标签：#ev

Recently got an email from "Paratype" that one of my sites was using a font that was unlicensed and we needed to pay a fee. I inherited the site from someone else so had no idea about the font, which was hidden in a Bootstrap library, so the decision was made to remove it completely. I replied to Paratype stating this and they replied, "Well, you were using it in the past, so you should pay us anyway." Obviously I'm going to tell them to piss off, but I was wondering how common this sort of thing is? I doubt they have much of a claim legally, the wording of the email is pretty weak sounding to me. submitted by /u/TConner42 [link] [留言]

Hey everyone, I'm a researcher at Carnegie Mellon University conducting a research study on how developers are actually using spec-driven development (SDD) in practice — things like writing SPEC.md files, PRDs, or structured natural-language specs before working with AI coding agents like Claude Code, Cursor, Kiro, etc. There's a lot of community knowledge about how to do SDD well, but almost no academic research on it. I'm trying to change that. What the study involves: One 45-60 minute semi-structured interview via Zoom Questions about your SDD workflow, what's worked, what hasn't, and how it fits into your SDLC No tasks, no tests — just a conversation about your experience Who I'm looking for: Have at least one year of active experience as a contributor or maintainer of any open-source GitHub project Have used SDD tools/workflows in that project (spec files, structured prompting, plan-mode workflows, etc.) 18 or older, fluent in English What you get: Honestly, nothing monetarily. But your experience will directly shape a taxonomy of SDD workflows and practices that I'll publish openly. Happy to share findings with participants who want them. Ethics/privacy : The interview will only be audio-recorded with your consent. Your responses will be kept confidential and de-identified in any published findings. If you're interested, fill out this short screening survey (5 min): LINK Or DM me / comment below with questions. Also happy to hear if there are other communities I should be posting in. submitted by /u/lost_researcher1 [link] [留言]

OSSurf is a platform for discovering open-source repositories and contribution opportunities. It lets you: Explore trending repositories Track pull requests and issues Browse projects by language and category Discover projects suitable for contributions and GSoC Looking for feedback on the overall experience, usefulness, and UI. https://ossurf.vercel.app/ https://github.com/OSSURF submitted by /u/Direct_Sorbet_1631 [link] [留言]

Syndicated from the FavCRM blog . The old quote was two weeks. With an agent on the UI and a headless backend, it's an afternoon. A client needs a booking site. The old quote was two weeks: a calendar, a database, an availability engine, payments, a customer table. With an AI agent building the frontend and FavCRM as the headless backend , the real work is an afternoon. Here is the whole job, start to finish. The scenario A small clinic. Three services, one practitioner, online booking with deposit. You are the agency; you have an AI agent in your editor and a terminal. The plan: Register the clinic's FavCRM workspace Configure services and availability Wire one server route that talks to FavCRM Let the agent build the booking UI against that route Test a real booking end to end Step 1 — Register the workspace (~5 min) The favcrm CLI registers a workspace and issues an API key. No dashboard. favcrm signup request --email clinic@example.com \ --organisation-name "Bright Smile Clinic" favcrm signup verify --request-id < id > --code <6-digit-code> The verify step prints a fav_mcp_* key. Put it where your build can read it — never in the repo: export FAVCRM_API_KEY = fav_mcp_... Step 2 — Configure services and availability (~30 min) Hand the brief to your agent and let it call the tools. Inspect a schema first: favcrm tool describe create_service Then create each service: favcrm tool call create_service '{ "name": "New Patient Exam", "durationMinutes": 45, "price": "80.00" }' favcrm tool call create_service '{ "name": "Cleaning", "durationMinutes": 30, "price": "60.00" }' Set when the practitioner works, so availability is real: favcrm tool call set_staff_availability '{ "weekday": "mon", "start": "09:00", "end": "17:00" }' Repeat per weekday. At this point the backend is done — services, hours, an availability engine that knows about clashes. You wrote no schema. Step 3 — One server route (~30 min) The browser must never hold the API key. Put it in one server route tha

Syndicated from the FavCRM blog . The number that predicts whether an agent is safe to let loose isn't the tool count. When people compare agentic CRMs, they count tools. The number that actually predicts whether an agent is safe to let loose is a different one: annotation coverage . An MCP tool annotation tells the agent what a tool does to the world — whether it reads or mutates, whether it's safe to retry, whether it reaches an external service. Without annotations, the agent is guessing. This is what they are, and why a catalog's annotation coverage matters more than its tool count. What an MCP annotation is Every MCP tool can carry hints alongside its input and output schemas: readOnlyHint — the tool only reads; it changes nothing. Safe to call freely. destructiveHint — the tool mutates or deletes. The agent should confirm before calling. idempotentHint — calling it twice with the same input has the same effect as once. Safe to retry on a timeout. openWorldHint — the tool reaches an external service (sends an email, charges a card), so its effects leave the system. These are not documentation for humans. They are machine-readable signals the agent reasons over before it acts. Why they prevent the worst failures The dangerous class of agent failure is not "the agent couldn't do something." It's "the agent did the wrong destructive thing because it misread an ambiguous instruction." Delete the customer instead of the tag. Refund the wrong invoice. Cancel every booking instead of one. Annotations let the agent self-gate. A well-annotated catalog means the agent calls list_members without ceremony but pauses to confirm before cancel_booking , because one is marked read-only and the other destructive. Pre-MCP function-calling had no equivalent — every tool looked the same to the model, so safety lived entirely in the prompt. Why coverage matters more than count A 190+ tool catalog with 100% annotation coverage is safer than a 30-tool catalog with none. A tool that l

What are HTML Tags? HTML documents consist of a series of elements, and these elements are defined using HTML tags. HTML tags are essential building blocks that define the structure and content of a webpage. HTML tags are composed of an opening tag, content, and a closing tag. The opening tag marks the beginning of an element, and the closing tag marks the end. The content is the information or structure that falls between the opening and closing tags. For Example: <h1>Hello</h1> HTML Elements HTML elements are the essential components of a webpage and provide structure, organization, and meaning to content. Elements are defined by HTML tags which define how different types of content will appear in a browser window. For Example: <p> This is an element. </p> Block-Level Elements A page’s entire width is occupied by a block-level element. The document always begins with a new line. An HTML page generally has three tags i.e., <html> , <head> , and <body> tag. Example: The following is an unordered list, an example of block-level elements. List item 1 List item 2 Inline Elements A block-level element’s inner content can be formatted with an inline element by adding links and stressed strings. These elements help you to format text without disrupting the content’s flow. Example: The following code creates a hyperlink to a URL. It is an inline element because it is used within paragraphs, headings, or other text content to create hyperlinks. It does not disrupt the flow of the document by forcing new lines before or after its content. <a href="https://www.example.com"> Visit Example </a> CSS Properties CSS properties are used to decorate your web page and assign a unique behavior to your HTML element. CSS properties are the foundation of web design, used to style and control the behaviour of HTML elements. They define how elements look and interact on a webpage. Used to control layout, colors, fonts, spacing, and animations on web pages. It is essential for making web pa

I have found a weird case where I put in a real address (verifiable on google maps) it keeps correcting me to a wrong address (doesn't exist and cannot be found on google maps. What gives? If it's truly a bug, how do I let Google know? See below. https://preview.redd.it/x2b1ws07635h1.png?width=1336&format=png&auto=webp&s=18091e8ec57f96854611fef8578fd9e79e369d8b submitted by /u/flatcoke [link] [留言]

Two rules that can't both be true Event sourcing has one rule: you never delete. You append. The log is the source of truth, and rewriting history is the cardinal sin. GDPR Article 17 has one rule too: when a user asks, you erase their personal data. Not "hide it," not "flag it deleted" — erase it, everywhere, including backups. Put an event-sourced system in front of a privacy regulator and those two rules collide head-on. The user's name, email, and address are baked into CustomerRegistered , AddressChanged , OrderPlaced — dozens of immutable events, replicated to read models, snapshotted, and sitting in every nightly backup you've ever taken. "Just delete the events" breaks event sourcing. "Never delete" breaks the law. Most teams discover this tension after they've committed to append-only. A word on why this isn't academic for me. I build from Germany. Article 17 is EU law — the GDPR, or DSGVO as we call it here — not a German invention, but Germany enforces it about as hard as anywhere in Europe: regional data-protection authorities that issue real fines, and "we were careful" has never been a defense that held up. That pressure is exactly why I wanted erasure to fall out of the architecture instead of being a promise I make to an auditor and then pray I can keep. Why "delete the row" doesn't actually erase anything Say you give in and hard-delete the events for one user. You've still got their data in: every read-model projection rebuilt from those events, every snapshot that rolled them up, every backup taken before the deletion, every replica and every export that already left the building. Chasing personal data across all of those, provably, on a 30-day regulatory clock, is a nightmare — and a single missed backup tape means you didn't comply. Physical deletion doesn't scale to a system designed to keep everything forever. Crypto-shredding: delete the key, not the data The trick is to stop trying to delete the data and instead delete the ability to read it

The Hook: The 48-Hour Re-Infection Nightmare It’s a scenario that keeps e-commerce founders and agency directors awake at night: You wake up to a critical alert that your flagship WordPress site is redirecting users to a spam domain. You immediately deploy a premium security plugin, run a deep scan, quarantine three suspicious files, and breathe a sigh of relief. The scanner gives you a green checkmark. You're safe. Then, exactly 48 hours later, the redirects return. What went wrong? The automated scanner checked the surface, but the attacker had already established a foothold deeper in the architecture. They didn't rely on a loose PHP file in your uploads directory; instead, they weaponized an overlooked, unauthenticated WordPress REST API endpoint to re-inject the payload the moment your scanner turned its back. When high-value enterprise sites are compromised, treating the symptoms with standard security plugins is like putting a band-aid on a structural fracture. To truly remediate a persistent infection, you must think like a forensic analyst, hunt down hidden persistence mechanisms, and harden the application perimeter. The Anatomy of Persistence: Where Malware Hides Modern WordPress malware is sophisticated. Attackers know that standard security tools look for modified core files or rogue scripts in the /wp-content/plugins/ directory. To survive cleanups, they embed themselves into the core infrastructure of your site using three primary vectors: 1. wp-config.php Pre-Loading Attackers frequently inject obfuscated code directly into the top of wp-config.php . Because this file executes before the rest of the WordPress core loads, malware can hook into the initialization process, silently recreating deleted malicious files every time a page is requested. 2. Malicious Must-Use (MU) Plugins Files placed in /wp-content/mu-plugins/ are executed automatically by WordPress and cannot be disabled from the admin dashboard . Attackers love this directory. They will ofte

I’m building Obex, a faith-rooted self-control app for men who want to quit porn and stay consistent with daily discipline. The stack is Expo / React Native, with a web landing page and a desktop blocker companion. Core features: Streak tracking and rank progression Panic Mode for urgent moments Accountability partners Blocker support on desktop Christian-focused language and reminders The goal is to make the product feel practical rather than preachy. People usually respond better to clear feedback loops, a visible streak, and a calm recovery path after setbacks. If you want to see it or give feedback, the site is here: https://obex.so

submitted by /u/creaturefeature16 [link] [留言]

This open-source community project lets you create a StumbleUpon-like experience for recommending your favorite sites.

Hi — I'm E Lion (Eric), Hawaii-based builder at Coral Crown Solutions . I ship production code on my own domains—not tutorials: elionmusic.com — 400+ promo pages, vinyl-style player UX, Vapi phone agent + OpenAI "Shine" chat (one knowledge base, unified CSV log, webhook follow-up emails) prayerauthority.com — faith-tech at scale; WebM flying angels , SOAP journal, oracle tools Digital Zion — Three.js metaverse + native 3D desk fork + localhost bridge APIs Stack: PHP 8, vanilla JS, webhooks, JSON-LD / Search Console, ElevenLabs, Playwright, Electron (Shine assistant), Cursor pair-programming. Looking for: peers who respect hard integration work (SMTP, CORS, cPanel, webhook auth) and clients who need a real AI front desk or artist/ministry platform. Live demos: coralcrownsolutions.com · elionmusic.com Happy to give honest feedback on your builds—drop a link.

The Setup I run a Proxmox 9 homelab (pve-manager/9.0.5, kernel 6.14.8-2-pve) and I needed to run Docker inside an LXC container — not a VM — to test a customer-style "bring-your-own-VPS" deployment path for a PaaS I'm building. The container had to act like a standard Ubuntu cloud VM: Docker, systemd, the works. LXC over a full VM gets me near-bare-metal performance, a fraction of the RAM overhead, and instant boots. The catch: the "Docker on LXC" recipes you'll find on most blog posts and Proxmox forum threads are out of date . They assume kernel 5.x and runc 1.1.x. On a modern Proxmox (kernel 6.14 + runc 1.2+ shipped with Docker 29) those recipes fail in two new and confusing ways before you even reach the workarounds we used to know about. This article walks through exactly what fails, why it fails, and the config that actually works in 2026 — plus an honest look at the security tradeoffs, because spoiler: the working config is privileged , and that matters. The Goal A Proxmox LXC container that can: Run docker run hello-world cleanly Pull and build complex images (multi-stage builds, overlay2 storage driver) Run nested containers with their own systemd Use systemd --user for per-service lingering processes Attempt 1: Unprivileged LXC (the path you "should" take) Conventional wisdom says: use unprivileged LXC. The container's root is mapped to an unprivileged UID on the host (typically 100000 ), so even a full container compromise can't escape to host root. Modern Proxmox makes this the default and recommended mode. I started with an unprivileged Ubuntu 25.04 container, added the now-standard features: pct set <vmid> -features nesting = 1,keyctl = 1,fuse = 1 Then inside the container, installed Docker from the official download.docker.com repo and ran: docker run --rm hello-world Here's what happened: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start

Wer täglich in anspruchsvollen Agenturprojekten arbeitet und zwischen Windows-Host und Linux-Umgebung wechselt, weiß: WSL 2 ist ein Gamechanger. Doch selbst wenn man das perfekte Setup einmal konfiguriert hat, kommt unweigerlich der Moment, in dem eine Distribution hängt, RAM freigegeben werden muss oder man ein Backup ziehen will. Anstatt jedes Mal Stack Overflow zu durchsuchen, habe ich mir angewöhnt, die essenziellen Konsolen-Befehle immer griffbereit zu haben. Hier sind die 5 WSL-Befehle, die ich in meinem Setup am häufigsten brauche: Wer täglich in anspruchsvollen Agenturprojekten arbeitet und zwischen Windows-Host und Linux-Umgebung wechselt, weiß: WSL 2 ist ein Gamechanger. Doch selbst wenn man das perfekte Setup einmal konfiguriert hat, kommt unweigerlich der Moment, in dem eine Distribution hängt, RAM freigegeben werden muss oder man ein Backup ziehen will. Anstatt jedes Mal Stack Overflow zu durchsuchen, habe ich mir angewöhnt, die essenziellen Konsolen-Befehle immer griffbereit zu haben. Hier sind die 5 WSL-Befehle, die ich in meinem Setup am häufigsten brauche: 1. Den Status aller Distributionen prüfen Der absolute Standard-Befehl, um zu sehen, welche Linux-Instanzen laufen und welche WSL-Version sie nutzen. wsl --list --verbose # oder kurz: wsl -l -v 2. Der Notaus-Schalter (RAM freigeben) Wenn Docker oder ein Node-Prozess im Hintergrund den gesamten Arbeitsspeicher blockieren, fährt dieser Befehl alle WSL 2 Instanzen sauber herunter. wsl --shutdown 3. Eine bestimmte Distribution als Standard setzen Wichtig, wenn man beispielsweise neben Ubuntu noch Debian installiert hat und festlegen will, was sich beim reinen Befehl wsl öffnet. wsl --set-default <Distributionsname> 4. Die WSL-Umgebung neustarten Es gibt keinen direkten "Restart"-Befehl. Die sauberste Lösung ist das Beenden (Terminate) der spezifischen Instanz. Beim nächsten Aufruf startet sie frisch. wsl --terminate <Distributionsname> 5. IP-Adresse der WSL-Instanz herausfinden Extrem hilfreich für be

What is an LLM evaluation harness? A deep dive into lm-eval-harness You fine-tuned a 7B model. It aced your smoke tests, your colleague ran a few prompts and shrugged approvingly, and the README is now full of cherry-picked outputs that look great in a screenshot. Then someone asks: how good is it, really? — and you realize you have no number to point at. No MMLU score. No HellaSwag. Nothing reproducible, nothing you can defend in a PR review, nothing you can compare to last week's checkpoint. That's the gap an evaluation harness fills. It turns "vibes-based evaluation" into something with a score, a stderr, and a config file you can re-run next Tuesday. Why evaluate LLMs at all? Two reasons that actually matter: Comparability. If you can't put a number on a model, you can't compare it to anything else — not the previous checkpoint, not the open-source baseline, not the commercial API you're trying to replace. Leaderboards are noisy and gaming-prone, but a local leaderboard with the tasks you care about is one of the most useful artifacts a team can build. Regression detection. Most model regressions are silent. A 0.3-point drop on MMLU won't show up in a chat session, but it will show up in CI. People who ship models for a living treat evals the way backend engineers treat unit tests: mandatory, run on every PR, and blocking on regressions. You don't need a hundred benchmarks. You need the three to five tasks that map to your actual use case , plus one or two general capability anchors (MMLU, HellaSwag) so you can sanity-check that you didn't accidentally destroy basic reasoning while you were tuning for your domain. What is an "evaluation harness"? An evaluation harness is the software that sits between a model and a benchmark. It handles the boring-but-critical parts: loading the model weights, tokenizing prompts in the way the benchmark expects, running inference, extracting the answer from a longer generation, scoring it against a ground-truth key, aggregating

Building a Self-Healing Data Pipeline with Event-Driven Idempotence Building a Self-Healing Data Pipeline with Event-Driven Idempotence A senior engineer’s sketchbook: a project I shipped to production that turned brittle batch jobs into resilient, observable, and self-healing data pipelines. The core idea is to treat data processing as an event-driven system with strict idempotence guarantees, automated reconciliation, and graceful recovery. The result was a measurable reduction in retry storms, faster time-to-insight for dashboards, and a foundation that scales with data volume without blowing up operator toil. Overview and motivation Problem: A data ingestion workflow relied on nightly batch jobs that often overlapped, causing late-arriving data, duplicate processing, and fragile error handling. Observability was ad-hoc, retries were uncoordinated, and operators spent days triaging failures. Solution: Reframe the pipeline around event streams with idempotent processing, push-based checkpoints, and a lightweight orchestration layer that can recover from partial failures without human intervention. Impact: 40% reduction in data latency for dashboards, 60% fewer retry-induced incidents, and a robust foundation for future scaling. Architecture at a glance Data sources emit events to a durable message bus (Apache Kafka or a cloud equivalent). A set of microservices subscribes to the stream, each performing a deterministic, idempotent transformation. A central idempotence layer guarantees that repeated events do not mutate state or produce duplicate side effects. A reconciliation service audits the target data store against the event log and replays or compensates as needed. Observability stack with per-event tracing, lineage, and anomaly detection. Key design principles Idempotence by default: Every processing step should be safe to replay. Use deterministic keys and avoid non-idempotent side effects without compensation. Exactly-once semantics where feasible: Impleme

Vercel's built-in cron triggers your serverless functions on a schedule. For simple use cases it works. But it has no failure alerts, no execution history on the Hobby plan, and no way to know whether your function actually completed successfully — only that it was called. Where Vercel cron falls short Vercel cron works by invoking one of your API routes on a schedule defined in vercel.json . The invocation is fire-and-forget — if your function times out, throws an error, or returns a non-2xx status, you get no alert. You find out when a user reports something is broken. The specific gaps developers run into: No failure alerts. Vercel does not send an email or webhook if your scheduled function fails. No execution history on Hobby. The free plan does not retain cron execution history. Timeout ceiling. Functions are subject to the same timeout limits as all serverless functions — 10 seconds on Hobby, up to 300 seconds on Pro. HTTP-only. Vercel cron calls an HTTP endpoint on your app. You cannot schedule arbitrary background work outside your deployment. No heartbeat monitoring. Even if your function is called successfully, you have no built-in way to verify it completed its work — only that it was invoked. Minimum 1-hour interval on Hobby. Sub-hourly schedules require a paid plan. If you are hitting any of these limitations, you need an external tool. Comparison at a glance Tool Schedules jobs Failure alerts Heartbeat Uptime monitoring Free tier Vercel built-in ✓ ✗ ✗ ✗ ✓ (1h min) Tickstem ✓ ✓ ✓ ✓ ✓ Upstash QStash ✓ ✓ (retries) ✗ ✗ ✓ Inngest ✓ ✓ ✗ ✗ ✓ cron-job.org ✓ ✓ (basic) ✗ ✗ ✓ Tickstem — cron + heartbeat + uptime in one API key Best for: developers who need scheduling, failure alerts, heartbeat monitoring, and uptime checks without managing multiple tools. Tickstem is an external HTTP cron scheduler with built-in monitoring. You register your Vercel endpoint as a cron job, and Tickstem calls it on your schedule — every minute if needed, regardless of your Vercel

Swap debugging war stories\n\nI have been living in webhook + PHP + email land (Vapi, OpenAI, PHPMailer, CSV logs).\n\nDrop your stack in a comment (even one line). I will reply with the first three places I would look for a silent production failure.\n\nNo sales pitch — trying to meet dev friends who ship unglamorous integration work.\n\nMy builds: elionmusic.com · prayerauthority.com

Stop shipping a 1990s C library to compute planets. Xalen is the pure-Rust, Apache-2.0 replacement for Swiss Ephemeris. If your app does astrology, you already know the dependency. Swiss Ephemeris: a C library from the 1990s, a folder of binary .se1 data files you have to ship and locate at runtime, and a license that is either AGPL or you pay for a commercial seat. For 30 years it was the only serious option, so everyone just swallowed the cost. That era is over. Xalen Ephemeris is a full planetary engine written in pure Rust, with no unsafe in the core engine (the only unsafe lives in the optional FFI, Node and WASM binding crates), released under Apache-2.0. No C toolchain. No data files to ship. No copyleft clause waiting for the day you try to make money. It is built to replace Swiss Ephemeris in production, not to admire it from a distance. Python is live on PyPI and the Rust crates are live on crates.io: # Python pip install xalen # Rust cargo add xalen-ephem xalen-time xalen-ayanamsa xalen-vedic Node and WASM build straight from the repo. Repo: https://github.com/vedika-io/xalen-ephemeris Switching takes one line Xalen ships a pyswisseph-shaped API on purpose. Migrating an existing codebase is a find-and-replace: # before import swisseph as swe # after import xalen.swe as swe jd = swe . julday ( 1990 , 6 , 15 , 10.5 ) xx , ok = swe . calc_ut ( jd , swe . SUN , swe . FLG_SWIEPH | swe . FLG_SPEED ) # same argument order, same SE_/SEFLG_/SIDM_ constants, same tuple layout Your function calls do not change. Your data-file directory disappears. Your license problem disappears. Xalen vs Swiss Ephemeris Line them up and the gap is hard to miss. Swiss Ephemeris is C from the 1990s, shipped as a native library you compile and link, fed by .se1 data files you have to bundle and locate at runtime, under AGPL or a paid commercial license. Xalen is pure Rust with no unsafe in the core engine, thread-safe, with no native dependency and no data files for the analytical eng