标签：#war

The standard objection to writing the design down is that it is what you give up in exchange for speed. Early-stage companies are meant to be the place where you skip it: no specifications, no plans, just build the thing and find out. Documentation is treated as a tax that mature organisations can afford and small ones cannot. I have worked the other way round, and I want to make the argument properly rather than just assert it. At Cendra , across a twelve-month tenure as one of two founding engineers, the work produced 255 design specifications, 207 implementation plans and 17 production runbooks. Over the same period: 377 production releases coordinated across four repositories, and 482 merge commits across those repositories (an all-merges count, broader than the frontend-only first-parent integration figure on the Cendra page), across 239 active development days. That release figure works out at roughly one every twenty-two hours. All of those figures are tenure-scoped, and self-measured against private repositories while I held authorised access to them, which is a caveat I will come back to. But the shape is the point: the documents and the shipping happened together, at the same time, by the same person. What I am not claiming I cannot prove the specifications caused the cadence. There is no control group. It is entirely possible to imagine a version of that year with no documents and more releases, and I have no way to rule it out. What I can do is describe precisely what the artefacts removed from the critical path, and let you judge whether that is worth the hours. The mechanism matters more than the correlation, because the mechanism is the part that transfers to your codebase rather than mine. The specification is a comprehension test I administer to myself The honest reason I write a design down before building it is not communication. It is that writing it is how I find out whether I actually understand the problem. There is a specific and reliable exp

Broadcom admits it put “too big a focus on VCF.”

U.S. CD revenue jumped 58.6% in the first half of 2026, reversing last year’s decline as interest in retro tech and physical media continues to grow.

AI engineering sounds fancy. New terms are everywhere: agentic development, AI-native engineering, spec-driven development, and now AI harness engineering. Underneath all the terminology, though, something genuinely useful is happening. AI can now help with requirements, challenge a PRD, explore UX ideas, reason about architecture, create implementation plans, write code and validate the result. The obvious question is what AI can do. The more interesting question is whether the way we build software is ready for it. The workflow is changing A workflow we've been exploring breaks development into five stages: requirements, refinement, planning, build and validation . The stages themselves aren't new, but AI can now participate in each one. It can take existing product inputs, help clarify the problem, question assumptions, identify gaps in a PRD and then turn a well-defined requirement into a plan and eventually implementation tasks. This puts more emphasis on the quality of the requirements. A human involved in a project might understand what “improve the experience” means because they've had several conversations about it. An agent doesn't have that shared history. It needs the problem, scope, constraints, edge cases and expected outcome to be explicit. That doesn't mean writing enormous specifications; it means using AI to help make the requirements precise before we start building. AI can actually be a useful, slightly annoying reviewer here, asking what happens when something fails, whether a requirement is testable, whether two parts of the document contradict each other and what we haven't considered yet. It can also help compare different versions of a PRD or have one model review another's output, making gaps easier to spot. The important part is that AI is helping us uncover ambiguity, not making the decisions for us. Maybe coding isn't the bottleneck This becomes more interesting when we look at where teams actually spend their time. Complex work can invo

I built the pipeline that publishes this site's content in versioned code instead of n8n. Not a philosophical stance against no-code tools, a practical call, and one specific bug is why I still think it was the right one. Why code, not a canvas Four reasons drove it, in order of how much they actually mattered: Review parity. Every change to how a post gets approved or published goes through the same PR review as the rest of the site. A workflow-canvas change doesn't get that by default. Headless operation. Claude Code drives the queue directly, no GUI dashboard sitting between the agent and the task. Existing infrastructure. A Telegram bot already handled approvals; there was no gap a workflow tool needed to fill. One fewer service. Every extra tool in the stack is something else to patch and keep secure. Skipping it was the cheap option, not just the principled one. The bug that proved it On July 20, 2026, a scheduled post silently failed. The Buffer API adapter treated an error response as a normal one, never checked the status, so the X post never actually went out while the pipeline marked it published. Nothing threw, nothing alerted, the queue just quietly lied about what had shipped. I found it the way you'd expect: read buffer.py , saw exactly where the status check was missing, fixed one line. Cheap once you can see it. That's the part I can't picture happening the same way in a workflow canvas. I genuinely don't have a mental model for debugging that failure mode there, a canvas doesn't hand you the same thing a stack trace and git blame hand you in code. You'd be reading node configuration and hoping the tool's own logging caught the edge case, instead of reading the exact line that skipped a check. What this is actually about It isn't code versus no-code as a philosophy. It's about legibility when automation is wrong in a way that doesn't throw an error. A silent-fail bug is the worst kind, because nothing tells you to go look. The only thing that saved

Intro There's a pitch behind every "AI writes your tests too" workflow: more coverage, less manual toil, a safety net that used to take a sprint now takes minutes. The pitch skips over what that safety net is actually made of. When the same model writes the implementation and the test suite, you haven't added a second, independent check. You've asked one reviewer to grade its own homework and handed you the green checkmark as if someone else had signed off. The blind spot loop A model reasons about a function once, forms an implicit set of assumptions (input shapes, timezone handling, what counts as "empty"), and writes the implementation against those assumptions. Ask the same model to write tests for that function, and it doesn't re-derive correct behavior from scratch. It writes tests against the same assumptions it just used to write the code. If it assumed dates always arrive as ISO strings in UTC, the implementation assumes that, and the tests assume it too. The suite goes green. The assumption is still wrong. Tests that pass for the wrong reason (Illustrative, not a specific case, but recognizable to anyone who's shipped an AI-generated suite.) Picture a discount-calculation function where the model assumes quantities are always positive integers. The implementation skips a negative-quantity check. The generated tests exercise 1, 5, and 100, because those are the "normal" values a model reaching for plausible test data will reach for. Nothing ever asks what happens at -1 or 0, because neither pass, the code or the tests, ever considered them worth asking about. Coverage tooling reports 100% on this function. The bug ships anyway. Coverage becomes a false signal High line or branch coverage from an AI-authored suite tells you the code paths were exercised, not that the right inputs exercised them. A suite can hit every line of a function and still never send it a null, an empty array, a duplicate key, or a value at a type boundary, if the author, human or mode

Pro soccer team's CTO points to "issues with the Broadcom takeover."

Enterprise resource planning has traditionally been associated with large vendors, complex implementations, long contracts, and significant licensing investments. For decades, companies evaluating ERP systems were likely to encounter names such as SAP, Oracle, Microsoft Dynamics, and other established commercial platforms. That model is not disappearing. But the assumptions behind it are changing. In 2026, enterprises have more choices than simply selecting between competing proprietary ERP vendors. Open-source platforms such as ERPNext, Odoo, and other business application ecosystems have become credible alternatives for organizations that want greater control over their software, more flexible customization, and different approaches to total cost of ownership. At the same time, SaaS pricing, vendor lock-in, integration complexity, cloud adoption, data ownership, and increasingly capable development tools are changing how businesses think about enterprise software. This does not mean open-source ERP is automatically better. It means the ERP decision deserves to be reconsidered. The question is no longer simply: Which ERP vendor should we buy from? Increasingly, organizations are asking: How much control should we retain over the software that runs our business? What Is Open-Source ERP? Open-source ERP is enterprise resource planning software whose source code is made available under an open-source license that grants defined rights to use, inspect, modify, and distribute the software. The practical implications depend heavily on the specific project's license. For an enterprise buyer, however, the important distinction is that open-source software can provide a level of visibility and extensibility that proprietary software may not. A simplified comparison looks like this: Proprietary ERP Business │ ▼ Vendor Software │ ├── Vendor controls source ├── Vendor controls roadmap ├── Vendor controls licensing └── Vendor controls many upgrade decisions Open-Source ERP Busi

When businesses outgrow spreadsheets and disconnected SaaS tools, the next question is often whether they should buy another application, customize an existing platform, or build a system specifically around their workflows. For many organizations, building custom business software can appear expensive and technically demanding. A development team has to think about authentication, permissions, database models, APIs, user interfaces, background jobs, reporting, audit trails, and deployment. This is where open-source application frameworks can change the equation. Instead of building every foundational capability from scratch, a framework can provide the underlying architecture while developers focus their effort on the business problems that actually differentiate the organization. One example is the Frappe Framework , an open-source web application framework used to build business applications such as ERPNext. But what exactly is Frappe, and why would an organization consider using it for custom enterprise software? What Is Frappe Framework? Frappe is an open-source, Python- and JavaScript-based web application framework designed to make it easier to build database-driven business applications. Rather than being simply a collection of programming utilities, Frappe provides a broader application foundation. It includes capabilities for: Data modeling Authentication Role-based permissions REST APIs Web forms Background jobs Reporting Workflow management Notifications File attachments Activity and audit information User interfaces Database access Application configuration This means a development team can start with an application architecture that already understands many of the requirements common to business software. The important distinction is this: Frappe is a framework for building applications. ERPNext is an application built using that framework. That distinction matters when evaluating Frappe for custom software development. Frappe vs ERPNext Frappe and ERP

Ultrahuman is targeting a $200 million annual revenue run rate by January 2027 as it builds a new Qualcomm-powered smart ring.

The Circular Ring 3 series announcement comes amid a year of heightened competition in the smart ring market, following the launches of the Oura Ring 5 and RingConn Gen 3.

A developer opens a pull request. The feature works. The tests are green. The implementation looks reasonably clean. Then they realize the PR changes 17 files for what should have been a relatively small feature. There is a new abstraction nobody on the team has seen before. A dependency has been added for functionality the project already had. Two similar utilities now exist in different parts of the codebase. The tests are extensive, but nobody is completely sure what assumptions they are actually testing. And the author didn't write most of it manually. AI did. This is one of the less obvious problems created by AI coding tools. The problem isn't necessarily that AI generates bad code. Sometimes it generates perfectly valid code. The problem is that it can generate code faster than a team can develop an understanding of it. That changes the bottleneck in software engineering. The Cost of Writing Code Has Changed For a long time, engineering teams were constrained by how quickly developers could implement things. A developer had to understand the requirement, design the solution, write the code, debug it, and test it. AI changes the economics of that process. A developer can now describe a feature, generate an implementation, ask for tests, refactor it, and generate supporting code in a fraction of the time it might previously have taken. That's useful. But the amount of code entering the system can increase faster than the team's ability to review and understand it. Consider a simple feature that requires modifying four files. An AI coding assistant might produce a solution that touches twelve. It may introduce a service layer, a helper abstraction, a configuration object, several interfaces, and a new package. None of these things are necessarily incorrect. But every additional abstraction creates another thing a future developer has to understand. This is where code familiarity becomes an engineering concern. Working Code Isn't the Same as Understandable Code A

A couple of weeks ago, I helped a cross-platform app team with their App Store release. The code, packaging, and testing were all done, but we got stuck on the last step: how to get the IPA to the App Store. Nobody on the team had used a Mac, and many articles we read assumed you already have Xcode. That step is actually not that difficult. If you break down the complete iOS App Store publishing process, it comes down to registering an account, creating certificates, creating provisioning profiles, configuring Bundle IDs, packaging, uploading, and waiting for review. Each stage has clear steps, and I will walk through them in order below. Registering a Developer Account Registering a developer account is the first step. Both individual and company accounts cost $99 per year. To register, log in to the Apple Developer website with your Apple ID and agree to the agreement, and the account will be activated. Company accounts also require a D-U-N-S number. A free account can create development certificates and run internal testing, but it cannot submit or publish, and it cannot use capabilities such as Sign in with Apple, payments, or push notifications. To publish officially, you must upgrade to a paid account. Creating Certificates Certificates are the ticket for packaging and publishing. There are two types: development certificates (iOS App Development) and distribution certificates (iOS Distribution). The generated files are in P12 format. On a Mac, you would open Keychain Access and request a Certificate Signing Request file, then upload it to the developer portal. With Appuploader, a cross-platform team can generate certificates directly on Windows by entering a certificate name, email, and password, without touching the Keychain. The certificate can also be synced to different computers, saving considerable effort in team collaboration. Note that the certificate password must be remembered, because it is used as the private-key password for packaging and signing

abandoned open source package vulnerability EOL dependency strategy fork vs patch security alert open source risk mitigation OSS abandonment decision tree tech lead security SLA abandoned dependency vulnerability end of life open source package unpatched upstream dependency replace abandoned OSS library isolate vulnerable code fork open source package internal maintenance OSS fork formal risk acceptance InstaSLA accepted risk logging vulnerability SLA deadline EOL package remediation open source dependency risk unmaintained open source library patching abandoned packages Upstream OSS Abandonment An Engineering Decision Tree for EOL Dependencies Back to blog The Silent Crisis of Upstream Abandonment Option 1: Replace the Dependency (The Ideal, but Costly Path) Option 2: Wrap and Isolate the Code (The Tactical Defense) Option 3: Fork and Maintain Internally (The Ownership Commitment) Option 4: Formal Risk Acceptance (The Compliance Reality) What 2025–2026 Actually Looked Like Conclusion Upstream OSS Abandonment: An Engineering Decision Tree for EOL Dependencies When an active vulnerability SLA deadline looms over a critical application, the standard playbook is straightforward: update the package, run the tests, merge the pull request. But what happens when the underlying open-source library has been quietly abandoned by its maintainer? Engineering teams are running into this exact scenario more often, and the numbers back that up: Veracode's 2025 State of Software Security report found that half of organizations carry critical security debt, and 70% of that debt originates from third-party code and the software supply chain. As the software supply chain grows more complex, the odds of an EOL package sitting somewhere in your dependency tree keep climbing. This article lays out a step-by-step decision framework for tech leads and security teams managing an EOL dependency when no upstream patch is coming — and updates it with what's actually happened in the open-source

🎮 ADAM-PS5 — A PS5 Emulator in Development I’m working on an ambitious project called ADAM-PS5 , with the ultimate goal of developing a PlayStation 5 emulator for PC capable of running PS5 games . The project is still in the early stages of development , and I do not consider it a complete emulator at this point. I’m building the foundation step by step: system architecture, low-level emulation, memory and resource management, graphics, input handling, execution, debugging, and development tools. 🚧 Early Development There is still a huge amount of work ahead before reaching the point where commercial PS5 games can actually run. That’s why I’m sharing the project from its early stages rather than presenting it as a finished product. 🤖 One of the project’s goals is also to integrate Artificial Intelligence to help analyze errors, monitor performance, understand system logs, and assist with the development process. The long-term goal is: PC → ADAM-PS5 → PS5 Software Environment → Games Reaching that stage requires implementing and accurately simulating many different components of the console’s hardware and software architecture. I’m sharing the project now because I want to document the entire development journey from the beginning — including what gets built, what fails, what gets improved, and how the project evolves with each release. 🔥 ADAM-PS5 is not finished. It is being built. And the ultimate goal is simple: Run PlayStation 5 games on PC through our own emulator. ADAM-PS5 is an independent development project and is not affiliated with Sony Interactive Entertainment.

Every developer I know now runs an AI coding agent in something like auto-accept mode. Claude Code, Codex, Cursor: you give it a task, it runs commands, edits files, installs packages, and you review... the diff, maybe. The commands? The installs? The thing it did in that folder outside the repo? Nobody looks. The activity scrolls off the terminal and is gone. That asymmetry bothered me. We built an entire industry around audit trails for humans (git blame, CI logs, access logs), then handed the keyboard to agents and kept none for them. So I built Tracon: a local flight recorder for AI coding agents. The name is the FAA's term for Terminal Radar Approach Control, the radar room that tracks every aircraft in an airspace. This one tracks every agent on your machine. What it does Tracon is a Mac and Windows desktop app (Tauri 2, Rust core, React UI, SQLite store) that sits in the tray and records what your agents do: A timeline per session: every command, file edit, package install, and prompt, attributed to the agent and session that did it Danger flags as they happen: recursive deletes, pipe to shell installs, credential access, force pushes, permission bypasses. Tracon flags; it never blocks A Live page: one monitor per active session, like a security room, streaming recent commands with flagged ones highlighted in red, plus which subagents the session has spawned A conversation reader: the actual chat behind any event, read straight from the agent's own transcript, read only A package watch across npm, pnpm, pip, cargo, and brew, with opt in threat intelligence against osv.dev Capture is deliberately passive. Hooks give real time events over localhost; transcript tailing (filesystem notify, read only) covers everything else, so CLI sessions show up live even with zero setup. A dead or closed Tracon never slows an agent down. Everything stays on your machine: no telemetry, no accounts, AGPL. The recursive part Here is the part I find genuinely funny: Tracon was lar

Wonderful said it will use its $550 million Series C funding to develop products faster, expand its FDE teams, and meet demand for its products.

Jio is betting it can turn an aging computer into an AI-ready PC for as little as about $11 for two months.

Upgrading Juniper MX Networks from 100GbE to 400GbE: What Engineers Need to Know Moving a production network from 100 Gigabit Ethernet to 400 Gigabit Ethernet sounds simple on paper: Replace a 100G interface with a 400G interface and get four times the bandwidth. In a real carrier or data-center network, however, the interface is only one part of the equation. The router's forwarding silicon, switch fabric, midplane, power system, cooling, optics, software release, slot selection, redundancy configuration, and licensing can all determine whether the expected capacity is actually available. Juniper's MX240, MX480, and MX960 platforms provide an interesting example because these systems can be upgraded with newer generations of Modular Port Concentrators rather than requiring an immediate chassis replacement. One particularly useful case study is the Juniper MPC10E-15C , a Trio 5-based line card capable of supporting both 100GbE and 400GbE interfaces. This article isn't about whether you should buy a particular line card. Instead, we'll use the MPC10E-15C to examine the engineering questions that should be answered before attempting a 100G-to-400G upgrade on an existing Juniper MX network. Video Overview The video provides a short overview of the hardware. Below, we'll go deeper into the architecture and the deployment considerations that matter when integrating this class of line card into an existing MX environment. Why Moving from 100G to 400G Isn't Just a Port Upgrade Suppose an edge router has four heavily utilized 100GbE connections. At first glance, replacing those links with 400GbE interfaces appears straightforward. But consider what happens behind the physical port. Traffic entering that 400G interface must travel through several parts of the system: Interface → Packet Forwarding Engine → Fabric → Other line cards/interfaces Every component in that path needs sufficient capacity. A 400GbE optic connected to a router that cannot move 400 Gbps through its inte