标签：#programming

pg_anon found 1 of the 8 personal-data columns in my PostgreSQL database. The one it caught was email , and only because "email" is spelled the same in Spanish and English. The other seven — nombre , apellido , telefono , direccion , fecha_nac , tarjeta_ult4 and rut — walked straight through, unmasked. pg_anon is the open TantorLabs tool that masks personal data in PostgreSQL: it scans the database, flags the sensitive columns, and dumps a masked copy. Like pg_dump , but covering the sensitive parts on the way out. Exactly what you want before handing a colleague a copy of production. So I fed it a Chilean database and watched it miss almost everything — no error, no warning. It finished successfully and handed me a dump with names and national IDs still in cleartext. What the scan actually does Two filters, in order. First it reads each column's name against a set of regexes ( ^email$ , ^phone$ , ^ssn$ …). To the columns left over, it opens the data and tries patterns on the value (an email's @ , a card's 16 digits). Whatever no filter catches passes through. The rules in the demo meta-dict it ships with are written for English schemas. Mine aren't. 1 of 8 Column Holds Stock rules email email ✅ nombre first name ❌ apellido surname ❌ telefono phone ❌ direccion address ❌ fecha_nac birth date ❌ tarjeta_ult4 card digits ❌ rut national ID ❌ email got caught by name (it's an English word) and confirmed by its @ . Everything else has a Spanish name no stock rule looks for. The rut is the clearest miss. A RUT looks like 7917183-2 : seven or eight digits, a dash, and a mod-11 check digit that can be the letter K . The only national-ID rule pg_anon ships with is ssn . It has no idea what a RUT is — and it won't know a cpf (Brazil), dni (Spain, Argentina), curp (Mexico), nif (Portugal) or aadhaar (India) either. If your schema isn't American, the defaults miss your most sensitive column. The fix: a few lines of Spanish You teach it. Column names in your language, plus a conte

A short essay on naming submitted by /u/foobear777 [link] [留言]

Level 300 Some time ago we created a blog showing the capabilities of AI DLC and SDD to create quick and efficient prototypes as a MVP, the results were amazing, however, we omitted something: DevSecOps best practices and CICD for the workload. The prototype was built with a serverless framework and modern cloud-native application patterns. However, moving from a working MVP to a production-ready solution requires stronger alignment with DevSecOps, CI/CD, and operational excellence. That transition leaves several important questions open: Security posture • What security vulnerabilities exist in the solution? • Is the platform ready to withstand common web attacks? Code quality and production readiness • What is the overall quality of the code? • Is this truly an example of an enterprise-ready solution? Cloud compliance and misconfiguration risk • Which cloud security compliance gaps still need to be addressed? • Are there misconfigurations that could create operational or security risk? The other side of this challenge is organizational readiness. Many companies are enabling development teams with assistants such as Kiro, Claude, Cursor, and similar tools. However, without a mature process to review, scan, govern, and manage code at scale, these tools can introduce high costs, expand security risks, and growing technical debt. For the Agentic AI era, DevSecOps maturity is no longer optional. A secure software development lifecycle, policy-driven development, and zero-trust principles must become core operating requirements rather than afterthoughts. Open loop – Starter point a classical DevSecOps CICD system Suppose that the company already has a continuous integration and delivery framework and tools for that kind of workload with classical tools, in terms of maturity level and L3 Defined and Managed here we have Security gates integrated in CI/CD; SAST/SCA/secrets/IaC; centralized findings; quality gates. The maturity model we use We measure against a five-level

submitted by /u/manny2206 [link] [留言]

Building StudySift Without Third-Party Dependencies Introduction What if a useful study tool could be built without installing a single third-party package? For the Zero Dependency Hackathon, I built StudySift , a command-line tool that converts lecture transcripts into structured, revision-friendly study notes. The idea is simple: give StudySift a transcript and automatically extract useful information such as keywords, definitions, examples, and important points. The interesting part was the constraint. The project had to run using Python's standard library only , with no third-party runtime dependencies. The Problem Lecture transcripts can be long and difficult to revise. Important definitions, examples, keywords, and important statements can be spread throughout the transcript. Students often have to manually read the entire transcript, identify important sentences, and create their own notes. I wanted to reduce this manual work. StudySift takes a text transcript as input and processes it into organized notes. The basic workflow is: Lecture Transcript ↓ StudySift ↓ ┌─────────────────┐ │ Definitions │ │ Important Points│ │ Examples │ │ Keywords │ └─────────────────┘ **What I Built** StudySift is a Python command-line tool. The user provides a transcript file: python src/main.py examples/lecture.txt StudySift processes the transcript through several stages: 1. Read the input file 2. Split the text into sentences 3. Extract words 4. Remove common words 5. Count word frequencies 6. Detect definitions 7. Detect examples 8. Identify important sentences 9. Score sentences 10. Sort sentences by importance 11. Generate structured notes The goal is not to pretend that a collection of simple rules is a complete natural-language understanding system. Instead, StudySift is a lightweight and transparent approach to turning transcripts into useful revision material. **The Zero-Dependency Challenge** The biggest constraint was that StudySift could not depend on third-party runt

A cryptography library had a bottleneck no test could see : encrypting half a megabyte took fifty seconds. Every test passed. They had been passing for months. The cause is a trap that keeps recurring: a correct, well-documented optimisation that fixes the constant and not the order — and whose comment, precisely because it is well written, convinces the reader the problem is already solved. What the code did Quipu renders encrypted data as a sequence of symbols. To do that it converts the whole message into a single huge integer and repeatedly divides it to extract digits, the same way you would convert a base-10 number to base 2 by hand. The code did not divide one digit at a time. It carried a sensible optimisation: divide by the largest power of the base that fits in a machine word, extracting nine digits per pass instead of one. The comment explaining it opened by saying that doing it one at a time would be quadratic , and then described the improvement. All true. And the result was still quadratic: extracting nine digits per pass divides the work by nine; it does not change how the work grows. That sentence — "doing it this way would be quadratic" — reads in the past tense, as if it described the previous state. It described the current one. The measurement, which is the only thing that says so Size Time Factor per doubling 64 KiB 0.79 s — 128 KiB 3.16 s ×4.0 256 KiB 12.6 s ×4.0 512 KiB 50.7 s ×4.0 Exactly four, three times running. That is textbook quadratic: every time the input doubles, the time quadruples. Extrapolating, ten megabytes would have cost about five and a half hours . And here is the point: a correctness test sees none of this . A slow algorithm produces exactly the same bytes as a fast one. The suite stayed green, and would have stayed green forever. The fix is two hundred years old Nothing had to be invented. Divide-and-conquer radix conversion is a classical algorithm: instead of peeling digits off one end, you split the number in half — div

The problem I was trying to solve Candidates send hundreds of applications. Companies receive thousands of resumes. Most candidates never hear back. Both sides exhausted. Most of the effort wasted. The insight that changed my thinking: senior engineers don't apply to jobs. They get headhunted. A recruiter finds them, reaches out, and they evaluate the opportunity on their terms. Why is that only available to senior people? It shouldn't be. What I built Wrkmark Jobs — a hiring platform where candidates never apply. Here's how it works: Candidates create one profile Algorithm scores them against active roles Companies see their top 15 ranked matches Companies reach out. Candidates choose to respond. No applications. No cover letters. No ghosting. How the matching algorithm works This is the part I want to talk about technically. The algorithm scores each candidate against each job across four dimensions: Skills — 40% of score Simple exact match (case-insensitive) with a synonym map for common variations: const SKILL_SYNONYMS : Record < string , string [] > = { ' ruby on rails ' : [ ' rails ' , ' ror ' , ' ruby-on-rails ' ], ' kubernetes ' : [ ' k8s ' , ' kube ' ], ' postgresql ' : [ ' postgres ' , ' pg ' , ' psql ' ], ' javascript ' : [ ' js ' , ' es6 ' , ' ecmascript ' ], // 60+ mappings } A candidate with "RoR" on their profile matches a job requiring "Ruby on Rails". Simple but surprisingly effective at this scale. Salary — 25% of score All salaries converted to USD for comparison using live exchange rates (Frankfurter API). The logic: job_max_usd >= candidate_min_usd → score 100 job_max_usd < candidate_min_usd → score 0 If a company offers $80-120K and a candidate expects $30-50K — that's a great match. The company can easily meet the candidate's expectation. Score: 100. The common mistake is calculating range overlap. Overlap fails in the overqualified-offer case. Experience — 20% of score Years of experience vs role requirement. Meeting or exceeding → full score

My thoughts on hate trends against software developers. submitted by /u/ParserXML [link] [留言]

submitted by /u/SunnyKatt [link] [留言]

submitted by /u/der_gopher [link] [留言]

I run seven agents over the same domain. They have never once sent each other a message. That was not the plan. The plan was the thing everybody builds first: a coordinator that hands work between specialists, agents that call each other, a shared conversation they all append to. It worked in the demo and it fell apart the moment the work got real. What replaced it is boring and it has held up: every agent writes claims to one shared record, and nothing else. No agent reads another agent's reasoning. No agent can call another agent. The record is the only channel. Here is why, and what it cost. What breaks in the group-chat design Three things, roughly in the order they hurt. Context grows without bound. If agents converse, every agent needs everyone else's output in its window to participate. Six specialists means each one is reading five other monologues. Your token spend goes quadratic in the number of agents and the marginal agent makes the others measurably worse. Errors laminate. Agent B reads agent A's output as input. If A was confidently wrong, B does not treat it as a claim to be weighed — it treats it as context, which is to say, as true. By the time it reaches F you have a well-reasoned conclusion resting on a hallucinated premise, and nothing in the transcript flags where the floor gave way. You cannot answer "why." Six weeks later someone asks why the system concluded X. The honest answer is "there was a conversation." That is not an answer you can act on, and it is not an answer that survives an auditor. Agents as authors, not as callers The reframe that fixed it: an agent is not a function other agents invoke. An agent is an author with a domain of authority . Each of mine owns a slice of the problem and may only make claims inside it: Agent Domain Claims it may make Verification What is true about the thing today Observed facts, source records, reconciled geometry Design What it should become Plan gaps, code compliance, takeoffs Recovery What can be

I've built enough animated portfolio sites and agency landing pages at this point that I can usually tell within the first three seconds of scrolling whether a site was built by someone who actually understands scroll animation, or someone who just copied a GSAP tutorial and called it a day. And honestly, for a long time, I was the second guy. I remember the first time I tried to recreate one of those Awwwards style hero sections, the ones where text fades and slides as you scroll and everything feels buttery and expensive. I copied the GSAP code almost exactly from a tutorial. Same triggers, same easing, same everything. On my laptop, using my trackpad, it looked incredible. I was proud of it. Then I opened it on my client's Windows machine with a regular mouse, and it looked like it was having a seizure. Stuttering, jumping, completely different animation than what I built. That was the moment I realized the problem was never really the animation. The problem was what the animation was reading from. That thing is scroll. And native browser scroll is honestly kind of a mess. Why native scroll ruins your animations Here's the part nobody explains properly when they show you a GSAP demo. When you scroll a normal webpage, the browser doesn't give you a smooth continuous stream of scroll position. It gives you scroll position in little discrete jumps. How big those jumps are depends on the device, the input method, the browser, even the operating system. A trackpad on a Mac behaves differently than a mouse wheel on Windows, which behaves differently again on a touchscreen. Now think about what ScrollTrigger is actually doing under the hood. It's constantly reading your scroll position and mapping it to animation progress. If the scroll position itself is jumpy and inconsistent, then no matter how well you write your animation code, the output is going to inherit that same jumpiness. You could have the most perfectly tuned easing curve in the world and it still won't ma

What started as "translate dialogs in a Korean game without alt-tabbing to Google Translate" became a rewrite of my screenshot toolchain. A few months later, one app: Capture area, window, or fullscreen Copy the text out of any screenshot, like it were a document Translate a foreign-language screenshot in place, offline Long pages stitch into one tall image Screen record with a camera bubble What I'm most happy with: zero network calls for reading and translating text. Screenshots carry API keys, client work, personal chats. Mine never left the Mac, and that felt like the right default for everyone's. Tech notes, happy to go deeper in comments: Pure Swift and SwiftUI, no Electron. About 25MB Apple's Vision framework for reading text. Genuinely scary good for how cheap it is One hotkey, everything else lives in menus Building in public. How you extract text from screenshots today would help me know what to chase next. Trial: https://ishot.buzz?utm_source=devto

submitted by /u/soap94 [link] [留言]

I haven't written an article in a while. But nothing gives you more inspiration to write than an opinion you really, really disagree with. In my case it was I'm done using AI article by Brett Codes. Over around 2000 words, the author explains his negative views on AI and why he decided to stop using it . I am really no AI evangelist. I am aware of its limits and its problems and the incompetent people causing more harm than good with it. But I also see the goodies, and I am pretty much convinced author's decision was driven less by rationality and more by the false pride. Let's swallow one bitter, but important pill - no one is paying you solely for being a good developer. You are being paid for delivering a value. And yes - being a good developer greatly contributes towards the ability of delivering apps that work and help businesses yielding the values. And by "work" I mean not only they look good at the first glance, but also being not (too much) buggy, secure and maintainable in the foreseeable future. Therefore, purely vibe-coded projects driven solely by non-IT people often (if not always) fail. Because their authors don't know what it takes and so they cannot prompt their agents to reason and care about it. We devs do. Some of us know more, some of us know less (yet). The "AI is going to replace all programmers" is a lunatic nonsense. But so is rejecting AI and sanctifying "good ol' hand work" . Does anyone seriously think we should reject modern programming languages and revert into writing in assembly or even better directly in binary code? Do you develop in plain text editor without syntax highlighting? Why are you using containers and not building new on-premise servers every time? Whaat? You use frameworks and 3rd party libraries? You don't implement everything from scratch in the vanilla language? Seriously? Why all those abstractions and shortcuts? They make you lazy and they obfuscate the true principles, aren't they? You are a worse developer if you

Managing files, running scripts, and executing terminal commands on your smartphone from a computer is much more convenient through a full SSH session, eliminating the need to switch between device screens. ​Installing OpenSSH Open Termux and install the package for the secure protocol: pkg update && pkg install openssh Configuration ​Set a password to secure the connection: passwd ​ Find your current username using the whoami command (usually looks like u0_a... ). ​Start the SSH server: sshd ​Connecting from a PC Find your smartphone's local IP address using ifconfig (look for the inet line under the wlan0 interface). Note that Termux uses a non-standard port 8022 by default instead of the standard 22. Connect from your computer (Linux, macOS, or Windows via PowerShell/PuTTY): ssh <username>@<smartphone_IP> -p 8022 After entering your password, you will gain full access to your phone's terminal directly from your PC. Autostarting the Server To avoid starting the server manually every time you open the app, add the command to your shell configuration: echo "sshd" >> ~/.bashrc This tool turns your mobile device into a fully functional remote node that is easy to manage over the local network when developing and testing lightweight projects. I share more simple and awesome smartphone IT projects on my Telegram channel: @termuxq

submitted by /u/davidalayachew [link] [留言]

TL;DR — I put an AI code reviewer on a pull request written by an AI coding agent. On the default setting it found nothing. On the strict setting it found a real vulnerability. And the patch it offered would have quietly broken every negative number in the exported file. I ship small browser tools written by Claude Code, and I am not a good enough reviewer to catch a security bug in code I did not write. That is the awkward kind of gap: the code looks fine, the page works, the tests pass. So I installed CodeRabbit on the repository and gave it something real to read: a CSV export for a pricing calculator. One row per material line, then other costs, total cost, selling price, profit, margin. About sixty lines of vanilla JS. My own checks passed first — a static site audit, plus a headless browser run of the tool, 14 of 14. Round 1: silence No actionable comments were generated in the recent review. That is the default. CodeRabbit ships a review profile called CHILL , tuned not to nag. For a team drowning in review comments that is probably right. For someone who cannot fully audit their own code, silence is the least useful answer available. So I committed a config file: # .coderabbit.yaml reviews : profile : assertive Same commit. Same diff. Same reviewer. Only the setting changed. Round 2: a real bug, checked the hard way The strict pass flagged CSV formula injection (CWE-1236) , and it was right. A spreadsheet treats a cell that begins with = , + , - or @ as a formula. Name a product =1+1 , export it, and the number two appears in the file the other person opens. Pick a nastier formula and it stops being a curiosity. My csvCell() escaped quotes and commas correctly and did nothing at all about this. What surprised me was how it checked. Folded into the comment was a shell command it had actually run against the repo — a ripgrep over every place a product name or unit flows into the exporter — to see whether something upstream already sanitised the value. It did n

Code: Megapixel99/lambda-language lm is a small low-level language I wrote: static types, explicit memory, no closures, no garbage collector, and four independent backends that emit C, WebAssembly, ARM64 and bytecode for a VM. Its compiler is about 4,400 lines of JavaScript. The obvious next question is whether the language can compile itself, and the obvious first step is the lexer, which is 129 lines. In lm the same lexer is 355 lines. That ratio is the finding, because almost none of it is lm being a verbose language. Six specific absences account for nearly all of it, and writing them down was a planned milestone rather than an afterthought: the point of porting the lexer first was to find out what the language could not do while the port was still small enough to abandon. The one that cost the most src/lexer.js has a single advance(n) that moves pos , line and col together, called from 14 places. lm had no way to take the address of a scalar local, so a function could not mutate a caller's variable, and a function returning three values would need a struct allocated on every call. So advance does not exist. All 14 sites write pos += 1; col += 1; inline, and the newline case writes the three-line variant. That is the single largest source of the size difference, and it also caused the only correctness bug in the port. Column counting inside a string literal has to skip UTF-8 continuation bytes, and because the logic is inlined rather than centralised there is no one place to fix it. The two comment scanners over-count a column in exactly the same way. They get away with it only because a comment always ends at a newline, which resets the column before anything reads it. That is worth sitting with. A centralised advance would have been fixed once and been right in all three places. Instead the code is right in one place by correction and in two others by luck, and the luck is load-bearing: change what terminates a comment and two latent bugs become live ones. Dup

Are you pushing your body to the limit or just driving it into the ground? In the world of high-performance athletics and biohacking, Heart Rate Variability (HRV) has become the "North Star" for recovery. But raw numbers from your Garmin or Oura Ring only tell half the story. To truly understand the relationship between sleep quality , exercise load , and stress perception , we need more than a dashboard—we need a predictive pipeline. In this tutorial, we will build a multi-dimensional analysis system using Scikit-learn , LSTM (Keras) , and the Terra API to predict overtraining risks. By the end of this guide, you'll know how to turn messy wearable data into actionable health insights. The Architecture: From Bio-Signals to Insights To handle the complexity of time-series data (HRV) and categorical features (activity types), we use a hybrid approach. We use Random Forest to identify which lifestyle factors impact recovery the most and LSTM to predict future HRV trends based on historical sequences. graph TD A[Garmin / Oura Ring / Apple Watch] -->|Webhook| B(Terra API) B --> C{Data Preprocessing} C -->|Feature Engineering| D[Random Forest Classifier] C -->|Sequence Processing| E[LSTM Neural Network] D -->|Feature Importance| F[Stress Analysis Engine] E -->|Trend Prediction| F F --> G[FastAPI Endpoint] G --> H[End User Dashboard] Prerequisites To follow along, you'll need: Terra API Keys : For unified access to wearable data (Garmin, Oura, etc.). Tech Stack : Python 3.9+, Scikit-learn, Keras/TensorFlow, and FastAPI. The Mindset : A passion for Health Tech and Wearable Data Science . Step 1: Ingesting Data with Terra API Standardizing data across different wearables is a nightmare. The Terra API acts as an abstraction layer, giving us a unified JSON structure for heart rate, sleep, and activity. import requests def get_wearable_data ( user_id , start_date ): # Using Terra API to fetch aggregated daily health data url = f " https://api.tryterra.co/v2/daily?user_id= { use