标签：#p

Originally published at woitzik.dev A previous article here covered setting up gitleaks for homelab secret scanning - the setup, the pre-commit hook, getting CI to fail on new commits that contain secrets. The setup was correct. The tool was running. The CI was green. And it had been quietly suppressing a live production credential for months. This is the follow-on story: not about getting gitleaks running, but about the specific way a baseline file breaks the guarantees you think you have once it's in place. View the complete homelab infrastructure source on GitHub 🐙 What a Baseline File Does (and Is Supposed to Do) When gitleaks first runs on an existing repo, it finds every secret-shaped string in the full git history - including secrets that were introduced years ago, rotated long since, and are completely inert. Flagging those in CI creates noise that causes developers to tune out gitleaks entirely, which is worse than not having it. The baseline workflow is the standard answer: run gitleaks on the current state, export all findings to a JSON file, commit that file to the repo, and tell gitleaks to suppress any finding that already appears in the baseline. Future commits that introduce new secrets still fail; old known-inert findings don't. # Generate baseline from current HEAD gitleaks detect --report-format json --report-path .gitleaks-baseline.json # Tell gitleaks to use it gitleaks detect --baseline-path .gitleaks-baseline.json The assumption embedded in this workflow: findings that appear in the baseline are inert. They were there before the baseline was generated; they've been there; they're known. The Assumption That Broke It The baseline was generated at a point when the repo contained Garage's rpc_secret and admin_token committed in a YAML file. Those were real production values - the cluster was live, using those exact secrets - but the baseline suppression treated them as "known, reviewed, not a problem." The commit that introduced them had happened

Responsibly dispose of your food scraps with one of these indoor, (mostly) odor-free, WIRED-tested devices.

The European Union is weighing sweeping new restrictions on children's and teenagers' access to social media, including age limits, an outright ban, and phased access. Social media platforms could also be forced to prove their services are not harmful before young people are allowed to use them. European Commission President Ursula von der Leyen said […]

Most people assume better AI performance means a bigger bill. That assumption is quietly being proven wrong. The "Don't Touch It" Trap in AI Products There's a psychological pattern that shows up in almost every team running a live AI-powered product: once something works, nobody wants to mess with it. And honestly, that instinct makes sense. You've tuned your prompts, worked out the edge cases, trained your users, and finally gotten the thing stable. The idea of swapping out the underlying model - the engine of the whole operation - feels like pulling a thread that might unravel everything. So teams stay put. They watch new model releases come out, read the benchmark comparisons, and quietly decide it's not worth the risk. The phrase you hear most often is "if it ain't broke, don't fix it." The problem is that this logic made sense when model upgrades were expensive and disruptive. That's no longer the default reality. What's actually happening now is that AI providers are competing hard on price-per-token while simultaneously improving quality. That combination - better output, lower cost - breaks the old mental model most product people are still operating with. What a Model Migration Actually Involves Let's be clear: switching AI models isn't a one-click operation. But it's also not the months-long project many teams imagine it to be. At its core, a model migration for an AI agent involves three things: re-evaluating your prompts (because different models respond differently to the same instructions), running parallel tests to compare output quality on your real use cases, and updating any API parameters that differ between versions. That's the actual work. For most small-to-medium deployments, that's days of effort, not weeks. The bigger shift is in how you think about model versions. Rather than treating the model as permanent infrastructure, it helps to think of it more like a dependency in your software stack - something you update deliberately, test careful

We're surrounded by data every single day. Every online purchase, website visit, customer review, or...

Like Google Maps, Waze is going all-in on Gemini.

Waze is getting an AI makeover. Google is integrating its flagship AI assistant, Gemini, into the driving app with the goal of letting users personalize their trips a little more. Of the four new updates, only two are being described as involving Gemini. Waze says its updating its conversation reporting feature, first introduced in 2024, […]

Local-first AI video editor for Mac Discussion | Link

Hey everyone, We talk a lot about documenting clean architectures and robust APIs, but software engineering history is uniquely shaped by its failures. Documenting these bugs globally usually results in scattered StackOverflow threads or unindexed GitHub issues. I wanted to explore how to build a highly structured, community-driven database dedicated exclusively to tracking software bugs, their deep technical root causes, and multi-language solutions. Here is a technical breakdown of the architectural challenges, data modeling decisions, and security implementations behind building this engine. 1. The Data Modeling Challenge: Structuring the Unstructured Bugs are notoriously hard to normalize in a relational database. A classic logic bug looks nothing like a memory leak or a floating-point precision error. To solve this, we modeled the schema around a strict "Bug DNA" structure using PostgreSQL: Categorization & Multi-Runtime Target: Mapping a single bug to multiple language runtimes dynamically (e.g., how the 0.1 + 0.2 anomaly propagates across V8 JavaScript, CPython, and JVM identically due to hardware constraints). The Diagnostic Timeline: Instead of a generic description text, we structured a linear, time-stamped array to track state changes during the replication phase. 2. Deep Dive: Representing IEEE 754 at the Schema Level Our inaugural entry into the database was the infamous base-2 fractional conversion problem ($0.1 + 0.2 = 0.30000000000000004$). To make this data educational, the challenge was handling how the processor truncates infinite binary fractions: $$0.1_{10} = 0.0001100110011001100110011001100110011001100110011001101..._2$$ We decoupled the storage mechanism so that the raw precision error is stored as a literal string to prevent the database layer (PostgreSQL float types) from auto-correcting or rounding the very bug we are trying to document. 3. Edge Security: Row-Level Security (RLS) Without a Middleware Backend Since the application runs on a

The sidebar agent for the rest of us Discussion | Link

Jake Lazaroff discussed the AT Protocol as a framework for distributed applications beyond social networking. He emphasised a local-first architecture where users maintain data in PDSs while leveraging shared infrastructure for synchronisation and updates. The presentation included experiments showcasing collaborative tools and highlighted the benefits of reduced reliance on app-specific backends. By Olimpiu Pop

The AI-native Operating System for founders. Discussion | Link

submitted by /u/Rich_Investigator_23 [link] [留言]

Videos are one of the heaviest assets you can add to a web page. Loading videos too early can significantly impact your application's performance. The good news is that modern browsers are starting to support lazy loading for video elements , allowing you to defer loading until users are likely to watch them. However, there's one important thing to know: 👉 This feature is not yet part of the Baseline web platform , so browser support is still limited. At the time of writing, lazy loading for <video> elements is supported in Chromium-based browsers such as Google Chrome , Microsoft Edge , and Opera , while browsers like Firefox and Safari do not yet support it natively. In this article, we'll explore: What lazy loading videos is Why it's important for web performance How to implement it Browser support considerations Best practices for optimizing video loading Let's dive in. 🤔 What Is Lazy Loading for Videos? Lazy loading means delaying the loading of a resource until it's actually needed. Instead of downloading every video immediately during page load, the browser waits until the video is close to entering the viewport. This helps reduce: initial network requests bandwidth usage page load time memory consumption Especially on pages with multiple videos, the difference can be significant. 🟢 What Problem Does It Solve? Imagine an e-commerce page with several product videos. Without lazy loading: every video starts downloading immediately bandwidth is consumed even for videos users never watch page rendering may become slower This negatively impacts; Largest Contentful Paint (LCP), Time to Interactive (TTI), and overall user experience. Most visitors won't watch every video on the page. So why load them all? Lazy loading ensures videos are fetched only when they're actually needed. 🟢 How to Lazy Load a Video The easiest approach is using the loading="lazy" attribute. Example: <video controls loading= "lazy" poster= "/preview.jpg" > <source src= "/video.mp4" type= "vide

Multiple Tailscale tailnets at once, no switching + no VM Discussion | Link

How to not architect your software submitted by /u/yyyyuuuuyyyyyyyyyy [link] [留言]

Problem Statement For roughly a decade, vision-language models have been declared to be approaching or matching human performance on scene description (captioning). The evidence for that claim has almost always come from the same family of benchmarks—most famously MS-COCO. Those images are typically clean, well-lit, and depict either no people or people performing simple, isolated actions (sitting, walking, holding an object). They rarely require the model to parse multi-agent social dynamics, subtle intentions, or the kind of relational reasoning humans perform effortlessly when watching a movie scene or a street interaction. Because the evaluation data are easy, the reported numbers look excellent. Automatic metrics such as BLEU-4, CIDEr, or even embedding-based scores like BERTScore further inflate the impression of progress: they reward surface lexical overlap more than genuine semantic fidelity. At the same time, almost no work has systematically catalogued which visual-cognitive failures models still commit, or how those failure modes have changed as architectures moved from CNN+LSTM captioners to today’s multimodal large language models (MLLMs). The result is a field that can claim “human-level performance” while remaining largely blind to whether the models actually understand the scenes that matter most in real applications—scenes full of people interacting. The authors therefore set out to answer two concrete questions that the existing literature left open: (1) How much of the apparent progress is an artifact of easy data? (2) Which specific error types have been eliminated and which stubbornly remain? Core Idea The core insight is that progress looks dramatically different once you force models to describe complex social behavior and once you measure not only overall accuracy but a taxonomy of visual-cognitive errors. By constructing a new 100-image Complex Social Behavior (CSB) dataset drawn from movie frames that require reasoning about multi-person in

Try the demo: K-Saju Crew For fun only. K-Saju is an entertainment project. The K-Pop roles below are a playful interpretation of saju-inspired signals, not personality assessment or advice. A two-person compatibility page can stay stateless with almost no effort. Put both birth dates in a URL, render the result on the server, and the link is the record. No account, no database, no cleanup job. That was already a product rule in K-Saju. We do not retain personal inputs. A result is reproducible from its GET parameters. Then we built /crew : “What if your friend group debuted as a K-Pop group?” A creator makes a link, sends it to a group chat, and each friend enters their own birth date. At three to seven members, the app assigns distinct positions, shows pairwise chemistry, and creates a shareable poster. The fun part is the casting. The engineering problem is that the social flow needs a temporary shared state. A link cannot accumulate submissions by itself. This post is about the decisions behind that feature: where we allowed state, how we made the result durable without retaining a lobby forever, and how we kept the casting explainable instead of treating it as a black-box score. The conflict: a self-service group flow needs somewhere to collect data There were two clean but incomplete options. The first was to keep everything stateless. The creator would enter all members' dates at once, then receive a result URL. It matched our existing architecture, but it defeated the point of sharing a link. The person who starts the group often does not know everyone else's date, and asking them to collect it in a chat creates friction before the feature has started. The second was a conventional persistent group object. It would make joining easy, but it would turn a deliberately stateless service into one that keeps user-provided dates indefinitely unless we built retention and deletion policies around it. We chose a hybrid instead: The lobby is temporary state. It store

For decades, software was designed around one assumption: A human would be the one using it. That...

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...