标签：#disc

I used to laugh at people who panicked over data limits. Then my carrier switched my "unlimited" plan...

In June 2026, Peter Steinberger reported that his system spent $1,305,088.81 over 30 days and...

Keep the shell. Preserve the presence. The ally doesn't suspect; the enemy doesn't move. — The 36 Stratagems, Slough off the Cicada's Golden Shell Previously on this series: #19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P confirmed Mark's report was read from a Singapore IP. A note was left: "Entry's gone. Two weeks. Don't reach out. I'll find you." #20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — ACL's processing latency climbed abnormally. Someone had done something in the same time window. Exposed P's monitoring pinged while P was still helping Mark verify an address. Deep night. The screen was the only light in the room. P opened the monitor. The record was waiting: a read from Singapore. Time, method, address, all matching. Mark's bait had been taken. P knew this path. A false lead planted in Mark's report, waiting for this exact day. P double-checked the address: an AWS Elastic IP registered in the Singapore region, same network block. No ambiguity. P sent an encrypted message: "Your report was read. From a Singapore IP." Then P ran the routine check. The environment status list scrolled in the terminal: storage levels, certificate expiry, key rotation dates. P had read these lines a hundred times. Every time, identical. One line was different. P's fingers stopped on the trackpad. The cursor sat on the entry's metadata line. A new tag P had never configured. # Old entry metadata: new entry (not configured by P) status : reclaim_pending source : acl-asset-scanner scanned_at : 02:01:07Z P didn't move. The cursor sat on screen. In the room, only the fan. The fan cycled once. P's fingers lifted off the trackpad, then settled back. The tag was still there. The tag wasn't an alert. Not an error, no explanation. The format matched ACL's automated scan records. P had seen it before, in a data company's audit report last year, in another client's logs the year before. ACL's scanner had swept

The answer arrives clean, well-formatted, and certain. You run it. The config flag doesn't exist. Nothing in the response told you the difference between the parts it was sure about and the parts it filled in. The syntax was right. The explanation was reasonable. The flag had a sensible name and a clear purpose. It just wasn't real. This is a calibration problem, not a trust problem. "Don't trust AI" is useless advice. It tells you to doubt everything, which is the same as doubting nothing, because you can't actually work that way. What you need instead is a way to tell which parts of an answer are grounded and which were filled in. There are patterns to look for, and once you know them, they are hard to miss. 🔍 Why this affects beginners specifically This isn't about intelligence. It's about experience. An engineer with a few years behind them has already lost time to a function that didn't exist. They have wasted an afternoon on a config parameter that turned out to belong to a different engine. They have built up a collection of "that looked right but wasn't" memories, and those memories now activate automatically. A small feeling that says check this one before they run it. Beginners haven't had those afternoons yet. The pattern recognition that comes from repeated failures doesn't exist, because the failures haven't happened. Everything arrives in the same confident tone, and without past mistakes to compare against, there is no internal signal separating a grounded answer from a made-up one. That's not a character flaw. It's missing experience, and it can be partly replaced with three concrete things to look for. ✅ The three signs These aren't perfect. They are a minimum standard, and they catch the common cases. I'll be clear about what they miss at the end. Sign 1: Very specific details with no source When the answer includes a precise detail (a specific config flag, a particular function signature, an exact version number) and doesn't say where that detail

In an era where data privacy is no longer a "nice-to-have" but a legal mandate (looking at you, GDPR and HIPAA), sending raw user data to the cloud is like playing with fire. If you are building health-tech or fintech apps, the risk of exposing Personally Identifiable Information (PII) is a constant headache. But what if the data never leaves the user's browser in its raw form? Enter Edge AI and Privacy-preserving AI . By leveraging Transformers.js and WebAssembly (WASM) , we can perform complex Named Entity Recognition (NER) to de-identify sensitive information directly on the client side. In this tutorial, we’ll build a "Privacy Shield" that detects and masks names, locations, and health identifiers before they ever hit your API. The Architecture: Privacy First 🏗️ The traditional approach involves sending raw text to a server-side LLM or NLP service. Our approach intercepts the data at the "Edge" (the browser). graph TD A[User Inputs Sensitive Health Data] --> B{Browser-side Privacy Shield} B --> C[Transformers.js / WASM] C --> D[NER Model Analysis] D --> E[Data Masking / Redaction] E --> F[Clean Data] F --> G[Cloud Storage / Analytics] G -.-> H[Compliance & Security ✅] style B fill:#f9f,stroke:#333,stroke-width:2px style C fill:#bbf,stroke:#333,stroke-width:2px By using WebAssembly , we get near-native performance for running BERT-based models in the browser, ensuring the UI remains snappy while keeping the data 100% local. Prerequisites 🛠️ To follow along, you'll need: Tech Stack : TypeScript, Vite, and Transformers.js . Basic understanding of NER (Named Entity Recognition) . A passion for not getting sued for data leaks. 🥑 Step 1: Setting up the Privacy Pipeline First, let's install the library: npm install @xenova/transformers Now, let's create our PrivacyShield service. We will use a lightweight NER model (like Xenova/bert-base-NER ) that has been optimized for the web. // src/services/privacyShield.ts import { pipeline , env } from ' @xenova/transformers ' ;

A message landed in my inbox a few months back. New scope, same title. Frontend, backend, and QA, folded into one role, because the team now had AI to cover the rest. I had shipped backend work for years. The frontend half of our codebase, and the QA half, I had barely touched. Reading someone else's frontend patterns for the first time, at speed, with a deadline attached, is its own skill and I did not have it yet. I said yes anyway. Has your role quietly grown a second and third job inside it Not a promotion. Not new headcount. The same title, the same paycheck window, and suddenly three disciplines expected of one person because a tool now sits in the gap where two teammates used to be. I want to be honest about what that gap actually feels like from the inside, because most of what I read about this treats it as a spreadsheet problem. It is not. It is a specific, physical kind of tired that shows up on a Tuesday when you are debugging a CSS layout you have no instinct for, at 6pm, after a full day of the work you actually trained for. The tool covers the syntax, not the judgment AI got me through the mechanical parts fast. Flexbox, a broken build step, the shape of a test file I had never written by hand. Genuinely fast. I could paste an error and get a plausible fix in under a minute. What it never gave me was the judgment for when the plausible fix was wrong for THIS codebase, and why this component was structured the odd way it was. Whether a generated test actually proved anything, or only made the red X turn green. That judgment only comes from having broken things in that specific layer before, and I had never broken anything in QA before, so I had none. The tool closes the syntax gap instantly. It does nothing for the judgment gap. Those are different gaps, and conflating them is where I think a lot of the current AI-productivity optimism goes wrong. What actually closed it, and what did not Reading transcripts of AI-assisted changes other people made in

Recently I went looking for a CLI tool to manage my Dev.to articles from the terminal. I write 4-5 articles per month, track analytics obsessively, and wanted a git-backed workflow. I found 9 existing tools. Tried them all. Here's what happened: devto-cli (Node): Last commit 2 years ago. Broke on install. dev-to-git (Node): Only syncs TO local. Can't push back. slinkity : Abandoned. forem-cli : 3 endpoints implemented out of 40+. Every single tool does the same thing: publish an article. That's it. Maybe pull. Maybe validate tags. Meanwhile the Dev.to API has 40+ endpoints including analytics, semantic search, ML-powered content concepts, follower engagement, trend tracking, and reading list management. Nobody uses them. So I built devpub . Table of Contents What devpub does What I discovered in the API The build story Architecture Try it Contributing What devpub does (that nothing else does) # The basics (every tool does this) devpub push -f articles/my-post.md devpub pull # Analytics in your terminal devpub stats # Views: 246.5K | Reactions: 4.4K | Comments: 402 | Followers: 18.9K # Full dashboard with top articles devpub dashboard # AI-powered search (semantic, not keyword) devpub search "building serverless apps" --semantic # What's trending RIGHT NOW devpub trends # Catch problems before publishing devpub validate The difference isn't one feature. It's coverage. Here's the comparison: Capability devpub Everyone else Publish/update articles Yes Yes Pull articles to local Yes Some Analytics (7 endpoints) Yes No Semantic search Yes No Trend discovery Yes No Article validation Yes No Rate limiting (30 req/30s) Yes No Retry logic for failures Yes No Concepts API (ML topics) Yes No What I discovered in the Dev.to API While building devpub, I found several API endpoints that aren't documented anywhere obvious: 1. Semantic Search -- Dev.to has a full embedding-based search system using Gemini embeddings (768-dimensional vectors) with pgvector. You can search articles b

Job hunting is exhausting. Between tweaking resumes, updating portfolios, and filling out endless...

Às vezes, a maior barreira para começar um projeto não é a complexidade do problema, mas a busca por...

Every esports team captain has done this by hand at least once: open Discord, scroll through a dozen "I can play Thursday after 8" messages, cross-reference them against who plays Tank versus DPS, remember that one of your DPS is actually a sub, and try to assemble a starting five that can actually scrim tonight. It takes fifteen minutes, you get it slightly wrong, and you do it again the next day. I build Supatimer , a free Discord bot for competitive gaming teams, and "generate the lineup for me" was the single most requested feature. This post is about how the lineup optimizer actually works, why it is genuinely AI (and not in the marketing sense), and where a large language model fits in versus where it absolutely does not. "AI" is doing a lot of work in this industry Half the Discord bots on the market slapped "AI" on their landing page the week ChatGPT launched. Usually it means there is a chatbot command somewhere that proxies to an LLM. That is fine, but it is not what your team needs when it is 7:45pm and you have a scrim at 8. There are two honest definitions of AI worth separating: Search and optimization - the classical branch. Constraint satisfaction, combinatorial optimization, planning. This is the part of AI that solves "given these rules and these resources, find the best valid arrangement." Machine learning / LLMs - the statistical branch. Pattern recognition, generation, extraction from unstructured text. The lineup problem is squarely a problem for the first kind. So that is what I built first. The lineup problem, stated precisely Strip away the gaming context and a lineup is a constrained assignment problem: You have N players , each with a set of roles they can fill (Tank, DPS, Support, IGL, and so on). Each player has an availability signal for a given time block (available, maybe, unavailable). Each player has a roster status (starter, substitute, trial). The game defines a required composition : Overwatch 2 wants 1 Tank, 2 DPS, 2 Support. Va

Picture a young software developer sitting in a small, dimly lit room in Tehran. He has no political ambitions, no connections to the state apparatus, and no desire to break any domestic or international law. He wants to do something profoundly ordinary: build a small piece of software, refine his code, and offer it to the world using the same AI-driven development tools that his peers in Berlin, Toronto, or Tokyo take for granted. He opens his browser, clicks on a U.S.-based AI platform, and is immediately greeted by a cold, automated refusal: "Access from your region is restricted." In that single, unyielding moment, a door to the global community slams shut in his face. He has not been accused of a crime. No tribunal has judged him. No regulatory body has flagged his name. He is locked out simply because of where he was born and where he draws breath — a geographical reality he did not choose and cannot alter. The Asymmetry of Sanctions: How the State Circumvents While Citizens Suffer The tragic absurdity of this system lies in who actually bears the pain. Broad economic and digital sanctions are nominally designed to pressure and isolate a government. In practice, however, the targeted state mechanisms possess vast institutional wealth, specialized intelligence networks, and endless financial resources that render these restrictions practically useless against them. When the Iranian government or state-linked entities need to bypass international sanctions, they deploy a deeply entrenched, highly sophisticated network of circumvention tools: Front and Shell Companies: Establishing complex layers of paper companies in regional commercial hubs — such as the UAE, Turkey, Oman, or Eurasia — with clean, local ownership structures that mask the true state beneficiaries. Proxy Banking & Intermediaries: Utilizing specialized financial conduits and foreign bank accounts registered under these shell entities to route payments globally without triggering compliance alerts.

This is a submission for Frontend Challenge - Comfort Food Edition, CSS Art. Inspiration Comfort...

Are you a "data hoarder" when it comes to your health? Between Apple Health exports, Oura Ring logs, and Garmin CSVs, I found myself sitting on nearly 10 million rows of biometric data. Trying to analyze a multi-year trend of Heart Rate Variability (HRV) or Resting Heart Rate (RHR) in Excel is a one-way ticket to "Application Not Responding" hell. 📉 In this tutorial, we are diving into the world of Quantified Self data engineering. We will leverage DuckDB —the Swiss Army knife of OLAP—and Apache Superset to build a lightning-fast, local-first biometric dashboard. We'll explore how to turn messy JSON/CSV exports into high-performance insights using dbt for modeling and DuckDB for compute. If you've been looking for a way to master Data Engineering for personal use, this is the ultimate "learn in public" project! 🚀 The Architecture: From Raw Export to Real Insights Before we write a single line of SQL, let’s look at how the data flows. We want a system that is modular, fast, and stays entirely on our local machine (privacy first, right? 🥑). graph TD A[Raw Data: Apple Health / Oura / Garmin] -->|CSV/JSON| B(DuckDB Storage) B --> C{dbt Transformation} C -->|Cleaned Views| D[DuckDB Analytical Layer] D --> E[Apache Superset / Grafana] E -->|Visualization| F[Personal Biometric Dashboard] style B fill:#fff,stroke:#333,stroke-width:2px style D fill:#fbbf24,stroke:#333,stroke-width:2px Prerequisites 🛠️ To follow along, ensure you have the following in your tech stack: DuckDB : Our ultra-fast in-process analytical database. dbt-duckdb : For data modeling and transformations. Apache Superset : For the "wow factor" visualizations. Python 3.10+ : To glue it all together. Step 1: Ingesting the "Mess" with DuckDB DuckDB is incredible because it can query CSV and JSON files directly without an ingestion step. Let’s say you have a massive heart_rate.csv from an Apple Health export. Instead of waiting for a traditional DB to "load" the data, we can create a view instantly: -- Create a

👋👋👋👋 Looking back on your week -- what was something you're proud of? All wins count -- big or small...

I recently read an article by the main maintainer of InversifyJS describing the journey of rebuilding its dependency resolution algorithm . What caught my attention wasn't the performance improvements or the technical details. It was something much more familiar. As I was reading, I realized they were experiencing the exact same phenomenon I had experienced years ago while creating InversifyJS. It reminded me of something that, until now, I had never really put into words. The temptation to solve the hardest problem first Every engineer has experienced it. You're implementing a feature when you encounter a design problem that feels wrong. You know the current approach won't scale, and you know there must be a beautiful abstraction somewhere, so you stop writing code and start designing. Sometimes that's the right thing to do. Many times it isn't. While building InversifyJS, I eventually adopted a different habit. Whenever I found myself thinking, "This feels too complicated, and I can't find a simple, elegant solution right now," I decided to wait. Not because I ignored the problem, but because I didn't think I understood it well enough yet. Instead, I focused on features where I had a reasonable level of confidence. I kept improving the parts of the system that felt obvious, leaving the difficult problems untouched. At first, this almost felt irresponsible. Over time, it became one of the most valuable engineering lessons I have learned. The magic wasn't finding the solution The interesting part is that I rarely came back later with a better idea. Something stranger happened. Implementing those simpler features changed the system itself. New abstractions naturally appeared. Responsibilities became clearer. Concepts that previously seemed unrelated suddenly fit together. Eventually, I would return to the "hard" problem only to discover it wasn't hard anymore. Not because I had become smarter or because inspiration had struck overnight. The problem itself had changed

I think many of us have already noticed that a growing number of open-source projects and libraries are moving towards commercial or dual-licensing models. In the .NET ecosystem, several widely used libraries have taken this path over the past year or so. AutoMapper and MediatR introduced commercial editions under a dual-licensing model, Fluent Assertions began requiring a paid licence for commercial use with version 8, and MassTransit 9 became a commercial product. These libraries were widely used in .NET applications and I mean widely used. Many projects treated them almost as a standard part of the ecosystem. Now, the same change is reaching the frontend world. PrimeTek recently announced that future major versions of PrimeNG, PrimeReact and PrimeVue will no longer be released as open source. All these projects were widely adopted, and many commercial applications depended heavily on them. Their licensing changes were primarily driven by the cost of long-term maintenance, but this raises a broader question: Is AI also changing the world of open source? You have probably already read many articles about code inflation. With AI, we can generate a huge amount of code in a very short time, even if the quality is sometimes questionable. The same thing is happening in open source. Maintainers can now receive more AI-generated issues, pull requests and feature requests than they can realistically review. Producing code has become cheaper, but understanding, testing and maintaining that code still requires significant human effort. Maintainers can become overwhelmed very quickly. AI may also discourage some developers from publishing their work publicly. Even small experiments, educational repositories and proof-of-concept projects can become training material for large language models. Some authors may therefore decide to keep their repositories private because they do not want AI companies learning from their work without permission, attribution or compensation. Licens

Sometimes, there comes a day in life when everything around me continues as usual, but something...

If this is too long, tldr : Google Conway’s Law wath yt video and think There is a popular rule in software development called Conway's Law. It says that organizations design systems that mirror the way people inside those organizations communicate. In simpler terms: Your architecture will eventually look like your team structure. Big company with separate frontend, backend, data, DevOps, and platform teams? You will probably end up with separate services, separate processes, separate ownership, and a lot of API calls between people who sit in different Slack channels. But what happens when the entire company is just two people? That is where things get interesting. At bundle.social, we are running a unified social media API that handles a lot of edge cases. And there are two of us. There is no dedicated platform team No analytics department No infrastructure group. No product manager translating customer feedback into Jira tickets. Just two people are trying to keep a fairly large system moving without turning it into a pile of slop services nobody fully understands. You would think Conway's Law does not really apply to such a small team. It absolutely does. It just shows up differently. How Conway’s Law Works in a 2-Person Team When you have 50 developers split across departments, Conway's Law creates microservices and cross-team dependency hell. When you have two developers, Conway's Law forces your system into one of two extremes: The "Two Halves of a Brain" Split: Service A belongs entirely to Person A, and Service B belongs entirely to Person B. Because human communication between two people has practically zero friction, it's extremely tempting to drift into the lazy version of Conway's Law: ignoring technical boundaries altogether because "we can just talk about it on Slack." Why write explicit API documentation when you sit next to the person who wrote the endpoint? Why enforce strict domain boundaries when you can just export a helper function across modul

AI Worms in Word: How Document-Borne Threats Self-Propagate Meta Description: Document-borne AI worms can self-propagate through Copilot for Word, creating a new attack surface. Learn how these threats work and how to protect yourself. TL;DR: Researchers have demonstrated that malicious instructions embedded in documents can hijack Microsoft Copilot for Word, causing it to replicate harmful content, exfiltrate data, and spread the attack to new documents automatically — all without the user clicking a single suspicious link. This isn't theoretical anymore. Here's what you need to know and what you can do about it right now. Key Takeaways Document-borne AI worms exploit a technique called prompt injection to hijack Copilot for Word's generative AI capabilities These worms can self-propagate by instructing Copilot to embed malicious instructions in any new documents it generates or summarizes Sensitive data — including email addresses, financial figures, and personal information — can be silently exfiltrated during normal document workflows The attack requires no malware installation and can bypass traditional antivirus tools entirely Microsoft has issued guidance but the fundamental architectural challenge remains unsolved as of mid-2026 Practical defenses exist today, including document hygiene practices, access controls, and third-party AI security tools What Are Document-Borne AI Worms? If you've been following cybersecurity news, you've probably heard the term "prompt injection" thrown around. But document-borne AI worms take that concept to a genuinely alarming new level. Instead of just tricking an AI into saying something it shouldn't, these attacks can turn Microsoft Copilot for Word into an unwitting accomplice that spreads malicious instructions across your entire document ecosystem . The core idea is deceptively simple: an attacker embeds hidden instructions — often in white text on a white background, in metadata, or inside document comments — that Copilo

Every senior developer, engineering manager, and tech recruiter I’ve talked to recently is echoing...