标签：#X

An extension can work perfectly in development and still fail after packaging. The risky change is often not in the feature code itself. It can be a permission that moved, a host pattern that expanded, a content script that now runs somewhere new, or a browser surface that was never included in the release checklist. Here is the small preflight review I now use before testing an MV3 release. 1. Compare the packaged manifests Compare the last version you actually shipped with the new packaged version, not only the source manifest. Check separately: required permissions; optional permissions; required host access; optional host access. A permission moving from optional to required deserves attention even if the set of permission names looks familiar. 2. List every browser surface Turn the manifest into a list of things a person can interact with or that Chrome can start: action popup; options page; side panel; background service worker; content scripts; commands; externally connectable pages; declarative network rules; web-accessible resources. If a surface changed, add at least one release check for it. This sounds obvious, but it is easy to review the main popup while forgetting an options page or a host-specific content script. 3. Check where code can now run For every content script, compare: match patterns; excluded matches; frames; execution world; run timing. The JavaScript file can be unchanged while one of these settings changes the extension's behavior on real sites. 4. Test the packaged build Run the checklist against the same build directory that will be uploaded. A development build can hide packaging, path, minification, or generated-manifest differences. At minimum, reload the packaged extension and exercise one path through each changed surface. 5. Record why each check exists Instead of keeping a generic list such as “test the popup,” connect each check to a release change: host access expanded → test the new host and confirm the old hosts still

When applying for engineering roles, automated applicant tracking systems (ATS) often silently reject candidates due to parsing blockers like multi-column layouts, missing quantitative metrics, or non-standard font embeddings. To fix this latency bottleneck, I built MyRizzume ( https://myrizzume.me ) — designed to parse and score resumes end-to-end in under 1,000ms. What it checks: Layout Integrity: Validates that column and table layouts won't merge or scramble text during ATS ingestion. Action Verb Strength: Highlights passive phrases and suggests active, quantifiable replacements. Keyword Density: Compares section headers and skill blocks against common parser taxonomies. Try it out live at https://myrizzume.me and let me know how it handles your layout!

An early version of Say It Ahead had a basic problem. A user could listen carefully, ask good questions, and offer a reasonable plan, but the AI character might still sound just as upset as it did at the start. That made the practice feel arbitrary. The user could not tell whether anything they said had changed the conversation. The character had a strong opening mood, but no clear reason to move away from it. The fix was not a list of magic calming phrases. It was a simple model of how a difficult conversation can move forward. This note explains that model, how the live progress display works, and where the system can still get it wrong. The first character knew how to be upset The first parent scenario was easy to start. The prompt described an angry parent, gave the parent a complaint, and told the voice to push back. The result sounded convincing for the first few turns. The problem appeared when the user handled the conversation well. The model had been told why the parent was upset, but not what would make the parent become more open. It often treated anger as the character's permanent personality. A good question might produce an answer, but the next reply could jump back to the original complaint as if no trust had been built. Adding more instructions such as 'calm down when appropriate' did not solve the problem. Appropriate is too vague. The model needed to know what evidence to watch for and how its behavior should change after seeing it. A useful character needs a reason to resist Each ready-made scenario now gives the character more than a mood. It describes what happened, what the character believes, what facts they know, why they do not trust an easy answer, and what a credible resolution would look like. For example, a parent may reject a general promise because two earlier meetings led nowhere. A manager may care less about one missed deadline than about whether the same communication problem will happen again. An interviewer may accept transferabl

The Silent Killer of Next.js Performance: Component Poisoning In the modern React ecosystem, specifically within Next.js and the new paradigms introduced in React 19, the distinction between Server Components and Client Components is the most critical architectural concept to master. Yet, it is also the most frequently misunderstood. If you have ever imported a React Server Component directly into a Client Component, you have inadvertently "poisoned" your application. This silent performance killer is rampant in production codebases, leading to bloated bundles, broken security, and a complete breakdown of the server-side benefits you migrated to React Server Components (RSC) to achieve in the first place. What is Component Poisoning? Component poisoning occurs when a developer treats file boundaries as mere organizational choices rather than strict execution boundaries. When you write import MyServerComponent from './MyServerComponent' inside a file marked with 'use client' , you are telling the bundler to include that component in the client-side JavaScript bundle. The moment that import statement is parsed, the Server Component is stripped of its server-only capabilities—like direct database access or environment variable usage—and compiled into a Client Component. The result? Bundle Bloat: Code that was meant to stay on the server is now shipped to the browser. Broken Logic: Any code relying on Node.js-specific APIs or secret keys will throw errors at runtime because it is now executing in the browser's environment. Performance Degradation: The primary benefit of RSC—reducing the amount of JavaScript sent to the client—is completely negated. The Mental Model: Respecting the Serialization Boundary To avoid poisoning, you must shift your mental model. Client Components cannot "own" Server Components. They cannot import them, nor can they directly control their execution lifecycle. Instead, think of the Serialization Boundary . React Server Components render on the

Most nginx misconfigurations announce themselves. You typo a directive, nginx -t fails, you fix it. That feedback loop is fast and it works. The dangerous ones are different. The config is valid. nginx -t passes. The server starts, serves traffic, logs nothing unusual. And the thing you configured is quietly not happening. I maintain gixy-ng , a static analyzer for nginx configs. A growing share of its checks exist for exactly this category, because it turns out static analysis is the only practical way to catch a failure that produces no signal at runtime. Here are four worth knowing about. 1. OCSP stapling that staples nothing server { listen 443 ssl ; server_name example.com ; ssl_certificate /etc/ssl/example.com.pem ; ssl_certificate_key /etc/ssl/example.com.key ; ssl_stapling on ; ssl_stapling_verify on ; } Looks right. It does nothing. OCSP stapling means nginx fetches the certificate's revocation status from the CA itself and attaches it to the handshake, so the client does not have to. To do that, nginx has to make an outbound request to a hostname. nginx does not use the system resolver for runtime lookups. It has its own, and it only exists if you configure it. No resolver in scope means the hostname never resolves, the fetch never happens, and stapling is silently skipped. Your config test passes. Your clients go do their own OCSP lookups, which is the exact thing you turned stapling on to avoid. resolver 127.0 .0.1 valid=300s ipv6=off ; resolver_timeout 5s ; Use a local resolver or your cloud provider's internal DNS. Pointing this at 8.8.8.8 sends every internal lookup off your network in cleartext, which is its own problem. Check it with: echo | openssl s_client -connect example.com:443 \ -servername example.com -status 2>/dev/null \ | grep -A 17 'OCSP response' Working stapling prints OCSP Response Status: successful . Broken stapling prints no response sent . Run it twice, since the first handshake after a reload usually goes out unstapled while the f

If you use Claude Code for both work and personal projects, you've probably hit this: switching accounts means logging out, logging back in, and losing whatever session state you had. It's a small friction that adds up fast if you're context-switching several times a day. The fix is one environment variable: CLAUDE_CONFIG_DIR for both work and personal projects, you've probably hit this: switching accounts means logging out, logging back in, and losing whatever session state you had. It's a small friction that adds up fast if you're context-switching several times a day. Running Multiple Claude Code Accounts on Linux - Writing Run separate Claude Code accounts on Linux with CLAUDE_CONFIG_DIR — manual setup, an automation script, direnv auto-switching, and VS Code integration. sakibullah.me

When an Elixir project outgrows a handful of modules, the habit of pasting definitions into IEx starts to break down — redefinition warnings pile up, names collide, and nothing survives the session. One way to picture what comes next is a workshop: it begins as a single shelf of drawers and, as the work grows, turns into a whole room with labeled aisles and a storage room for materials that are not tools at all. In the last few articles I filled those drawers — modules — and learned how to reach between them with alias , import , and require . A project structure is the map of that room: it tells me where each module lives on disk, how file names line up with module names, and which aisles other people are allowed to walk into. In this article, we will build a real Mix project from scratch and watch it grow: starting from mix new , adding directories like lib , test , priv , and config , naming modules so they mirror their paths, and drawing boundaries so the project stays navigable as it grows. Note : The examples in this article use Elixir 1.20.1. While most operations should work across different versions, some functionality might vary. This is also a small turning point for the series: instead of pasting examples into iex , everything from now on lives in real files inside a Mix project. Each code block shows the file path, and every example is verified with mix run , with the output shown right after — and when we just want to poke at our functions, iex -S mix brings back the interactive shell, now with the project compiled from its files. Table of Contents Introduction Starting From Mix New The Anatomy of the Default Project Growing Lib: Modules That Mirror Paths Running the Project: Scripts and the Shell Namespaces and Boundaries The Priv Directory Configuration and Environments Practical Guidelines Conclusion Further Reading Next Steps Introduction In the previous articles, every example was self-contained: one or two defmodule blocks pasted into an iex sess

Run this against your site right now: curl -s https://yoursite.com | grep -o "<h1[^>]*>.*</h1>" If nothing comes back, or you get an empty <div id="root"> , then large parts of the internet cannot read your site. Not "reads it poorly". Cannot read it. I do this on every site we take over, and the result surprises people often enough that it is worth writing down. What the test is actually showing curl does exactly one thing: it fetches HTML and stops. It does not run JavaScript. It does not wait for hydration. It does not call your API. That is also what a large number of crawlers do. Googlebot is the exception people think of, and it is genuinely good: it fetches, queues the page, and renders it with a headless browser later. Client rendered content usually gets indexed eventually. The AI crawlers are a different story. As of now, the major ones (GPTBot, ClaudeBot, PerplexityBot, and friends) largely do not execute JavaScript. They fetch the HTML, take what is in it, and move on. Whatever your framework paints after the bundle loads is invisible to them. So curl is a decent proxy for the floor: if your content is not in that response, assume a meaningful slice of automated readers never see it. Why this got worse recently For years the bet was reasonable. Google renders JS, Google is search, so client rendering was survivable. Then a chunk of discovery moved to assistants. People ask ChatGPT for a recommendation instead of scrolling ten blue links. If the model cannot read your page, you are not in the answer, and there is no page two to be on. For a marketing site this is the whole ballgame. For a small business it is worse, because the queries that matter ("web designers in X", "who does Y near me") are precisely the ones people now ask an assistant. Three ways to check properly 1. Raw HTML, by word count. curl -s https://yoursite.com | wc -c # total bytes curl -s https://yoursite.com | \ sed 's/<script[^>]*>.*<\/script>//g' | \ sed 's/<[^>]*>/ /g' | wc -w # actu

A inteligência artificial no setor jurídico ultrapassou a fase dos chatbots genéricos de pergunta e resposta. Quando lidamos com o Direito, o custo de uma "alucinação" de IA não é apenas um incômodo — pode significar a perda de um prazo fatal, uma tese fundamentada em jurisprudência inexistente ou a violação de sigilo. Para resolver esse problema, a engenharia de software aplicada a LegalTechs está migrando para os Agentic AI Workflows (Workflows de IA Agêntica). Em vez de depender de um único prompt gigantesco para resolver um problema complexo, orquestramos múltiplos agentes especializados. Neste artigo, vamos detalhar como arquitetar uma esteira de triagem, busca vetorial e sumarização de processos, utilizando ferramentas maduras e garantindo que o advogado permaneça como o orquestrador final no Quality Gate . 1. Dividir para Conquistar: A Arquitetura Multi-Agente A premissa da orquestração de agentes é a especialização. Cada agente no sistema possui um escopo restrito, ferramentas específicas ( tool use ) e um objetivo claro. Em um cenário de entrada de um novo processo longo (ex: um PDF de 500 páginas), o workflow se divide em três estágios: Agente 1: Classificação de Intenção e Roteamento O primeiro agente atua como o recepcionista. Ele não lê o documento para extrair teses; ele apenas analisa as primeiras páginas para responder: O que é isso? É uma Inicial Trabalhista? Uma intimação de prazo? Uma contestação? A partir dessa classificação, o workflow roteia o documento para a fila correta de processamento. Agente 2: RAG (Retrieval-Augmented Generation) e Busca Vetorial O segundo agente é o pesquisador. Ele quebra o documento em fragmentos ( chunks ) e cruza as alegações da parte contrária com o acervo interno do escritório. No ecossistema Elixir, por exemplo, podemos utilizar o PostgreSQL com pgvector e Ecto para armazenar os embeddings de casos passados e jurisprudências vencedoras do próprio escritório. O agente busca semelhanças e recupera o contexto estrit

Asha Sharma said Xbox is developing a 'great family of devices' for Helix.

Fabiane Nardon shares how TOTVS prepares enterprise data for token-hungry AI agents. She discusses balancing deterministic logic and non-deterministic LLMs across precision, security, and cost. Nardon details using data mesh, low-latency database architectures, semantic ontologies, and dynamic MCP tool selection to optimize context windows and reduce token overhead in transactional systems. By Fabiane Nardon

Every AI redesign of my portfolio looked different and was the same filing cabinet underneath. What a style guide couldn't fix — and the one instruction that did.

In alignment with security compliance standards, the Nautilus project team has opted to impose restrictions on crontab access. Specifically, only designated users will be permitted to create or update cron jobs. Configure crontab access on App Server 3 as follows: Allow crontab access to rose user while denying access to the rod user. Solution Step 1: Connect to App Server 3 (stapp03) ssh banner@stapp03 # Password: BigGr33n Step 2: Switch to root or use sudo sudo su - # Password: BigGr33n Step 3: Create the cron.allow file with user rose echo "rose" > /etc/cron.allow Step 4: Add rod to cron.deny file (optional but ensures denial) echo "rod" >> /etc/cron.deny Note: If cron.allow exists, cron.deny is ignored. However, it's good practice to maintain both. Step 5: Verify the configuration # Check cron.allow file cat /etc/cron.allow # Check cron.deny file cat /etc/cron.deny # Test rose user access su - rose -c "crontab -l" 2>&1 # Test rod user access su - rod -c "crontab -l" 2>&1 Complete One-Line Commands From jump host with password: echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'echo rose > /etc/cron.allow && echo rod > /etc/cron.deny && echo \" === cron.allow === \" && cat /etc/cron.allow && echo \" === cron.deny === \" && cat /etc/cron.deny'" From jump host using heredoc: ssh banner@stapp03 << ' EOF ' echo 'BigGr33n' | sudo -S bash -c ' echo "Creating cron.allow with rose..." echo "rose" > /etc/cron.allow echo "Creating cron.deny with rod..." echo "rod" > /etc/cron.deny echo "" echo "=== Verification ===" echo "cron.allow contents:" cat /etc/cron.allow echo "" echo "cron.deny contents:" cat /etc/cron.deny echo "" echo "Testing rose user (should have access):" su - rose -c "crontab -l" 2>&1 || echo "No crontab for rose (expected)" echo "" echo "Testing rod user (should be denied):" su - rod -c "crontab -l" 2>&1 ' EOF Step-by-Step Interactive Commands # Connect to stapp03 ssh banner@stapp03 # Enter password: BigGr33n # Become root sudo su - # Enter password: B

At xFusionCorp Industries, the Stratos Datacenter houses a jump host server that stores template XML files essential for the Nautilus application. Prior to their use, these files need to be populated with valid data. As part of regular maintenance, the system administration team utilizes various string and file manipulation commands to prepare these templates. Your task is to substitute all occurrences of the string Text with Echo-Location within the XML file located at /root/nautilus.xml on the jump host server. Solution Step 1: Connect to the Jump Host Server ssh thor@jump-host # Password: mjolnir123 Step 2: Switch to root sudo su - # Password: mjolnir123 Step 3: Verify the file exists and check its content # Check if file exists ls -la /root/nautilus.xml # View the file content (optional) cat /root/nautilus.xml Step 4: Substitute all occurrences of "Text" with "Echo-Location" Method 1: Using sed (Recommended) sed -i 's/Text/Echo-Location/g' /root/nautilus.xml Command breakdown: sed : Stream editor for filtering and transforming text -i : Edit files in-place (without backup) s/Text/Echo-Location/g : Substitute all occurrences s : Substitute command Text : Pattern to search for Echo-Location : Replacement string g : Global (replace all occurrences, not just the first) Method 2: Using sed with backup (Safer) sed -i .bak 's/Text/Echo-Location/g' /root/nautilus.xml This creates a backup file nautilus.xml.bak before making changes. Step 5: Verify the changes # View the modified file cat /root/nautilus.xml # Check for any remaining "Text" strings grep -n "Text" /root/nautilus.xml # Check for "Echo-Location" strings grep -n "Echo-Location" /root/nautilus.xml # Count occurrences replaced grep -o "Echo-Location" /root/nautilus.xml | wc -l Complete One-Line Commands From jump host directly (as root): sed -i 's/Text/Echo-Location/g' /root/nautilus.xml && echo "✓ Substitution complete" && grep -c "Echo-Location" /root/nautilus.xml From jump host with sudo: sudo sed -i 's/Text

If you searched for a klogg alternative , you probably already know klogg is good. It is fast, it is free, it is open source, and it runs on Windows, macOS and Linux. Most people who go looking for something else are not unhappy with klogg as a viewer. They are unhappy with one specific moment in their day: Opening the file again. You investigated a 48GB log yesterday. You closed it. This morning your colleague asks about a different error, and you have to wait through the whole index build a second time. On a USB HDD that is nine minutes of staring at a progress bar — and while it builds, klogg only shows you the beginning of the file. That is the problem this article is about. Below is a measured comparison on a real 47.73GB file, including the rows where klogg wins . The test File OpenStreetMap Japan japan-latest.osm — 47.73 GB, 892,239,125 lines Machine MacBook Air / Apple M4 (10 cores) / 32GB RAM Storage (measured with dd ) USB HDD 0.10 GB/s ／ USB SSD 0.41 GB/s ／ Internal SSD 3.29 GB/s Versions klogg 24.11.0 ／ UwView Pro Search hit counts were verified to match exactly across klogg, UwView Pro, and a direct search of the raw file — so we know both tools are answering the same question. The numbers klogg 24.11.0 UwView Pro Ratio First open HDD ~9 min ／ USB SSD ~110 s ／ Internal SSD ~15 s — every time HDD 10.6 min ／ USB SSD 138.5 s ／ Internal SSD 23.3 s — first time only klogg wins Reopening Same as the first open (re-indexes every time) 0.01–0.07 s ~1,250–50,000x Search, literal "Tokyo" ~585 s ／ 120–135 s ／ 15–20 s 74.8 s ／ 14.3 s ／ 5.1 s ~7.8x ／ ~9x ／ 3–4x Search, regex "Tok[yi]o" ≈ literal (I/O bound, pattern-independent) 29.8 s (USB SSD) ／ 11.0 s (Internal SSD) ~4.4x ／ ~1.5x Disk used to keep the file 48 GB (original required) 5.3 GB (original can be deleted) 1/9 Two things are worth saying plainly. klogg opens the file faster the first time. UwView Pro is slower on the first open because it is building a compressed cache while it reads. That is a real cost a

This article is about running a hand-written Gemma 4 port in pure JAX on three different accelerators, and about the two places the abstraction leaks. The code is here: github.com/xbill9/gemma4-dev What is this project trying to Do? This project aims to serve one Gemma 4 checkpoint from one JAX port across every accelerator I can rent, and to find out — by measurement, not by reading docs — which parts of "it's just JAX" are true. The port lives in ports/gemma4/ and is driven by a generation loop behind an OpenAI-compatible server. No PyTorch, no vLLM, no torch_xla . The same code runs on Cloud TPU v5e and v6e, and on an NVIDIA T4G attached to an AWS Graviton2 host. "Pure JAX" is the whole experiment. If the port is really portable, the only thing that should change between those rigs is a config file. It mostly is. Two things are not, and they are the interesting part. Gemma 4 E2B is not a stock transformer Any port has to carry four irregularities, and none of them are optional: Two attention geometries. Sliding layers use head_dim=256 , global layers use 512 . Most inference stacks assume one head dimension per model. 8:1 MQA , so the KV budget is nothing like the parameter count would suggest. A KV-share map that collapses 35 layers onto 15 caches . A 512-slot sliding ring , plus per-layer embeddings (PLE) held in a 4.70 GB table that gets quantized to 4 bits on load. That first one is worth dwelling on, because it is what breaks other stacks. On the vLLM path, the heterogeneous head dims force the Triton attention backend: Gemma4 model has heterogeneous head dimensions {'sliding_attention': 256, 'full_attention': 512}. FA4 not available, forcing TRITON_ATTN backend. And on a Turing GPU that backend then asks for shared memory the hardware does not have: triton.runtime.errors.OutOfResources: out of resource: shared memory, Required: 98304, Hardware limit: 65536 JAX never enters that conversation. Attention is ordinary XLA rather than a hand-tiled kernel, so ther

Building Next-Gen Agentic Architectures: From Local RAG to Sandboxed Execution and BigQuery MCP The 3 AM production fire revealed a harsh truth: modern agentic systems often collapse under their own weight. A single agent processing 10K RAG queries OOM-killed an 8GB cloud instance. The culprit was not the workload but the infrastructure: @pinecone-client/vecdb with 47 transitive dependencies bloat memory with unquantized float32 embeddings. The solution was 200 lines of Python using sqlite3 , array , and heapq , with bounded queues and race condition resilience. This is the story of how we replaced dependency bloat with surgical precision. The Dependency Problem Agentic systems today face three critical bottlenecks: Vector Search : Libraries like faiss-cpu (12MB) combined with pg-vector (synchronous disk I/O) block the event loop, creating latency spikes. BigQuery : The @google-cloud/bigquery client (12MB) plus grpcio (5MB) leaks file descriptors, hitting Linux's default 1024 soft limit. Sandboxing : Docker containers consume 500MB+ per instance, making them impractical for memory-constrained environments. The root cause is always the same: unbounded resource consumption. 1M vectors at 768 dimensions in float32 consumes 3GB of memory. Synchronous I/O stalls the event loop. Unmanaged connections leak file descriptors. The Zero-Bloat RAG Engine The solution begins with a fundamental shift: replace heavy dependencies with lightweight, audited code. Our LocalRAG implementation demonstrates this approach: import sqlite3 import array import heapq import json import threading from typing import List , Tuple , Optional class LocalRAG : def __init__ ( self , db_path : str , dim : int = 768 , max_vectors : int = 1_000_000 ): self . dim = dim self . max_vectors = max_vectors self . lock = threading . Lock () self . conn = sqlite3 . connect ( db_path , isolation_level = None , check_same_thread = False ) # Enable WAL mode for concurrent reads/writes self . conn . execute ( " PR

Technical progress has encouraged a new batch of companies to jump in on the promise of profits from humanoid robots. And they're all Chinese automakers.

Are XREAL's smart glasses the way of the future for home entertainment?

According to Xbox CEO Asha Sharma, Project Helix, which she announced in March as a codename for Microsoft's "next generation console" - phrasing that seemingly implied a singular device - will actually be a "family" of devices." "We've been hard at work on a great next generation and a great family of devices for Helix, […]