标签：#t

A reviewer that flags the same known issue on every run trains you to ignore it. The fix can't be "hide findings," because a tool that silently drops things is worse than one that nags. CommitBrief has two ways to accept a finding and move on — a per-developer baseline and an in-source suppression marker — and both are built so that what they remove is always counted, never quietly swallowed. The interesting part is how a finding keeps its identity when the code around it moves. TL;DR Baseline ( .commitbrief/baseline.json , gitignored): accept the current findings once; later runs drop anything whose fingerprint is already in the file. Inline suppression : a commitbrief-ignore: <reason> comment on or above a line removes that finding — and lives in committed source, so a reviewer sees it. A finding's fingerprint deliberately excludes its line number , so accepting it survives the code drifting up and down the file. Both are TRUE removals — they affect --fail-on and the JSON findings[] , not just the display — and both print what they removed. The limit. The baseline is per-developer, not a shared team policy; it quiets your runs, not CI's. The fingerprint that survives code drift The whole design rests on one question: when is a finding "the same finding" you already accepted? If the answer included the line number, a baseline would evaporate the moment you added an import above the issue. So it doesn't. A finding's identity is three fields, hashed: func normalizeTitle ( title string ) string { return strings . ToLower ( strings . Join ( strings . Fields ( title ), " " )) } func Fingerprint ( f render . Finding ) string { h := sha256 . New () h . Write ([] byte ( f . File )) h . Write ([] byte { 0 }) h . Write ([] byte ( f . Severity )) h . Write ([] byte { 0 }) h . Write ([] byte ( normalizeTitle ( f . Title ))) return hex . EncodeToString ( h . Sum ( nil )) } File, severity, and a normalized title — and nothing else. Line is out, so the same issue keeps its finger

A year ago today, I started at Approov. A hundred days in, I wrote about the transition: leaving management, the refreshing day-to-day feedback loop, the strange experience of relearning a craft I thought I'd lost. I stand by most of it. But a hundred days is enough to notice a change; it takes a year to understand it. So here is what a year taught me that a hundred days couldn't. The rust that mattered At a hundred days I called myself rusty. I was. I reached for patterns that no longer fit and looked up syntax I once knew by heart. I expected that to be the hard part. It wasn't. The rust came off faster than I feared, and somewhere along the way I realised I'd been worried about the wrong thing entirely. The agentic era arrived in earnest this year, and it quietly rewrote the job description. The premium skill is no longer how fast you can produce code from memory. It's whether you can write a precise specification and make a strong architectural decision, then judge honestly whether what comes back is any good. Those are not new skills for me. They are the exact skills that years of reviewing architecture and mentoring engineers had been sharpening the whole time. The craft I sat down to relearn was not the craft that turned out to matter. I spent years assuming management had pulled me away from engineering. It hadn't. It had been quietly preparing me for the version of engineering that was coming. Charity Majors has a name for the shape of this: the engineer/manager pendulum. The idea that a healthy career swings between the two, rather than treating management as a one-way door you walk through once and never come back. I didn't choose when mine swung back. But it swung the right way, and the years spent on the other side weren't lost. They were compounding. A secure transaction is a secure transaction The work itself has been a homecoming of a different kind. I spent years in payments. Now I work in mobile and API security. On paper those are different worlds

June was not about making the most contributions -- it was about becoming a better collaborator. This month I had: ✅ 1 PR merged 🔄 1 PR still open 👀 3 PR reviews completed 🐞 1 issue opened I am making this graph all green... Biggest Learning The biggest milestone wasn't writing code. It was reviewing pull requests. One review led the author to update their PR based on my feedback. That experience taught me that open source isn't just about contributing code; it's also about helping improve someone else's work through discussion and constructive feedback. Working Alongside AI Reviewers I also had an interesting experience interacting with automated reviewers like Vercel Bot and Copilot. Rather than accepting every suggestion, I tested them, evaluated the trade-offs, and explained why I chose a different approach. It was a good reminder that AI can assist reviews, but engineering judgement still matters. Looking Ahead My biggest challenge is still finding a larger project that I can consistently contribute to over the long term. That's my main goal for July, alongside publishing my OSS Contribution Toolkit repo and making my CaaS project usable for others. Small, consistent steps continue to move the journey forward. What was your biggest open source learning in June? Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

The White House is easing restrictions on Anthropic’s most advanced AI models weeks after ordering the company to suspend access for foreign nationals.

What if one pitch changed everything? The next company nobody has heard of yet is building something that will matter. It could be yours.

WebMCP lets a web page expose tools that AI agents can discover and execute inside the browser. That...

The app's arrival follows an announcement at last year's Meta Connect conference.

Dish, the company that operates Dish TV and Sling TV, has filed for Chapter 11 bankruptcy," as reported earlier by Reuters. The plan will allow the EchoStar-owned company to continue to wind down its wireless operations after "unforeseen delays" held back its sale of $23 billion worth of 5G spectrum to AT&T. Dish TV, Sling […]

Most "agent memory" and "agent context" tools today require sending your data to someone else's cloud. If you operate in a regulated, air-gapped, or simply privacy-conscious environment, that rules them out before you've even tried them. I build the opposite: two MIT-licensed, local-first MCP servers that do this work entirely on your own hardware. The problem Agent memory and context assembly are converging on a cloud-only default. That's a non-starter for defense, healthcare, finance, legal, and any team that can't or won't let agent context leave their VPC. It's also just slower and less deterministic than it needs to be: agents re-discover the same facts about your repo and services every session, burning tokens and turns before doing any real work. Mimir: persistent memory, fully offline Mimir is a single ~8MB Rust binary. It encrypts everything at rest with AES-256-GCM, and it works with no API key, no model download, and no network access at all, because the embeddings used for dense search are bundled directly into the binary. It's bi-temporal: every fact carries a validity window, so you can query memory "as of" any past point and supersede facts without deleting history. 43 MCP tools, SQLite + FTS5 hybrid search under the hood. One honest tradeoff worth naming: the FTS5 index needed for fast keyword search currently sits over plaintext, even though the underlying record is encrypted at rest. We're upfront about this in the docs rather than overstating the encryption story. Perseus: compile-before-context Perseus takes a different approach to context than runtime tool-call discovery. Instead of letting an agent rediscover your git state, running services, and test status through a chain of tool calls every session, it compiles all of that into a ready briefing the moment a session starts. The result is deterministic and byte-stable: the same repo state always produces the same compiled context. Honest, reproducible benchmarks On paraphrased queries, Mimir's

The free open source agentic program is finally invading your phone.

Un fondateur technique doit arrêter de coder le jour où son code freine plus son entreprise qu'il ne l'aide. Concrètement, trois signaux ne trompent pas : vous ralentissez votre propre équipe, vous ne managez plus, vous perdez la vue d'ensemble. Lâcher le code ne veut pas dire renoncer au produit ni à la technique : c'est passer de 90 % de code à 10 % de prototypage, pour récupérer le levier bien plus puissant d'un rôle de CPO, CTO stratégique ou CEO. Voici comment reconnaître le moment et organiser la transition. Vous avez fondé votre startup, écrit les premières lignes de code, recruté vos premiers développeurs. Et maintenant vous êtes toujours là, à relire chaque pull request, à refactorer du code le week-end, à être le seul à savoir déployer en prod. Vous savez que ce n'est plus tenable, mais vous n'arrivez pas à lâcher. Parce que lâcher le code, pour un fondateur technique, c'est renoncer à ce qui vous a défini depuis le premier jour. De fondateur à C-Level Cette transition est souvent l'occasion de clarifier le rôle que vous voulez jouer. Si le produit vous passionne, le rôle de CPO est une évolution naturelle. Si c'est la vision business, vous devenez CEO. Ni l'un ni l'autre ne nécessite de coder 8 heures par jour. Les trois signaux qu'il est temps d'arrêter Avant de les détailler, voici les trois signaux en un coup d'œil, avec ce qu'on observe sur le terrain et le risque sous-jacent. Si vous vous reconnaissez dans ne serait-ce qu'un seul, il est temps d'agir. Signal Ce qu'on observe Le risque pour l'entreprise Vous ralentissez l'équipe Tout passe par votre validation, vous réécrivez le code Goulot d'étranglement, équipe qui n'ose plus proposer Vous ne managez plus Recrutement, 1-1, vision à 12 mois passent à la trappe Démotivation et départs silencieux des seniors Vous perdez la vue d'ensemble Vous confondez intéressant techniquement et utile au client Mauvaises décisions stratégiques, dérive produit Vous ralentissez votre propre équipe C'est le signal le pl

3 platforms, one queue, zero editorial control. That was the state of my content automation before I sat down to spec the dashboard. LinkedIn, X, and Threads each had their own generator, their own state files, their own publishing loop. Drafts got generated, passed a quality gate, and fired into the void. If the draft was mediocre or the timing was wrong, I found out after the fact. The problem is not the automation. Automation is why I can run three platform engines without spending two hours a day managing content. The problem is that zero editorial visibility means you cannot catch the bad ones before they post. What I wanted: see every draft before it goes out. Edit inline if needed. Post immediately or schedule for the next slot. Compose something manually when I have a specific take to push. Keep the comment automation untouched because that runs high frequency, low stakes, and babysitting individual replies defeats the point. The spec came out to three core flows. Review queue. Every pregenerated draft surfaces here with full context: platform, topic, generation timestamp, quality score. One click to edit inline, one to approve for the next slot, one to post immediately. The goal is a 30 second review per draft, not a full editing session. Manual compose. Sometimes I know exactly what I want to say. A text area, platform selector, and post button. No generation, no queue, just publish. This is the escape hatch for when something is happening in real time and the pregenerated queue is irrelevant. Schedule view. A simple calendar showing what is queued for which slot across all three platforms. The generator already handles slot logic and quiet hours. The dashboard just needs to surface the state so I can see gaps and move things around without touching JSON files directly. What I deliberately left out: comment automation. That pipeline runs separately, fires frequently, and does not benefit from human review on every reply. Adding it to the dashboard would cr

AWS ECR Guide for ECS Fargate Teams Originally published at https://fortem.dev/blog/aws-ecr-guide AWS ECR from the ECS Fargate operator's seat: how pulls work, the execution-role IAM, why private-subnet tasks fail, real pricing, and the lifecycle policy that cuts the bill. Every ECS Fargate deploy pulls an image from ECR — and ECR is the part nobody owns until it breaks. A task in a private subnet throws ResourceInitializationError , or five years of untagged images quietly push the bill to $400/month. This is ECR from the ECS operator's seat: how pulls actually work, the IAM the execution role needs, what it costs at fleet scale, and the lifecycle, scanning, and replication settings that matter at 10+ environments — with the AWS-verified pricing nobody else itemizes. TL;DR ECR is AWS's managed container registry — the default image store for ECS and EKS. Registry → repository → image, with IAM-based access and a short-lived auth token per pull. The #1 ECR failure on Fargate is a private-subnet task that can't pull: it needs either a NAT gateway or three ECR VPC endpoints, plus AmazonECSTaskExecutionRolePolicy on the execution role. ECR storage is $0.10/GB-month; same-region pulls to Fargate are free. The hidden bill is old images — one team went from $400/mo to ~$15/mo with a 30-day lifecycle policy. At fleet scale three settings matter: lifecycle policies (cost), scan-on-push (security), and cross-account replication (multi-account image distribution). For ECR-heavy fleets in private subnets, VPC interface endpoints are often cheaper than routing every pull through a NAT gateway. Ready to use — copy this today Push an image, then a lifecycle policy that keeps the bill flat, then the exact networking + IAM a private-subnet Fargate task needs to pull: # 1. Authenticate Docker to your private ECR registry, then push aws ecr get-login-password --region us-east-1 \ | docker login --username AWS --password-stdin \ 123456789012.dkr.ecr.us-east-1.amazonaws.com docker tag

"Privacy by design" is one of those phrases you read everywhere and rarely understand. It is often treated as a document to attach to a project, a box to tick before going live. In reality it is not a piece of paperwork: it is the way software is conceived and built from the very first line, so that it protects people's data without anyone having to remember to do so afterwards. What the GDPR actually says The principle is written plainly in Article 25 of the GDPR, which speaks of "data protection by design and by default". These are two distinct things. Protection by design concerns the choices made while the system is being built. Protection by default concerns how the system behaves the moment it is switched on, before anyone touches a single setting. The law does not mandate a specific technology. It asks for an outcome: that data protection be built into the system, proportionate to the risks, and not bolted on afterwards as a patch. It is a difference of substance, not of form. A well-designed system does not have to chase compliance: it already has it inside. It is not a document, it is an architecture The most common mistake is to reduce privacy by design to a file. A report is written, filed, and the building goes on exactly as before. But a PDF protects no data. What protects data are the technical decisions: what information is collected, where it is stored, who can see it, how long it stays, what happens when it is no longer needed. These decisions are made at design time, and changing them later costs far more than getting them right at the start. The principles, turned into concrete choices Privacy by design becomes useful only when it stops being a slogan and turns into a series of choices. Translated into practice, the principles sound like this. Minimisation. You collect only the data genuinely needed to deliver the service. A field you do not collect does not need protecting, cannot be lost in a breach, does not need keeping. The safest piece of da

At an event for pharmaceutical executives, biotech founders, and researchers on Tuesday, Anthropic announced Claude Science, a major new product intended to support scientific research in the same way that Claude Code supports software engineering. Like Claude Code, Claude Science can autonomously carry out meaningful work when given concise, high-level instructions, and it has access…

If you've ever done a timed C++ coding assessment on a platform like HackerRank or DevSkiller, you know the friction isn't really the algorithm — it's the loop . Download a zip with a weird filename, unzip it, hunt for the project root, configure CMake, build, run GTest, fix one failing test, repeat... and somewhere in there you've burned ten minutes of your one-hour window just fighting the harness instead of writing code. These platforms' in-browser editors are fine for quick problems, but for anything involving multiple files (headers, sources, a real test suite), I'd rather work in my own terminal and editor. The catch is that you still have to get the project out of the browser sandbox, build it locally with the exact same toolchain (CMake + GTest), and then package it back up in a way the grader will accept. So I wrote three small bash scripts to remove that friction entirely. Sharing them here in case they save someone else the same ten minutes. The workflow Download the project archive from the platform (zip or tar.gz, filename is whatever the platform gives you — often randomized) Extract it — script 1 handles this regardless of filename or archive type Iterate — script 2 configures CMake once, then repeatedly builds and runs GTest, optionally watching for file changes Package — script 3 strips build artifacts and any local helper scripts, then zips it back up under a name that won't collide with the original download, ready to re-upload Script 1: extract_and_setup.sh Most of these platforms hand you an archive with an unpredictable filename. This script extracts whatever you point it at ( .tar , .tgz , .tar.gz , or .zip ), figures out which directory it unpacked to by diffing the folder listing before and after, and drops the build script into it automatically. #!/usr/bin/env bash # extract_and_setup.sh # Extracts $fname (tar, tgz, tar.gz, or zip) into the CURRENT folder, # then copies run_build.sh into the directory that was created. # # Usage: # ./extrac

Subtitle: Build a Python app with Telnyx AI Inference that turns customer activity signals into churn risk, recommended actions, and retention next steps. Most customer churn is only surprising because the signals were scattered. Usage dropped in one place. Support tickets went up somewhere else. A renewal date got closer. A login did not happen for two weeks. Payment issues started showing up. None of those signals alone proves a customer is leaving, but together they usually tell a story. That is the workflow I wanted to make easier to build: take customer activity data, pass it through an inference model, and return a structured churn assessment that a product or customer success team can actually use. The example is here: https://github.com/team-telnyx/telnyx-code-examples/tree/main/ai-customer-churn-predictor-python It is a small Flask app using Telnyx AI Inference through the chat-completions API. The App Shape The app exposes a few routes: POST /predict for one customer POST /predict/batch for up to 20 customers GET /predictions for recent in-memory predictions GET /health for app health The current default model is set in .env.example : AI_MODEL=moonshotai/Kimi-K2.6 Under the hood, the app calls: POST https://api.telnyx.com/v2/ai/chat/completions The prompt asks the model to behave like a customer success analyst and return JSON only. That is the important part. This is not a chatbot. It is an application endpoint that produces structured output. What Goes In A request can look like this: curl -X POST http://localhost:5000/predict \ -H "Content-Type: application/json" \ -d '{ "customer_id": "CUST-123", "call_volumes": [120, 105, 80, 55], "message_volumes": [450, 420, 300, 190], "support_tickets": 6, "account_age_months": 18, "renewal_days": 21, "last_login_days": 14, "payment_issues": 1 }' Those fields are deliberately simple. The point is to show the pattern, not to pretend this is a full enterprise churn model. The model gets the trend data, support contex

Data Modeling, Relationships, and Schemas in Data Analytics In the fields of data analytics, data warehousing, and database management, modeling and schema design are the fundamental pillars used to organize and query information efficiently. This article provides a comprehensive guide to these core concepts. 1. Data Modeling Data modeling is the architectural process of designing how data is stored, interconnected, and accessed within a system. Core Questions Addressed: Storage: What specific data points need to be captured? Structure: How should individual tables be organized? Connectivity: How do these tables interact with one another? Levels of Data Models: Conceptual Model: A high-level business perspective focusing on entities and their relationships, devoid of technical specifications. Logical Model: Defines specific attributes, keys, and relationships. It is independent of the Database Management System (DBMS). Physical Model: The actual implementation within a database, including technical details like indexes, partitions, and storage requirements. 2. Relationships Relationships define the logic of how data in one table corresponds to data in another. One-to-One (1:1): A single record in Table A relates to exactly one record in Table B. One-to-Many (1:M): The most common relationship; for example, one Customer can place many Orders . Many-to-Many (M:M): Multiple records in one table relate to multiple records in another. This requires a Junction Table (Bridge Table) to function. Example: One Student can enroll in many Courses, and one Course contains many Students. 3. SQL Joins Joins are used to combine rows from two or more tables based on a related column. Join Type Description Inner Join Returns only the records that have matching values in both tables. Left Join Returns all records from the left table and the matched records from the right. Right Join Returns all records from the right table and the matched records from the left. Full Outer Join Returns

TL;DR — A Kafka + Flink + OTel ingestion pipeline cost us ~$700–800/month at 10 MB/s. We rebuilt it as a single binary where the data, the write-ahead log, and the Iceberg catalog all live in S3 alone — no Kafka, no local disks, no coordination service — for ~$100/month . Here's the design. Self-hosted observability sooner or later runs into the problem of storing state. Query load, CPU, and data volume can all be handled by scaling out, but the stateful layer is something you have to operate by hand. At first it's almost unnoticeable: a disk degrades here, replication falls behind there, a recovery hangs somewhere else. As the data grows, incidents stop being one-offs and start to recur. At some point your observability stack - whether it's Grafana Loki, Elastic, or ClickHouse - starts demanding the same attention as a full-blown database that you're on the hook for. Kubernetes operators cover some of these cases, but operating the state is still on you. Managed solutions take that burden away and bring their own: rising costs, ingestion-pipeline constraints, and limits on retention and cardinality. But if you'd rather not sign up for the constant operational grind - or live with the constraints of managed solutions - it's worth asking: can we take the stateful part out of operations entirely? Storage and format The first candidate for offloading storage responsibility is Amazon S3. S3 gives you what local disks can't: fault tolerance and practically unlimited scale, with no storage to manage yourself. It isn't free, though: data-access latency goes up, and you pick up separate costs for API operations. For OLTP workloads that's a dealbreaker. For observability workloads - which are dominated by sequential writes and analytical reads - these trade-offs are often acceptable. At first glance, this problem is already solved. Loki , for example, uses S3 as its primary storage. But according to Loki's public documentation (v3.6.x) at the time of writing, Loki doesn't re

If you have ever opened a system design article, seen a diagram with twelve boxes, three databases, a message queue, and the words "eventually consistent," and quietly closed the tab, this post is for you. There is a myth that you need years of experience running large systems before you can learn system design. You don't. Plenty of engineers learn it before they have ever deployed anything bigger than a side project. What you actually need is the right starting point and a way to build intuition without access to production-scale traffic. That is exactly what this guide gives you. "But I've never built anything at scale" Good news: neither had most people the first time they learned this. System design is not a memory test about how Uber works. It is a thinking skill: given a vague problem and some constraints, make a sequence of reasonable trade-offs and explain them clearly. That skill does not require having operated a system serving millions of users. It requires understanding what the moving parts do and practicing the reasoning. The experience helps later, but it is not the price of entry. So drop the idea that you are "not ready." You are ready to start today. The honest minimum prerequisites You do not need much, but you do need these four things. If any feels shaky, spend a few days here first; it will save you weeks of confusion later. What happens when you load a web page. Client sends a request, DNS resolves a name to an address, a server responds. If you can sketch that, you're fine. The two kinds of databases. Relational (tables, rows, SQL) versus non-relational (documents, key-value). You don't need to be an expert, just know they exist and roughly when each fits. What an index is. A way to find data fast without scanning everything. That one sentence is enough to begin. Basic estimation. If something gets a million requests a day, roughly how many is that per second? (About 12, for the record.) The ability to do rough math out loud matters more than