标签：#t

Your CI catches the npm vulnerability. Your developer is already three branches away and one standup behind. The package is installed, the lockfile regenerated, the import wired into a service, and the human who made that decision did it on a Tuesday afternoon with a tab open to Stack Overflow. Now the scanner is yelling. From the terminal, that is not security. That is grief counseling. That is the frame Sonu Kapoor lays out in a DevOps.com essay this week, and the engineering bones of it are correct. A scanner is not a gate. It is a status check. Kapoor's argument is about feedback loops. A developer installs, codes, commits, pushes. Only then does CI run. By the time the finding surfaces, the decision to add the package, and the context for why, has evaporated. So has the lockfile churn that caused it. What started as "is this package safe?" becomes "fix this in a different sprint." The scanner did its job. The fix is now a project. He backs it with a small case study from the NestJS repo: a scan of package-lock.json returned 1,626 resolved packages and 25 vulnerabilities. Of those, 12 were directly fixable. Thirteen were transitive, buried in upstream graphs, waiting on someone else's release. In a pipeline-first workflow, every dependency hop is a separate commit and a separate run. (Multiply by the number of services your team owns. Then by your runner-minutes budget. Send me the bill.) The arithmetic gets ugly quickly. A single lockfile with more than fifteen hundred resolved packages is not exotic for a working Node app, it is the default. The chance that the first time anyone looks at that graph is during a pipeline run, after the merge intent is already in the reviewer's queue, is the structural bug. Where the essay is right, and where it gets too tidy Concede the obvious. CI is not the problem. CI is fine. It runs uniformly, it cannot be skipped, and it is the right place to fail a build when an OSV record drops mid-week against a dependency that was clea

In the world of wearable health technology, the holy grail has always been moving intelligence from the cloud to the edge. Waiting for a cloud server to analyze your heart rhythm is not just a latency issue—it's a privacy and battery life concern. Today, we are diving deep into TinyML , Edge AI , and ECG signal processing to build a real-time abnormality detector. By leveraging TensorFlow Lite for Microcontrollers and the versatile ESP32 , we can process raw electrocardiogram (ECG) data locally. This approach ensures low-latency detection of arrhythmias while keeping sensitive medical data on-device. If you've been looking to bridge the gap between high-level deep learning and low-level embedded systems, you're in the right place! The Architecture: From Raw Signal to Insight 🏗️ The pipeline involves capturing a high-frequency analog signal, cleaning it, and feeding it into a quantized Convolutional Neural Network (CNN). Here is how the data flows through our ESP32: graph TD A[Raw ECG Signal/Sensor] -->|ADC Sampling| B(Preprocessing: Bandpass Filter) B --> C{Buffer Management} C -->|Windowed Segment| D[TFLite Micro Inference Engine] D --> E{CNN Model Classification} E -->|Normal| F[Log: Sinus Rhythm] E -->|Abnormal| G[Trigger Alert: Arrhythmia] G -->|Bluetooth/Wi-Fi| H[Mobile Dashboard] Prerequisites 🛠️ To follow this advanced guide, you'll need: Hardware : ESP32 (DevKit V1 or similar). Sensor : AD8232 ECG Module (or simulated ECG data). Software : Arduino IDE or PlatformIO. Frameworks : TensorFlow Lite for Microcontrollers (TFLM), EloquentTinyML (optional wrapper), or the standard C++ TFLM library. Step 1: Model Training & Quantization 🧠 Before we touch the C++ code, we need a model. Typically, we use the MIT-BIH Arrhythmia Database to train a 1D-CNN. The crucial step is Post-Training Quantization . Since the ESP32 doesn't have a dedicated NPU, we convert our 32-bit float model into an 8-bit integer (INT8) model. This reduces the size by 4x and speeds up inference s

When Logs and Metrics Aren't Enough You have great dashboards. Your log aggregation is solid. But when a user reports "the checkout page is slow," you still spend 30 minutes jumping between services trying to find the bottleneck. That's the gap distributed tracing fills. What Tracing Actually Shows You A trace is a complete picture of a single request as it flows through your system: User Request → API Gateway → Auth Service → Product Service → DB → Cache → Response 5ms 12ms 45ms 120ms 3ms ^ This is your bottleneck Without tracing, you'd see: API Gateway: latency looks fine Auth Service: latency looks fine Product Service: latency is HIGH but why? With tracing, you see the exact DB query inside Product Service that's taking 120ms. Getting Started with OpenTelemetry OpenTelemetry is the standard. Here's a minimal setup: # Python example with Flask from opentelemetry import trace from opentelemetry.instrumentation.flask import FlaskInstrumentor from opentelemetry.instrumentation.requests import RequestsInstrumentor from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor from opentelemetry.sdk.trace import TracerProvider from opentelemetry.sdk.trace.export import BatchSpanProcessor from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter # Setup provider = TracerProvider () provider . add_span_processor ( BatchSpanProcessor ( OTLPSpanExporter ( endpoint = " http://otel-collector:4317 " )) ) trace . set_tracer_provider ( provider ) # Auto-instrument everything FlaskInstrumentor (). instrument_app ( app ) RequestsInstrumentor (). instrument () SQLAlchemyInstrumentor (). instrument ( engine = db . engine ) That's it. Three auto-instrumentations cover 80% of what you need. Custom Spans for the Other 20% Auto-instrumentation gives you HTTP calls and DB queries. Add custom spans for business logic: tracer = trace . get_tracer ( __name__ ) def process_order ( order ): with tracer . start_as_current_span ( " process_order " ) as sp

We've all been here. A new form shows up, you install React Hook Form, add Zod or Yup, and in ten minutes you have something that "works." The problem doesn't surface that day. It surfaces three months later, when the same VIN you validate in the create car form also has to be validated in edit , in import from Excel , and it turns out the rule —"17 characters, the last 5 numeric"— is written three times, each one slightly different, and none of them lives in a place you can point to and say "here is what a valid VIN is." A typical form with a library looks roughly like this: const schema = z . object ({ vin : z . string (). length ( 17 , " The VIN must be 17 characters " ), miles : z . number (). min ( 0 , " Miles cannot be negative " ), // ...and 8 more fields }); const { register , handleSubmit , watch , formState : { errors }, } = useForm ({ resolver : zodResolver ( schema ), }); It works. But if you stop to look at it, you're paying three costs that almost never get named: 1. Clean code dissolves. The business rule ends up scattered across the schema , the resolver , the register calls, the Controller s, and the JSX. The knowledge — what makes a car valid — has no home. It's wired into the UI. And what's wired into the UI doesn't get reused: it gets copied. 2. Performance and coupling are paid silently. These libraries live on subscriptions: watch , re-renders on every keystroke, internal state to keep in sync. For a contact form, who cares. For a screen with 15 fields, sub-forms, and cross-field validation, your component is tied to the library's lifecycle —not yours— and you start fighting it instead of using it. 3. Developer convenience is a trap. It's wonderfully convenient at first . But that same rule: how do you test it without mounting a component? How do you move it to the backend? How do you translate it into two languages without polluting the schema? Everything the library gave you for free, it charges you for the day you need to step outside its mo

So this weekend I spent $200 solving a $2 problem. Not because I was careless. Not because the system was broken in the old way. It happened because the tool was powerful, fast, confident, and wrong for just long enough. That is the strange thing about AI systems. They do not always fail loudly. A cloud server goes down, an alert fires, a dashboard turns red, someone opens an incident bridge, and the team knows what kind of movie they are in. AI failure is softer. The answer looks useful. The workflow keeps moving. The agent tries another path. The model explains itself beautifully. The bill keeps climbing. With cloud reliability, we learned how to survive machines failing. We built retries, failover, backups, autoscaling, health checks, runbooks, and incident reviews. The cloud taught us that infrastructure is never perfect, so systems must be designed to bend without breaking. AI is teaching us something different. The machine may be running perfectly and still produce the wrong result. The API may be healthy, the latency may be fine, the token stream may complete, and the business outcome may still be bad. That is why AI Site Reliability is going to become its own serious discipline. It will not be enough to ask, “Is the model available?” We will have to ask, “Is the model still useful?” “Is it drifting?” “Is it spending too much?” “Is it using the right tools?” “Is it looping?” “Is it making the same mistake with more confidence?” “Is a human needed before this continues?” In the cloud world, uptime was the king metric. In the AI world, usefulness will matter just as much. A model that is always available but often wrong is not reliable. An agent that finishes every task but spends 100 times more than needed is not reliable. A chatbot that gives answers with perfect grammar but poor judgment is not reliable. The next generation of reliability engineering will care about cost, correctness, context, and control. Cost matters because AI turns thinking into metered

I got laid off in March 2026. The day HR handed me the 30-day notice, I had a small panic attack, then opened my laptop and started building things. Here's the deal: I had 30 days before severance ran out, and I wanted to see how much I could ship with AI tools before the money (and motivation) ran dry. I gave myself a single rule — every project gets a 7-day deadline, otherwise I kill it. I built 6 things. One has real users. One broke in production. Two I never opened again. This is what happened, in the order I built them. 1. AI Buddy (Chrome sidebar) — shipped, 15 users A Chrome extension that puts an AI assistant in a sidebar. Select text on any page, hit a keyboard shortcut, it goes to the AI, reply shows up without you leaving the page. Works with GPT-4, Claude, Gemini, DeepSeek. No login, no credit card. Time: 11 days (April 1–11). Status: Live on Chrome Web Store. 15 real users as of June 28, 2026. Rating 4.2. What I used AI for: 90% of the code (500 lines of JavaScript, written in Cursor). The README, the Chrome Web Store description, the marketing tweets — all AI-drafted, then I rewrote the parts that sounded like AI. What went wrong: The first version had a Stripe integration. AI wrote 90% of the webhook signature verification. I had to rewrite it from scratch. Also the model-picker UI went through 5 revisions because AI kept proposing what looked right but didn't work. → Chrome Web Store 2. Weekly report generator — personal use only Every Friday at 4pm, a script grabs my git commits, Slack messages, and Linear ticket changes, throws them at GPT-4, and asks for a "manager-readable" weekly report. I review, tweak, send. Time: 2 days. ~200 lines of Python. Status: Running for 11 weeks. Has 1 user. Me. Cost is $0.12/week. What I used AI for: The prompt. It's surprisingly tricky to get GPT-4 to write a weekly report that doesn't sound like a robot. The single most useful line: "if you don't have data, write 'no progress this week' — don't make things up." T

Circuit breakers and bulkheads are design patterns — their numbers are operational weapons. Failure ratio 50% or 30%? Max concurrent calls 25 or 100? During an outage the right answer changes hourly . Code the pattern once; tune thresholds live . Kiponos.io separates resilience structure (in Java) from resilience parameters (in live config tree). Pattern in code, numbers in Kiponos public boolean allowCall ( String downstream ) { var cfg = kiponos . path ( "resilience" , downstream ); return breaker ( downstream ) . failureRateThreshold ( cfg . getFloat ( "failure_rate_threshold" )) . waitDurationInOpenState ( cfg . getInt ( "open_seconds" )) . permittedInHalfOpen ( cfg . getInt ( "half_open_calls" )) . tryAcquire (); } Ops opens circuit sensitivity during brownout — dashboard edit, not redeploy. Resilience tree resilience/ payments-api/ failure_rate_threshold : 0.5 open_seconds : 30 half_open_calls : 5 bulkhead_max_concurrent : 40 inventory-api/ failure_rate_threshold : 0.35 open_seconds : 60 bulkhead_max_concurrent : 25 global/ force_open_all : false Extreme: coordinated degradation Platform SRE sets force_open_all: false normally. During regional disaster, flip selective open_seconds sky-high on non-critical downstreams — bulkhead by configuration , Java still executes pattern logic. Performance Breaker checks are per-call — getFloat() must be local. See rate limits article . Getting started Externalize Resilience4j YAML values to resilience/* Incident drill: tighten failure_rate_threshold live Resources: github.com/kiponos-io/kiponos-io Kiponos.io — resilience patterns with live numbers. Breakers that bend during the outage.

The latest update to hermes-memory-installer introduces a focused set of features that directly address production-level concerns: observability, storage management, security, fault tolerance, and performance introspection. If you maintain a message-processing pipeline or job queue, these are the components that often decide whether your system survives peak loads or security audits without manual heroics. Let's break down each addition and how you can integrate them into your workflow. System Metrics Exposing runtime health is no longer an afterthought. The new metrics module taps into the core processing loop and emits standard Prometheus-formatted data: message throughput (count and rate), latency percentiles, queue depths, and goroutine or thread pool utilization. This isn't a simple "up/down" gauge—you get histograms for processing duration and derived metrics like consumer lag. For example, if you run multiple worker instances, you can now directly compare their processing speeds via a Grafana dashboard. The endpoint is configurable, so you can keep it behind a reverse proxy or internal load balancer. Memory pressure triggers a separate gauge for heap usage per queue, which helps with capacity planning before it becomes a midnight incident. Auto-Archive Without auto-archive, old messages accumulate in memory or primary storage, driving up costs and slowing down scans. This feature moves processed or expired messages to a cheaper tier (S3, GCS, or local file system) based on age or queue size. The archive process is a background task that runs on a cron-like schedule; you can define how many messages to retain per queue before archiving kicks in. The compression is transparent—gzip by default, but you can switch to snappy or zstd. A key detail: archived messages retain their metadata and can be restored if needed, though the replay path skips them automatically unless explicitly requested. This is useful for audit trails or multi-region cold replicas. Token Rot

Dealing with vendor invoices usually means someone is sitting there manually opening PDFs and typing...

Aprenda a substituir o velho Cron por systemd timers para ganhar logs nativos, controle de dependências e maior robustez.

Like most developers, I have a set of tools I use every day. Most of them work great, and I don't...

Angular has signals now - and as of 19.2, even a signal-based way to fetch: httpResource, built on...

Abstract Executing autonomous AI agent payloads in Google Workspace via the Apps Script...

China's Zhipu AI (Z.ai) released its open-weight GLM-5.2, and some researchers have claimed that it matches Mythos in certain bug-finding and cybersecurity scenarios. While GLM lags behind models from Anthropic and OpenAI in other, more general tasks, it seems that China has dramatically reduced the gap in the capabilities between its models and those of […]

Streaming ads might be getting a lot quieter.

Performance optimization has always been one of the hardest parts of web development. You run...

Originally published on danholloran.me The original Grimicorn was an exercise in restraint: muted pastels on a blue-gray base, tuned so nothing on screen ever burns your eyes. Grimicorn Neon is the opposite impulse. Same grim-reaper-meets-unicorn idea, except this one is plugged into the mains — saturated, glowing accents on a near-black base, dark-only, loud on purpose. What makes the pair interesting from an engineering angle is how little had to change to get there. Neon is not a new theme so much as the same theme with the volume knob turned all the way up. That only works because of a decision made back in the calm version: colors are defined by role, not by appearance. Eight roles, eight louder hexes Both themes share the exact same role map. Blue is keywords, links, and the primary accent. Green is strings, success, and the cursor. Yellow is types, decorators, and warnings. The accent hierarchy is still blue → purple → teal, and the semantic anchors still hold: green means good, the error color means wrong. What changes is only the values bound to those roles. Calm Grimicorn's blue is a soft #83AFE5 ; Neon's is an electric #2323FF . Calm green is a sage #A9CE93 ; Neon green is an acid #A3E635 . The error role even swaps identity, from a gentle salmon to a hot #FF2D9B pink. Lay the two palettes side by side and the structure is identical — only the saturation and brightness move: // same eight roles, two personalities const calm = { blue : " #83AFE5 " , green : " #A9CE93 " , error : " #DD9787 " , base : " #253039 " , }; const neon = { blue : " #2323FF " , green : " #A3E635 " , error : " #FF2D9B " , base : " #0A0A0B " , }; Because every one of the fourteen tool ports — VS Code, Ghostty, Obsidian, Claude Code, JetBrains, tmux, and the rest — is generated from a single palette.md , producing the neon set was mostly a matter of feeding the build a different eight values. The emitters that translate roles into VS Code scopes or ANSI slots never knew the difference.

Have you ever wondered how apps like university portals know which courses a student is enrolled in, or how they pull up an instructor's full schedule in seconds? The answer lies in database relationships - one of the most important concepts in backend development. In this article, we'll explore: What database relationships are and why they matter The three types of relationships: One-to-One, One-to-Many, and Many-to-Many How relationship schemas work (primary keys, foreign keys) How SQL Joins let you pull connected data from multiple tables To keep things grounded, we'll use one running example throughout: a University Management System . By the end, you won't just understand the theory, you'll see exactly how these concepts connect in a real-world scenario. What Are Database Relationships? A database relationship defines how data in one table connects to data in another. Instead of storing the same information repeatedly, relational databases organize data into separate tables and link them using keys . Think about our university system. We have a table for students and another for courses . A student can enroll in multiple courses, and each course can have many students. Rather than storing a student's full details on every course record, we store the student's info once and create a relationship between the two tables. This keeps data clean, reduces duplication, and makes updates easy. If a student's email changes? Update it in one place - done. Here's a simple visual of what that looks like: +------------------+ +------------------+ | Students | | Courses | +------------------+ +------------------+ | student_id (PK) | | course_id (PK) | | name | | title | | email | | credits | +------------------+ +------------------+ \ / \ / \ / Enrollments (links students ↔ courses) Now let's look at the three types of relationships you'll encounter. Types of Database Relationships 1. One-to-One (1:1) Each record in Table A matches exactly one record in Table B and vice versa

Share a portion of your ultrawide or high-res screen on Mac Discussion | Link

Most of the web's foundational moments have vanished. The servers were unplugged, the code was lost, the pages 404'd into history. But the first website ever published is a striking exception: you can still read it today, more or less as it appeared when it went live on August 6, 1991. It is a plain, text-only page with a white background and blue hyperlinks, and it explains a brand-new idea called the World Wide Web. One page that described itself The author was Tim Berners-Lee, a British computer scientist working at CERN, the particle physics laboratory near Geneva. By the end of 1990 he had quietly assembled the three technologies that still define the web: HTML for writing pages, HTTP for moving them between machines, and the URL for addressing any document on any server. The first website, hosted at the address info.cern.ch , was the web explaining itself - what hypertext was, how to browse it, and how to make your own pages. It ran on a NeXT computer, the sleek black workstation designed by Steve Jobs's company during his years away from Apple. That single machine was the entire World Wide Web for a while. A handwritten label was stuck to its case: "This machine is a server. DO NOT POWER IT DOWN!!" One unplugged cable would have taken the whole web offline. Why a 1991 web page still matters to IoT It is easy to file this under nostalgia, but the first website is more than a museum piece. It is the origin point of the request-and-response model that quietly powers almost everything connected today. When an ESP32 sensor node pushes a reading to a cloud dashboard, when a smart meter checks in with a server, or when you open an app to see whether your device is online, the same basic conversation is happening: a client asks a question over HTTP, a server answers, and a URL says where to look. Berners-Lee made a deliberate choice that turned out to matter enormously. He kept the standards open and unlicensed. Anyone could implement a browser or a server without pa