标签：#go

If you send SMS one-time codes, there's a decent chance you're paying scammers to phone-spam themselves on your dime. It even has a name: SMS pumping . And it's not a rounding error — Elon Musk claimed Twitter was losing ~$60M/year to fake 2FA traffic before they killed SMS 2FA for free accounts. Here's how the scam works, why SMS 2FA is structurally expensive, and why flipping the direction — mobile-originated (MO) 2FA , taken to its logical end over iMessage — fixes both the cost and the fraud at once. What is SMS pumping? SMS pumping (also called AIT — Artificially Inflated Traffic , or SMS toll fraud ) is a scheme where bad actors abuse a form that sends SMS one-time codes. They pump thousands of phone numbers — usually premium ranges they secretly control with a telecom — into your "send me a code" endpoint. You pay for every one of those messages. A cut of that termination fee flows back to the fraudsters via the carrier. The "users" never log in. They were never users. The entire point was to make your verification endpoint dial a meter that pays them. The structure that makes this possible is simple: you, the company, send (and pay for) the message. Every code is revenue for someone in the delivery chain — so there's a direct financial incentive to trigger as many as possible. Why SMS 2FA is expensive even without fraud Even with zero abuse, application-to-person ( A2P SMS ) is a bad cost curve: You pay per message. Volume spikes — a launch, a bot attack, an international audience — turn into surprise bills. International is brutal. Cross-border A2P carries steep carrier surcharges that vary wildly by destination. Carrier fees and registration overhead. In the US you're funneled through A2P 10DLC registration, brand vetting, and per-segment fees before you send a single legit code. So your 2FA line item is pay-per-event , unpredictable , and exploitable . Three bad properties for something that's supposed to be boring infrastructure. The Twitter/X case This

I'm building TTT -- a terminal text editor and IDE written in Go. Single binary, zero config, runs anywhere. Think VS Code but in your terminal. It has syntax highlighting, LSP integration, a plugin system, an integrated terminal, git integration, etc... The source is on GitHub and I develop it with Claude Code as my pair programmer. This is the story of how a frustrating limitation turned into something genuinely useful: a built-in scripted interaction system that lets AI agents (or anyone) drive the editor like Playwright drives a browser. The problem I was deep in revamping the widget system and building out a Lua plugin API. Phases of work stacking up -- widget rendering, panel support, tree views, input fields, command registration, keybinding hooks. The kind of work where you need to see what's happening. Click a tree node, check if it expands. Open a panel, verify focus moves correctly. Run a plugin, confirm the dialog appears. Here's the thing: Claude Code can run shell commands and read files. It cannot interact with a live TUI session. The editor launches, takes over the terminal, and that's it -- Claude is blind. Step 1: tui-use (what we had) The project already had functional tests using tui-use , a JavaScript library that drives a real terminal binary. It can type, press keys, wait for text to appear, and take snapshots: const tui = await start ( " bin/ttt " , [ " test-file.go " ]); await tui . waitFor ( " test-file.go " ); await tui . exec ( " editor.joinLines " ); const screen = await tui . snapshot (); expect ( screen ). toContain ( " joined line " ); This works. But it's slow -- each test spawns the binary, waits for screen renders, polls with timeouts, and parses terminal escape codes. And critically, it can't click . Mouse events aren't supported. For a widget system with tree views, buttons, and split panels, that's a dealbreaker. Step 2: Debug commands (the workaround) So we added a Debug: Simulate Click command to the editor itself. Open the co

When confronted with cancer, Connor Christou fed everything tied tied to his regime — blood results, scan data, wearable output, journal entries — into Claude.

GitHub热门项目 | CasaOS - A simple, easy-to-use, elegant open-source Personal Cloud system. | Stars: 35,603 | 502 stars today | 语言: Go

A Go interview is rarely about syntax alone. Yes, you should know how slices work, how goroutines...

This post is my submission for DEV Education Track: Build Apps with Google AI Studio . What I Built For this project, I built DevBrand AI, an AI-powered web application that helps developers create a complete personal branding kit in just a few clicks. Instead of manually writing bios, portfolio headlines, README introductions, or designing graphics, users simply provide their GitHub username, role, tech stack, experience, and preferred design theme. The application then generates everything automatically. Prompt Used I used Google AI Studio's Build apps with Gemini feature with a prompt similar to this: Build a modern React + TypeScript application called DevBrand AI that generates a complete developer branding kit. Use Gemini to generate professional bios, portfolio headlines, GitHub README introductions, project ideas, mission statements, social media introductions, CTAs, and branding recommendations. Use Imagen to generate a modern 3D developer mascot, hero illustration, and portfolio banner. Create a responsive UI using Tailwind CSS with reusable React components, loading animations, copy buttons, and download functionality. Features 🤖 AI-generated developer bio 🎯 Personal tagline 💻 Portfolio headline 📄 GitHub README introduction 💡 Project ideas 🌈 Suggested branding colors 📢 Social media introduction 🚀 Portfolio call-to-action 🎨 AI-generated developer mascot 🖼️ Hero illustration 🌐 Portfolio banner 📋 Copy buttons 📥 Download generated content 📱 Responsive modern interface Demo Screenshots Live Demo App: https://devbrand-ai-706459620449.asia-southeast1.run.app My Experience This project was my first time using the new Build apps with Gemini experience in Google AI Studio, and it was surprisingly fast to go from an idea to a working application. What impressed me most was how the AI generated a well-structured React + TypeScript project instead of just producing a single file. The generated components, services, and overall architecture made the project easy to und

title: sqlex — A Modern Drop-in Replacement for jmoiron/sqlx published: false description: sqlex is a fully API-compatible modernization of jmoiron/sqlx that fixes 20+ long-standing bugs, adds pluggable hooks, auto IN expansion, and more. Built for Go 1.21+. tags: go, database, sql, opensource If you use sqlx, this is worth 3 minutes of your time jmoiron/sqlx has been the go-to SQL extension library for Go for years. Struct mapping, named parameters, IN clause expansion — it made database/sql actually pleasant to use. I've used it in almost every Go project I've worked on. But here's the reality: its activity has been modest at best, and has slowed to a crawl in recent years. Hundreds of issues sit untouched. PRs go unanswered. Bugs reported years ago are still there, waiting to cause production incidents. This isn't a knock on sqlx — it's a great library with solid design. But an unmaintained foundational library is a liability. So we built sqlex sqlex is a drop-in replacement for jmoiron/sqlx that is 100% API-compatible . All sqlx methods ( Get , Select , Exec , NamedQuery , Preparex , etc.) work identically. Migrating takes 30 seconds — just change the import path: - import "github.com/jmoiron/sqlx" + import "github.com/go-sqlex/sqlex" 🐛 20+ bug fixes from sqlx, all fixed 🚀 New features sqlx never had Auto-Rebind — write ? everywhere, works on PostgreSQL ($1), MySQL (?), SQLite (?), SQL Server ( @p1 ). No more manual db.Rebind(). SQL parsing fixes — colons in strings, :: type casts, ? in comments are correctly handled. Silent bugs from sqlx are gone. Auto IN expansion — slices in IN (?) are detected and expanded automatically on all methods. Hook system — pluggable SQL interceptors for logging, tracing, metrics (onion model). JSONValue[T] — generic JSON column type with auto serialize/deserialize. StrictMode — lenient by default (matching sqlx Unsafe()), optionally strict for debugging. Unified interfaces — Ext / ExtContext / NamedExt / BindExt with compile-time

In the global streaming economy, Spotify, Apple Music, and other DSPs process billions of plays daily. Behind this massive transaction layer lies a fragmented, dual-copyright structure: The Recording Copyright (Master Right): Identifies the audio file, registered using the ISRC (International Standard Recording Code). The Composition Copyright (Publishing Right): Identifies the melody, lyrics, and arrangement, registered using the ISWC (International Standard Musical Work Code). Because these registries are managed by separate global entities (IFPI for ISRCs and CISAC for ISWCs), there is no central mapping registry between them. This gap causes millions of dollars in mechanical royalties to sit unclaimed in collective management organization (CMO) "Black Boxes" before being liquidated to major publishers. In this article, we'll design and implement a high-performance Semantic Entity Resolution Protocol (SERP) to bridge this metadata gap programmatically. The SERP Resolution Pipeline Reconciling these records requires a multi-layered classification pipeline. Since manual matching is logistically impossible, we implement a three-tiered algorithmic approach: ┌────────────────────────┐ │ Raw Recording & Work │ │ Data Ingestion │ └───────────┬────────────┘ │ ▼ ┌────────────────────────┐ │ 1. Normalized Title │ ──[Similarity < 0.85]──> [Unmatched Queue] │ Distance Filter │ └───────────┬────────────┘ │ [Similarity >= 0.85] ▼ ┌────────────────────────┐ │ 2. Creator Overlap │ ──[No Overlap]──────────> [Unmatched Queue] │ Intersection Matrix │ └───────────┬────────────┘ │ [Intersection >= 1] ▼ ┌────────────────────────┐ │ 3. Duration Tolerance │ ──[Delta > 4s]──────────> [Manual Verification] │ Guard Check │ └───────────┬────────────┘ │ [Delta <= 4s] ▼ ┌────────────────────────┐ │ Verified Link & │ │ CMO Dispute Ready │ └────────────────────────┘ Step 1: Normalization & String Similarity Filter Title comparisons often fail due to punctuation mismatches, subtitle variations,

Chinese companies control nearly two-thirds of Argentina’s own squid fleet.

Why I Am Writing This: A PHP Developer Crossing Into Go I am a PHP developer. I have...

“We don’t believe this kind of government access process should become the long-term default,” says OpenAI. “It keeps the best tools from users, developers, enterprises, cyber defenders, and global partners who need them.”

We know that ICE wants to deploy eyeglasses with facial recognition that can identify people in real time. Turns out Meta is prototyping the feature with a Pentagon supplier. (Alternate news story.)

AI models have progressed to the point where their capabilities have real political consequences. Dealing with those consequences will require collective action.

Google Pixel Buds are steeply on sale, presumably only through the end of the day.

Edward Nalwamba is a 78-year-old retired pastor whose health has rapidly declined while in detention, his attorney says.

GitHub热门项目 | git push no-mistakes | Stars: 3,158 | 996 stars today | 语言: Go

The Argo CD project released a v3.5 release candidate in June 2026. This version adds mutual TLS enforcement for internal components. It also includes Git commit signature verification for supply chain security and native ApplicationSet management in the UI. The release also graduates two significant features: impersonation and Source Hydrator, from alpha to beta. By Claudio Masolo

A database of almost a million passports from around the world was leaked online. Note what happened. A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk.

YouTube has made several key changes to Shorts by removing dislikes and offering a clear screen mode.

I spent 3 months building a tool that solves the most annoying part of working on a dev team. You know the drill: → New dev joins → "hey check your DMs" → Someone pastes the .env in Slack → That message sits there forever → 6 months later someone screenshots it by accident or worse — → git add . → git commit -m "added env" → git push → you just leaked your prod database URL to the internet I got tired of it. So I built DotSync. ─────────────────────────────────── Here's what it looks like in practice: $ dotsync push 🔒 Encrypting 10 secrets for team access... 📤 Uploading... ✅ Version : v7 Secrets : 10 keys encrypted Teammates can now run: dotsync pull That's it. New dev joins? They run dotsync pull. Secrets updated? dotsync push. Moving between your laptop and work machine? dotsync pull. ─────────────────────────────────── The part I actually care about — security: Everything is encrypted ON your machine before it hits the network. The server stores a blob it literally cannot read. I'm not asking you to trust my infrastructure. You don't have to. Stack if you're curious: • Argon2id key derivation (64MB memory cost — brute force isn't happening) • AES-256-GCM encryption • Zero-knowledge server (stores ciphertext only) • Single Go binary, no runtime deps ─────────────────────────────────── Other things it does that I use daily: dotsync diff → shows exactly which keys changed vs remote (never shows values) dotsync history → full version history, who pushed what and when dotsync rollback → restore any previous version in one command dotsync run -- node server.js → injects secrets as env vars, nothing written to disk dotsync scan → scans your codebase for accidentally committed secrets ─────────────────────────────────── Free tier covers: • 1 project • 3 team members • 7 days history That handles most small teams completely free. ─────────────────────────────────── Now the part where I need your help: I'm looking for 100 engineers to actually stress test this. Not "give i