标签：#X

I have no idea what I'm f*cking doing. Something I keep questioning: Why the hell am I building an operating system for this? Seriously. Every couple of weeks I look at ShrekOS, look at the amount of work involved in building an actual Linux distribution, and have basically the same reaction. This is f*cking ridiculous. I wanted a safer way to run AI agents on my computer. Somehow that turned into an immutable Debian system with isolated workloads, capability grants, controlled egress, verified updates, a desktop policy layer, an installer, and enough architecture documents to make me question every decision that led me here. There has to be an easier answer. There has to be some tool I missed. Run the agents in Docker. Use Podman. Use a VM. Use a better agent harness. Install some security middleware. Find a desktop application that manages all of this. Anything other than: Build a f*cking operating system. So I keep trying to prove that ShrekOS does not need to exist. And the annoying part is that every time I do, I eventually end up back at the same problem. I already know containers exist I already wrote the technical version of this question in Why I'm Building ShrekOS When Containers Already Exist . I am not going to repeat that whole argument here. Containers are useful. I use them. The Bench system in ShrekOS literally runs on rootless container technology. I did not invent a magical new isolation primitive because AI showed up. Namespaces exist. Seccomp exists. Landlock exists. Containers exist. Virtual machines exist. Linux already has an absurd number of ways to restrict a process. That is not the thing I keep getting stuck on. The thing I cannot seem to find is the user space around all of it . Not userspace in the kernel terminology sense. I mean the actual space where the human uses the computer. The desktop. The workflow. The place where I can run several autonomous things on my machine and understand, at a glance, what each one is allowed to do. I wa

You don't necessarily need more traffic. I know that's not what most growth advice tells you. Every ad platform and every "get more eyes" thread says the opposite. But after reviewing dozens of business websites across real estate, construction, hospitality, and retail, the uncomfortable truth is usually the same: the site isn't leaking customers because too few people show up. It's leaking them because the people who do show up leave within seconds, and nobody is asking why. If you've opened Google Analytics, seen respectable traffic numbers, and then looked at a disappointing lead count, this article is for you. Traffic Is Not the Same as Conversion Traffic measures attention. Conversion measures whether that attention trusts you enough to act. The gap between the two is where most of your lost leads live. A useful way to think about it is the conversion rate: the percentage of visitors who take your intended action (a form submission, a booking, a call, a purchase). If your conversion rate is 1% and you double your traffic, you now have 2% of a bigger number, but you're still losing 99% of everyone who lands on your site. Pouring more traffic into a website that fails the basics doesn't fix anything. It just means more visitors leaving faster, at a higher cost per click. The 10-Second Test Your Website Is Failing A new visitor isn't reading your site; they're scanning it. In the first few seconds, they're subconsciously asking three questions: What is this? Can I trust it? What do I do next? If your homepage doesn't answer all three quickly, they're gone. Not because they weren't interested, but because nothing gave them a reason to stay. That's not a traffic problem. That's a trust problem. Why This Keeps Getting Missed Here's the trap: trust doesn't show up as a line item in Google Analytics. There's no "trust score" sitting next to your sessions and impressions. So business owners chase what's measurable (clicks, reach, ad spend) because it feels like progress

Longshot is a Firefox screenshot extension I wrote to replace FireShot: full page, visible area, drag region and element capture, an editor with eleven annotation tools, export to PNG, JPEG, WebP and PDF, and local OCR that produces a searchable text layer. It has no runtime dependencies. The code is not public, so this is a description rather than an invitation to read it. At one point it had 130 passing Node assertions across six suites, zero failing. Printing could not open a dialog at all. Not "printed the wrong thing". The print command hung indefinitely and no dialog ever appeared. The suites did not go amber, or flake, or report a warning. They reported 130 passed, 0 failed, which is what they had reported the day before and what they would have gone on reporting. Why nothing caught it printCanvas encoded each slice of the image to a blob URL and awaited img.decode() . That call does not resolve for an image inside a display:none subtree, and the print stylesheet creates exactly such a subtree by design, since the container has to be hidden on screen. So the await never returned, and the dialog never opened. Every part of that failure is a meeting point between my code and the browser: the decode promise's behaviour, the stylesheet's effect on the subtree, and the ordering between them. None of it is reachable by a function you can call from Node. The six suites test band arithmetic, canvas dimension limits, filename sanitising, the background module graph under stubbed extension APIs, PDF structure and scan geometry. All of that is worth testing and none of it goes near a real DOM. The second bug in the same batch has the same shape one level in. Choosing PDF broke "Open in editor", because deliver() handed the editor the PDF blob and createImageBitmap cannot decode one. That is not a browser boundary; it is one internal stage handing another something it cannot accept. Both stages were tested; the seam between them was not. That is the pattern worth naming.

I Have a Job — I Just Need to Do It A few months ago, I left my last job as a remote Unity developer. Before leaving, I had already started working on a freelance project to build a multi-tenant security and workforce management system . It became a fairly large system involving web applications, mobile apps, real-time tracking, scheduling, reporting, GPS, notifications, and more. The project is now mostly completed, but the client wants to continue adding maintenance, business logic changes, UI modifications, and new development under the same maintenance fee. That doesn't work for me. Maintenance and development are two different things, and when the amount of new development keeps growing while the price stays the same, eventually it stops being sustainable. So I started thinking about what I would do next. The Fear of Not Having a Job For the last few days, I was genuinely worried. I have more than 250,000 BDT in savings , so I'm not in an immediate financial crisis. But money slowly disappears when there is no income. And freelancing isn't exactly comforting right now either. I've been using Upwork, but the experience has become increasingly frustrating. You apply for jobs and often hear nothing. Some clients post a job and never hire anyone. Some jobs get dozens of proposals and disappear quickly. Some invites arrive, but someone else gets hired almost immediately. And every application costs money. After a while, it starts feeling like you're continuously putting money into a machine that promises a job somewhere in the future. You keep applying. You keep waiting. You keep hoping. And eventually, I realized something. What I Was Actually Missing I wasn't missing money. I was missing a job . And there is an important difference. I already have the skills. I already know how to build software. I already have ideas. I already have projects I want to work on. I was simply thinking that a "job" had to come from someone else. Then I thought: I can create my own job

The short version NextAuth (now Auth.js) creates 4 tables in your database: users , accounts , sessions , and verification_tokens . The users and accounts tables have a one-to-one relationship via accounts.user_id . Sessions link to users via sessions.user_id . Verification tokens are short-lived and self-cleaning. The 4 tables users Column Type What it means id text / UUID Primary key. Generated by NextAuth. name text Display name from the OAuth provider (Google, GitHub, etc.) email text User's email. May be null if the provider doesn't share it. email_verified timestamp When the email was verified. Null if never verified. image text Profile picture URL from the provider. created_at timestamp When the user first signed in. updated_at timestamp Last profile sync from the provider. accounts This table links a user to an OAuth provider. One user can have multiple accounts (e.g., Google + GitHub). Column Type What it means id text / UUID Primary key. user_id text Foreign key → users.id . type text Always "oauth" or "oidc" . provider text "google" , "github" , "discord" , etc. provider_account_id text The provider's unique ID for this user. refresh_token text OAuth refresh token (encrypted in production). access_token text OAuth access token (encrypted in production). expires_at integer When the access token expires (Unix timestamp). token_type text Usually "Bearer" . scope text Permissions granted by the provider. id_token text OIDC ID token (if using OIDC). session_state text Provider-specific session state. sessions Active sessions for each user. NextAuth creates a new row here on every sign-in. Column Type What it means id text / UUID Primary key. session_token text The session token stored in the user's cookie. user_id text Foreign key → users.id . expires timestamp When this session expires. verification_tokens Short-lived tokens for email verification, password reset, etc. Self-cleaning old tokens are deleted automatically. Column Type What it means identifier te

Tuning guides talk about throughput. Nobody pages you about throughput. They page you about symptoms, and the useful skill is mapping a symptom back to a cause before you spend money on hardware. Three failure modes account for most of what I find on inherited servers. Each has a distinct signature. The 502 nobody can reproduce Server has 8GB. PHP-FPM is set to 100 workers. Each worker uses 60MB under load. That's 6GB of PHP, plus MariaDB, plus Nginx, plus the OS. Under normal traffic you never approach 100 workers, so it looks fine for months. Then a marketing email goes out, concurrency spikes, and the kernel runs out of memory. The OOM killer picks a process and terminates it, usually the biggest one, which is a PHP-FPM worker holding an in-flight request. User gets a 502. The application log has nothing, because the process died before it could write anything. Nginx logs recv() failed (104: Connection reset by peer) . Ten minutes later everything looks normal. sudo dmesg -T | grep -i "killed process" sudo journalctl -k | grep -i oom Hits there mean you don't have a mystery. You have a pm.max_children value nobody checked against real memory. The site that degrades all day and resets overnight TTFB is 180ms at 8am. By 4pm it's 900ms. Nobody deployed. Overnight it's fast again because something restarted PHP-FPM. That's OPcache running out of room. When the cache fills, it stops caching new scripts or wipes and rebuilds, and every miss pays full parse-and-compile again. It degrades gradually, which is why it goes unnoticed for months. The counters are oom_restarts and hash_restarts from opcache_get_status() . Here's the part that trips people up. OPcache state is per SAPI. Run that function from the CLI and you're reading the CLI cache, which is empty, separate, and tells you nothing about your site. You have to ask through PHP-FPM. <?php // drop in webroot, lock to your IP, delete when done $allowed = [ '203.0.113.42' ]; if ( ! in_array ( $_SERVER [ 'REMOTE_ADDR'

The intricate, 5.6 trillion-pixel map covers approximately 75 percent of the sky and includes about 4 billion celestial objects.

It’s called the Edge Panel. Here’s how to make the most of it.

Forget email surveys or long calls spent on hold. Voicebox lets people send customer feedback by recording a voice note on their phone.

Railway's pricing trips up developers who assume it works like Vercel or Netlify with a generous free tier and predictable monthly bills. It doesn't — it's usage-based, and the bill can climb fast once you move past hobby projects. Here's what you're actually paying for in 2026. How Railway pricing actually works Railway bills on three axes: compute (vCPU-hours), memory (GB-hours), and egress (GB). There's no seat-based pricing and no per-project fee. Every service you spin up — a Next.js app, a Postgres instance, a Redis container, a background worker — accumulates compute and memory cost independently. This is the first gotcha: a monorepo with three separate Railway services isn't one bill line, it's three. A typical Next.js + Postgres + Redis stack is billing on all three simultaneously, 24/7, even if traffic is zero. Railway free tier limits in 2026 The Hobby plan starts at $5/month (a recent change from the old credit system) and includes a $5 usage credit each month. If your services stay within that credit, you pay only the base $5. Exceed it and Railway charges the overage at standard rates. Resource Hobby included Rate above included vCPU ~8 vCPU-hours/mo (within $5 credit) $0.000463 / vCPU-second Memory ~32 GB-hours/mo (within $5 credit) $0.0000018 / GB-second Egress 100 GB/mo $0.10 / GB Postgres storage 1 GB (Hobby DB) $0.25 / GB / mo Execution timeout 10 min (one-off jobs) — Team members 1 (solo) — The credit math is easy to exhaust. A single 512 MB Node.js service running continuously costs roughly 512 MB × 3600 s × 24 h × 30 d × $0.0000018/GB-s ≈ $2.40/month in memory alone. Add a small Postgres instance and a Redis container and you've eaten the credit. The $5 base is essentially the minimum floor, not a ceiling. The free trial (no credit card) gives $5 one-time credit and then stops. That's roughly enough for a weekend of testing — not a production staging environment. Pro plan: what changes The Pro plan costs $20/month per workspace and removes the

CERN engineers announced a shift from Red Hat-based distributions to Debian for its accelerator control systems. This decision stems from Red Hat's tightening compiler mandates, which threatened legacy hardware. The transition, focused on 2,200 specialized control machines, is set for completion in late 2026, while CERN's other systems will remain with Red Hat and AlmaLinux. By Olimpiu Pop

From February to April 2026, I launched four web apps, each starting from a code bundle that Figma Make (Figma's AI feature that generates a working front-end code bundle from a design) had spat out: a beauty-curation site, a gift-record app, a plush-toy album, and a UI mock for an AI development tool. Every one of them starts its repository in a state where "the look is already finished." In this article I look back — from the actual config files and commit history — at what I did to get those generated outputs into a state where I could take over development in Claude Code (Anthropic's CLI coding agent) and start working on them, and at how far each of the four repositories progressed or stalled. The starting point: what shape does a Figma Make output come in? A Figma Make export runs as-is with npm run dev . The README tells the story. # Beauty Information Curation Site This is a code bundle for Beauty Information Curation Site. The original project is available at https://www.figma.com/design/ <id> /... ## Running the code Run `npm i` to install the dependencies. Run `npm run dev` to start the development server. A README that says "the original lives in Figma." That symbolizes the character of the output: the code is a projection of the Figma design, and the code is not the source of truth. On top of that, if you look at package.json , every dependency is exact-pinned. { "dependencies" : { "next" : "15.3.4" , "react" : "19.1.0" , "react-dom" : "19.1.0" , "lucide-react" : "0.487.0" , "motion" : "12.23.24" , "tailwind-merge" : "3.2.0" } } Fixed versions with no ^ . As a snapshot of the moment it was generated, it is highly reproducible, but leave it as-is and it grows stale with no one ever updating it. There is no data layer either. The screens are pretty, but behind them everything is mock data — no persistence, no authentication. "It runs, but there is no foundation to grow it on" — this was the common starting point across all four repositories. [画像: The READ

Most countries tax immovable property, and most of them argue about it badly. The argument usually skips the part that decides the answer: before any map is coloured, someone has to choose what is added up, what it is divided by, over which territory it is aggregated, and which cases are left out . Change any of those and the map can change while the underlying data stay identical. This post works through that problem with Chilean data, because Chile happens to publish the pieces needed to do it honestly: a national cadastre of every taxable property, and an official index that ranks small civic territories by socio-territorial vulnerability. The mechanics, though, are not Chilean. Any jurisdiction that assesses property for tax and then maps the result against a deprivation measure faces exactly the same four choices. The question fits in one small fraction: territorial indicator the unit you compare it against the total you want to describe ​ Adding up the assessed value inside a territory answers how much administrative value was allocated there. Dividing that same total by households, by residents or by square metres answers different questions. None of them is «the correct one» by nature; the error appears when one is presented under another's name. The arithmetic is usually innocent. The narrative is not always. Reading contract I cross two Chilean administrative registers: the real-estate cadastre of the Servicio de Impuestos Internos (SII) —Chile's tax authority, roughly the counterpart of the IRS or HMRC— and the Índice Global de Vulnerabilidad Socioterritorial (IGVUST) , a socio-territorial vulnerability index published by the Ministry of Social Development and Family. The unit of analysis is the neighbourhood unit , not the parcel, the household or the person. A word on that unit, because it has no clean equivalent elsewhere and it drives half of what follows. A Chilean unidad vecinal (UV) is a civic territory drawn for neighbourhood organisation and loca

A program of mine hung for forty minutes. Not spinning at a thousand loops a second: at zero percent CPU . It wasn't doing too much work; it wasn't doing any work at all. And still it wouldn't finish. The program does something common: it orchestrates external command-line tools. It launches one, reads what it writes to standard output, and moves on to the next when it's done. So it doesn't get stuck when a tool drags, each one has a timeout: when it fires, the process is killed and we carry on. That's the part that failed, and it failed where no one looks: after killing the process. Killing the process doesn't close the pipe When you read a subprocess's output, you read from a pipe : one end writes (the subprocess), the other reads (you). Your reader doesn't finish when the subprocess dies. It finishes when EOF arrives, and a pipe's EOF arrives only when the last write end is closed. Almost always they coincide: the subprocess is the only writer, it dies, its end closes, EOF arrives, your reader finishes. All in microseconds. But "almost always" isn't "always". The tool I launched launched another one in turn —a grandchild—. And that grandchild inherited the pipe's write end, because on Unix a child inherits its parent's open descriptors unless told otherwise. So when the timeout fired, I killed the child. Its end closed. But the grandchild was still alive , with its copy of the descriptor open. The last write end hadn't closed. EOF never came. And my reader sat waiting for an EOF that would never arrive —at zero percent CPU, blocked in a read() , indistinguishable from slow work—. The symptom that deceives What makes this failure so hard to see is that it doesn't look like a failure . An infinite-loop hang burns CPU: you see it in top instantly. This one spends nothing. The thread is asleep in the kernel waiting for data that isn't coming. In the process list it looks healthy. In the metrics it looks like it's "taking a while". The only way to tell "hung forever"

Well...Well...Well... You’re probably tired of Windows, too—or maybe you just want something new , And you think Linux is an interesting option, you HAVE to read this What do I want to talk about? You have likely already heard the name of the best distribution for beginners, but I will list a few options for you to choose from to get started. (We'll talk more about choosing a distro in another post.) Linux mint (Cinnumon Recommended) Pop_!OS Ubuntu Zorin OS MX linux Choose one to get started. How do we use them for the first time? NEVER install Linux fully on your computer. You have two options: Virtual machine (recommended) Dual boot Dual-booting requires more complex steps—such as creating a bootable flash drive or partitioning the disk—but it leaves all the computer's resources available, allowing you to use the system normally. A virtual machine is like running Linux as if it were an application; however, it consumes more resources, so you need a more powerful computer. Installing them is simple, too—whether on a virtual machine or in a dual-boot setup. You can easily learn how to install it by watching a YouTube video and talking to an AI. Important note: For a dual-boot installation, be sure to check the internet connection, audio, keyboard, mouse, and display within the live-USB before starting the installation. And make sure the USB drive is in good working order and has at least 8 GB of space. Okay, I've installed it. How do I use it? First of all, the basic terminal commands. (on linux yo have to learn it , else you are NOT a linux user) Package manager All the distributions mentioned here use the apt package manager. If you are using a different distribution, search online to find out how to use its package manager. Knowing how to search is a skill in itself! (Discussing package managers would take too long, so I won't talk about them.) However, if you are using these distributions, you should know these commands for removing, installing, and updating. fo

Welcome back to TechCrunch Mobility, your hub for the future of transportation and now, more than ever, the role AI is playing in it.

This is a shortened version of my original post . My wife and I have blogged about every trip since our honeymoon 10 years ago. For the people at home, for ourselves later, and by now for our children. We took turns writing, but both had photos and videos on their phones. The text was never the hard part. The photos and videos were: every day one of us sent them from the phone to the other, who had to upload them and sort them into the entry in the right order. So I wrote Texttile , an open-source blog engine built for writing together. One entry, two screens Multiple people can have the same entry open. One of them has the text and types, the other watches the words arrive and can take the text over with one click. Both can still work on the gallery. Photos and videos belong in the same gallery. Videos come from your own server. Drop one in and Texttile converts it, thumbnail included. No YouTube embed, no player from anywhere else. One container, one folder Phoenix, LiveView, ffmpeg and SQLite live in one Docker image. Everything is in /data . Move that folder and you move the blog. A reader's browser talks to your server and nothing else. No CDN, no tracker, no hosted font. What it is not There are no roles, no permission matrix, no plugins, no theme marketplace. Everybody with an account is an admin. I built it for people who trust each other, because that is who writes a blog together. You can try it or read the source . The full story includes a video showing both screens. How do you blog on the road?

If you use Windows or Linux, you may have created a bootable USB at some point. For example, if you want to install Windows 11 or Linux Mint , you can download the ISO file and use a tool like Rufus to create a bootable USB. Rufus works very well. But recently, while using Linux Mint, I discovered another tool called Ventoy . At first, I wondered: If Rufus already creates bootable USBs, why would I need Ventoy? After understanding how Ventoy works, I realized that the two tools solve slightly different problems. Let's look at it in a beginner-friendly way. What is Rufus? Rufus is a popular tool for creating bootable USB drives. For example, suppose you download the Linux Mint ISO: linuxmint.iso You open Rufus, select your USB drive and the ISO file, and Rufus prepares the USB so that you can boot your computer from it. The process looks like this: Linux Mint ISO ↓ Rufus ↓ Bootable USB ↓ Install Linux Mint The same idea works for Windows 11 and many other operating systems. Rufus is especially useful when you simply want to create one bootable USB for one ISO. Then what is Ventoy? Ventoy takes a slightly different approach. Instead of writing one ISO directly to the USB, you install Ventoy on the USB drive first. After that, you can simply copy ISO files to the USB like normal files. For example: Ventoy USB │ ├── Windows11.iso ├── LinuxMint.iso ├── Ubuntu.iso ├── Fedora.iso └── Clonezilla.iso When you boot your computer from this USB, Ventoy shows you a menu. You can then choose which ISO you want to boot. Something like: That's the main idea behind Ventoy. The biggest difference This is probably the easiest way to understand the difference: Rufus: ISO → Rufus → Bootable USB You normally repeat the process when you want to replace the ISO. Ventoy: Install Ventoy once ↓ Copy ISO files ↓ Boot from USB ↓ Choose an ISO You don't have to recreate the USB every time you want to use a different ISO. A simple real-world example Imagine you have a 64 GB USB drive. With Rufus,

I run Knipsmig , a QR-code photo sharing service for weddings and parties. Guests scan a code and upload straight from the phone, no app. Most of those uploads are 12 MP and print fine. A meaningful slice are not: photobooth captures at 1080x810, WhatsApp forwards at 1600x1200, screenshots, old scans someone re-uploaded. Those end up in the printed photo book looking soft. So I added an "Improve resolution" option to the editor. It adds up to 4x the pixels, and the whole thing runs on my own server. No API, no vendor, nothing leaves the box. This post is about why I went local and what it took to make that work inside a Rails app. Why not just call an image API I already have Gemini and OpenAI keys configured in the app for other things, so the lazy path was obvious. I did not take it, for three reasons. The generative models redraw the image. They don't upscale, they regenerate. Faces drift. These are guests' faces at someone's wedding, and "your aunt looks slightly different now" is not a feature. A super-resolution network stays faithful to the input: it only adds pixels consistent with the ones already there. Privacy paperwork. Every third-party processor I add has to go into the DPA. Guests' photos leaving the server to be fetched by a vendor is a real change, not a footnote. Running locally means the data processing agreement doesn't change and the existing opt-out for third-party AI stays about third parties. Cost. Per-image API pricing on a bulk action over hundreds of photos adds up fast. CPU time on a job lane I already pay for is free at the margin. The model I went with realesr-general-x4v3 from the Real-ESRGAN project (BSD-3-Clause). It's the compact SRVGGNet variant: about 1.2M parameters, roughly 5 MB as an ONNX file, and around 10x faster on CPU than the full RRDBNet x4plus. Quality is more than fine for event snapshots. Getting it into a usable shape was a one-off: export the release weights with the repo's pytorch2onnx.py script using dynamic H/W a

When I started using Linux Mint , I spent quite a bit of time exploring small desktop customizations. One of the simple things I discovered was that Linux Mint Cinnamon lets you customize how the date and time are displayed on the taskbar. Instead of showing only something like: Sat Aug 22 07:10 PM you can change it to something that works better for you. For example: Sat, Aug 22 • 07:10 PM or: 22 Aug 2026 | 07:10 PM or even: Saturday, 22 August • 19:10 It is a small change, but it is a nice way to personalize your desktop. Where can I change it? On Linux Mint Cinnamon, right-click the clock/date area on the taskbar and open the calendar settings. You should find a Display section with an option called: Use a custom date format Enable it and you will see a field where you can enter your own date and time format. For example: % a % b % e | % I :% M % p The Cinnamon documentation provides a complete reference for these formatting codes. But what do these strange symbols mean? At first, the format looks a little confusing: % a % b % e | % I :% M % p Don't worry. Each % code simply represents a different part of the date or time. For example: Code Meaning Example %a Short weekday Sat %A Full weekday Saturday %b Short month Aug %B Full month August %d Day with leading zero 02 %e Day without leading zero 22 %m Month number 08 %Y Four-digit year 2026 %y Two-digit year 26 %H Hour, 24-hour format 19 %I Hour, 12-hour format 07 %M Minutes 10 %S Seconds 35 %p AM/PM PM %P am/pm pm %Z Timezone IST The complete Cinnamon reference also includes things such as week numbers, day of the year and fractional seconds. You don't need to remember all of them. Once you understand a few common codes, creating your own format becomes quite easy. My favorite date and time combinations Here are some combinations you can try directly in the Date format field. 1. Simple and clean % a % b % e % I :% M % p Result: Sat Aug 22 07:10 PM 2. More readable % a , % b % e • % I :% M % p Result: Sat, Aug 22