标签：#disc

Have you ever read a job posting and your heart just sings the song of "HIRE ME PLEASE!!!", yeah,...

Pessoal, eu quase mandei uma lista de 23 "vulnerabilidades" pra mantenedores de código aberto. XSS, CORS, CSP, um SVG suspeito. O modelo tinha devolvido volume. Eu sentia que tinha trabalhado. Aí parei. Se eu fosse o cara do outro lado da issue, eu levaria isso a sério? A conta virou quando eu parei de pedir "audita meu código". Passei a escrever o contrato antes de abrir o repo. Direção (o que o modelo pode afirmar) e disciplina (o que ele não pode). Isso não deixa o LLM mais inteligente. Controla o comportamento. Em segurança, isso é o que separa auditoria de lista. O que você leva daqui: o contrato (esqueleto), por que o scanner não substitui hunt, e as três portas pra não colar relatório no tracker. Os repos no meio são prova. Não são o ponto. Tabela de Conteúdo 1. Direção e disciplina não deixam o modelo mais inteligente 2. O scanner vê o que está. O hunt vê o que falta 3. Silêncio também é resultado 4. As três portas 5. O que você monta amanhã 1. Direção e disciplina não deixam o modelo mais inteligente Esse é o ponto que eu demorei pra aceitar. O modelo já conhece OWASP. O que muda é o que ele tem permissão de afirmar. Sem isso, "audita meu código" devolve XSS fantasma, CORS, CSP, um SVG. Volume. A pergunta de segurança some: disto aqui, o que vira issue, o que vai pro e-mail privado, o que é silêncio? Direção amarra três coisas antes da leitura: Padrão externo. OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante em uma frase, falsificável. "Webhooks deveriam ser autenticados" é opinião. "Todo handler de webhook de entrada verifica autenticidade do remetente antes de mutar estado" é hunt. Formato único. Finding, observação e hipótese não misturam. Disciplina é o que corta o teatro. O texto que o modelo vê antes de abrir arquivo: Padrão: OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante: uma frase, falsificável. Relatório: finding, observação e hipótese não misturam. Sem arquivo:linha → não é finding. CWE inv

Mushroom is a tiny pixel creature that lives on your Mac . It can tell when you are actually at the desk, so it nudges you to drink, move and rest your eyes at the moments that help, and stays quiet when they would not. Made for people who sit at a Mac for hours. Developers, designers, writers, students, anyone whose focus is the problem and the job at the same time. Mushroom can do lots of things: https://www.getmushroom.app/features Pricing: https://www.getmushroom.app/pricing If you've seen Mushroom elsewhere, please let me know where. If you miss a feature, please tell me. I'm open for feedback and suggestions. Personal comment: I have created Mushroom because I wanted a very simple way to set up a quick reminder. You just type what and when in one sentence, and your reminder is set. Over the course of weeks, it evolved into a whole set of features. I'd like to thank Michael K. Graves for helping with ideas and suggestions, and I'd like to thank Caz-Bee for providing the graphics. Thank you for giving my post attention.

On July 11, 2026, I started building a project inspired by link-in-bio platforms. The idea was pretty straightforward: Create a profile → customize it → add your links → share it. So I built Rizzzler. And right now, it has 11 users. Yep. 11 😂 Not exactly the kind of number you'd put on a startup pitch deck. But those 11 users actually made me think about the project in a completely different way. The problem I noticed 🤔 I started looking at how people were using Rizzzler. And I noticed something: People would create their profile... Then disappear. Some wouldn't come back for a week. Some wouldn't even check the app for weeks. And eventually I realized something obvious. Why would they? Rizzzler was primarily a profile website. Once you've created your profile and shared your link, what reason do you have to open it again? You don't. That got me thinking: What else can we actually do with a profile? I didn't want Rizzzler to become something people set up once and completely forget about. I wanted the profile to actually do something. And that's where I got a pretty crazy idea. What if Rizzzler became more than a profile? I've used services that let you log into other applications using their account. For example: Sign in with GitHub. That got me thinking: What if Rizzzler could do something similar? Instead of Rizzzler only being a place where you create a profile... What if developers could use Rizzzler as an identity provider? And suddenly I had a new idea: Sign in with Rizzzler That was probably the craziest idea I've had for this project so far. And I decided to build it. I built my own OAuth 2.0 system 🔐 I started building the OAuth 2.0 mechanism, the developer-side integration, and the documentation. I also created a developer docs page so developers can understand how to integrate Sign in with Rizzzler into their applications. I've tested the mechanism locally, but there's an important distinction: It hasn't been properly tested by a real third-party applica

So, my fiance wanted a health and fitness app, to track meals, exercise routines, manage upcoming...

AI coding tools can write a function in seconds. The harder question is whether that function...

We’re a small team building Sealshot, a free and open-source screenshot app for macOS. We started working on it because screenshots often become disposable files. We use them for bug reports, QA, documentation, support, and security work, but later they can be hard to find or reuse. They can also accidentally contain sensitive information such as emails, API keys, tokens, internal URLs, or customer data. Sealshot is built around a simple idea: Treat screenshots more like documents than temporary images. It supports: region, window, and scrolling capture screen recording editable annotations OCR and searchable screenshot archives sensitive information detection before sharing encrypted local storage local metadata generation Everything is processed locally on the Mac. It’s open source and free, and we’re still actively improving it. We’d really appreciate feedback, especially from developers, QA engineers, support teams, and people working in security. Website: https://seal-shot.com/ GitHub: https://github.com/ldeng83/Sealshot

Nobody chooses .NET. Not as a student, at least. You hear "backend" and the room splits into Spring...

I own two laptops. A 2020 Intel MacBook Air, 8GB RAM, no unified memory, gifted by my sister. And a...

Welcome to this week's Top 7, where the DEV editorial team handpicks their favorite posts from the...

Some random questions that have been living rent-free in my head since I was a kid... So...

Intro There's a pitch behind every new AI-powered feature: it understands anything a user...

In the era of hyper-personalized fitness, data is the new "pre-workout." We want our smartwatches to tell us exactly how many calories we burned, but there’s a massive catch: Privacy . Giving a centralized cloud server access to every heartbeat, GPS coordinate, and sleep cycle feels increasingly like a security nightmare. This is where Federated Learning and Edge AI come to the rescue. Instead of sending your raw data to the cloud, we send the model to your device, train it locally, and only share the encrypted mathematical updates. In this tutorial, we will build a collaborative fitness model using Flower (flwr) and PySyft to predict calorie expenditure across a community of users without a single byte of raw heart rate data ever leaving their phones. Why Decentralized Machine Learning? 🥑 Before we dive into the code, let's look at the "Why." Standard machine learning requires a data lake. Federated Learning (FL) enables Privacy-Preserving AI by keeping data siloed on the edge. This is crucial for HIPAA compliance and building trust in community-driven health apps. The Architecture: Federated Optimization Loop Here is how the data flows in our group fitness ecosystem. Notice that the "Server" only sees weight updates, never the raw heart rate logs. sequenceDiagram participant S as Aggregation Server participant C1 as User A (Edge Device) participant C2 as User B (Edge Device) Note over S: Global Model Initialized S->>C1: Send Initial Model Weights S->>C2: Send Initial Model Weights Note over C1: Train on Local HR Data Note over C2: Train on Local HR Data C1->>S: Send Local Gradient Updates C2->>S: Send Local Gradient Updates Note over S: FedAvg Algorithm (Aggregating Weights) S->>C1: Send Updated Global Model S->>C2: Send Updated Global Model Prerequisites 🛠️ To follow this advanced guide, you'll need: Python 3.9+ Flower (flwr) : For federated orchestration. NumPy : For local data processing. PySyft : For differential privacy concepts. pip install flwr numpy Step 1

Have you ever had a melody, lyric, or song idea stuck in your head but felt completely unqualified to...

Have you ever wondered why we keep learning advanced things that probably might not be applied properly where we came from? As someone who came from a developing country where resources are not being served on a gold plate. In fact, even if you have all the necessary knowledge to make a change but one thing comes up with no answer, how can we implement our knowledge gained abroad with no funding and no equipment to help us contribute to the blooming of our beloved country? I guess our parents worked hard to actually send us abroad, not to return to our country but instead to find a way to make a living where God destined us to go. This is not because they hate our homeland, but they feel there is no way things can change where corruption and unemployment reign to a high degree. Therefore, this is the time where advanced technologies must not be seen as burdens in a developing country. Share answers on this particular spec. Thanks!

If I could go back to my first year in design, I would spend far less time asking "Which design app...

It takes me 2 hours. I am not joking. Usually, I don't have it "planned" before I started to...

Meme Monday! Today's cover image comes from the last thread. DEV is an inclusive space! Humor in...

When I first started learning HTML, I thought it would be the easiest part of web development. The basic tags seemed straightforward, and creating a simple page didn't take long. But as I kept learning, I realized that HTML is more than just putting elements on a page. Understanding semantic HTML , proper document structure, forms, accessibility, and knowing which element to use in different situations takes practice. For example, it can be tempting to use for almost everything, but learning when to use elements like <section>, <article> , <nav> , or <header> makes a big difference in writing meaningful markup. I'm curious about other developers' experiences: What HTML concept confused you the most when you were starting out, and what helped it finally click? I'd love to hear different perspectives, especially from people who have been working with HTML for a while.

If you’ve ever tried to open an Apple Health export.xml file in VS Code, you’ve probably watched your RAM melt into a puddle of sadness. 🫠 Apple’s HealthKit data is a treasure trove of biological insights, but at the scale of 5GB+ of "dirty" XML, it’s a Data Engineering nightmare. In this tutorial, we are building a high-concurrency Apple Health ETL Engine . We’ll be leveraging Rust for blazing-fast parsing, Apache Arrow for memory-efficient data transport, and ClickHouse for lightning-fast analytical queries. Whether you are building a personal bio-hacking dashboard or a population health platform, this architecture is designed to handle "Big Data" on "Small Hardware." The Problem: Why XML is Killing Your Pipeline Apple Health exports everything as a single, massive XML file. A typical 3-year history contains millions of <Record> tags with inconsistent attributes. Standard DOM parsers (like Python’s ElementTree ) will crash your system because they try to load the entire tree into memory. To solve this, we need a Streaming ETL approach. The Architecture 🏗️ Our pipeline follows a "Performance-First" philosophy: we parse in a low-level language, pass data through a zero-copy memory format, and sink it into a columnar database. graph TD A[Apple Health export.xml] -->|Streaming I/O| B(Rust XML Parser) B -->|Schema Mapping| C{Apache Arrow Batches} C -->|Zero-copy| D[Python/Polars Wrapper] D -->|Bulk Insert| E[(ClickHouse OLAP)] E -->|SQL/Grafana| F[Health Insights] style B fill:#f96,stroke:#333,stroke-width:2px style E fill:#00f,stroke:#fff,stroke-width:2px Prerequisites 🛠️ Before we dive in, ensure you have the following installed: Rust (Latest stable) Python 3.10+ ClickHouse (Local or Cloud) Tech Stack : quick-xml , arrow-rs , polars , clickhouse-connect . Step 1: The High-Speed Rust Parser 🦀 We use the quick-xml crate because it provides a "pull-based" API. This allows us to read the file byte-by-byte without ever loading more than a few KB into memory. // src/parser