标签：#m

Your CI catches the npm vulnerability. Your developer is already three branches away and one standup behind. The package is installed, the lockfile regenerated, the import wired into a service, and the human who made that decision did it on a Tuesday afternoon with a tab open to Stack Overflow. Now the scanner is yelling. From the terminal, that is not security. That is grief counseling. That is the frame Sonu Kapoor lays out in a DevOps.com essay this week, and the engineering bones of it are correct. A scanner is not a gate. It is a status check. Kapoor's argument is about feedback loops. A developer installs, codes, commits, pushes. Only then does CI run. By the time the finding surfaces, the decision to add the package, and the context for why, has evaporated. So has the lockfile churn that caused it. What started as "is this package safe?" becomes "fix this in a different sprint." The scanner did its job. The fix is now a project. He backs it with a small case study from the NestJS repo: a scan of package-lock.json returned 1,626 resolved packages and 25 vulnerabilities. Of those, 12 were directly fixable. Thirteen were transitive, buried in upstream graphs, waiting on someone else's release. In a pipeline-first workflow, every dependency hop is a separate commit and a separate run. (Multiply by the number of services your team owns. Then by your runner-minutes budget. Send me the bill.) The arithmetic gets ugly quickly. A single lockfile with more than fifteen hundred resolved packages is not exotic for a working Node app, it is the default. The chance that the first time anyone looks at that graph is during a pipeline run, after the merge intent is already in the reviewer's queue, is the structural bug. Where the essay is right, and where it gets too tidy Concede the obvious. CI is not the problem. CI is fine. It runs uniformly, it cannot be skipped, and it is the right place to fail a build when an OSV record drops mid-week against a dependency that was clea

When Logs and Metrics Aren't Enough You have great dashboards. Your log aggregation is solid. But when a user reports "the checkout page is slow," you still spend 30 minutes jumping between services trying to find the bottleneck. That's the gap distributed tracing fills. What Tracing Actually Shows You A trace is a complete picture of a single request as it flows through your system: User Request → API Gateway → Auth Service → Product Service → DB → Cache → Response 5ms 12ms 45ms 120ms 3ms ^ This is your bottleneck Without tracing, you'd see: API Gateway: latency looks fine Auth Service: latency looks fine Product Service: latency is HIGH but why? With tracing, you see the exact DB query inside Product Service that's taking 120ms. Getting Started with OpenTelemetry OpenTelemetry is the standard. Here's a minimal setup: # Python example with Flask from opentelemetry import trace from opentelemetry.instrumentation.flask import FlaskInstrumentor from opentelemetry.instrumentation.requests import RequestsInstrumentor from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor from opentelemetry.sdk.trace import TracerProvider from opentelemetry.sdk.trace.export import BatchSpanProcessor from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter # Setup provider = TracerProvider () provider . add_span_processor ( BatchSpanProcessor ( OTLPSpanExporter ( endpoint = " http://otel-collector:4317 " )) ) trace . set_tracer_provider ( provider ) # Auto-instrument everything FlaskInstrumentor (). instrument_app ( app ) RequestsInstrumentor (). instrument () SQLAlchemyInstrumentor (). instrument ( engine = db . engine ) That's it. Three auto-instrumentations cover 80% of what you need. Custom Spans for the Other 20% Auto-instrumentation gives you HTTP calls and DB queries. Add custom spans for business logic: tracer = trace . get_tracer ( __name__ ) def process_order ( order ): with tracer . start_as_current_span ( " process_order " ) as sp

Labeled break/continue is now live across the entire Cx language stack. From the lexer to the JIT, two commits streamlined the implementation into a complete vertical slice. No parts left out, no corners cut—everything just works. The lexer seam If you're handling character literals and labels in the same codebase, you'll know what a pain this can be. We opted for a Rust-like syntax: 'ident for labels, with no closing quote. The label regex sits right after LiteralChar in the logos enum. Thanks to longest-match, 'x' becomes a char literal, while 'outer is parsed as a label. Escape sequences? They can't match labels because they have a backslash, making 'x' always look cleaner in code. A test fixture ( t_char_literal_guard ) ensures this order and regex integrity hold. Change the lexer rules, and it'll catch any mistakes immediately. Two-commit split We didn't cram this into a single mega-commit. No, we split it into two. Commit f94c6a5 laid down the frontend groundwork—adding the Label token, allowing loops and breaks to carry optional labels, and rejecting any misuse with semantic checks. The interpreter and JIT, however, initially took a back seat, guarding themselves against mislabeled jumps. Then came commit 0f56f1e , which wiped out these guards and enabled real execution on backends. Now all parses and semantic checks play nicely without rogue labeled breaks sneaking into the wrong loops. Interpreter changes The interpreter now handles BreakSignal and ContinueSignal carrying labels. Loops catch these signals when the label is either absent (defaulting to the innermost loop) or matches their own. The difference from before? Zero unlabelled break/continue behavior change while facilitating outward jumps. JIT changes The JIT saw more extensive adjustments, gaining a label field within LoopContext . Push and pop that context on a stack, trace it through lowering calls, and you've got labeled jumps pinpointed. The unlabeled jumps? They get the same treatment as bef

The latest update to hermes-memory-installer introduces a focused set of features that directly address production-level concerns: observability, storage management, security, fault tolerance, and performance introspection. If you maintain a message-processing pipeline or job queue, these are the components that often decide whether your system survives peak loads or security audits without manual heroics. Let's break down each addition and how you can integrate them into your workflow. System Metrics Exposing runtime health is no longer an afterthought. The new metrics module taps into the core processing loop and emits standard Prometheus-formatted data: message throughput (count and rate), latency percentiles, queue depths, and goroutine or thread pool utilization. This isn't a simple "up/down" gauge—you get histograms for processing duration and derived metrics like consumer lag. For example, if you run multiple worker instances, you can now directly compare their processing speeds via a Grafana dashboard. The endpoint is configurable, so you can keep it behind a reverse proxy or internal load balancer. Memory pressure triggers a separate gauge for heap usage per queue, which helps with capacity planning before it becomes a midnight incident. Auto-Archive Without auto-archive, old messages accumulate in memory or primary storage, driving up costs and slowing down scans. This feature moves processed or expired messages to a cheaper tier (S3, GCS, or local file system) based on age or queue size. The archive process is a background task that runs on a cron-like schedule; you can define how many messages to retain per queue before archiving kicks in. The compression is transparent—gzip by default, but you can switch to snappy or zstd. A key detail: archived messages retain their metadata and can be restored if needed, though the replay path skips them automatically unless explicitly requested. This is useful for audit trails or multi-region cold replicas. Token Rot

Dealing with vendor invoices usually means someone is sitting there manually opening PDFs and typing...

Aprenda a substituir o velho Cron por systemd timers para ganhar logs nativos, controle de dependências e maior robustez.

Like most developers, I have a set of tools I use every day. Most of them work great, and I don't...

Streaming ads might be getting a lot quieter.

Would you trust a sci-fi author to program critical AI systems for humanity? No? Yet, that's what we've been doing. Years ago, I remember hearing the argument: "Why don't we just prompt LLMs with Asimov's three laws of robotics ?" It sounds elegant. The laws were designed to constrain artificial minds. Why not use them? Because the model has already read every story where they fail. LLMs are statistical engines designed to autocomplete text. Imagine a story that starts like this: Once upon a time, there was a good little robot who followed the 3 laws of robotics to the letter. Now take human literature and complete the story. Does it end well? ‹ › (function() { var container = document.currentScript.closest('.ltag-slides--carousel'); var track = container.querySelector('.ltag-slides__track'); var slides = track.querySelectorAll('.ltag-slide'); var prevBtn = container.querySelector('.ltag-slides__nav--prev'); var nextBtn = container.querySelector('.ltag-slides__nav--next'); var dotsContainer = container.querySelector('.ltag-slides__dots'); var current = 0; var total = slides.length; for (var i = 0; i < total; i++) { var dot = document.createElement('button'); dot.className = 'ltag-slides__dot' + (i === 0 ? ' ltag-slides__dot--active' : ''); dot.setAttribute('aria-label', 'Go to slide ' + (i + 1)); dot.dataset.index = i; dot.addEventListener('click', function() { goTo(parseInt(this.dataset.index)); }); dotsContainer.appendChild(dot); } function goTo(index) { current = ((index % total) + total) % total; track.style.transform = 'translateX(-' + (current * 100) + '%)'; var dots = dotsContainer.querySelectorAll('.ltag-slides__dot'); for (var i = 0; i < dots.length; i++) { dots[i].classList.toggle('ltag-slides__dot--active', i === current); } } prevBtn.addEventListener('click', function() { goTo(current - 1); }); nextBtn.addEventListener('click', function() { goTo(current + 1); }); })(); It doesn't. Because the entire body of fiction built around those laws exists to explo

Your AI coding agent writes something that looks right. It compiles in your head. Then you notice it called user.getProfileById() — a method that doesn't exist anywhere in your codebase. You didn't ask it to make that up. It invented it confidently, in the middle of otherwise-fine code. And that's the worst kind of wrong: not obviously broken, just quietly incorrect in a way you have to catch. If you've run Claude Code, Cursor, or any agent on a real repo, you know this one. Here's why it happens — and why the obvious fix doesn't work. The fix everyone tries first (and why it fails) You reword the prompt. You add "Don't make up functions." It behaves… for one file. Then it does it again. So you add "Only use methods that exist in the provided code." Better for a bit. Then two more sentences — and now your prompt is fifteen rules long and it still invents a method the moment the task gets complex. Here's the part nobody tells you: rewording treats a structural problem as a vocabulary problem. A prompt isn't a contract the model reads once and obeys. It's something the model has to hold in working memory while it reasons about your actual task. A flat list of fifteen rules is unholdable. As the work gets harder, the model spends its attention on the code and quietly drops whichever rule wasn't front-of-mind. "Don't invent methods" is usually rule #11. Under load, it falls out. You can't out-word that. A sixteenth rule just gives it one more thing to drop. The actual cause: shape, not wording The agent invents a method because nothing in the prompt's structure requires it to check. You told it what not to do. You never changed what it actually does, step by step. So stop forbidding the bad thing. Remove the opportunity for it. Instead of a rule it has to remember, make grounding a required step it has to perform. Before — a pile of rules:You are an expert engineer. Write clean code. Follow our conventions. Don't make up functions. Only use methods that exist. Handle er

Last night I was deep in a build session with an AI assistant. We picked it back up tonight. At some point I mentioned it had been a day and a half since we last spoke — and the model had no idea. None. As far as it knew, it was still the previous session. The gap was invisible to it. That tiny moment is one of the most underrated problems in AI systems right now. So let's talk about it. The model doesn't know what time it is An LLM gets a rough sense of "now" at the start of a conversation — a single timestamp, handed to it once. That's why it can greet you with "good morning." But that stamp is frozen. It doesn't update as the conversation runs, and it definitely doesn't travel into the next conversation. Each session starts cold. On its own, that's a curiosity. It becomes a real problem the moment the model reasons over retrieved context — search results, documents, database rows, another agent's output. Staleness is invisible Here's the dangerous part. When a model reads a retrieved document, that document usually carries no trustworthy signal about when it was true . So the model treats it as present-tense. It produces a confident answer from six-month-old data with nothing flagging that the data is old. A few places this bites: Pricing — quoting a number that changed last quarter. Availability — "in stock" from a cached page. Compliance — citing a policy that was superseded. People — stating someone's job title from two years ago. For a human reader, a slightly stale search result is fine — you see the date and judge for yourself. For an LLM, the staleness is silent. The wrong answer looks exactly like a right one. Why "just add a clock" doesn't fix it The instinct is: give the model the current time. But knowing it's 9 PM doesn't help if the document you're citing went stale in 2023 and nothing told you. The missing piece isn't the model's clock — it's the context's freshness . Two different things: What time is it now? — easy, a now() call solves it. How old

Performance optimization has always been one of the hardest parts of web development. You run...

Most of the web's foundational moments have vanished. The servers were unplugged, the code was lost, the pages 404'd into history. But the first website ever published is a striking exception: you can still read it today, more or less as it appeared when it went live on August 6, 1991. It is a plain, text-only page with a white background and blue hyperlinks, and it explains a brand-new idea called the World Wide Web. One page that described itself The author was Tim Berners-Lee, a British computer scientist working at CERN, the particle physics laboratory near Geneva. By the end of 1990 he had quietly assembled the three technologies that still define the web: HTML for writing pages, HTTP for moving them between machines, and the URL for addressing any document on any server. The first website, hosted at the address info.cern.ch , was the web explaining itself - what hypertext was, how to browse it, and how to make your own pages. It ran on a NeXT computer, the sleek black workstation designed by Steve Jobs's company during his years away from Apple. That single machine was the entire World Wide Web for a while. A handwritten label was stuck to its case: "This machine is a server. DO NOT POWER IT DOWN!!" One unplugged cable would have taken the whole web offline. Why a 1991 web page still matters to IoT It is easy to file this under nostalgia, but the first website is more than a museum piece. It is the origin point of the request-and-response model that quietly powers almost everything connected today. When an ESP32 sensor node pushes a reading to a cloud dashboard, when a smart meter checks in with a server, or when you open an app to see whether your device is online, the same basic conversation is happening: a client asks a question over HTTP, a server answers, and a URL says where to look. Berners-Lee made a deliberate choice that turned out to matter enormously. He kept the standards open and unlicensed. Anyone could implement a browser or a server without pa

What happens when thousands of people decide they're hungry at the exact same time? The Quiet Before the Storm 10:00 PM. The numbers are gentle tonight. One hundred eighty-nine requests trickle in. Someone in Lagos is ordering late-night suya. A rider in Ibadan is wrapping up his last delivery. In Bangladesh, someone is just discovering us for the first time. By 11:00 PM , things get quiet. Just 8 requests. The platform takes a breath. 2:00 AM. A mystery. 151 requests spike out of nowhere. We check the logs. Nothing unusual. Just a group of night owls ordering food, maybe shift workers, maybe students pulling an all-nighter. The beauty of a platform is we're always on, always ready. 7:00 AM. Good morning, Nigeria. Fifty-five requests. People waking up, checking their wallets, planning their day. The coffee hasn't even brewed yet, but the platform is already humming. The Morning Rush 9:00 AM. 315 requests. The workday begins. Offices buzz with conversations about lunch plans. If someone searches "foodmat site" for the third time this week, they're getting closer to finding us. A corporate client logs in to set up their employee meal program for the first time. By 10:00 AM , the traffic settles to 50 requests. A calm before the real storm. 11:00 AM. 173 requests. The hunger is building. People are making decisions about what to eat, where to order, and which vendor to choose. Our World Cup campaign notifications ping. Someone shares their referral code. The viral loop begins. The Lunch Explosion 12:00 PM. 321 requests. It's happening. The platform comes alive. 1:00 PM. 339 requests. The peak is building. Our servers are handling it smoothly. This is where the magic happens when thousands of people decide they're hungry at the exact same time. 2:00 PM. 289 requests. Still going strong. Vendor dashboards refresh. Riders accept orders. Laundry bookings come in alongside food deliveries. If someone cancels an order with a reason, we take note. Every interaction teaches us

submitted by /u/Important-Addition79 [link] [留言]

submitted by /u/HHalo6 [link] [留言]

Suno has ambitions to be more than just a toy to churn out AI slop, it also wants to be a streaming destination and to break new artists. Spark is their new incubator program for independent artists that provides grants, mentorship, and marketing support. To apply, artists need to be an unsigned singer, songwriter, or […]

Most teams reach for Temporal when they need coordination guarantees.The tradeoff is rewriting your entire codebase to be deterministic and learning a new programming paradigm. Redis SETNX wasn't giving me correctness guarantees. You can make your own coordination primitive on postgres Like I did for my payments service Full writeup: https://statecraft.hashnode.dev/you-don-t-need-temporal-you-need-postgres Edit: i formatted poorly and the bracket became a part of the link it's fixed submitted by /u/munch_muffin_solas [link] [留言]

Why console.log() can be misleading in browser DevTools: live object references, promises that look different when expanded later, logs changing timing-sensitive behavior, stale React state after updates, and source maps pointing at surprising line numbers. submitted by /u/OtherwisePush6424 [link] [留言]

Clicking on the links now reveals blank pages and empty PDFs. "Intellectually, it’s not acceptable.”