标签：#t

readm3 can edit now, and it speaks Reddit readm3 started as a markdown reader for the terminal. File browser on the left, rendered document on the right. Version 0.3.0 adds the obvious missing half: you can change the file you are looking at. Press e , type, press esc . The preview has already re-rendered by the time you get back to it, because both modes read the same buffer. There is no second preview to keep in sync, which is the part that usually goes wrong in editors with a live preview pane. ctrl+s saves. Quitting with unsaved work asks first. enter continues the list you are in, so the same bullet, the next number, or an unchecked box for a task, and pressing it on an empty item ends the list. There is no selection and no cut and paste. This is for fixing a typo and adding a paragraph. Your editor is still your editor. Two dependencies, not forty The old parser was a few hundred lines of hand-rolled regex, and it got reference links, nested lists and bare URLs wrong. Every fix was another regex. Parsing moved to marked. The reason it won was not features, it was weight: marked is CommonMark plus GFM with zero dependencies of its own . readm3 went from one dependency to two. markdown-it would have been seven. A remark and micromark pipeline is somewhere between twenty and forty packages, for a program whose whole point is that it starts instantly in a terminal. Only the parsing moved. The layout code that wraps text, draws code gutters and sizes tables is untouched, so readm3.com still renders through the exact same functions the terminal does. There is still no second renderer. The swap fixed reference links, nested and loose lists, bare URL autolinks and hard line breaks for free. The dialects actually disagree marked does not ship GitHub alerts, footnotes, :emoji: , or anything Reddit added. Those are tokenizer extensions in readm3 now, still with no new dependency. They are behind a --flavor switch rather than all on at once, because the dialects contradic

This is a submission for Weekend Challenge: Generosity Edition What I Built Every...

AI can write code now. That part is no longer surprising. You can describe a feature to Copilot, Claude Code, Cursor, Codex, or another coding agent and get a working implementation in minutes. Sometimes it is genuinely impressive. But there is a bigger question: Can you actually trust the code enough to ship it? According to the Stack Overflow 2025 Developer Survey, 84% of developers use or plan to use AI tools . At the same time, trust in AI-generated output is still limited. One of the biggest frustrations developers report is getting an answer that is almost right, but not quite . Source: https://survey.stackoverflow.co/2025/ai And that “almost right” part is exactly where developers still matter. AI may write more code. But humans still need to decide whether that code is correct, secure, maintainable, and actually worth merging. So here is a simple review workflow I think every developer should practice. 1. Start With the Requirement, Not the Diff Imagine you tell an AI agent: Add password reset support. A few minutes later, it generates the full feature. The code may compile. The UI may work. The tests may even pass. But before reading the implementation, ask: How long should reset tokens remain valid? Can the same token be used twice? What happens if the email does not exist? Should existing sessions be logged out? Are we exposing whether a user account exists? This matters because AI can build the wrong thing very cleanly. So before asking: Does this code work? Ask: Does this solve the correct problem? That one question can save a lot of time. 2. Check the Architecture Before the Syntax AI is usually good at writing a function. It is not always good at understanding where that function belongs inside your system. For example, an agent might create something like: components/ ├── PaymentForm.tsx ├── PaymentAPI.ts ├── StripeService.ts └── Database.ts Everything may technically work. But should database access really live beside your UI components? Probably no

Adapted from my original Japanese article , with AI-assisted translation and editing. My manager: “Test this device.” (Doesn't really know the product or the technology.) Me: “Sure.” (Also doesn't really know the product or the technology.) If you've worked in infrastructure, that may sound familiar. I'm Goda, a network engineer sharing things I learned while figuring out the job. SNMP comes up in a lot of network device testing. For a while, my idea of an SNMP test was simple: Run snmpwalk . Watch a pile of OIDs and values scroll past. Mark SNMP as working. A screen full of output is reassuring. It certainly looks like something is being monitored. Then I was asked to write a test plan for a device. I added an item along the lines of “Confirm that information can be retrieved using SNMP” and sent it for review. The feedback was: Which OIDs will you use for CPU and memory? The customer will probably ask. You should at least cover those. That was when it clicked: a successful walk and successful retrieval of the metrics we need are two different things. My other thought was, “Fine, you write the test plan, then.” But the feedback was fair. Getting something back is not the same as getting what you need. What did the successful walk actually prove? snmpwalk is useful. Net-SNMP's tool uses GETNEXT requests to walk through a subtree starting from a specified OID. Net-SNMP manual If it successfully returns values, you've established that you could read those values under those test conditions . That matters. It does not, by itself, establish that your CPU and memory monitoring requirements are satisfied, or that every required OID is available. I had been treating a successful command as a much broader result than it actually was. Break “SNMP testing” into specific checks Today, I'd separate at least these questions: Question What to check Can I communicate over SNMP? Whether the device responds to the intended request under the defined conditions Can I monitor CPU? The

A process supervisor can tell you that a process exists. It cannot, by itself, tell you that a Minecraft player can join. I work on ChunkCraft, a Minecraft hosting project. Here is a small state model that helps keep operational status separate from player-facing guidance. Separate three questions Is the process alive? The container or service manager owns this signal. Has the game finished starting? Startup logs or a game-level probe provide this evidence. Can this player join? Client version, edition, whitelist and network reachability still matter. A useful state model is stopped → starting → ready , with failure and unknown states represented explicitly. Avoid converting a failed probe into “stopped”: a timeout means the observation failed, not necessarily that the server died. Tie each state to a next action Observed state Useful guidance Starting Wait for world loading; show recent startup progress Ready Show the complete connection address and expected version Unreachable or unknown Show when the last successful observation happened and offer diagnostics Player rejected Read the actual join error; check version and whitelist The same principle applies to control buttons. A copy-address action is helpful when the address exists and startup has completed. Showing it as the only instruction during startup invites repeated failed joins. Do not confuse observation with proof Even a successful game-level probe does not prove every player can reach the server. Likewise, a positive player-count sample proves someone was connected at that sample time; it does not identify that person or establish uninterrupted availability. Store observation timestamps alongside values. When a collector fails, preserve historical observations but mark them stale. A freshly rendered dashboard is not evidence of fresh underlying data. A small review checklist Does every status describe an observation we actually have? Is an unknown state distinguishable from a confirmed failure? Does th

The first version of most AI features is not a system. It is one giant prompt doing too many jobs. It is supposed to understand the user, check account facts, retrieve policies, write a response, avoid legal risk, match the brand tone, and maybe decide whether to escalate. Then one edge case arrives — a refund request with a partially used subscription — and the prompt starts negotiating with itself. That is usually when teams say, “We need better prompting.” Often, the real problem is architectural. A single prompt becomes a god object. It holds competing responsibilities, hidden assumptions, and constraints that are hard to test. Multi-agent orchestration is not about creating a mystical swarm of autonomous bots. It is about doing the boring, Laravel-style thing: breaking a large problem into bounded services, coordinating them with typed contracts, and using queues, events, validation, logging, and failure policies to keep the system honest. Laravel is a good place to build this because it already gives you the pieces: service container, queues, batches, events, validation, HTTP client, rate limiting, caching, structured logging, and database persistence. The hard part is not calling a model. The hard part is coordinating specialists safely. TL;DR A giant prompt becomes fragile when it tries to be researcher, analyst, writer, reviewer, and policy engine at once. Model agents as bounded specialists with explicit inputs, outputs, tools, and permissions. Use a lightweight router to classify work, not to do the work. Coordinate through typed messages, not loose prompt fragments. Use Laravel’s container, queues, batches, validation, and logging to make orchestration operational. Give specialists permissioned tool adapters instead of implicit knowledge. Add budgets, timeouts, retries, and escalation paths from the beginning. Do not use multi-agent orchestration when one deterministic service or one simple prompt is enough. 📋 Table of Contents The Giant Prompt Is a God

Jakub Pachocki reflects on increasingly capable AI and the challenge of keeping it aligned. He calls for stronger safeguards and international coordination.

A library isn't code. A library is thirty or forty decisions somebody already made, correctly,...

The engineering team at software company Figma recently documented how they built AI agents to help their security team investigate alerts, search past incidents, check company systems, and even prepare code fixes. The agents learn from previous investigations, reducing repetitive work and helping engineers resolve complex alerts about 70% faster. By Renato Losio

We shipped a filter that threw away bad GPS readings. Months later somebody asked whether it was working, and I could not answer. The evidence was gone. That question changed how I build anything that rejects data. The obvious version, and why it rots Mileage tracking depends on trustworthy distance, and GPS lies constantly. So the first version of our cleanup did what everyone's first version does: if (! fix . isPlausible ( previous )) return // drop it, move on accumulateDistance ( fix ) Clean data comes out the other end. It feels responsible. It is also a trap, because that return destroys the only record that could ever tell you whether the rejection was correct. Six months in, someone asked the reasonable question: is the filter right? I could not say how many readings we had dropped, on which journeys, or whether any of them had been a genuine drive through a tunnel rather than a glitch. We had built a thing that made a judgement call thousands of times a day and kept no record of any of it. Persist, then classify The rebuild flipped the default. Rejection stopped being a return and became a label. Only two cases are still deleted, because they cannot physically be real: // impossible coordinates if ( fix . lat ! in - 90.0 .. 90.0 || fix . lng ! in - 180.0 .. 180.0 ) return null // impossible accuracy: too precise to be true, or useless if ( fix . accuracyM <= 0.1f || fix . accuracyM >= 250f ) return null That is the entire delete list. Everything else is persisted and sorted into named accumulators: originalDistanceM += displacement // every metre we ever saw when { fix . isMock -> mockDistanceM += displacement abnormal -> { abnormalDistanceM += displacement if ( isHardSpike ) spikeDistanceM += displacement } accuracyGated -> { /* recorded, deliberately not counted */ } else -> cleanedDistanceM += displacement } Five numbers instead of one. The UI shows cleaned . The rest live beside it. And the row itself keeps its provenance: accuracy, provider, bearing, a

If you're prepping for a Business Intelligence (BI) Engineer, Data Analyst, Data Engineer, or Data Scientist role at Amazon, you probably already know SQL matters. It's a core part of the hiring bar. But Amazon isn't just checking your syntax. They want to see if you can think in sets, write clean queries under pressure, and reason about data the way the business actually uses it. Here's exactly how to prepare based on what the interview actually rewards. What the Interview Really Tests Amazon's SQL rounds usually show up in one of two ways. It's either a technical screen using a shared coding tool, or a whiteboarding case-study during the main loop. Either way, the interviewer is watching for a few specific signals. For starters, correctness always beats speed. A working query is far better than a clever one that fails. Communication is also huge. Do you talk through your logic before you even touch the keyboard? You'll often get a vague ask, like finding the "best" customers. You are completely expected to define what "best" means out loud before you start writing Common Table Expressions (CTEs). And watch out for messy data. Nulls, duplicates, and mismatched grain are almost always baked into the problem on purpose. The Core Topics to Master Focus your prep time on a few specific areas. Actually, it turns out this is where almost all the interview questions live. Joins Inside and Out You need to know your INNER, LEFT, RIGHT, and FULL OUTER joins cold. Be ready to explain exactly why row counts change after each one. A classic Amazon-style question is finding customers who placed orders but never left a review. That's just a LEFT JOIN with a NULL check. The interviewers want to see you reach for it right away. Window Functions Functions like ROW_NUMBER() , RANK() , DENSE_RANK() , and LAG() or LEAD() show up constantly. You might see a common pattern—like finding the second-highest order value per customer, or calculating month-over-month growth. If you're shaky he

188 vulnerabilities. That's where we started. After the modernisation, the jjwt migration, the targeted remediations, and the documented suppressions, here's where we ended up: 6 open findings. All suppressed with documented reasons. 0 unaddressed. But "188 to 6" is a headline, not a measurement. This article is about what meaningful security posture measurement actually looks like — the metrics that tell a real story versus the ones that just make a dashboard look good. Why Raw Finding Count Is a Weak Metric The most common way teams measure SCA progress is finding count. Before: 188. After: 6. Improvement: 182 findings resolved. 97% reduction. That number is real but it's also misleading in isolation. Here's why. If I had suppressed all 188 findings without fixing anything, my finding count would also be 6. The dashboard would look identical. The actual security posture would be unchanged. Finding count measures activity, not outcomes. What you need to measure is: What risk was actually reduced — not just what got closed What risk remains and why — the documented residual risk How the remediation was achieved — fix vs. suppress breakdown What the exploit exposure looks like — before and after exploit maturity These four dimensions together tell a story that a single number can't. Metric 1: Risk Reduction by Severity The most important before/after comparison is severity distribution, not total count. Severity Before After Fixed After Suppressed Remaining Critical 10 10 0 0 High 99 93 6 0 Medium 59 29 23 0 (7 in 4.x backlog) Low 20 0 20 0 Total 188 132 49 0 unaddressed Every Critical finding was fixed — not suppressed, fixed. That's the number that matters most. No Critical vulnerability was accepted as residual risk. The 6 suppressed High findings are all in the "no known exploit" category with documented unreachability justifications. The 23 suppressed Medium findings are split between test-scope dependencies and unreachable code paths. What to say when presentin

When I started using Linux Mint , I spent quite a bit of time exploring small desktop customizations. One of the simple things I discovered was that Linux Mint Cinnamon lets you customize how the date and time are displayed on the taskbar. Instead of showing only something like: Sat Aug 22 07:10 PM you can change it to something that works better for you. For example: Sat, Aug 22 • 07:10 PM or: 22 Aug 2026 | 07:10 PM or even: Saturday, 22 August • 19:10 It is a small change, but it is a nice way to personalize your desktop. Where can I change it? On Linux Mint Cinnamon, right-click the clock/date area on the taskbar and open the calendar settings. You should find a Display section with an option called: Use a custom date format Enable it and you will see a field where you can enter your own date and time format. For example: % a % b % e | % I :% M % p The Cinnamon documentation provides a complete reference for these formatting codes. But what do these strange symbols mean? At first, the format looks a little confusing: % a % b % e | % I :% M % p Don't worry. Each % code simply represents a different part of the date or time. For example: Code Meaning Example %a Short weekday Sat %A Full weekday Saturday %b Short month Aug %B Full month August %d Day with leading zero 02 %e Day without leading zero 22 %m Month number 08 %Y Four-digit year 2026 %y Two-digit year 26 %H Hour, 24-hour format 19 %I Hour, 12-hour format 07 %M Minutes 10 %S Seconds 35 %p AM/PM PM %P am/pm pm %Z Timezone IST The complete Cinnamon reference also includes things such as week numbers, day of the year and fractional seconds. You don't need to remember all of them. Once you understand a few common codes, creating your own format becomes quite easy. My favorite date and time combinations Here are some combinations you can try directly in the Date format field. 1. Simple and clean % a % b % e % I :% M % p Result: Sat Aug 22 07:10 PM 2. More readable % a , % b % e • % I :% M % p Result: Sat, Aug 22

Knowing React Is Not the Same as Being a Frontend Engineer A huge number of self-taught developers can build a React component, wire up useState , and fetch data with useEffect . A much smaller number can build a frontend that stays fast as it grows, handles real error states gracefully, and doesn't quietly re-render half the page every time a user types a letter. That gap — between "I can use React" and "I can build a production frontend" — is where a lot of otherwise-promising candidates get stuck. It's not usually a knowledge problem about React's API. It's a gap in the surrounding skills: state architecture, performance, accessibility, and the unglamorous parts of frontend work that tutorials rarely cover in depth. This guide lays out a realistic path from "knows React" to genuinely job-ready frontend engineer, focused on the specific gaps that show up in real interviews and real codebases. This post originally appeared on the Ciphemic Academia blog . What "Frontend Engineer" Actually Requires Beyond React Basics The role is broader than component-building, and being explicit about what it covers helps target the right skills: State management at scale — not just useState in one component, but how state should flow through an application with many interconnecting pieces Performance — understanding re-renders, memoization, and why a frontend that works fine with test data can slow down badly with real data volume Accessibility and semantic HTML — building interfaces that actually work for everyone, not just visually API integration done properly — loading states, error states, race conditions, not just the happy-path fetch call Testing — component and integration tests that catch real regressions, not just tests that exist to say tests exist A typical React tutorial project touches the first item briefly and skips most of the rest. That's exactly why a portfolio built entirely from tutorial-style projects tends to fall short in real interviews. Step 1: Confirm Ja

Why I built this Every time I applied for an internship, I did the same tedious thing: read the job description, guess what interview questions might come up, and google "common interview questions for [role]" — hoping something would stick. I wanted something smarter. Something that actually looked at my resume and the specific job description, and told me exactly where I stood and what to prepare. That's how PrepAI was born — an AI-powered career assistant that analyzes your resume against a job description and generates a match score, a skill-gap breakdown, personalized interview questions, and a 7-day preparation roadmap. 🔗 Live: prep-ai-navy-nine.vercel.app 💻 Code: github.com/Lalitprajapat47 What it does Upload your resume + paste a job description PrepAI extracts skills, experience, and keywords from both It generates: An ATS-style match score A skill-gap analysis (what the job wants vs. what you have) Personalized interview questions based on the actual role A 7-day roadmap to close the gaps before the interview Tech stack Frontend: React.js Backend: Node.js + Express.js Database: MongoDB AI: Google Gemini API for resume/JD analysis and question generation Classic MERN, with Gemini doing the heavy lifting on the reasoning side. The interesting part: prompting Gemini reliably The hardest part wasn't calling the API — it was getting consistent, structured output back every time. Interview prep needs predictable JSON (question lists, scores, roadmaps), not freeform paragraphs that break your UI. What helped: Being explicit in the prompt about the exact JSON shape I wanted back Feeding in resume text and JD text as clearly labeled sections, not just mashed together Adding a fallback parse step on the backend in case Gemini added extra text around the JSON This taught me a lot about prompt engineering as an actual engineering discipline — not just "ask nicely," but treating the prompt like an API contract. What I learned How to design a backend that talks to an LL

I've been quietly building Antigravity Tools — a collection of 59 free, browser-based developer utilities — and today I'm sharing everything I built and learned. Why vanilla JS? No React, no build step. The main constraint I set for myself: zero dependencies, zero server, zero telemetry . When you paste your JWT token into jwt.io, it goes to their server. When you use an online regex tester, your test strings are logged. I built Antigravity Tools so every operation runs inside your browser, using native APIs. No Node.js backend No npm packages No webpack/vite/parcel No Google Analytics No cookies Everything runs on Web Crypto API , Canvas API , Web Audio API , and IndexedDB — all native to modern browsers. The 8 tool categories 🔐 Security & Auth Tools JWT Inspector — decode JWT header, payload, and check expiry locally RSA & ECC Key Generator — generate 2048-bit key pairs via SubtleCrypto Hash & Password Generator — SHA-256/SHA-512 via Web Crypto PII Masker — strip emails, credit cards, SSNs, IPs from text Universal Encoder/Decoder — Base64, URL, Hex, HTML entities, Unicode 🤖 AI & Prompting Tools AI Token Counter — estimate cost across GPT-4o, Claude 3.5, Gemini 2.0, DeepSeek R1 System Prompt Builder — structure agent instructions with XML tags and tool definitions AI Text Humanizer — rephrase robotic AI output into natural writing Prompt Cost Trimmer — compress prompts by 30–50% to reduce API costs ⚡ Dev & Code Tools JSON Workbench — beautify, validate, convert to TypeScript, Python, Go types cURL Converter — cURL → JS fetch, Python requests, Go, PHP Regex Tester — real-time match highlighting with capture group display Cron Builder — visual cron expression editor with plain-English output Git Command Helper — build undo/squash/cherry-pick commands visually Try it 👉 https://antigravitytools.app

Security Bolted on at the End Is Not DevSecOps The most common failure pattern in teams that claim to "do DevSecOps" looks like this: build the pipeline, ship the feature, and run a security scan right before release — treating security as a checkbox at the end of the process instead of something built into every stage of it. That's not DevSecOps. That's a security review with extra steps. Real DevSecOps means security is woven into the pipeline itself — scanning dependencies on every commit, catching misconfigurations before they're deployed, and treating a vulnerability the same way you'd treat a failing test: something that blocks the pipeline, not something reviewed manually after the fact. This guide is for people who already have some DevOps or backend foundation and want to understand what it actually takes to move into a DevSecOps-focused role — not just "add security" to an existing skillset, but understand the mindset shift that makes the discipline distinct. This post originally appeared on the Ciphemic Academia blog . What "DevSecOps" Actually Requires DevSecOps sits at the intersection of three skill areas, and a real role expects working competence across all three, not deep expertise in just one: DevOps fundamentals — CI/CD pipelines, infrastructure-as-code, containers, the same core skills a cloud/DevOps engineer needs Application security — understanding common vulnerability classes, how to find them, and how to actually fix them, not just recognize their names Security automation — the specific skill of embedding security checks into a pipeline so they run automatically, consistently, on every change That third point is what actually distinguishes DevSecOps from "a DevOps engineer who also cares about security." It's specifically about automation and process — making secure practices the default path, not an extra manual step someone has to remember to do. Step 1: Confirm Your DevOps Foundation Is Solid DevSecOps is not an entry point into DevOps —

TrueNAS CORE has been the standard for open-source storage using FreeBSD and OpenZFS. The shift to TrueNAS SCALE, based on Debian, left some users needing alternatives. FreeCORE upgrades TrueNAS CORE to FreeBSD 15.0, restoring essential features like FreeBSD Jails. While it satisfies certain administrators' needs, its long-term sustainability and maintenance by a single individual raise concerns. By Olimpiu Pop

Yash K Saini — Engineer, building in public — AI/ML, low-level (Rust/C/C++), and open source. GitHub...

If you do local SEO work, you've run into this: a client's Google Business Profile says one phone number, their website footer says another, and nobody noticed until a customer called the wrong number. Or the postal code on the GBP listing is a leftover from an old office. This kind of drift is called a NAP (Name, Address, Phone) inconsistency, and it's widely cited as a local search ranking factor. But checking it by hand means opening every listing and every website side by side. I built Google Maps NAP Consistency Checker , an Apify Actor that takes Google Maps scraper output, fetches each business's own website (lightly: homepage plus one likely subpage), and checks whether the name, postal code, and phone number on the Google Business Profile actually show up on the site. What it does, and what it doesn't This Actor checks one thing: does a business's own website agree with its Google Business Profile on name, postal code, and phone number. It does not check third-party directories (Yelp, Facebook, etc.). That's a different problem with a different competitor landscape. It does not crawl an entire website; it fetches at most two pages per business (homepage, plus a subpage if one with a keyword like "contact" or "about" is linked from it). It does not use an LLM. It's regex and string matching against fetched text, which makes it fast, cheap, and predictable. There's no model that can hallucinate a match that isn't there. Businesses with no independent website (only a social profile, or nothing) are skipped entirely, because there's nothing to fetch and compare against. How it works For each place with a real website, the Actor: Checks robots.txt for that domain before fetching anything, and skips the business if the checker's user agent isn't allowed. Fetches the homepage HTML (up to 3 MB), strips <script> , <style> , and comments before converting to text, so JavaScript variables and tracking IDs don't get misread as phone numbers. Looks for an internal link