标签：#p

Every developer has done it. You hit a README, you see the install command: curl -fsSL https://example.com/install.sh | sh And you run it. Maybe you skim the script first. Maybe you don't. But you run it. I've been doing this for years. And each time, a small voice in the back of my head says: you have no idea what that script actually does. You just piped a stranger's code straight into your shell. Eventually I got tired of ignoring that voice. What the pattern actually is curl | sh is not a bad pattern — it's a fast, convenient pattern with a real trust gap. The script runs with your permissions, in your shell, right now. It can: Install something with sudo Delete files with rm -rf Write to your disk with dd Access your SSH keys or .env files Set up a cron job or a systemd service that runs again next reboot Decode and run a payload with base64 | eval Most install scripts do none of these things maliciously. But many do several of them legitimately — and you wouldn't know which ones until something went wrong. --- ## What I built instead I'm a solo founder based in Ouagadougou, Burkina Faso. I build with heavy AI pairing — I'm not a trained engineer, I work with Claude, review the output, and ship. This tool ( peek ) was AI-paired and reviewed by me before release. peek is a ~130-line POSIX shell script that sits in front of the pattern: # Instead of: curl -fsSL https://example.com/install.sh | sh # Do: peek https://example.com/install.sh Before anything runs, peek: Fetches the script Scans it for risky patterns Prints a risk score and the exact dangerous lines Asks you to confirm — and refuses to auto-run a HIGH-RISK script unless you type RUN You can also pipe into it, or run it in analysis-only mode: curl -fsSL https://example.com/install.sh | peek # analyze from a pipe peek --print ./downloaded.sh # never runs, analysis only What it flags (and what it doesn't) The patterns peek checks: Root escalation — sudo , running as root Destructive file ops — rm -rf , fi

You've built a checkout reactor that reserves inventory, charges a card, generates a shipping label, and sends a confirmation email. It runs through Sidekiq. When something fails, compensation logic rolls it back. It works. Then your team asks: "How many checkouts failed this week? Which step? How long does the charge step take at p99? Can we see a trace through the entire system?" Before v0.5.0, you'd need to add logging calls to every step, build a custom Sidekiq middleware, and figure out how to correlate traces across async job boundaries. Now it's one line of config. Enter Middlewares Ruby Reactor 0.5.0 introduces a middleware pipeline — the same pattern that powers Rack, but designed for saga execution. A middleware is a plain Ruby object that hooks into the reactor lifecycle: class TimingMiddleware < RubyReactor :: Middleware def initialize ( ** options ) super @started = {} end def on_start_step ( step_name , _arguments , _context ) @started [ step_name ] = Process . clock_gettime ( Process :: CLOCK_MONOTONIC ) end def on_complete_step ( step_name , _result , _context ) started = @started . delete ( step_name ) return unless started elapsed = Process . clock_gettime ( Process :: CLOCK_MONOTONIC ) - started logger . info ( "step #{ step_name } took #{ elapsed . round ( 4 ) } s" ) end end This middleware times every step. Register it globally: RubyReactor . configure do | config | config . middlewares = [ TimingMiddleware ] end Now every reactor — every checkout, every refund, every data import — gets step-level timing, for free. The full lifecycle (20+ events) Middlewares can observe the complete execution lifecycle: Phase Events Reactor on_start_reactor , on_complete_reactor , on_failed_reactor Step on_start_step , on_complete_step , on_failed_step , on_retry_attempt Compensation on_start_compensation , on_complete_compensation , on_failed_compensation Undo on_start_undo , on_complete_undo , on_failed_undo Coordination on_lock_acquired , on_lock_failed , on_

Hey pessoal! 👋 Queria compartilhar um projeto que venho desenvolvendo para resolver um problema comum: encontrar uma biblioteca de ícones limpa, consistente e fácil de integrar, sem peso desnecessário no projeto. Apresento o coreIcons — uma coleção organizada de 352 ícones de desenvolvimento feita para workflows modernos. 📦 Por que o coreIcons? Leve e Rápido: Impacto mínimo no carregamento das suas aplicações. Organizado: Desenvolvido com uma grade (grid) e estilo totalmente consistentes. Focado no Dev: Feito para se encaixar perfeitamente nos seus projetos de frontend ou full-stack. 🚀 Como Usar É super simples! Basta acessar a nossa demonstração ao vivo, navegar pela coleção e clicar em qualquer ícone. O sistema vai fornecer instantaneamente a URL correta ou o snippet do ícone escolhido para você copiar e usar na hora. 🌟 Apoie o Projeto & Conecte-se! Se você achar essa biblioteca útil, por favor, considere deixar uma estrela ⭐️ no nosso repositório do GitHub ! Seu apoio ajuda o projeto a crescer e a alcançar mais desenvolvedores na comunidade. Também quero deixar um agradecimento enorme a todos que apoiam projetos open-source, contribuem com feedbacks e ajudam a construir um ecossistema melhor para todos nós. Vamos construir juntos! 🔗 Acesse o projeto Repositório no GitHub: https://github.com/mauriciospark/coreIcons Demonstração / Site: https://mauriciospark.github.io/coreIcons/ O que você achou? Deixe suas ideias, feedbacks ou sugestões nos comentários abaixo! 👇 Hey everyone! 👋 I wanted to share a project I've been working on to solve a common problem: finding a clean, consistent, and easy-to-integrate icon library without overhead. Meet coreIcons — an organized collection of 352 development icons built for modern workflows. 📦 Why coreIcons? Lightweight & Fast: Minimal footprint for your applications. Organized: Designed with a consistent grid and style. Developer-Centric: Built to fit smoothly into your frontend or full-stack projects. 🚀 How to Use It's extremely

WP Maintenance Manager ships from a single Python codebase to both Windows and macOS. "Python is cross-platform — write once, run anywhere," the saying goes. The reality is that the distribution pipeline is completely separate per OS , each with its own pitfalls. PyInstaller / Inno Setup / Apple Notarization / eSigner — the release cycle is a combination of OS-specific toolchains. Here's the full picture, plus what to watch out for at each step. (The choice of internal architecture, Flask + browser UI, is covered separately in why we built a desktop app on local Flask + browser UI ; this post is about distributing that architecture across two operating systems.) The per-OS pipeline at a glance Step Mac Windows Build PyInstaller ( --target-arch x86_64 ) PyInstaller Distribution format .app bundle → .dmg folder → .exe installer Installer creation hdiutil / create_dmg.sh Inno Setup ( .iss script) Code signing codesign + Developer ID certificate eSigner CSC (cloud signing) Pre-distribution validation Apple Notarization SmartScreen reputation buildup Final artifact WP_Maintenance_Pro_X.X.X.dmg WP_Maintenance_Pro_Setup_X.X.X.exe Both OSes share PyInstaller, but the path diverges from there. Mac sits inside Apple's review process; Windows runs through Microsoft's reputation system. They're fundamentally different ecosystems. Mac — PyInstaller → sign → Notarization → DMG The Intel / Apple Silicon trap The first trap in Mac PyInstaller builds is architecture . Running pip install + python build_app.py on an Apple Silicon Mac without thinking produces native binaries (like cffi ) for arm64 only — which then don't run on Intel Macs at all. The fix is to run the entire build through arch -x86_64 : arch -x86_64 pip3 install -r requirements.txt arch -x86_64 python3 build_app.py That produces an .app containing only x86_64 binaries, which runs natively on Intel Macs and through Rosetta 2 on Apple Silicon — a unified distribution. Sign inside-out The .app PyInstaller produces conta

This post is a TypeScript implementation of the pattern described in "Beyond the Agentic Loop: The Orchestrator Pattern for Multi-Agent Systems" by Amogh Ubale (Stackademic). The original is Python with generic agents; here we keep the idea intact and re-theme it as a shopping assistant so the three execution modes have something concrete to chew on. All the design credit goes to that article — go read it first. The cast: a handful of shopping agents Before the pattern, the scene. The demo is a small storefront assistant backed by a few single-purpose agents: Catalog — list the categories on offer, or search products by keyword and price. Inventory — check stock and availability for a product. Pricing — look up the current price and any active promotions. Reviews — fetch a product's rating and review highlights. Order — place an order for a product. A customer request might need just one of these, several of them at once, or a few in a strict order — and deciding which of those shapes a request calls for is exactly what the orchestrator is for. The problem: the LLM as a while loop The default way to build a multi-agent system is the agentic loop : you hand the model a bag of tools and let it drive. think → call a tool → observe the result → think again → call another tool → … The LLM is both the brain and the control flow. That's wonderfully flexible, and it's the right tool when the task is open-ended and you genuinely don't know the steps in advance. But in production it has three nasty properties: Unpredictable shape. Every "think" step is another LLM round-trip, so a three-agent task might take 3 calls or 9 — you don't know until it runs, and latency swings with it. (The article clocks a representative three-agent query at ~7 calls through the loop; the wall-clock and spend follow, but the unpredictability is the part that actually bites.) Non-determinism. The same question can take a different path each time, which makes behavior hard to reason about and hard t

Fable 5 came and went. And because it was taken away so quickly, developers wanted it back even more. Scarcity has a way of making things feel more valuable. Reviews during its short tenure described a model that was very capable and great at churning on long-running, ambiguous tasks. But it was too expensive. The model was also intelligent enough that, on large work and overhauls, it tended to overthink. Most likely because of its size. For iterative work like implementing a feature or change, Fable 5 was comparable head-to-head with GPT 5.5, except Fable 5 would run for 10x as long: a larger model, more overthinking, and more time. The other issue was fallback behavior. If you hit a case where the model needed to call the fallback Opus model, you would not necessarily know it happened, and you would be billed at the higher charge. Nonetheless, it was a noticeable change compared to existing models. It was good at churning on a specific, goal-oriented problem. For example, optimizing a slow path by repeatedly profiling, tracing call sites, tightening hot loops, and validating the regression budget. For architecture design, it was still not remarkable. So it was good at that goal-oriented push, but even within that you needed to run it in sessions, review its code, and steer or compact to get the results you wanted. It is a good model to use for planning, research, and review, which is where I had adopted it. I saw real benefits. However, when it came to orchestration or running workflows, I still believe GPT 5.5 is better and more cost-effective on both tokens and time. Personally, I care about token spend, but I care immensely more about my time. The bigger problem Fable 5 exposed Model capability aside, I still think we are missing a bigger problem, and Fable 5 put a magnifying lens on it because of the nature of its capabilities. AI adoption in organizations is still a challenge for many developers because there are not enough good examples of how power users of

We’ve all been there: it’s 2 AM, you’re deep in a "Refactoring Rabbit Hole," your coffee is cold, and your heart is racing. You feel productive, but is your body paying the price? As developers, we often ignore the physical signals of burnout until it's too late. In this tutorial, we are going to quantify the "Dev Grind." We'll build a Programmer Stress Warning Dashboard using the Oura Ring API to track Heart Rate Variability (HRV) and correlate it with your GitHub commit frequency . By the end of this guide, you'll have a real-time visualization of how that complex Kubernetes migration is actually affecting your nervous system. We will be utilizing HRV monitoring , biometric data visualization , and the Oura Ring API to create a predictive stress model for high-performance engineers. The Architecture 🏗️ The logic is simple: we fetch your physiological "readiness" and stress markers from Oura and overlay them with your activity from GitHub. If your commits are spiking while your HRV is tanking, it's time to step away from the keyboard. 🥑 graph TD A[Oura Cloud API] -->|HRV & Stress Levels| B(Next.js Backend) C[GitHub API] -->|Commit Frequency| B B -->|Data Aggregation| D{Correlation Engine} D -->|JSON Stream| E[D3.js Visualization] E -->|Alerts| F[Developer Dashboard] style F fill:#f96,stroke:#333,stroke-width:2px Prerequisites 🛠️ To follow this tutorial, you'll need: Oura Ring & a Personal Access Token (from the Oura Developer Portal ). Next.js (App Router) for our frontend and API routes. D3.js for crisp, reactive data visualizations. Vercel for instant deployment. Step 1: Fetching HRV Data from Oura API Heart Rate Variability (HRV) is the gold standard for measuring autonomic nervous system stress. A high HRV usually means you're recovered; a low HRV means you're under pressure. Here is a clean implementation of a Next.js API route to grab your daily stress metrics: // app/api/oura/route.ts import { NextResponse } from ' next/server ' ; export async function GET (

When I started coding, I made so many silly mistakes 😅 Today I’m sharing 3 small mistakes that every beginner developer makes: 1. Trying to write "Perfect Code" on Day 1 Bro, your code will be messy at the start. Just make it work first. Perfect comes later. 2. Watching tutorials but not coding yourself Watching videos is easy. But you only learn when you type the code on your own laptop. 3. Getting scared of errors Red error ≠ Failure. Error = Teacher. Copy it to Google, you’ll find the fix. What mistake did YOU make when you started? Tell me in the comments 👇

A few days ago I published a post about the three-layer auth model and the invoice incident that made...

Whether you’re at a festival, tennis match, or wedding, these hand fans and wearable cooling devices will make the heat way more bearable.

The Dell XPS 13 is now available, starting at $599.

OS runtime unifying GA4, PostHog, + Stripe into a local db Discussion | Link

Anthropic's popularity with business users is growing so well that the latest beef with the government might actually boost it, data from Ramp suggests.

NAACP lawsuit says xAI uses gas turbines without permits for Grok data center.

Partner tells Ars that HPE should be giving out more free VM Essentials licenses.

In the coming weeks, Apple will move anonymously generated emails addresses to a different domain.

Powerful computer built into lightweight see-through glasses Discussion | Link

The funny-sounding name offers new insights into galaxy formation.

Introduction Dans le cadre de mon apprentissage des pratiques DevOps modernes, j’ai conçu et implémenté un pipeline CI/CD (Continuous Integration / Continuous Deployment) capable de déployer automatiquement une application web frontend sur deux environnements de production distincts : Vercel et GitHub Pages . Cette mission constitue une application concrète des concepts fondamentaux du DevOps, notamment l’automatisation des processus, la réduction des interventions manuelles et la mise en place d’une chaîne de livraison logicielle fiable et reproductible. Tableau comparatif des plateformes Dans ce projet, le déploiement sur les deux plateformes n’est pas un doublon mais une démarche pédagogique et technique délibérée permettant de tester la flexibilité de l'orchestrateur. Voici comment elles se comparent : Critère GitHub Pages Vercel Hébergement Statique uniquement Statique + SSR + Serverless Domaine gratuit username.github.io projet.vercel.app CI/CD intégré Via GitHub Actions Natif + GitHub Actions Performance Bonne Excellente (Edge Network) Previews PR Non Oui (automatique) Gratuit Oui (illimité) Oui (avec limites) Cas d’usage Portfolios, docs Apps React/Next.js, SaaS ⚠️ Le problème du double déploiement : Laisser Vercel en mode automatique génère un conflit critique avec GitHub Actions. Pour éviter que deux builds s'exécutent en parallèle, j'ai désactivé le déploiement natif de Vercel en ajoutant un fichier vercel.json à la racine contenant "git": { "deploymentEnabled": false } . Le pipeline complet — deploy.yml Voici le code source du fichier de configuration de l'orchestrateur GitHub Actions ( .github/workflows/deploy.yml ). Ce script gère séquentiellement l'installation, le build et la publication vers nos deux cibles : name : CI/CD -- Deploy to Vercel & GitHub Pages # Declenchement : uniquement sur push vers main on : push : branches : - main jobs : build-and-deploy : runs-on : ubuntu-latest permissions : contents : write steps : # Etape 1 : Recuperer le code

There is a comparison that the artificial intelligence industry had kept out of the public conversation until now. Satya Nadella brought it up this Sunday in a post on X that garnered over a thousand responses in just a few hours. The metaphor he used is "industrial offshoring" . Just as the first wave of globalization hollowed out industrial economies, wiping out factory jobs and decades of competitive advantage with consequences we still feel today, artificial intelligence threatens to do the same to corporate knowledge. The Silent Drain of Expertise The mechanism Nadella describes is concrete. If an organization hands over its workflows, its domain knowledge, and the accumulated judgment of its teams to external AI models, those models absorb it. What was once a unique advantage, now could become a generic capability available to everyone. There are no layoffs or plant closures. The hollowing out happens silently, in every usage cycle, in every operation the model records and leverages. Where there was once exclusive know-how, there is now a standard resource. "You can outsource a task, or even a job. But you can never outsource the learning." Microsoft CEO Warns That AI Winners Could Hollow 'Entire Industries' - Business Insider AI models are hoovering up corporate knowledge, and that's leaving one big loser, says Satya Nadella. businessinsider.com The Invisible Asset / The Identity This warning is not directed at employees but at executives. The risk Nadella identifies is not the loss of an individual position, but the erosion of the organisation's collective intellectual property, its processes, and the judgment a team spends years building. To name this, he introduces a term that was not in the business management vocabulary until now: "Token Capital" . This represents the layer of agentic capability that a firm builds and owns when it connects its real workflows with the AI models it uses. It is not software or a database. It is a system that learns with eve