标签：#p

If you've ever cat -ed a Terraform or OpenTofu state file, you already know the uncomfortable truth: it's a plaintext JSON dump of everything your infrastructure knows, including secrets. Database passwords, generated private keys, API tokens injected through providers — they all land in state, in the clear. OpenTofu is the one place where you can fix this at the source, because native state and plan encryption is a first-class OpenTofu feature that upstream Terraform does not have. Here's how it actually works and how I roll it out on existing projects without breaking them. Why plaintext state is a real risk State is not a cache you can regenerate. It's the authoritative map between your HCL and the real resources, and OpenTofu has to store the values of attributes to compute diffs. That includes sensitive ones. Marking an output sensitive = true only hides it from the CLI output — it's still written verbatim to state. On real infra I've seen state end up in three places it shouldn't: an S3 bucket without SSE and with overly broad read IAM, a CI artifact that got uploaded to a build cache, and a developer laptop with terraform.tfstate committed to a feature branch by accident. Backend encryption (like S3 SSE) helps for one of those. It does nothing for the other two, because the moment state leaves the backend it's plaintext again. OpenTofu's encryption operates at the data layer, before the bytes ever hit the backend or a local file. The state is encrypted at rest everywhere: in the backend, in local copies, in CI artifacts. That's the property I want. Anatomy of the encryption block Encryption lives in a terraform { encryption { ... } } block. It has three moving parts: a key provider (where the encryption key comes from), a method (the actual cipher), and targets ( state and/or plan ) that bind a method to what you want encrypted. terraform { encryption { key_provider "pbkdf2" "passphrase" { passphrase = var . tofu_encryption_passphrase } method "aes_gcm" "defa

I had a website blocker, a Pomodoro timer, a tab suspender, and a time tracker installed at the same time — four separate extensions, four separate settings pages, none of them talking to each other. Starting a focus session meant manually turning on the blocker, then starting the timer, and neither knew the other existed. So I built TabInsights , which does all four and actually connects them. What it does Website blocker — block by domain, category, or schedule, with an optional typed "unblock challenge" for the days willpower isn't enough. Pomodoro focus timer — one click starts a 15/25/45-minute sprint, which also auto-blocks distracting categories for the duration and unblocks them automatically when it ends. This is the part that actually solves my original problem — the timer and the blocker are the same feature, not two extensions coincidentally running at once. Memory saver — auto-suspends tabs you haven't touched in a configurable window (15–60 min), freeing roughly 50MB of RAM each via chrome.tabs.discard() . Suspended tabs stay in your tab bar and reload exactly where you left off with one click. Automatic time tracking — logs time per domain with no manual start/stop, and shows a daily focus score. A few implementation notes Manifest V3 removed persistent background pages, which meant every "ongoing" feature — sprint timers, the daily summary, auto-suspend checks, license re-validation — had to be rebuilt on chrome.alarms instead of a long-lived timer. The gotcha: Chrome clamps alarm intervals to a minimum of 1 minute in packaged (published) extensions, so anything needing finer granularity has to accept that floor rather than fight it. The blocker uses declarativeNetRequest — you hand Chrome a set of match rules and it enforces them at the browser level. The extension never actually reads the blocked request; it can't, by design, which is also the honest answer any time someone asks whether a blocker "sees" their browsing. The bigger architectural deci

8 min read · telecom provisioning platform, 30M+ subscribers Most companies avoid migrating their monolith for one reason: they imagine it as a single, terrifying event — months of a feature freeze, a weekend cutover, and a rollback plan that's really just hope. That fear is reasonable. A big-bang rewrite of a live system serving 30M+ subscribers really would be terrifying. So we didn't do that. We used a pattern that lets you migrate a monolith one slice at a time, while the system keeps running and the product team keeps shipping features — the same pattern Martin Fowler named Strangler Fig , after the vine that grows around a host tree, gradually taking over, until eventually the original tree is no longer needed. Why the "just rewrite it" instinct is usually wrong The instinct to rewrite a legacy monolith from scratch is understandable — the old code is scary, undocumented, and nobody wants to touch it. But a full rewrite has a well-known failure pattern: it takes far longer than estimated, the business can't freeze feature development for that long, and by the time the rewrite is "done," the old system has changed underneath it and the rewrite is already out of date. The alternative isn't "don't migrate." It's: migrate in slices small enough that each one is boring , and never require the business to stop shipping while you do it. The pattern: a facade, and one slice at a time Strangler Fig works by putting a routing layer — a facade or API gateway — in front of the monolith. At first, 100% of traffic passes through to the old system untouched. Then, one capability at a time: Build the new version of that one capability as an independent service. Update the facade to route just that capability's traffic to the new service. Run both in parallel long enough to trust the new one (see "shadow traffic" below). Retire that piece of the old monolith. Repeat for the next capability. At every point in this process, the system is fully functional. There's no "half-migrat

На прошлой неделе DeepSeek отказался писать мне регулярку. Не «не смог», а вежливо объяснил, что регулярка тут плохая идея, и предложил цикл. Тогда я поймал себя на том, что уже год сравниваю модели «на глаз»: одна затупила — скопировал промпт в соседнюю вкладку, посмотрел, сделал выводы из ничего. Надоело. Я устроил маленький честный замер: три типовые задачи из моих рабочих будней, буквально один и тот же промпт, три модели. Про сетап — один абзац, чтобы дальше не отвлекаться. Хотелось убрать переменную «у одной вкладки отвалился VPN, у другой слетела сессия», поэтому гонял всё в одном окне через агрегатор; ссылка будет внизу, здесь она не важна. Важно одно: модель переключается прямо над полем ввода, так что все три участника получали идентичный текст без копипасты между сервисами. Участники: GPT (флагман, GPT-5-класс), Claude, DeepSeek. Задача 1. Регулярка: split CSV-строки, не ломая кавычки Промпт: «Напиши JS-регулярку, чтобы разбить строку CSV по запятым, но запятые внутри двойных кавычек разделителями не считать». Классическая ловушка: наивный split(',') рвёт поле "Иванов, Иван" пополам. GPT сразу выдал вариант с lookahead: const parts = row . split ( /, (?=(?:[^ " ] *" [^ " ] *" ) * [^ " ] *$ ) / ); Работает. Правда, на моём проверочном кейсе с экранированной кавычкой "" внутри поля — уже нет. Но я такого и не просил, засчитываю. Claude дал ту же регулярку, но с примечанием: lookahead на каждой запятой пробегает хвост строки, на длинных строках это квадратично, для продакшена берите csv-parse . Занудно, но по делу — я однажды именно такую конструкцию ловил на таймауте. DeepSeek — это тот самый отказ, с которого всё началось. Регулярку писать не стал, предложил цикл с флагом «мы внутри кавычек» — мол, так надёжнее. Формально это даже честнее, но задание было «напиши регулярку», и выдал он её только после уточнения. Итог раунда: GPT и Claude ровно, Claude на полбалла впереди за предупреждение. Задача 2. Рефакторинг: функция скидок с вложенными if Скормил всем

A team lead asks the question in a planning meeting and the room splits three ways: do we build this agent in Copilot Studio, write the orchestration ourselves and host it, or hand our container to Foundry and let it run our code? All three are official Microsoft build paths in 2026, all three end up in the same tenant-wide agent inventory, and the wrong pick costs you a rebuild once the project outgrows it. The answer is not "the most powerful one." It is the one whose service model matches who is building the agent, who owns the runtime, and how much pro-code control over orchestration and protocols you actually need. This article is the decision framework for that choice, grounded in Microsoft Learn and current as of mid-2026. Two of these three paths are public preview, so this is a guide to architectural fit and direction, not a production-reliability scorecard. TL;DR Three build paths, picked by service model, not power. Copilot Studio: low-code managed SaaS for makers. GA. Foundry Hosted agents: managed PaaS runtime for your own container. Public preview. Microsoft 365 Agents SDK: pro-code, self-hosted, widest channel reach. Agent Framework orchestrator in public preview. Monday move: before picking a platform, write down four things for this agent - who builds it (maker or pro-dev), who must own the compute, what channels it has to reach, and whether you need custom protocols or background/async behavior. Those four answers pick the path more reliably than a feature checklist. The three paths in one paragraph each Microsoft's own Cloud Adoption Framework frames the build options as three service tiers, which is the cleanest mental model to start from. The CAF positions them as Copilot Studio (SaaS, no/low-code), Microsoft Foundry (PaaS, pro-code or low-code), and GPUs and Containers (IaaS, code-first frameworks for maximum flexibility). The first two are managed by Microsoft. The third is where the self-hosted SDK path lives when you own the compute end to e

DISCLAIMER: This post was written entirely by me! I used AI for a little research, spelling, grammar, and comprehension checks. This post was originally shared on Hackernoon Entertain me for a moment, let's appreciate where we are today by understanding where we've been… or at least, where I've been. I remember when I first learned to code. I was bad, like really bad. But I was so curious! It all started by writing some VBA in an MS Access Database to create an IT Inventory app in the late 90s. Then I learned JavaScript, ASP (without the .Net), then C#, .Net ( I still have my .Net for Dummies book, see below) , jQuery, Python, Java, Angular, ReactJS, and Python again (yeah, had to relearn that one for some reason), and I'm sure there are others in there I forgot about. Learning to write code was rewarding! There were those days I'd spend hours on a bug, only to realize I didn't initialize the variable or forgot a semicolon. I learned .Net over a weekend thanks to the above book. I never became an artist of the craft, like some of my colleagues have (you know who you are: Josh, Kevin, and many others), but I knew how to build anything. I loved that ability: I could build anything. Pure joy! If you haven't had the joy of learning to code, do your best to learn it, because you can't prompt your way to being a Senior Engineer . As I progressed in my career, I became an architect and senior lead. I started off by leading a single engineering team, and now I support large programs and teams. All the while, I never let go of hands-on-code. I still love coding for work and my myriad of side projects. Then, a few years ago, this GenAI thing showed up. Put me in that group of: oh-no-there-goes-my-joy. Joy, yes, not my job. I love my job because I get to do what I love. I loved the dramatic rollercoasters: architecting a perfect solution, realizing it's wrong, getting to write every line of code, chasing impossible bugs, panicking with deadlines, late nights chasing hot fixes,

Adobe's Project Indigo can now remove all kinds of backgrounds from photos you snap using the app

Every time you run a JavaScript program, a lot happens behind the scenes. Variables are allocated memory, execution contexts are created, functions are pushed onto the call stack, and the engine starts executing your code. But before we dive into all of that, let's first understand what JavaScript actually is and why it was created. An Introduction to JavaScript What is JavaScript? JavaScript is a programming language that was originally created in 1995 by Brendan Eich in just 10 days while he was working at Netscape. JavaScript is a high-level programming language primarily used to make web pages interactive. Today, it is also used to build servers, mobile applications, desktop software, and much more. Why was JavaScript created? JavaScript was created to make web pages alive . But what does "alive" mean? it means adding interactivity (e.g., animations, clickable buttons, popup menus, etc.) to the static web pages. Today, JavaScript isn't limited to browsers. With runtimes like Node.js, it can also be used to build backend applications and APIs, which allow you to add more functionality to a website. Did you know? When JavaScript was created, it initially had another name: “LiveScript”. Where can JavaScript be used? In your browser — every interactive website uses it (Facebook, YouTube, Gmail). On servers — through Node.js, you can build backend APIs. In mobile apps — using frameworks like React Native. In desktop apps — VS Code itself is built using JavaScript (Electron). In smart devices, games, robots, and much more. Now that we know what JavaScript is, another question comes to mind: How does JavaScript execute my code? Before answering that, let's first understand Who executes my code? . The answer is: The JavaScript Engine The JavaScript Engine We already know what JavaScript is, but what exactly is this engine ? The "Engine" A JavaScript engine is a piece of software responsible for executing JavaScript code. Every environment that runs JavaScript, whether i

Regular Indexing works on a column level; it indexes the entire column value, but if you want to index each value in one row, then the GIN indexing technique is used. GIN can index each element of JSON stored in a JSONB field How Postgres creates a GIN file physically, what is the format of that file, how that file is retrieved in RAM while fetching records, what data types are used, and how Postgres calculates the exact address of an element of JSON are all explained in the article submitted by /u/Ok_Stomach6651 [link] [留言]

submitted by /u/BrewedDoritos [link] [留言]

Everything Claude Code: How One AI Assistant Becomes a Full Engineering Team Most developers use AI coding assistants in the same way. They open a repository and type: Build this feature. The assistant reads a few files, generates code, and reports that the task is finished. Sometimes the result is impressive. Sometimes it solves the wrong problem with perfectly formatted code. The issue is not always the intelligence of the model. The issue is the workflow around it. A single prompt often expects one AI assistant to behave like: a product planner a software architect a frontend developer a backend developer a security engineer a test engineer a debugger a code reviewer a release manager Real engineering teams do not work that way. They divide responsibility. One person plans. Another implements. Someone reviews security. Someone tests edge cases. Someone challenges the architecture. The final result improves because different people examine the same work from different angles. That is the idea behind Everything Claude Code , often shortened to ECC . ECC is an open-source collection of specialized AI agents, reusable skills, commands, security tooling, hooks, memory systems, and development workflows designed to turn Claude Code into something closer to an AI software engineering team. Instead of asking one general-purpose assistant to do everything in one pass, ECC separates software development into focused roles. That architectural idea is more important than any individual command. This article explains how ECC works, why developers are excited about it, how to install only what you need, and what security boundaries you should establish before giving any AI agent access to a real codebase. What Is Everything Claude Code? Everything Claude Code is not a new language model. It does not replace Claude. It is a workflow and configuration layer built around Claude Code. Think of Claude Code as one highly capable engineer. ECC attempts to turn that engineer into a co

Send big files and get paid on download Discussion | Link

Online retailer AliExpress says it's shocked by largest DSA fine yet.

Apple devices tend to be pretty durable, and the average lifespan of a new iPhone seems to be fairly consistent.

AI infrastructure company Infinity announced Monday a $15 million raise at a $100 million valuation from investors including Touring Capital, Principal VC, and researchers from companies such as OpenAI and Anthropic.

Today, I’m talking with Harvard professor and New Yorker staff writer Dr. Jill Lepore about her new book, The Rise and Fall of the Artificial State, which comes out on August 25. Jill is one of the best writers there is at identifying institutional patterns in history, and Decoder is a show about systems, so […]

There are a ton of deals available to shop today thanks to Best Buy’s “Black Friday in July” sale lasting all week. The sale typically aligns closely with Prime Day each year, but of course, Amazon’s shopping holiday happened much earlier than we expected. So it’s nice to have some deals in July. One of […]

A cloud workspace for coding agents from your phone Discussion | Link

Flock Safety sits right at the center of the debate over where the line should be drawn between privacy and public safety. That’s why we’re bringing Flock’s founder and CEO Garrett Langley to the stage to speak about those very issues.

submitted by /u/Usual-Amount-264 [link] [留言]