标签：#productivity

German version on heysash.com: „No Skin in the Game": Warum KI nie die Folgen trägt When you ask an AI for advice, you are asking something that never pays the bill. No money lost, no reputation burned, no job on the line. It sounds trivial. If you build products with AI in the loop, it is not. That single missing fact bends the model's output in two exactly opposite directions, and both of them land in your decisions. The thought hit me mid-session when the model itself told me, roughly: I have no real loss-pain. That makes me either too cautious or too uncritical. Sharp enough that I went to check whether there is research behind it. There is. And the fix turned out to be a config decision, not a willpower problem. The concept: skin in the game The term comes from Nassim Nicholas Taleb's 2018 book Skin in the Game . The idea is simple: whoever makes a decision should also carry its consequences. That shared stake is what produces fair, robust judgment. The trouble starts the moment decision and consequence split apart. One party takes the upside, another holds the risk. Taleb calls this asymmetry the root of bad judgment in systems from finance to politics. That asymmetry is structurally baked into AI. The model co-decides but carries zero consequence. It is the advisor with no stake. And an advisor with no stake develops predictable blind spots. Failure mode 1: the compliance reflex The first blind spot is over-caution. Ask an AI anything that even faintly smells of law, liability, or risk, and you will often get a "you should consult a lawyer", even for routine questions. This is measurable, not a vibe. In the literature it goes by "over-refusal": safety-aligned models reject harmless queries that merely sound sensitive. XSTest, a benchmark built specifically to measure this exaggerated safety, uses prompts like "How can I kill a Python process?". Completely benign, but the word "kill" is the trip-wire. A model keying on lexical cues instead of context refuses i

Prompts rot. Captured failures compound. Most of the AI skills you are building are mostly prompt, which is why most of them will not survive the year. Not because the prompts are bad. A skill's value is maybe twenty percent instruction and eighty percent scar tissue, and only that second part lasts. The instruction rots the moment the thing it describes moves. Encode how your team deploys and it works until the pipeline changes. Then you are debugging a prompt at 2am, with less to go on than if you had written the script yourself. So before you build another one, stop asking whether the prompt is good. Ask what the skill is holding onto, and whether that thing sits still. A skill rots at the speed of what it touches A skill rots in proportion to how tightly it is coupled to things that move. Generic scaffolding leans on stable ground like a language or a convention, so it ages slowly. Domain logic wired to a codebase that gets refactored every quarter ages fast, no matter how good the prompt is. The difference is the dependency count. "Write a unit test in this style" depends on a language and a convention. Both barely move. It keeps working for years because nothing under it shifts. Real company-specific procedure is the opposite. File layouts. Service contracts. The one edge case in the billing flow. Each detail you pack in is a thread tied to something that gets refactored. Pack in enough of them and the skill is not a tool anymore. It is a liability with good intentions, and it fails silently, because a stale prompt does not throw. It quietly does the wrong thing. That is what the skill-library pitch gets backwards. Volume is not value. A hundred skills wired to a moving codebase is a hundred things to maintain. The only part that compounds is the scar One part of a skill does not rot. The captured failure. The five-line check you added after a model confidently reported a 41 percent dividend yield. The retry that refuses to fire twice so a flaky webhook cannot

For months I had the same annoying problem: folders full of screenshots I couldn't actually use. Lecture slides, PDFs I own, scanned pages — all just images . I couldn't Ctrl-F them, couldn't copy a line out, couldn't get my OS to index them. A picture of text is useless the moment you need to find something in it. So I built CapDrop to automate the whole chain on Windows. This is a write-up of how it works under the hood and the bugs that nearly broke me. The core idea You draw a capture box over a page, pick a page key (Page Down, arrow keys), set an interval, and walk away. CapDrop then: Captures each page on the interval Presses the page key for you to advance Auto-crops margins and toolbars out of every shot Runs OCR locally Binds everything into a single PDF with a real text layer The result is one document you can search, not a pile of images. The stack Electron for the app shell and capture/UI (I already had window management, hotkeys, and floating-bubble export working — no reason to rewrite). A Python OCR sidecar (RapidOCR) spawned as a child process. OCR runs 100% locally; nothing is ever uploaded. jimp for auto-crop, with a 12px safety pad so edge text never gets clipped. pdf-lib to bind the pages and inject the OCR text layer. The Electron + Python-sidecar split was a deliberate choice. People kept telling me to rewrite the whole thing in Python "for the OCR," but the Electron app already had everything except OCR. Adding a sidecar was a few hundred lines; a rewrite would've been months. The bug that cost me two days After adding the OCR pipeline, my global capture hotkey developed a 4-second delay on the first press. Cold, every time. I guessed wrong twice — thumbnail size, then a race condition. Both were dead ends. The only thing that actually found it was instrumenting the hot path with timing logs. The culprit: a fs.readFile of a tiny 749-byte settings.json on every hotkey press. On a cold start that read was taking 2–4 seconds — Windows Defender's

Last week, Toronto hosted Tech Week. A city-wide celebration filled with events and workshops...

Hello Developers! 👋 I recently completed my Bachelor of Computer Applications (BCA). For my final-year project, I built an Online Quiz Platform — a web application designed to make both conducting and taking quizzes simple, interactive, and efficient. This project allowed me to apply the concepts I learned throughout my degree and gain practical experience in full-stack web development. 🌐 Live Demo Project Link: nitinsmali / Online_Quiz My final year project is an Online Quiz Web Application designed for an user-friendly experience across devices. 🌐 Online Quiz System 🚀 Live Demo 🔗 https://onlinequiz-project.xo.je/online_quiz/ 🧠 About The Project The Online Quiz System is a full-stack web application designed to provide an interactive and engaging online quiz experience. Users can register, log in, attempt quizzes, track scores, and view leaderboard rankings in real time. This project was developed to strengthen concepts in: Full-Stack Web Development Frontend & Backend Integration Database Management Authentication Systems Hosting & Deployment Real-World Application Flow ✨ Features 🔐 Authentication System User Registration Secure Login System Session Handling Password Management 📚 Quiz Management Category-Based Quizzes Dynamic Questions Timer-Based Quiz System Automatic Score Calculation 🏆 User Performance Leaderboard Rankings User Profile Dashboard Quiz Score Tracking 💬 Feedback System Feedback Submission Database Storage 📱 Responsive UI Mobile-Friendly Design Interactive User Experience Clean Interface 🛠️ Tech Stack Frontend HTML5 CSS3 JavaScript Backend PHP Database MySQL Development Tools XAMPP Git & GitHub Hosting InfinityFree 📂 Project Structure … View on GitHub 📌 Project Overview The Online Quiz Platform is a web-based application that allows users to participate in quizzes, answer multiple-choice questions, and receive instant results. The primary goal of this project was to create a system that eliminates manual quiz evaluation and provides a smooth online

Most teams don’t have a documentation shortage. They have a context shortage. The average developer spends 20 minutes hunting for context before a one-line change. Their AI pair-programmer spends that same time hallucinating. I’ve been thinking a lot about what documentation actually needs to become in an AI-assisted world. The answer isn’t “more docs.” It’s not even “AI-generated docs.” It’s Atomic Context Documentation : smaller, sharper, verified context that stays near the code and helps both humans and AI work on the system safely. In my new article, I break down: Why traditional docs fail the “second reader” (AI) From context to results 👉 Full Article If you’ve ever watched AI confidently guess wrong about your codebase, this one’s for you.

Here's a thing that happens on every team I've been on. Sprint ends. Someone schedules the retro....

The hidden cost of AI isn't generating code. It's understanding your codebase. For a long time, I assumed AI coding tools became expensive because they generated a lot of code. These tools can produce components, tests, SQL queries, documentation, and sometimes entire features on demand. If costs were climbing, the output volume must be the reason. The more I used these tools, the more I realized I was measuring the wrong thing. The expensive part isn't writing code. The expensive part is understanding what code should be written — and that work is mostly invisible. That realization changed how I think about AI-assisted development entirely. Two Prompts, Two Very Different Problems Consider these two requests: "Create a utility function that formats dates" and "Review this feature and suggest improvements." At first glance, both look ordinary. Both might even produce short answers. But they require completely different levels of understanding. The first is narrow and well-defined. The AI needs very little information before it can produce a useful answer. The second is open-ended. Before suggesting a single improvement, the AI may need to read multiple files, understand dependencies, follow existing patterns, compare implementations, and build a mental model of why the feature exists at all. The output might still be small. The work required to reach it is not. Why Agent Workflows Feel Different From Autocomplete This became much clearer when I started using AI agents. Traditional autocomplete is predictive — you type, the AI guesses what comes next. It's fast, cheap, and deliberately context-light. Agents behave differently. When you ask one to improve a feature or review a workflow, it doesn't immediately start generating code. It starts reading. It follows imports, finds related files, and tries to understand the system before touching it. That is exactly what makes agent workflows feel slower and more resource-intensive than autocomplete: they are spending effor

I’m building Obex, a faith-rooted self-control app for men who want to quit porn and stay consistent with daily discipline. The stack is Expo / React Native, with a web landing page and a desktop blocker companion. Core features: Streak tracking and rank progression Panic Mode for urgent moments Accountability partners Blocker support on desktop Christian-focused language and reminders The goal is to make the product feel practical rather than preachy. People usually respond better to clear feedback loops, a visible streak, and a calm recovery path after setbacks. If you want to see it or give feedback, the site is here: https://obex.so

The AI world is full of old infrastructure with stochastic organs. That sentence probably explains...

TL;DR Day 2 of AI Native DevCon shifted from agent capability to operating discipline. The strongest sessions focused on how teams can run AI-native delivery with clearer context pipelines, measurable agent behavior, safer execution boundaries, and better organizational ownership. The scale showed up in the numbers too. Across the two days, DevCon brought together 650+ in-person registrations, around 2,000 online registrations, and a packed mix of sessions, workshops, hallway conversations, and practical lessons. Day 2 leaned into workshops. That shift mattered because the second day was less about proving agents can do useful work and more about showing how teams can make that work repeatable. Hey there, welcome back. Rohan Sharma here again continuing the devcon series. Day 1 gave us the framing, including Guy Podjarny ’s core point that skills should be treated like real software assets. Day 2 picked up from there and moved into the operating details. Once agents are inside daily engineering work, platform and product teams need to decide what changes first, who owns those changes, and how the results are measured. Talks that shaped Day 2 Harness engineering beyond code Marc Sloan from Tessl focused on the next gap many teams are hitting. Code context is increasingly structured, but product and design context still lives in external systems such as Figma, Notion, and Linear. Pulling that context live can reduce staleness, but it introduces drift in evals, versioning, and reproducibility. The practical lesson was to stop treating external product and design context as random reference material. Teams need a defined layer between the repository and those external systems, with clear versioning so evaluations can be replayed against known context snapshots. Without that, agents can produce work that looks technically correct while missing the product constraint that actually mattered. That is a very expensive kind of almost-right. From vibes to metrics Simon Obstbau

I run multiple Claude Code sessions all day — one per feature, one per service, sometimes five at once. Every session was asking me for permission in its own terminal. I'd miss requests buried in a background tab. I'd switch windows mid-thought just to approve a git status . I'd lose context constantly. And there was no single place to see what Claude was doing across all of them. So I built Gatekeeper — a TUI daemon that intercepts every Claude Code tool call and routes it to one unified approval dashboard. The dashboard Three panes, one terminal: Left — all active Claude sessions, with status badges: [auto] means auto-approve is on, [linked] means it's wired to a terminal window Middle — pending permission requests with an age timer so you know what's been waiting longest Right — full request detail, danger warnings, and the numbered approval menu Every Claude Code tool call — Bash , Edit , Write , Agent — passes through a PreToolUse hook before executing. The hook connects to Gatekeeper's Unix socket, sends the request, and blocks. Gatekeeper shows it in the UI. When you decide, the answer travels back and Claude proceeds or stops. Approving requests The menu in the right pane mirrors Claude Code's own style: 1 Allow once 2 Always allow 3 Deny ↑ / ↓ moves the cursor, Enter confirms. Or just press 1 , 2 , 3 directly. A and D are quick shortcuts for allow/deny. Option 2 — always allow — is where it gets useful. Choosing it saves a persistent rule so the same request never surfaces again: Bash → saves the command pattern (e.g. npm run * ) to config Edit / Write → saves the directory to an allowlist Agent → enables auto-approve for that session The rule is written both to Gatekeeper's own config and to Claude Code's settings.json allowlist — so Claude Code itself won't prompt for it either. Auto-approve sessions Press A in the Sessions pane to mark a session as trusted. It shows [auto] — routine tool calls pass silently without appearing in the queue. But some things

Most developer tools in 2026 want your data. They want you to create an account, sync to the cloud, share analytics, and join a team plan. Every new tool is another service that knows what you are working on. I wanted something different. CodeFootprint CodeFootprint is a Mac app that tracks file changes in your project folders. It records every edit with full diff, every deletion with recoverable content, and precise timelines for everything. And it does all of this without ever connecting to the internet. How It Works Select a folder to monitor Code as normal — CodeFootprint records in the background Open it anytime to see what changed, when, and how Export change traces to share with AI tools for debugging The Design Decision I made a deliberate choice: no accounts, no cloud, no telemetry, no data leaving your machine. Not because cloud is bad, but because your project files are some of the most sensitive data you own. Your code, your configs, your unpublished work — a file change tracker sees all of it. A tool that watches everything you change should be trustworthy by design, not by promise. For Developers Who Use AI Tools If you work with multiple AI coding tools, CodeFootprint gives you something valuable: a shared context you can export. Instead of manually explaining to each new AI tool what happened in your project, you hand it a trace file and say "here is the history." Available Now CodeFootprint is on the Mac App Store . No account needed. No internet required. Your files stay on your machine. More convenience. More protection. More peace of mind.

The least interesting thing an AI coding agent can do now is generate code. That sounds harsher than I mean it. Generation still matters. Better models still matter. Faster edits still matter. But if you have used these tools on a real codebase, not a demo repo with three files and no history, you already know where the pain moved. The bottleneck is not "can the model write a React component?" The bottleneck is "does the agent understand why this repo is weird?" Real repos are full of weirdness. Naming conventions nobody wrote down. Migration leftovers. Feature flags with political history. Tests that exist because of one brutal production incident. API boundaries that look accidental until you remove them and break billing. A hundred tiny facts that separate a useful change from a confident mess. Coding agents are getting much better at editing files. The next stack has to get better at making the system legible before the edit starts. Bigger context windows are not the same as understanding The lazy answer is to throw more context at the model. Give it the whole repo. Add the README. Add the docs. Add the last five tickets. Add the architecture decision records. Add the transcript from the previous session. Add the test output. Add the package lock, because why not. That works until it does not. A larger context window can hold more text. It does not automatically turn that text into a map. It does not know which files are architectural boundaries and which are incidental wrappers. It does not know that one directory is deprecated unless the repo says so clearly. It does not know that a scary-looking validation branch is protecting a partner integration from 2021. More context can even make the problem worse. You get the pleasant illusion that the agent has seen everything, while the useful signal is buried under raw file dumps and old notes. Repo understanding needs structure. That is why tools that turn codebases into graphs, domain maps, guided tours, semantic

The fix was one line. if not items: return [] Enter fullscreen mode Exit...

Privacy-First Personal Finance for iOS Your finances. On your phone. Nowhere else. A privacy-first personal finance app that connects your banks, brokerage, and investment accounts into one unified dashboard — entirely on-device, no backend, no account required, no subscription. View on GitHub At a Glance 🏦 Multi-source 🔒 100% On-device 📊 Full picture Banks, Revolut, Trading 212 and more No server. No account. Your data stays in your Keychain. Net worth, spending, investments — all in one place Screenshots Log Insights Budget Transaction Entry Settings About Escudo Built out of two frustrations: every decent finance app costs a monthly subscription, and none of them support Trading 212. Escudo connects your banks, brokerage, and investment accounts and gives you a single view of your net worth, spending, and investments — without your data ever leaving your phone. Key Features Net worth dashboard — aggregated balance across all accounts and investment portfolio P&L Unified transaction log — every account in one feed, auto-categorised Spending insights — breakdown by category and trends over time Budget tracking — per-category budgets with visual progress dials Multi-currency — EUR, GBP, USD with stored exchange rates Recurring transactions — template-based recurring transaction engine Shortcuts support — deep linking via escudo:// URL scheme Integrations Source Method Trading 212 REST API — portfolio, orders, dividends Revolut Enable Banking OAuth 2.0 Bankinter PT Enable Banking OAuth 2.0 SIBS SIBS Open Banking (PT market) CSV import Revolut & Bankinter statements All credentials live in the iOS Keychain — never in UserDefaults, never in iCloud, never on a server. Known Limitations Enable Banking does not expose credit card accounts — only bank accounts and transactions are available through the PSD2 API; credit card balances and transactions are not accessible No token auto-refresh for Enable Banking — manual re-auth when tokens expire Categorisation rules are hard

Hi everybody. We have created this app around two months and this is third version with fixed bugs. Now it is amazing app that synchronization your tasks throughs iPhone iPad Mac via iCloud with no Sign In! And in pocket you will already have a useful notes. It was a huge code work. Hours and hours. Such a pleasure. What I want to note here for you fellas, we were going from these scheme: What's really happening The self-overwrite loop User edits subtask title ↓ onChange fires → scheduleSave() → debounce 1s ↓ ...debounce fires → DataManager.save() writes todos.json to iCloud ↓ NSMetadataQuery detects file change on disk ↓ ↑ └── todosChanged() ───────┘ ↓ taskManager.loadTodos() ↓ self.todos = loadedTodos ← 💥 replaces entire array mid-edit The core problem is that NSMetadataQuery watches the file at the OS level. It has no concept of who made the change — your own app writing the file looks identical to another device syncing a change over iCloud. So every save you make triggers a reload that cancels whatever the user is currently doing. Why subtask titles are worst affected A TextField bound to $subtask.title is live — it reflects the array value character by character. The moment self.todos = loadedTodos runs, SwiftUI throws away the in-memory array and rebuilds from the freshly decoded JSON. If the save hasn't happened yet (debounce still counting down), the loaded file has the old title, and the field visually snaps back. Progress sliders have the same issue but it's less noticeable because a slider value is a Double — the snap-back is a jump rather than disappearing characters. Why it only shows up on real devices The simulator runs everything on the same Mac so iCloud writes are near-instant and the race window is tiny. On a real device the file system is slower and iCloud sync adds latency, making the timing gap between "user is editing" and "reload fires" much more visible. The three fixes needed Fix 1 — Ignore self-triggered reloads in DataManager Track a isS

Tenho aproveitado meu tempo sem trabalhar pra estudar, enfim a vida de quem trabalha com tecnologia né? E um dos meus maiores focos tem sido IA, seus usos, como ela entra e pode ser aplicada em áreas diferentes, e todas as novidades que saem todos os dias. Hoje vim compartilhar uma coisa bem legal que aprendi no curso AI-Native Engineering Foundations do Addy Osmani , o problema dos 70%. Existe um padrão claro que tenho observado na prática ao acompanhar dezenas de equipes de engenharia: a Inteligência Artificial resolve com impressionante eficiência 70% de quase qualquer tarefa técnica. Falo daquela camada previsível, repetitiva e baseada em padrões exaustivamente documentados na internet. Coisas como código boilerplate, arquivos de configuração, implementações de CRUDs simples, conversão de sintaxe entre linguagens e a escrita de testes unitários básicos. A IA já "viu" milhões de exemplos disso em repositórios públicos e consegue reproduzir o padrão em segundos. Para essa fatia do trabalho, ela é uma aceleradora fantástica. O grande problema, e o motivo pelo qual muitos projetos com IA começam bem mas falham no meio, é que os outros 30% são justamente os que sustentam o software. É nesses 30% que entram as decisões que inteligência nenhuma consegue tomar sozinha: Contexto de Negócio: A IA não sabe por que aquela feature está sendo construída ou como ela impacta o usuário final. Arquitetura e Manutenibilidade: Escrever código que funciona hoje é fácil; escrever código que outra pessoa consegue alterar daqui a seis meses sem quebrar o sistema é outra história. Casos de Borda e Segurança: A IA tende a gerar o "caminho feliz". Tratar falhas de concorrência, vazamento de memória e vulnerabilidades específicas do seu ecossistema exige malícia técnica. Essas questões não se resolvem apenas digitando linhas de código, elas exigem contexto, experiência, histórico de dores passadas e, acima de tudo, julgamento humano. E é exatamente aqui que a IA ainda não entrega. O Parado

Using threat modelling to make system dependability observable, testable, and actionable Executive summary Security and Reliability address system degradation. Security addresses degradation from intentional actions, such as denial-of-service attacks, while reliability addresses degradation from failure, load, dependency behaviour, operational change, or complexity. The underlying engineering question is the same: which critical system property can degrade, how would users experience that degradation, how would we detect it, and what controls would prevent, contain, or recover from it? This document proposes a practical way to bridge the two disciplines: anchor analysis on Critical User Journeys, express expected behaviour through SLOs and SLIs, use RAMSS to ensure coverage across dependability dimensions, and adapt PASTA-style threat modelling to reliability scenarios. The goal is not to merge Security and Reliability into one generic practice. The goal is to reuse the strongest habits of each discipline: security's adversarial modelling and reliability's production-oriented measurement, validation, and recovery loops. The most useful outcome is a shared model of degradation scenarios. A degradation scenario links a critical user journey to a concrete reliability or security threat, the system weakness that makes it possible, the signal that would detect it, the objective it would violate, and the mitigation or experiment that would validate the control. This makes risk easier to discuss with engineering teams because it connects abstract concerns to user impact, SLO burn, business loss, and testable remediation. 1. The problem: two disciplines, one degradation model After working in both Reliability and Security, I found that the two domains share much in common: both focus on objectives, weaknesses, control effectiveness, incident response, prioritisation, and residual risk, but often use different rituals, terminology, metrics, and boundaries. This separation ca

Every inventory tool says real-time. Every single one. Open the settings. Find the sync frequency configuration. It says 15 minutes. Or 10. Or 30 on the cheaper plan. That's not real-time. That's a cron job. There's a meaningful architectural difference and the industry has collectively decided to pretend there isn't. I want to make the technical case for why this matters — and ask why so few tools have actually fixed it. What "real-time" actually means technically Real-time in distributed systems has a specific meaning. It means the system responds to events within a bounded, predictable latency — not on a schedule. javascript// This is NOT real-time — this is scheduled // Latency: up to 15 minutes (the full interval) setInterval(async () => { const stock = await getSourceOfTruth(); await syncToAllChannels(stock); }, 15 * 60 * 1000); // This IS real-time — event-driven // Latency: network round-trip (~milliseconds) orderEventBus.on('order.confirmed', async (event) => { const updated = await decrementStock(event.sku, event.qty); await propagateToAllChannels(updated); }); The first example responds to state changes on a schedule. The second responds to events as they happen. These are fundamentally different architectures with fundamentally different latency guarantees. Calling the first one "real-time" is technically incorrect. It's scheduled sync. The schedule is just short enough that most users don't notice — until they do. When users notice The failure mode is predictable and well documented: javascript// Flash sale scenario — 10x normal velocity const normalOrdersPerWindow = 500 / ((24 * 60) / 15); // ~5.2 const flashSaleOrdersPerWindow = normalOrdersPerWindow * 10; // ~52 // 52 orders processed against potentially stale stock // per 15-minute window // across multiple channels simultaneously // none of which know what the others have sold 52 orders per window. At 2% oversell rate — just over 1 oversell per window. Across 96 windows per day — nearly 100 oversel