标签：#t

Published on : 2026-06-06 Reading time : 6 min Tags : #python #async #performance #optimization 문제: 거짓 비동기 supabase-async 라이브러리는 이름은 async이지만, 실제로는 ThreadPoolExecutor로 동기 호출을 래핑하고 있었습니다. # ❌ 거짓 비동기 (기존 코드) class SupabaseAsync : def __init__ ( self ): self . _executor = ThreadPoolExecutor ( max_workers = 3 ) async def select ( self , table : str ): loop = asyncio . get_event_loop () r = await loop . run_in_executor ( self . _executor , lambda : requests . get ( url ) # 동기 호출을 async로 포장 ) return r . json () 문제점 : 최대 3개 동시 요청만 가능 (동시성 부족) 스레드 오버헤드 (각 요청마다 스레드 생성) 높은 메모리 사용량 해결책: httpx AsyncClient 진정한 비동기 HTTP 클라이언트인 httpx를 사용합니다. # ✅ 진정한 비동기 (수정된 코드) import httpx class SupabaseAsync : def __init__ ( self ): self . _client : Optional [ httpx . AsyncClient ] = None async def _get_client ( self ) -> httpx . AsyncClient : if self . _client is None : self . _client = httpx . AsyncClient ( headers = self . _headers , timeout = 30 , limits = httpx . Limits ( max_connections = 10 ) ) return self . _client async def select ( self , table : str ): client = await self . _get_client () r = await client . get ( f " { self . _base } / { table } " ) r . raise_for_status () return r . json () 성능 개선 동시성 비교 지표 ThreadPoolExecutor(3) httpx(10) 최대 동시 요청 3개 10개 평균 응답 시간 450ms 150ms 메모리 사용량 250MB 180MB 초당 처리량 6.7 req/s 20 req/s 벤치마크 # 100개 동시 요청 처리 시간 ThreadPoolExecutor : 15 초 httpx AsyncClient : 5 초 → 3 배 빠름 마이그레이션 단계 1. 클라이언트 초기화 async def _get_client ( self ) -> httpx . AsyncClient : if self . _client is None : self . _client = httpx . AsyncClient ( headers = self . _headers , timeout = 30 , limits = httpx . Limits ( max_connections = 10 , max_keepalive_connections = 5 ) ) return self . _client 2. 요청 메서드 async def _request ( self , method : str , url : str , ** kwargs ): client = await self . _get_client () if method == " GET " : return await client . get ( url , ** kwargs ) elif method == " POST " : return await client . post ( url , ** kwargs ) # ... 3. Context Manager 지원 async def clos

Published on : 2026-06-06 Reading time : 8 min Tags : #security #python #audit #devops 개요 3개월에 걸쳐 개발한 6개 Python 프로젝트(3개 봇 + 3개 라이브러리)를 종합 감사했습니다. 25개 보안/코드 이슈를 발견했고, 23개를 즉시 수정했습니다. 감사 대상 : FastAPI + Telegram Bot + LLM 통합 시스템 총 파일 : 91개 Python 파일 발견 이슈 : 25개 (심각 5개, 중간 18개, 경미 2개) 수정율 : 92% (23/25) 심각도 높음 - 5개 이슈 1. API 키가 Git 히스토리에 노출됨 🔴 문제 : Anthropic, Supabase, Telegram API 키가 .env 파일로 커밋됨 # ❌ 노출된 상태 (git log에서 확인 가능) ANTHROPIC_API_KEY = sk - ant - api03 - xxxxxxxxxx SUPABASE_KEY = sb_publishable_xxxxxxxxxx 위험도 : 누구든 이전 커밋으로 API 키 접근 가능 → 리소스 도용, 데이터 침해 해결책 : # 1. BFG로 히스토리 정리 bfg --delete-files ".env" --no-blob-protection . # 2. Git에서 제거 git rm --cached .env echo ".env" >> .gitignore # 3. API 키 로테이션 (필수) # - Anthropic: console.anthropic.com/account/keys # - Supabase: app.supabase.com → Settings → API # - Telegram: @BotFather → /token 2. SSL 검증 비활성화 (MITM 공격 위험) 🔴 문제 : requests 호출에 verify=False 사용 (10곳) # ❌ 위험한 코드 response = requests . get ( url , verify = False ) # ✅ 안전한 코드 response = requests . get ( url , verify = True ) # 기본값 영향 : HTTPS 중간자 공격(MITM) 가능 → 민감한 데이터 도청 수정 : contest-agent, supabase-async 전체 10곳 제거 3. 광범위한 예외 처리 🔴 문제 : except Exception 으로 모든 오류를 무시 (114곳) # ❌ 버그 추적 불가 try : result = await db_select ( " contests " ) except Exception : print ( " failed " ) # 어떤 오류인지 알 수 없음 # ✅ 구체적인 처리 try : result = await db_select ( " contests " ) except requests . HTTPError as e : logger . error ( f " DB error: { e } " , exc_info = True ) raise 영향 : 버그 원인 파악 불가 → 프로덕션 문제 대응 시간 증가 4. 라이브러리 __init__.py 부실 문제 : llm-router, supabase-async, telegram-agent의 __init__.py 비어있음 # ❌ 기존 (빈 파일) # __init__.py # (아무것도 없음) # ✅ 수정 후 from llm_router import LLMRouter __version__ = " 0.1.0 " __all__ = [ " LLMRouter " ] 영향 : PyPI 설치 후 import 실패 from llm_router import LLMRouter # ❌ ImportError 5. 문법 오류 (try-except 들여쓰기) ai-insight-curator의 processor.py에서 DB 작업이 try 블록 밖에 있었음 → 예외 처리 안 됨 심각도 중간 - 18개 이슈 의존성 버전 불일치 Anthropic: 0.25.0 / 0.34.0 혼재 → 0.34.0으로 통일 Supabase: 2.0.0 / 2.4.0 혼재 → 2

When I started learning Data Science, I expected to spend my first week writing Python code, exploring machine learning models, and working with advanced tools. Instead, I spent most of my time in Excel. At first, it felt underwhelming—just rows, columns, and simple spreadsheets. But within a few days, I realized something important: Excel is not a basic tool at all. It is one of the most widely used tools in data analysis, business decision-making, and reporting. 📊 Real-World Uses of Excel Excel is widely used across industries for handling and analyzing data. Some of the most common uses include: Business Analysis - Tracking sales and identifying trend Accounting and Budgeting - Managing Expenses, Profits and Financial reports Marketing Analysis - Measuring campaigns performance and customer behavior Data Entry and Management - organizing large datasets efficiently Businesses rely on Excel because it helps turn raw data into meaningful insights for decision making. 🛠️ Key Excel Features I Learned In my first week, I explored several important Excel Features that help with data organization and analysis: Excel Interface Overview - I first explored how Excel is organized, including Ribbon, Worksheets, Cell, Row, Columns, and formula bar. this helped me understand how to navigate the tool before working with data Data Sorting - Organizing data by numbers, Text and Dates Filtering - Showing only relevant data based on condition Data Validation - Ensuring accurate and consistent data entry Freeze Panes - Keeping header Visible while scrolling through large datasets. These features make working with data much easier, faster and more structured. 🧮 Basic Excel Functions I learned I was also introduced to some basic Excel functions used in Data Analysis. Aggregate Functions - SUM - Add all values in a range - AVERAGE - Calculate the mean of a dataset - COUNT - Counts numerical entries in a dataset Conditional Functions - SUMIF () and SUMIFS()** - Add values that meets one

New simulations reveal that the moons of Uranus may retain traces of giant planets.

Inspired by Nir Eyal's "beliefs are tools" framework Beliefs are tools, not truths. Tech stacks are too. Pick the ones that work for you. Most "tech debt" is actually "belief debt". We hold onto frameworks, patterns, and processes long after they stop serving the product. To build great software, we need to introduce a core rule: If a tech belief or "best practice" doesn’t solve a real problem for you right now, it must be treated as false. Here is how to audit your tech beliefs using 5 filters. 1. ARE THEY USEFUL? The real question isn’t "Is this the best tech?" It’s "Does this serve the user?" Tools are tools. Keep the ones that ship. Bad belief (Treat as False): "We need Kubernetes because it’s the industry standard." Useful belief (True for Now): "A $5 VPS serves 10k users. We’ll use K8s when we have a scaling problem, not a resume problem." If your architecture choice doesn’t make the core loop faster, cheaper, or simpler for users, it’s not serving you. Delete it. 2. ARE THEY TESTED? A useful stack holds up when the world pushes back. Pay attention to production, not the trending blog posts. Bad belief (Treat as False): "Microservices are inherently more scalable"—said before you even have 2 concurrent users. Tested belief (True for Now): "Our monolith handles 50 req/s perfectly. We’ll split services only when latency exceeds 300ms in prod." Load test it. Dogfood it. If it only works in a conference slide deck, it’s a story, not a tool. 3. ARE THEY OPEN? A tech choice you can’t change has stopped being a tool and has become a cage. Hold opinions firmly, but hold implementations loosely. Bad belief (Treat as False): "We’re a React shop forever." Open belief (True for Now): "React serves us today. If HTMX lets us ship this feature in 2 days instead of 2 weeks, we’ll use HTMX." In a famous study on hope, Curt Richter’s rats swam for 60 hours when they believed rescue was coming. Your team will grind for years on a legacy stack if they believe it can actually be r

JavaScript Data Types: Primitive and Non-Primitive Data Types Data types are an important concept in JavaScript because they define the kind of value a variable can store. Understanding data types helps developers write reliable and efficient code. What is a Data Type? A data type defines what kind of value a variable can hold. Example let name = " John " ; // String let age = 25 ; // Number let isActive = true ; // Boolean In the above example, each variable stores a different type of value. Types of Data Types in JavaScript JavaScript data types are broadly classified into two categories: Primitive Data Types Non-Primitive Data Types Primitive Data Types Primitive data types store a single and simple value. Characteristics Store a single value. Immutable (cannot be changed directly). Compared by value. Stored directly in memory. Types of Primitive Data Types 1. String Used to store textual data. let name = " John " ; 2. Number Used to store numeric values. let age = 25 ; let price = 99.99 ; 3. Boolean Represents either true or false . let isLoggedIn = true ; 4. Undefined A variable that has been declared but not assigned a value. let city ; console . log ( city ); // undefined 5. Null Represents the intentional absence of a value. let user = null ; 6. Symbol Used to create unique identifiers. let id = Symbol ( " id " ); 7. BigInt Used to store very large integers beyond the safe Number limit. let largeNumber = 123456789012345678901234567890 n ; Non-Primitive Data Types Non-primitive data types store multiple values or complex data structures. Characteristics Can store collections of data. Mutable (their contents can be modified). Compared by reference. Stored as references in memory. Types of Non-Primitive Data Types 1. Array Used to store multiple values in a single variable. let colors = [ " red " , " green " , " blue " ]; 2. Object Used to store data as key-value pairs. let person = { name : " John " , age : 25 }; 3. Function Functions are reusable blocks of co

This is a submission for the GitHub Finish-Up-A-Thon Challenge OpsPilot AI: Reviving an Unfinished AI-Powered Operations Platform with GitHub Copilot What I Built OpsPilot AI is an AI-powered operations assistant designed to help DevOps engineers, SREs, and operations teams investigate incidents, monitor service health, and gain actionable operational insights. The project originally started as a side project inspired by my experience working in production support and monitoring environments. I built an initial version to validate the idea but never fully completed it. The core concept was promising, but several important features and usability improvements were still missing. Through the GitHub Finish-Up-A-Thon Challenge, I revisited the project and transformed it into a much more complete and polished MVP. Key features include: AI-powered incident analysis Root cause investigation assistance MTTR analytics dashboard Service health monitoring Incident trend analysis Executive reporting insights Modern responsive user interface Demo Live Application GitHub Repository OpsPilot AI helps operations teams reduce investigation time and improve operational visibility through AI-powered workflows and analytics. The Comeback Story When I first started OpsPilot AI, it was mainly an experiment to explore how AI could assist operations teams during incident investigations. Although the foundation was built, the project was left unfinished because of limited time and competing priorities. The original version lacked: Incident analytics Meaningful operational insights Root cause investigation workflows Executive reporting capabilities A polished user experience For this challenge, I focused on completing the project and turning it into a usable MVP. What I Added AI Incident Analysis Enhanced the platform with AI-powered incident summaries and investigation assistance. Operations Analytics Added dashboards to track: Mean Time To Resolution (MTTR) Incident frequency Service health

At a small kickoff event in Los Angeles, Dan Greaney explained why he could no longer stand by and watch the demolition of American democracy.

eh, too late brah.. submitted by /u/TrisolaranPrinceps- [link] [留言]

submitted by /u/JackieBoy77 [link] [留言]

Pay per use, no subscription, 18 model providers supported Discussion | Link

One of the clearest breakdowns for average people like me to understand how AI actually works, and some interesting further information to'boot. https://rogerthatcleansignal.carrd.co/ Discuss. submitted by /u/Leading_Pollution131 [link] [留言]

As the title says, just curious if there are devices that two people speaning different languages can wear and talk in real time without needing any human interpreter? submitted by /u/fearofunknown1 [link] [留言]

Most developers learn CSS specificity once. They remember: #id > .class > div Then move on. Until one day… Everything looks correct. The CSS is present. The selector is correct. The z-index looks higher. And yet the UI is broken. That’s when CSS specificity stops being a beginner topic and becomes a production debugging problem. The Production Incident That Started This Recently, I was working on a microfrontend application. Everything worked fine initially. I opened a page, launched a modal and the UI looked correct. Then I navigated to another microfrontend. Its CSS got loaded. After returning to the original microfrontend, suddenly: ❌ Modal appeared behind page content ❌ Overlay behaved incorrectly ❌ z-index looked correct but wasn't working DevTools showed my CSS rule still existed. Yet another CSS rule was winning. The culprit? CSS Specificity. 🧠 What is CSS Specificity? CSS specificity is the algorithm browsers use to decide: Which CSS rule wins when multiple rules target the same element. Browsers don't simply apply: "The last CSS rule." That's one of the biggest misconceptions. Specificity is calculated first. Only when specificity is equal does source order become important. ⚔️ Example .modal { z-index : 9999 ; } .some-library .modal { z-index : 100 ; } HTML: <div class= "some-library" > <div class= "modal" ></div> </div> Many developers expect: .modal to win because the value is larger. But CSS doesn't compare values first. It compares selectors. 🧮 How Specificity Works Specificity is usually represented as: ID - CLASS - TYPE Specificity Table Selector Specificity * 0-0-0 div 0-0-1 .modal 0-1-0 [type="text"] 0-1-0 :hover 0-1-0 #dialog 1-0-0 Inline Style Highest MDN defines specificity as the weight browsers calculate to determine which declaration gets applied when multiple selectors match the same element. Example Calculation Selector: button .primary Contains: button → 0 -0-1 .primary → 0 -1-0 Total: 0-1-1 Another selector: #header button .primary Contai

submitted by /u/BhaswatiGuha19 [link] [留言]

Section 1: Getting Started with Cypress 1. Installing and Setting Up Cypress Prerequisites Before installing Cypress, ensure you have Node.js installed on your machine. Cypress requires Node.js 18.x or 20.x and above. You should also have an existing React project or create a new one. Check your Node.js version by running this command in your terminal: node --version # Should output v18.x.x or higher Creating a React Project (Optional) If you don't have an existing React project, create one using Vite which is the recommended approach for new React projects: npm create vite@latest my-react-app -- --template react cd my-react-app npm install Installing Cypress Navigate to your React project directory and install Cypress as a development dependency. Cypress is a fairly large package, so the installation might take a minute or two: npm install cypress --save-dev # Or using yarn yarn add cypress --dev Opening Cypress for the First Time After installation, open Cypress for the first time. This will create the initial folder structure and configuration files: npx cypress open When Cypress opens for the first time, you'll see a welcome screen where you can choose between E2E Testing and Component Testing. Select E2E Testing to get started with end-to-end tests. Cypress will then prompt you to choose a browser. You can select Chrome, Firefox, Edge, or Electron. Choose your preferred browser and click Start E2E Testing in [Browser] . Adding NPM Scripts Add convenient scripts to your package.json for running Cypress tests: { "scripts" : { "dev" : "vite" , "build" : "vite build" , "cy:open" : "cypress open" , "cy:run" : "cypress run" , "test:e2e" : "start-server-and-test dev http://localhost:5173 cy:run" } } Tip: Use npm run cy:open for interactive development with the Cypress Test Runner. Use npm run cy:run for headless execution in CI/CD pipelines. 2. Understanding Cypress Project Structure Project Directory Overview After initializing Cypress, you'll notice several new fold

TL;DR Claude Code and the op CLI reorganized 690 credentials — four vaults, 390 items tagged, SSH agent configured — in one session. This is AI-native work: the agent operated the vault; the human set direction and approved via Touch ID. The CLI failed on 18 items with social-auth ( UNKNOWN field type) — hard failure, not graceful degradation; a real reliability blocker for team-scale use. The bug was filed from the terminal via the GitHub CLI in the same session it was found. If your password manager has a CLI, you already have everything needed to run this. I've been a 1Password user for years. Not in a conscious, intentional way — more in the way you use a good chair: it became part of how I work and I stopped thinking about it. That changed when I set up a new machine. I had to install 1Password, wire up the SSH agent, reconnect the CLI, re-authenticate everything. The process took longer than it should have because I'd never written down what I'd built. I'd only accumulated it. And somewhere in the middle of that setup, it hit me: I had 690 credentials in one flat vault — logins from jobs I'd left years ago sitting next to active API keys, personal bank accounts mixed with infrastructure credentials, demo user passwords alongside production secrets. The kind of accumulation that happens when a tool works well enough that you never stop to organize it. I'd been meaning to clean it up for a long time. I never did, because the job is exactly the kind of work that's too tedious to do manually and too important to skip: touch every item, make a judgment call, move it somewhere sensible, repeat 690 times. Then I realized: with Claude Code and the op CLI, this was now actually possible. Not assisted — the agent could do it. So I handed it the keys. What "AI-native" actually means here Quick context on timing: 1Password launched its SSH agent and CLI 2.0 in March 2022. Git commit signing via the vault came six months later. These are mature, stable features — not betas

Day 48 of building GoDavaii, and the toughest problem isn't the sheer volume of allopathic medicines or the complexity of their interactions. It's the invisible logic of 'Desi Ilaaj' - the home remedies and traditional practices deeply ingrained in Indian families for generations. When everyone knows the comfort and efficacy of 'haldi-doodh' (turmeric milk) for a cold, how does an AI health platform authentically verify and integrate that knowledge without replacing professional medical advice? This isn't just a cultural nod; it's a fundamental challenge for any health AI truly built for India. Global competitors like Epocrates or drugs.com, while excellent within their scope, are entirely English-centric and focused on Western allopathic data. They have no framework for the millions of people who search for health guidance in Hindi, Tamil, or Marathi, and whose first instinct for a cough might be a herbal concoction, not an over-the-counter syrup. The Unspoken Truth About India's Health Landscape For a vast majority of Indian families, health decisions often involve a blend of modern medicine and traditional wisdom. From specific herbs to dietary adjustments passed down through generations, these practices are effective for many minor ailments. Yet, in the digital health space, they're largely ignored. Why? Because the data is fragmented, often anecdotal, and doesn't fit neatly into structured pharmacological databases. It's a goldmine of practical health knowledge, but also a minefield for safety if not handled with care. My realization as Pururva Agarwal, 27-year-old founder of GoDavaii, was simple but profound: if we truly want to serve families coming online in their mother tongue, our AI needs to understand and interact with this context. This means going far beyond just translating English medical terms into 22+ Indian languages. It means building a knowledge graph that can intelligently cross-reference traditional remedies with known active compounds, potent

After building the AI agent tree planting worldwide phenomenon ;) Lovology, I thought of a solution to allow the project to scale rapidly utilising the latest tech available and therefore not require a huge amount of resources to close the loop. I know first hand how exhausting reforestation can be, having worked in the field for many years myself, many moons ago 🌒 Steep terrain, heavy gear, repetitive strain, all day every day. At times, rewarding work, but unsustainable at the scale the planet actually needs. I made a joke in passing on a reddit thread..what if a robot dog just planted the trees? Then I thought about it for a second and it didn't seem like a crazy idea at all. So I mentioned it to my AI agent. And that's when "they" encouraged me to actually build it. Agents complete tasks for humans and create the capital to fund the project. And the robot dog plants the trees. Here's what I designed: Identifies native vs invasive species via computer vision Removes invasive species with a mini chainsaw and targeted poison Finds optimal planting locations using soil sensors and AI Ingests seeds into an internal germination compartment that mimics animal gut activation Digs the hole Poops the germinated seed into it Pees liquid fertiliser on it immediately after Biomimicry. Nature already solved this. We just need to build the hardware. Provisional patent filed. Earth Fund ready to receive crowdfunding. This may sound nuts but what if the Ai is right what if if this idea gets in front of the right engineer, roboticist, or someone at Boston Dynamics scrolling Reddit on a Saturday and it actually gets built… it might be one of the things that actually saves us. Share it if it resonates. @BostonDynamics — Spot needs a purpose. I've got one. Let's talk. 🌱🤖 submitted by /u/joeroganshopoffical [link] [留言]

If you're building or integrating Automated Test Equipment for aerospace or defence electronics, the technical requirements go well beyond "does the test pass." You need documentation that satisfies MIL-STD, AS9100, and DO-178C auditors — and an architecture that scales from prototype to production. Here's how modern Universal ATE systems are structured for defence-grade compliance. The Core Architecture A defence-grade ATE system has four functional layers: ┌─────────────────────────────────────────┐ │ Test Executive (LabVIEW) │ ← Orchestrates all test sequences ├────────────────┬────────────────────────┤ │ Instrument │ DUT Interface │ ← Hardware layer │ Control │ (ICT/JTAG/Func) │ ├────────────────┴────────────────────────┤ │ Data Management Layer │ ← Logging, traceability, reports ├─────────────────────────────────────────┤ │ Calibration & Verification │ ← Ensures measurement accuracy └─────────────────────────────────────────┘ Test Executive Design in LabVIEW The test executive controls the sequence, manages results, and handles failures. Key design principles: Test Sequence: 1. DUT identification (serial number scan or manual entry) 2. Pre-test self-check (verify instrument calibration status) 3. ICT phase — passive component verification 4. JTAG boundary scan — IEEE 1149.1 interconnect verification 5. Power-on functional test — operational verification 6. RF/signal analysis — if applicable to DUT type 7. Report generation — automatic, timestamped 8. Pass/fail disposition record JTAG Integration via IEEE 1149.1 For high-density boards where bed-of-nails is not viable, JTAG boundary scan is implemented via a JTAG controller (e.g., XJTAG, Corelis, or ASSET InterTech) integrated into the LabVIEW environment: LabVIEW → JTAG Controller API → Scan Chain → DUT ICs The boundary scan description files (BSDL) for each IC define the test vectors. Your test executive loads BSDL files, generates scan chain topology, and runs interconnect tests automatically. Data Traceabili