown. If you'd like to explore Proxify as we go, you can find the project here: https://github.com/Rahmannugar/proxify Table of Contents Request Lifecycle Project Structure Configuration Reverse Proxy Load Balancing Health Checks Circuit Breakers Middleware Graceful Shutdown Running Proxify with Docker 1. Request Lifecycle At a high level, every request follows the same path through the reverse proxy. A client sends an HTTP request to Proxify instead of communicating directly with an upstream service. Proxify receives the request, selects a healthy upstream using the configured load-balancing strategy, forwards the request, waits for the upstream's response, and finally returns that response to the client. Client │ ▼ +---------------+ | Proxify | +---------------+ │ Select Healthy Upstream │ ┌───────┴────────┐ ▼ ▼ Upstream A Upstream B │ ▼ HTTP Response │ ▼ Client Although the overall flow is straightforward, every step introduces additional considerations. Which upstream should receive the next request? What happens when an upstream becomes unhealthy? How can requests be distributed efficiently across multiple upstreams? How do we prevent a failing upstream from continuing to receive traffic? The remainder of this article answers those questions by gradually buildin

I needed a VPS to run CyberPanel. Simple enough: 1 vCPU, 1 GB RAM, 10 GB SSD, IPv6 only. CyberPanel...

HubSpot has redesigned its Just-In-Time Access (JITA) authorization system using a rule engine architecture. The system evaluates access requests through independent rules organized as a directed acyclic graph, adding structured decision metadata, rule-level observability, and governance workflows to replace complex conditional authorization logic. By Leela Kumili

I hit Ctrl-F more than any other key combination on this machine. It runs a shell function called fts — "find tmux session," which is not a good name but it's four years too late to change it. I press it, a fuzzy finder opens listing every project directory I have, I type a few characters, and I'm sitting in a tmux session for that project with the panes already laid out. If the session already existed, I'm back in it exactly where I left off. If what I typed doesn't exist yet, it offers to create it. Somebody watched me do this over a screen share recently and asked what was going on. So: here's the whole thing, the four tools it's built on, and a breakdown of every part that isn't obvious. What you'll end up with: One keystroke from anywhere to any project Fuzzy search across every repo you own, with a live directory tree preview Type a name that doesn't exist → it offers to scaffold and place it Never accidentally start a second tmux session for a project you already have open The same window/pane layout in every project, every time The problem it solves Before this, starting work looked like: cd ~/repo/work/some-project-i-half-remember-the-name-of tmux new-session -s some-project # split some panes, badly, slightly differently each time Three or four commands, one of which needed me to remember a path. None of it hard. All of it friction at exactly the wrong moment — the moment you've decided to start something, which is the moment you're most likely to get distracted instead. I'd also collected tmux sessions named 0 , 1 , 2 and some-project-2 , because I kept starting new ones instead of attaching to the one already running. So the goal wasn't really speed. It was making the right thing the automatic thing. Prerequisites Four tools plus zsh. All four are worth having on their own, and three of them are things you'll reach for daily once installed. Tool Version I'm on What it does here tmux 3.6a The terminal multiplexer. Holds the sessions, windows and panes. fz

AWS Builder Center now offers free, time-limited sandbox environments for workshops, so developers no longer need to use their own AWS account and credit card or worry about unexpected charges. This has been a long-standing request from the community and removes one of the biggest friction points for practitioners learning new AWS technologies. By Renato Losio

Por que usar o Cloudflare em vez do DNS padrão do seu registrador Escrevi esse texto depois de um perrengue aqui na empresa onde trabalho. Precisei registrar uns subdomínios, entrei no painel da Cloudflare esperando achar os registros lá e não tinha nada, fui atrás do time para entender onde aquilo estava apontando e a resposta foi que tudo passava direto pelo provedor de domínio. Quando você registra um domínio na GoDaddy, Namecheap, Registro.br ou qualquer outro provedor de domínio, ele já vem com um par de nameservers configurados por padrão. Funciona, mas "funcionar" e "ser a melhor opção para produção" são coisas diferentes, e trocar esses nameservers pelos da Cloudflare é uma das mudanças de maior custo-benefício que dá para fazer em um projeto. O que muda ao trocar os nameservers Um provedor de domínio só precisa resolver DNS: publicar seus registros A, CNAME, MX e afins, e responder consultas. A infraestrutura por trás disso varia muito de provedor para provedor e raramente é otimizada para latência global ou resiliência a ataques, porque não é o produto principal deles. A Cloudflare constrói a rede em torno de DNS, CDN e mitigação de DDoS como núcleo do negócio, e isso aparece em números concretos: a rede anycast cobre mais de 330 cidades, então uma consulta DNS ou uma requisição HTTP é respondida pelo ponto de presença fisicamente mais próximo do usuário, não por um servidor central do outro lado do mundo. Hoje a Cloudflare responde por algo em torno de 23% de todos os sites da internet. Vantagens técnicas O anycast é a base de tudo. Não existe "o servidor DNS" que pode cair: se um ponto de presença fica indisponível, o tráfego é roteado automaticamente para o mais próximo, o que reduz latência de resolução e risco de indisponibilidade. A mesma arquitetura, combinada a TTLs baixos, também acelera a propagação de mudanças: um registro DNS alterado costuma valer em minutos, enquanto em boa parte dos provedores de domínio tradicionais não é incomum esperar ho

AI is an amplifier; strategic focus on the organizational system brings the greatest returns. DORA's 2025 research on AI in software development provides team profiles and success capabilities that can be used to put the research into practice. By Ben Linders

I was already a big fan of SwitchBot's big circulator fan I recently reviewed, and now we're getting the SwitchBot Battery Circulator Fan 2 Pro. Priced at $119.99, it ditches the height-adjustable stand but increases battery life, throw distance, and wind speed while adding native Matter-over-Wi-Fi, allowing it to join your smart home without needing […]

Most VPN troubleshooting goes wrong in the same predictable way: three things get changed at once, and whatever happens next, nothing has been learned. The alternative is boring and effective — check one layer at a time, in an order that rules things out, and write down what each layer shows. One boundary before starting: troubleshooting means finding where a problem lives, not working against anyone's rules. On a network you don't control, or a device your organization manages, the policies in place stay in place. If a managed device is part of the picture, your organization's IT function is part of the troubleshooting — and switching off device security tooling is never a troubleshooting step. 1. Device basics first Start embarrassingly simple, because this layer resolves more than anyone likes to admit. Restart the VPN client. If that changes nothing, restart the device. Confirm that the operating system and the client are updated. An update that has been pending for weeks is a suspect, not background noise. Note whether anything changed around the time the problem started: an update, a new app, different settings, a different location. 2. Does the internet work without the VPN? Disconnect the VPN entirely and test ordinary browsing. If the connection is broken without the VPN, this isn't a VPN problem yet. Solve the underlying connection first, because nothing downstream is testable until this layer works. If the internet is fine without the VPN and wrong with it, you have genuinely narrowed something down. Write that down. 3. Client state: connected to what, exactly? Open the client and look, rather than assume. Is it actually connected, or still trying? Is the right profile selected — the current one, not an older entry left over from a previous setup? Disconnect and reconnect once, deliberately, and watch what the client reports. If multiple profiles have accumulated in the client, that is a finding in itself. Stale entries are a classic source of "it connect

When you open a website, send a message, or watch a YouTube video, many technologies work together in the background. As a beginner in DevOps, understanding these basic networking concepts will help you understand how applications communicate over the internet. **What Is a Protocol? A protocol is a set of rules that devices follow when communicating with each other. Think about two people having a conversation. For communication to be successful, both people must speak the same language and follow simple rules, like taking turns to talk and listening before responding. Computers work the same way. They use protocols to know how to send, receive, and understand information. Without protocols, computers would not be able to communicate with one another. **2. What Is Packet Switching? **Imagine you want to send a large book to a friend. Instead of sending the entire book in one huge package, you divide it into many smaller packages. Each package travels separately and, when they all arrive, your friend puts them back together in the correct order. This is exactly how the internet works. When you visit a website, your data is broken into small pieces called packets. Each packet travels across the internet and is reassembled when it reaches its destination. This process is called packet switching, and it makes internet communication faster and more reliable. **3. What Is an IP Address? **Every house has a unique address that helps delivery drivers know where to deliver packages. Similarly, every device connected to the internet has a unique Internet Protocol (IP) address. An IP address helps the internet know exactly where information should be sent. Without an IP address, websites, computers, and phones would not know where to send or receive data. **4. What Is TCP/IP? **Breaking data into packets is not enough. The packets must also arrive correctly. This is where TCP/IP (Transmission Control Protocol/Internet Protocol) comes in. IP finds the correct destination for ea

Introduction Small teams don't need GitFlow or other complex branching models. They need a workflow that's easy to understand, quick to execute, and minimizes merge headaches. Here's a practical workflow I've used with teams of 2-8 developers. The Core Idea: Main and Short-Lived Feature Branches We keep it simple with one long-lived branch ( main ) and short-lived feature branches. Every change starts from main and is merged back as soon as it's ready. git checkout main git pull git checkout -b feature/my-feature Branch Naming Convention Use a consistent prefix to keep branches organized: feature/ for new features fix/ for bug fixes chore/ for maintenance tasks Example: feature/user-authentication , fix/login-error The Workflow Step by Step 1. Start from an Up-to-Date Main Before creating a branch, make sure your local main is up to date: git checkout main git pull --rebase 2. Create a Feature Branch git checkout -b feature/awesome-feature 3. Make Small, Frequent Commits Commit early and often. Each commit should represent a logical unit of work. git add . git commit -m "Add user model with email validation" 4. Push and Open a Pull Request Even if the branch isn't finished, pushing early allows others to see your progress. git push -u origin feature/awesome-feature Then open a PR against main . Keep PRs small (under 400 lines if possible). 5. Keep Your Branch Updated If main moves forward, rebase your branch to avoid conflicts later: git checkout feature/awesome-feature git rebase main # resolve conflicts if any git push --force-with-lease --force-with-lease is safer than --force because it prevents overwriting others' work. 6. Code Review At least one other team member reviews the PR. Look for logic errors, readability, and test coverage. 7. Merge via Squash Merge When the PR is approved, use squash merge to keep main history clean: git checkout main git pull git merge --squash feature/awesome-feature git commit -m "Add awesome feature" Or use the GitHub/GitLab squ