The successor of MySpace. The website keep the old look and feel.

Possibly the hacker behind YggTorrent

Les logos du label https://sovereignty.cispe.cloud/ vont être utilisé chez 40 services cloud.

Ces critères permettent d’établir une classification des fournisseurs (SEAL, pour « Sovereignty Effectiveness Assurance Levels ») : SEAL 4 représente le maximum possible pour une offre vertueuse, SEAL 0 correspond à une offre sans souveraineté.

En France, il existe déjà une qualification permettant de s’assurer d’une étanchéité aux lois extraterritoriales (américaines et chinoises pour ne citer qu’elles) : le référentiel SecNumCloud de l‘ANSSI, dont la version 3.2 de 2022 intégre « principalement des critères de protection vis-à-vis du droit extra-européen ».

Je l'utilise par défaut au travail effectivement. RAS.

The average American generates about $1,605 a year in advertising value. A 35- to 44-year-old man in Bozeman, MT, without children, using a desktop and making high-value corporate searches, generates an estimated $17,929.30. An 18- to 24-year-old father in Fort Smith, AR, using an Android phone and making low-value searches, generates $31.05.

Google’s advertising mechanics have always been deliberately opaque. The data shows why: users are considered money-generating assets, assigned a value and targeted accordingly. Every feature built to increase engagement, every product designed to deepen lock-in, serves that extraction.

The library parses rich schemas (nested sections, $ref, arrays, key/value maps, pattern properties…) into a navigable form tree, renders it as a keyboard-first editor, and validates the result after every edit so users always see the full list of issues before saving.

It can be useful someday

The idea seems good. Another ID format: 16 bytes like UUID v4 and v7. The key difference is they are monotonic, but that's something UUID v7 and ULID can have.

The structure:

Timestamp: 8 chars · ms since epoch · good until year 6028
Counter: 6 chars · randomly seeded · monotonic
Random: 7 chars · cryptographically secure randomness

The landing page uses catchy things without real correlation: 23M SparkIDs/sec in Rust. Ok but with which hardware?

[the core summary is generated by AI]

Charging more doesn't just increase your income but it often leads to better customers, better outcomes, and a healthier business. Low prices attract customers who are more price-sensitive, require more support, and often value your work less..

Main ideas

• Price signals quality. Customers frequently use price as a proxy for value and expertise. Charging too little can make your offering appear less credible.
• Most people underprice because of psychology, not economics. Common fears include:
  • "Nobody will pay."
  • "People will think I'm greedy."
  • "I'll have to deal with too much customer support."
• Higher-paying customers are often easier to work with. Patrick shares data from his SaaS business showing that customers on more expensive plans submitted dramatically fewer support requests. They tended to ask strategic questions rather than basic troubleshooting questions. (kalzumeus.com)
• Sell business outcomes, not hours or technical skills. Clients don't primarily buy programming or consulting time—they buy increased revenue, reduced costs, reduced risk, and confidence that you'll deliver.
• Specialization justifies premium pricing. Being the obvious choice for a specific type of customer is more valuable than trying to serve everyone. The authors encourage explicitly turning away poor-fit clients.
• Positioning matters more than features. Ramit argues that understanding a customer's motivations and speaking directly to them can support prices that are many times higher than competitors charging for superficially similar products.
• Higher prices let you invest more in customers. More revenue enables better support, better service, and stronger guarantees, creating a positive feedback loop.
• Move beyond hourly billing when possible. As expertise grows, packaging work, retainers, or value-based pricing often align better with the value delivered than charging by the hour.
  The authors argue that raising prices should go hand-in-hand with delivering greater value and serving a narrower, better-matched audience. Rather than maximizing the number of customers, they recommend maximizing the value you create for the right customers. That tends to produce happier clients, less support burden, stronger trust, and a more sustainable business.

Oh shit we are in deep trouble: names are complex to handle.

My rules of thumbs:

• they can't be identifiers
• they are mutable
• the format is so complex that a single "display name" field should be used
  • create dynamic models (or SQL tables) if you need details for legal reasons
• UTF-8 encoding is a must. All characters are allowed because I can't verify Japanese, Chinese and all the possible character dataset

About the AI fatigue

La Deutsche Telekom Red Team vient en effet de publier Pack2theRoot (CVE-2026-41651), une faille notée 8.8/10 qui permet à n'importe quel utilisateur local de devenir root sans mot de passe.

Source:

• https://www.bleepingcomputer.com/news/security/new-pack2theroot-flaw-gives-hackers-root-linux-access/
• https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

La merditude des choses est un fait, mais le narratif du déclin inéluctable est un choix.

A quizz with 20 questions

hashing: SHA-512
Password or one time code hashing: Argo2id
Key derivation: SHAKE256 or HKDF-SHA512
Api key: prefix + version + Base32LowerCase.encode(UUID || 32-byte secret); hash function: SHAKE256 with a 512 bit output, or SHA3-512 or SHA-512

Encryption: AES-256 has too short nonces, jey / nonce reuse is catastrophic and it's also lacking context commitment. XChaCha20-Poly1305 lacks context commitment, that's why ChaCha20-BLAKE3 is recommended.

Encrypting secrets: use a Key Management Service

Symmetric Key signature: HMAC-SHA512
Asymmetric key signature: ML-DSA-65, or ML-DSA-87
JSON Web TOkens: ML-DSA-65 for asymmetric signatures or HMAC-SHA512 for symmetric signatures

End-to-end encryption

While you probably need more advanced protocols for your specific use case (e.g. The Messaging Layer Security (MLS) Protocol, RFC 9420, for messaging), basic end-to-end encryption to a public key has been standardized in RFC 9180 - Hybrid Public Key Encryption (HPKE). In this context hybrid means that we combine both symmetric and asymmetric cryptography.
Therefore, I recommend the following algorithms for use with HPKE to encrypt data to a public key:

• KEM: X-Wing
• AEAD: AES-256-GCM
• KDF: HKDF-SHA512

TLS

Today, the only quantum-resistant key exchange algorithm available for TLS is the hybrid X25519MLKEM768. Ensure that your load balancers / reverse proxies support it.

Eine deutsche Quelle: https://www.security-insider.de/boesartige-chrome-erweiterungen-stehlen-google-telegram-daten-a-a5061625029c52a58936a94487a2a353/

It's there if needed. A WebUSB implementation via native messaging.

About the possibilities of the web

In contrast to the frozen NPM package pages, npmx delivers some improvments:

• Transitive install size (similar to bundlephobia or packagephobia)
• Install script disclosure: any preinstall, install or postinstall script is rendered on the package page along with the npx
• outdated and vulnerable dependency trees
• version range resolution
• module replacement suggestions for features that become built-in ECMAScript. The dataset comes from https://github.com/es-tooling/module-replacements
• module format and types badges: ESM, CJS, both. Typescript types, node engine range
• Multi-forge repository stats instead of GitHub only
• cross-registry availability: npm, JSR
• side-by-side package comparison
• version diffing between two versions of the same package
• release timeline with size annotations: Every version of a package is plotted on a timeline with markers where install size jumped by a meaningful percentage
• download distribution by version (avoid download breaks with major versions)
• command palette
• i18n
• accessibility as default
• agent skill detection
• social features on AT Protocol
• Local-CLI admin connecter
• dark mode and custom palettes

La DINUM utilise donc NixOS pour se reproductibilité.

Avec NixOS, toute la configuration d'un poste, des logiciels installés, aux services activés, en passant par les paramètres de sécurité, est décrite dans un fichier texte. On applique ce fichier, on obtient exactement le système attendu. Rien de plus, rien de moins. Si on copie ce fichier sur mille machines, on obtient mille postes strictement identiques.

En revanche, il faut comprendre la logique déclarative de NixOS, et c'est cela qui freine son adoption pour le grand public. L'État a donc choisir bâtir Sécurix dessus, respectant les normes de l'ANSSI.

Bureautix propose un ensemble d'environnement de bureau prêt à l'emploi. Bureautix est conçu pour être cloné et adapté. Une administration peut prendre le kit, y ajouter ses propres logiciels et personnalisations, et créer sa version privée.

Le seul point noir reste l'hébergement du projet sur Github pour le moment.

En attendant un déploiement à plus grande échelle, la CPAM utilisera "La Suite".

A web directory of self-hostable apps

il semble qu'il y a une chute de 10% du budget: 20 millions en 2ß26 sur les budgets en cours.

A non-exhaustive list of Rust usage.

This means that no matter how good (and fast) Clippy is, or how great the memory safety caused by the borrow checker is. The first language that’s taught in many universities is still Java. People use Javascript for everything and C++ is still used in planes. This is why I find it important to highlight and underscore which projects have tried Rust, how the process went and what they learned along the way.

Paste the raw source of an email into the form on the front page. The email will then be parsed, decoded, separated into its various MIME parts, and displayed in an easy to view fashion. Image attachments will be displayed as images. HTML parts will be rendered in Chromium (with javascript and plugins, disabled) and then also displayed as an image. IP addresses in headers and message bodies will be identified, classified, and highlighted along with a flag representing their origin country. Hostnames and email addresses will also be identified and highlighted.

Whether you are a software engineer, a lawyer, a manager, or an entrepreneur, your value is directly correlated with how efficiently you can process new information to stay relevant in your field in an ever-accelerating world.

But there are two problems.

The first one is that today, there is simply too much information available and it's hard to extract signal from the noise.

The second problem is that knowledge ("white collar") jobs are evolving faster than the capacity of most people to learn new things. For example, today, you are a software engineer developing backend applications, and you may want to move into machine learning with all the recent and exciting advancements.

Good news: Knowledge follows the law of diminishing returns. By spending two weeks studying a topic really hard, you can assimilate the most important principles and become better than maybe 90% of the people on this plane

I came to this way of thinking by sheer accident. I was traditionally a desktop business app developer, and by the time I saw the writing on the wall, SPA frameworks were the dominant meta in front end. As I started getting contracts, I worked on one project with such a tight deadline that I simply had no time to bring a critical library into the cinematic React universe. So I just... wrote JS. I modified the DOM. And you know what? It was fine. Not only was it fine, it was easier. I wrote a little stream object in ~50 LoC to react to user inputs, and it worked flawlessly. I felt lied to. I thought making a web page interactive was an insanely difficult task only SPA framework authors were qualified to do? Yet here I was just... scripting the page.

The only cases to use framework is for project maintainability as I've found so far.

Summary of the changes in the kernel 7.0

The major version number is incremented when the number after the dot starts looking "too big." There is literally no other reason.

This is why I think the whole crunch culture is fucking stupid. People need rest. Without it, you spend more time doing things badly, because the tunnel vision that comes from working 10’s of hours straight means you’re not open to the possibility that the problem might be elsewhere.

le FBI a réussi à extraire et lire des messages Signal d’un iphone à l’aide de techniques de forensic.

car l'aperçu des notifications est stocké en clair dans une base de données locale du système.

Signal est ici pas en cause, mais bien le stockage des aperçus de notifications.

Si vous utilisez un iPhone, quelques réglages simples peuvent limiter les dégâts :

• Dans Signal → Notifications → “Ni le nom ni le message”
• Dans iOS → Notifications → Signal → désactiver les aperçus ou les limiter à “Quand déverrouillé”

Et surtout, il faut déconstruire une idée reçue tenace : celle de “l’application magique” qui réglerait tous les problèmes de sécurité. C’est une illusion dangereuse.

Like I mentioned, we have a base monorepo project at the studio that contains:

1. “apps”
2. Astro website
3. Design system software (Navi)
4. “packages”
5. CSS system
6. Data system
7. Design tokens
8. UI components/regions (Astro and web components)

temporary flags are rarely temporary. Once a flag exists, it starts attracting dependencies.

Documentation has to mention it. Support has to ask whether it is enabled. Bug reports have to include it. Tests need to cover both states.

A flag is a boolean and the boolean in the interface usually means a branching factor in maintenance.

The solution:

Every new flag should come with an expiration story.
Why does it exist? Who needs it? What breaks if it goes away? When will that be acceptable? If nobody can answer these questions, the flag is probably not a feature.

Je plussoie.

En fait, la peur des batteries des voitures, c’est la même que celle des stockages à SSD, ou les écrans OLED (et le "burn in") à leur débuts : pas tellement infondée, mais pris tellement au sérieux par les constructeurs qu’il est désormais proche d’être inexistant, ou en tout cas ne se manifeste plus.

Et avoir 80% de la batterie originale est sûrement suffisant. 5 charges au lieu de 4 sur un trajet de 1500km. Est-ce réellement un problème ?

Idem pour le téléphone qui est quasiment rechargé tous les jours: mis à part certain jours particulier, avoir 80% de la capacité originale de la batterie est suffisant.

LittleSnitch est donc maintenant disponible sur GNU/Linux.

https://obdev.at/products/littlesnitch-linux/index.html

LucidRook was observed in attacks in October 2025 that relied on phishing emails carrying password-protected archives.

Selon l'Insee, le patrimoine médian des Français s'établit à 205 100 euros

10 % des ménages possèdent 50 % du patrimoine total (seuil d'entrée à 857 700 euros).
Un ménage ayant déjà hérité possède 515 400 euros en moyenne, contre 374 900 euros pour l'ensemble.

Le rôle de la famille comme amortisseur économique freine la mobilité sociale. Si le succès d'un projet dépend de la dotation parentale, le mérite s'efface. L'accès au logement illustre parfaitement ce blocage. Les héritiers achètent plus tôt, plus grand et dans des zones plus tendues. Ils captent ainsi la plus-value immobilière de demain. Cela recrée l'écart avec les locataires à vie. Ce phénomène crée une société de rentiers où le travail peine à rattraper le capital hérité. L'Insee rappelle que ces transferts jouent un rôle direct dans l'accumulation du patrimoine. Ils soutiennent l'installation professionnelle et la trésorerie. C'est un mécanisme de reproduction patrimoniale qui s'auto-entretient.

Les experts suggèrent de favoriser les transmissions anticipées pour fluidifier le capital. Aujourd'hui, l'âge moyen de l'héritage avoisine les 60 ans. À cet âge, les besoins d'investissement sont moindres que pour un trentenaire.

In a recent analysis, Adam Harvey found that among the 999 most popular crates on crates.io, around 17% contained code that do not match their code repository.

How?

• buy compromised cookies or credentials
• typosquatting or misleading create names
• macros

How to solve?
Again, like Go: having a comprehensive standard library.

It should have: base32, base64, bytes, crc32 and crc64, crypto, gzip, hex, http, json, net, rand, regex, tar, tls, uuid, zip, zstd.

How to fix now?

• Use Dev Containers!
• Password manager for the SSH keys and secrets
• fetch the dependencies from source
• audit the dependencies: cargo-audit and cargo-vet

The post landed today on Lobsters

Thoughts about people living in the USA

Je pense qu'utiliser intelligemment l'IA n'est pas forcément mauvais:

• elle sert à vérifier si on n'a rien oublié dans un raisonnement,
• elle sert à trouver une inspiration, une idée...
• elle sert à retrouver rapidement une info
• compléter sa réflexion sur un sujet
• elle sert à avoir rapidement une explication sur un point précis qu'on n'a pas forcément compris...

En gros, si on s'en sert comme d'une aide dans son cheminement personnel et sa réflexion vers le résultat, ça me semble bénéfique. Si on s'en sert pour obtenir le résultat sans effort, elle nous pousse vers un abîme à la idiocracy.

Demo https://devcss.devins.page/

The bun single binary performs better!

Le Raspberry Pi 4GB est 15% plus cher que celui à 3GB.

3GB (2x1.5GB de LPDDR4) au lieu de 4GB (2x2GB).

C'est un peu le monde à l'envers : un Raspberry Pi, c'est censé être un petit ordinateur pas cher, et là on se retrouve avec un Pi 4 4 Go à 120 euros en France.

Singlepart: plaintext
HTML only: déconseillé car certains client mail ne le prendront pas en compte.

Si : il y a cette petite startup sans ressources et sans prétention appelée La Poste qui fait des emails en multiparts avec seulement une version en HTML. Le Plain est vide.

Si l’IA augmente la produc­ti­vité1, la baisse des coûts va libé­rer une masse de demandes qui n’étaient pas rentables avant et qui le devien­dront. Plus on baisse les coûts, plus la demande va être massive.

L'auteur pense plutôt que ceux n'utilisant pas l'IA seront lésés. On pourrait faire la même analogie avec les LSP des IDE par exemple.

wtf

I first asked how we should think about a mature standard like H.264 in 2026, where many but not all patents have expired. "Maturity changes the economic context, not the legal framework," he said. "The analysis shifts from an emerging innovation platform to a legacy but embedded infrastructure. That shift can affect valuation, but it does not nullify licensing obligations." Courts evaluating FRAND rates still look to comparable licenses and consider the composition, strength, and remaining life of the patents still in force.

It's possible in theory to use the free patents for x264, but it requires in practice a detailed claim-by-claim analysis of the relevant patents and the specific implementation. . Patent claims do not necessarily map neatly to profile labels, so determining whether a subset is truly non-infringing typically requires careful legal and technical analysis.

The baseline / main profiles is however OK and free to use, but the analysis is still required, because patent rights are strictly territorial. The infringement analysis typically turns on three factors: where encoding occurs, where content is transmitted from and where it is received or used.

The FAQ is also very interesting to learn about patents and software cases.

An introduction from unsafe to safe Rust lifetimes

The boilerplate needed, the first metadata title, link, description and the many additional optional values.
Dates in RSS conform to RFC 882

Each RSS feed has items. Each feed can contain the entire content, unabridged, or a summary of the content and that it should be read on the site.

Atom is XML-based but is a little bit stricter and more finely specced than RSS.

JSON feed is the newest format discussed around. It has similarly.

RSS can be auto-discovered with the link tag in HTML.

Gotchas:

• use absolute URLs for media in the RSS feed. RSS Readers can be disconnected from the origianl domain.
• escape HTML entities in XML or use CDATA wrappers.
• Web-based RSS readers have CORS rules to follow. Setting an Access-Control-Allow-Origin: * is mandatory header on your XML/JSON files ensures these web-based clients don’t get blocked by security policies.
• the readers have limited display
• validation via the W3C Feed Validation Service or the JSON Feed Validator.

Read the RSS 2.0 Specification, the Introduction to Atom, the RFC 4287: The atom syndication format or the JSON feed version 1.1 Explainer.

Ce qui a tout changé, c’est l’introduction des fils algorithmiques. En mars 2016, Instagram bascule d’un flux chronologique à un flux trié par performances.

il y a un deuxième phénomène, plus insidieux. Internet est devenu ironique. Profondément, structurellement ironique. Tout est du second degré.

Tumbl était meilleur car les conditions économiques et techniques n’avaient pas encore transformé les plateformes en machines à attention optimisée.

Dans ce cas, séparer directement la commande curl de bash afin d'auditer le script téléchargé. Le serveur peut être malhonnête et renvoyer différent contenu selon le User Agent de Curl ou d'un navigateur web.

Il est possible de détecter le curl | bash via une commande sleep.

L'auteur à une démo locale.

Faire confiance au projet pour livrer un script bash honnête revient aussi à faire confiance:

• au domaine
• au DNS
• à l’hébergement
• au CDN
• au compte GitHub
• aux secrets de CI/CD
• au pipeline de release
• aux dépendances
• aux mainteneurs actuels et futurs
• à l’absence de compromission au moment précis où vous exécutez la commande

body:has(li:hover) li:not(:hover){
    opacity:0.5;
    transition: opacity 500ms;
}

Highlight the hovered element of a list by hiding the others

Here for Berlin: it shows the temperature as stripes (similar to a bar code), then labelled, then as bar chart.

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

À propos des archétypes des utilisateurs de logiciels libres

• not memory safe (thread access, ...)
• error handling
• garbage collected
• used to directly call sys calls
• can trigger MTE on Android because Go reads the whole page of memory to access a string

It's not a bad language: It's often easy to write a full production ready server using only the standard library. In 2026 this is becoming more of a feature due to the ongoing supply chain attacks. Go itself also has some great technologists working on the project who are extremely responsive and care very deeply.

Les pièges a éviter:

• readme cimetière
• theator of documentation: useless comments
• outdate trap: "how" is a wrong answer
• un ROI négatif.(Lectures × Temps gagné) - (Temps d’écriture + Maintenance).

Pour maximiser ce ROI, il faut distinguer quatre types de documentation :

1. ROI Infini : La doc fonctionnelle (le problème). C’est la boussole de la feature. Elle ne décrit pas les boutons, mais la valeur.
   • Le contenu : À quel problème client répond-on ? Quelle est la vision à 6 mois ? Quelles sont les limites actuelles (ce qu’on a décidé de ne pas faire) ?
   • Pourquoi c’est crucial : Sans elle, un dev qui itère sur la feature 1 an plus tard risque de supprimer un comportement “bizarre” qui était en fait une réponse vitale à un besoin client.
   • Le public : Elle est le pont entre la Tech, le Produit et le Marketing. C’est la doc qui aligne tout le monde.
2. ROI Élevé : La Doc d’Intention (l’histoire).
   • Pourquoi ce choix ? Quelles étaient les limitations ? C’est ce qui survit aux refactos (ex: les ADR - Architecture Decision Records). N’importe quel dev peut comprendre votre code, mais personne ne peut deviner une intention métier disparue.
3. ROI Opérationnel : La Doc d’Usage (le manuel). Le strict nécessaire pour être autonome. Par exemple le guide du “Day One”. Si je ne peux pas lancer le projet à tous les coups en quelques minutes lors d’un onboarding, le README a échoué.
4. ROI Négatif : La Doc d’Implémentation. Les détails techniques changeants. C’est du “Waste”. À supprimer au profit d’un code propre, typé et bien nommé.

La documentation est écrite pour être lue, sinon elle est nulle. Une bonne documentation doit être compréhensible par la majorité de l’équipe (Tech, Produit, voire Marketing).
Le vrai danger lors d’une passation, ce n’est pas la perte du “savoir-faire” technique, c’est la disparition de la compréhension du système.

90% of programming jobs are in creating Line of Business software. [...] Software solves business problems. Software often solves business problems despite being soul-crushingly boring and of minimal technical complexity. [...] It does not matter to the company that the reporting form is the world’s simplest CRUD app, it only matters that it either saves the company costs or generates additional revenue.

Engineers are hired to create business value, not to program things: Businesses do things for irrational and political reasons all the time (see below), but in the main they converge on doing things which increase revenue or reduce costs. [...] Add revenue. Reduce costs. Those are your only goals. [...] You really want to be attached to Profit Centers [notion from Peter Drucker]. [...] If you can’t, either a) work elsewhere or b) engineer your transfer after joining the company.

About programming languages:

In the real world, picking up a new language takes a few weeks of effort and after 6 to 12 months nobody will ever notice you haven’t been doing that one for your entire career.

Co-workers and bosses are not usually your friends: You should be a good person to everyone you meet — it is the moral thing to do, and as a sidenote will really help your networking — but do not be under the delusion that everyone is your friend.

“Read ad. Send in resume. Go to job interview. Receive offer.” is the exception, not the typical case, for getting employment: Most jobs are never available publicly, just like most worthwhile candidates are not available publicly (see here).

Networking just means a) meeting people who at some point can do things for you (or vice versa) and b) making a favorable impression on them.

Academia is not the real world. [...] Your major and minor don’t matter.

Be better at negotiation:
a) Remember you’re selling the solution to a business need (raise revenue or decrease costs) rather than programming skill or your beautiful face.
b) Negotiate aggressively with appropriate confidence, like the ethical professional you are. It is what your counterparty is probably doing. You’re aiming for a mutual beneficial offer, not for saying Yes every time they say something.
c) “What is your previous salary?” is employer-speak for “Please give me reasons to pay you less money.” Answer appropriately.
d) Always have a counteroffer. Be comfortable counteroffering around axes you care about other than money. If they can’t go higher on salary then talk about vacation instead.
e) The only time to ever discuss salary is after you have reached agreement in principle that they will hire you if you can strike a mutually beneficial deal.
f) Read a book. Many have been written about negotiation. I like Getting To Yes. It is a little disconcerting that negotiation skills are worth thousands of dollars per year for your entire career but engineers think that directed effort to study them is crazy when that could be applied to trivialities about a technology that briefly caught their fancy.

The author is negative about equity grants.

So would you recommend working at a startup? Working in a startup is a career path but, more than that, it is a lifestyle choice. This is similar to working in investment banking or academia. Those are three very different lifestyles. Many people will attempt to sell you those lifestyles as being in your interests, for their own reasons. If you genuinely would enjoy that lifestyle, go nuts.

Your most important professional skill is communication.
Communication is a skill. Practice it: you will get better. One key sub-skill is being able to quickly, concisely, and confidently explain how you create value to someone who is not an expert in your field and who does not have a priori reasons to love you.

Modesty is not a career-enhancing character trait: The right tone to aim for in interviews, interactions with other people, and life is closer to “restrained, confident professionalism.”

All business decisions are ultimately made by one or a handful of multi-cellular organisms closely related to chimpanzees, not by rules or by algorithms: People are people. Social grooming is a really important skill.

At the end of the day, your life happiness will not be dominated by your career. Either talk to older people or trust the social scientists who have: family, faith, hobbies, etc etc generally swamp career achievements and money in terms of things which actually produce happiness. Optimize appropriately. Your career is important, and right now it might seem like the most important thing in your life, but odds are that is not what you’ll believe forever. Work to live, don’t live to work.

Read from a reddit post

Source: https://hackaday.com/2026/04/22/what-have-we-dumped-on-the-moon/

• PDFs only
• provide photos!
• booking online
• integrations (birthday, events, ...)

SEO is important for search engines and other services (TripAdvisor, Google Maps, Instagram). The majority of the users are using smartphones, so mobile-first is definitely a way to built these websites.

I did not install any Anthropic browser extension. I have never installed a Claude browser extension due to privacy and security concerns. I did install Claude Desktop, the Mac app, a while back. That is the only thing on this machine which could have written the file. Claude Desktop reached into Brave, a browser from a completely separate vendor, and registered a back door for a browser extension I do not have.

and the security risks involved is concerning.

Sounds logic :)

Render #html where the data lives.
If its stored on the backend in a database or cache, render HTML there and avoid sending potentially sensitive data to the client.
If state lives only on the client, render it there with plain old JS or your library of choice.

A comparison of data center capex with the Marhsall Plan, Apollo Program, F-35 Program, Interstate Highway System, International Space Station, US Railroads

The editor: https://editor.graphite.art/

A wireframe tool that uses real wireframe

A collection of small, low stakes and low effort tools.

No logins, no registration, no data collection. I can't believe I have to say that. Long live the handmade web.

Décrire le fonctionnement du jardin et son entretien peut être utile.

Construire un réseau résilien de communication. Meshtastic n'est pas WhatsApp. LoRa (Long Range) sacrifie le débit pour la portée, chaque message est limité à 228 caractères, et le canal tourne à 3–5 messages par minute avec le preset par défaut. En France, la bande 868 MHz impose en plus un duty cycle légal de 10% : votre nœud ne peut émettre que 6 minutes par heure maximum.

Un Flipper Zero peut aussi s'y connecter via un addon.

La référence du réseau en France est Gaulix: https://gaulix.fr/

https://meshnetwork.fr rend le réseau lisible via une carte. Il y a aussi https://meshmap.net/ pour l'international.

L'article de Yohann Ciurlik qui décrit son implantation dans l'Eure https://medium.com/@spawnrider/d%C3%A9couvrir-meshtastic-simplement-et-pourquoi-jai-cr%C3%A9%C3%A9-meshnetwork-fr-d24371d9e541

A single authentication layer for your entire platform. Integrate any identity provider through OpenID Connect — without touching your application code.

his web app will send you a confirmation email to make sure you own the email address. In that email there will be another link. Click that link and you will be taken to a page where you can trigger test emails to be sent to you. Those test emails are specially crafted to use a variety of techniques, to attempt to send information back to this server when read. It will then display the results for you.

The project is available at https://gitlab.com/grepular/ept3

JavaScript Patterns Patterns focused on plain Javascript and Node.js

Why benchmarks should be carefully used as arguments

Not updated anymore, but still relevant

Une revue du logiciel par Korben

It completes my post "Where to find blogs to follow?".

1. Personal recommendations

2. Aggregations

   • Bear Blog Discover: https://bearblog.dev/discover/
   • Blogosphere: https://blogosphere.app/
   • Blogroll: https://blogroll.org/
   • Bubbles: https://bubbles.town/
   • Kagi Small Web: https://kagi.com/smallweb
   • PowRSS: https://powrss.com/

3. Social media

Many people on the fediverse have blogs and share common interests with hastags. Hashtags can be followed to get content by the way.

Typo-squatting: using URLs is a false solution. "By making crate IDs longer, whether by namespacing within crates.io, GitHub organizations, or via domains, you only make it harder for users to remember them precisely, and thus harder to recognize typo-squatting."

Sandboxing can not be handled by the language itself.

It's the developer responsability to use crates on crates.io. It's an audit to make. Rust provides tool for it: cargo-vet, crates.io 90 day download plot, cargo chef or Nix to build isolation.

Also Rust itself does not have the resources for it at the moment. They simply can't. The compiler and std are primarily developed by volunteers, who don’t get anything out of it except for rare donations from other members of the community. The Rust project is not the same as GitHub or Linux. They don't have the same support.

We’re not nearly close to the level of security a centralized registry can provide. On the software side, in 2025 Rust teams made or piloted tools for typo squatting detection, dynamic build script analysis, and real-time code scanning. On the personal side, Rust Foundation hired on-call engineers in 2025 and a second infrastructure engineer in 2026. If that sounds overdue, well, they had net loss in 2023 – software isn’t cheap.

Plus radical, parce que le terme acceptable sous-entend bien que toute infrastructure numérique a un coût écologique et social hautement problématique, qu'on ne peut plus ignorer.

Au lieu d'aliénant, subi et dégradant socialement et écologiquement, Il doit être émancipateur, choisi et soutenable socialement et écologiquement.

"La technologie n’est ni bonne, ni mauvaise, ni neutre" de l'historien des techniques Melvin Kranzberg.

Il existe bien des couteaux à beurre et des couteaux de chasse.

Certaines technologies disparaissent, d’autres sont abandonnées non par manque d’efficacité, mais par manque d’intérêt économique ou politique. L’histoire est pleine d’inventions prometteuses restées dans les tiroirs, ou de savoir-faire perdus

En pratique:

• enseigner l'utilisation de Google --> comprendre, critiquer et transformer les moteurs de recherche
• installer un bloqueur de publicités --> comprendre, critiquer et transformer le capitalisme de surveillance
• enseigner les usages consommateurs et aliénants --> les pratiques contributrices et émancipatrices

Le web est devenu un supermarché. Autant retourner à la contribution.

It uses Youtube under the hood. It's still better than loading and using the videos :)

More efficient but this is typically the tool that should be used when needed :)

Ouvertement inspirées des « starter packs » proposées par Bluesky, ces collections ont vocation à réunir au sein d’une même enveloppe un ensemble de comptes à suivre.

Ce que faisait la communauté en quelque sorte.

Source: https://blog.joinmastodon.org/2026/04/designing-collections/

Le même overflow du bug de l'an 2038 sur Linux.

La seule solution pour le moment est de redémarrer la machine.

A list of available project

et un plan d'action ministériel à rendre d'ici l'automne.

Cela ressemble à un plan qui ne sera jamais appliqué, j'ai du mal à y croire, mais bon à suivre cette année.

Voir aussi l'avis du HollandaisVolant https://lehollandaisvolant.net/?id=20260411163418. Au moins, quelque chose de concret est tenté là https://next.ink/233186/letat-veut-reduire-ses-dependances-extra-europeennes-la-dinum-bientot-sous-linux/

Les taux maximum sont effectivement très élevés par rapport aux offres que l'ont peut obtenir sur le marché.

Afin de suivre les taux directeur de la BCE

Install bind and restart the shell to use delv.

So a CPU that was built in 1989. So Linux supported it for 36 years.

The most important capability BYD ever built was not a battery. It was the ability to learn from customers who were more sophisticated than they were, more quickly than anyone thought possible, and then convert those lessons into permanent institutional knowledge.

The Linked Web Storage Protocol specification aims to provide applications with secure and permissioned access to externally stored data in an interoperable way.

The difference between two watch: one that works for years and the other one that needs to be recharged every night.

Objects are now never finished.

It's self-explanatory based on the semantic!

Markdown in figcaption does not work anymore

You'll likely catch this image a million times in your various feeds: Earth as seen by Reid Wiseman from Artemis II en-route to the Moon.

My first thought? That's really noisy 🧐

But then I realised – it's the nightside of Earth, illuminated by the almost full Moon, not the Sun 🌕️

The bright limb at lower-right is where the dayside starts, & the fact that you can see aurorae, airglow, & cities in Europe, Africa, & S & N America also gives the game away.

The kagi website surfer is another way to browser and discover websites

Le marché se révèle être principalement spéculatif. « Il y avait une décorrélation totale entre les valorisations atteintes et la proposition de valeur de long terme de la technologie. Les cas d'usage n'étaient pas assez mûrs par rapport à l'engouement que ça a pris », insiste Gauthier Zuppinger.

« Pour qu'une technologie s'impose, soit elle fait quelque chose de très différent, soit elle fait la même chose beaucoup moins cher. Les NFT n'ont réussi ni l'un ni l'autre », estime Cyril Bertrand. Le nerf de la guerre, insiste-t-il, c'est le coût. « Créer un NFT coûtait plusieurs dizaines d'euros », rappelle-t-il, là où une base de données classique fait le travail pour une fraction de centime.

Declare identity to be used by other tools, so the information declaration process can be automated.
A bit sad that AI is the main branding of it.

Export to VCF is added: https://hachyderm.io/@ducks/116324991938693684

The related blog post https://jakegoldsborough.com/blog/2026/whoami-spec-declarative-identity/

The vast majority wants to replace US software with europeanuropean alternatives. A majority of the majority thinks it's unrealistic.

Une alternative de Wordpress en Typescript par Cloudflare. Le CMS est basé sur le framework Astro.
Les plugins sont enclavés afin d'éviter des failles de sécurités.

Les plugins sont cependant uniquement compatible avec les Cloudflare Workers, ou alors NodeJS avec SQLite ou Postgres.

cf: https://blog.cloudflare.com/emdash-wordpress/ qui cite 42 fois le mot Wordpress

Now I get it why I see links to this website.

The website offers news, technology reviews, and opinion articles, as well as an IRC server and forums. Over 345,000 users have registered for the forums,[6] making over 11,000,000 posts as of June 2016. Two projects initiated by members of the Neowin community include a community game server for Team Fortress 2[7] and a Folding@home team.

En pratique, la bêta d’Ubuntu 26.04 consomme environ 1,4 Go de mémoire vive au repos, témoigne un internaute sur Reddit.

A reminder, because the usual users only see "the Windows Desktop PC"

Mon code en PHP qui mange du HTML et sort du text/plain, sans les tags, mais en conservant au mieux les retours à la ligne, retirant les liens du corps du texte pour les lister tout à la fin.

En particulier, il s’agit ici de parser des e-mails au format HTML, et de les convertir en text/plain. Problème : beaucoup d’e-mails HTML sont fait avec des tableaux et beaucoup de bruit bien dégueulasse.

Store on Discord, but the file have now an expiration date.

Another supply-chain attack.

According to new reports by Aikido and Socket, the compromised packages were modified to include a malicious 'preinstall' script that executes automatically when the npm package is installed.

That's why it's pertinent that https://npmx.dev lists these postinstall scripts

Why is Peter Pan always flying?

He neverlands.

I like this joke because it never grows old.

For a website build

For local development, this has been a big win. Re-rendering all the HTML pages used to take about 15 seconds, but with a warm cache it takes 0.06 seconds. That’s a 200× speedup that I feel every time I hit save, and it’s made working on this site a smoother and more satisfying experience.

Et selon l'annonce du PDG, réduit les effectifs de 109 000 à 75 000.

En réalité, cela introduit un coût immédiat.
Chaque abstraction anticipée augmente :

• le temps de développement
• le temps de review
• la difficulté d’onboarding
• la surface de bugs potentiels
• la complexité du debugging
• la quantité de tests nécessaires
  Et surtout :
• le besoin anticipé peut ne jamais arriver.
  Mais même si ce besoin arrive un jour, un autre problème apparaît. La solution que nous avons imaginée n’est peut-être pas la bonne.

Because the problem is so low-level to solve that the Rust guarantees can not work properly at this assembly code level.

Safe wrappers can be built upon it though.

C'est ce qu'on fait: tester en tant qu'utilisateur. C'est le minimum, je dirais même avant les tests automatisés.

Les tests valident le code
l’usage valide le produit.

En comparant la réalisation du ticket avec l'essai du produit en tant qu'utilisateur:

Exécuter un ticket est simple :

• lire les requirements
• implémenter la logique
• écrire les tests
• ouvrir une pull request

Tester réellement le produit demande un effort différent.
Il faut :

• suivre le parcours complet
• imaginer les actions d’un utilisateur (se mettre à sa place)
• tester des scénarios inattendus.
  C’est plus lent, et demande de l’empathie.

About the <picture> syntax which the author finds great.

On the contrary, the srcset and sizes attributes on one image are hard to use. "So, we are left describing the all of the sizes that an element will be, across every breakpoint and container query, as a single string, in an HTML attribute. How disgusting."

A tool is neede to write media queries in the sizes attribute.

How is a tool supposed to generate (min-width: 1340px) 257px, (min-width: 1040px) calc(24.64vw - 68px), (min-width: 360px) calc(28.64vw - 17px), 80px though?

The author proposes to bury this attribute and use sizes="auto". The developer can rely on loading="lazy" to load the images after the layout is computed, thus the browser know the size in advance.
sizes values remain a must have for images displayed way up at the top of the page... well sizes="100vw" is a good fit for it, isn't it?
All other images? loading="lazy" sizes="auto"

Customer research is always quantitative. The start the next Google with venture capital. That’s not true. The research is really what allows you to distinguish yourself from your competition so that when someone comes to your site.

No SEO wakes up in the morning and thinks, “Damn, I have a WordPress problem.” They wake up in the morning and say, “Damn, I have a business problem.”

As an example:

You’ve gotten this level of traffic so far with your existing site. You want to double that over the course of the next year. You were saying that the roadblocks that are stopping you are a) you’re on an outdated architecture where you, personally, have to write everything, and b) it’s been impossible to find someone who is a subject matter expert at this who can also make web pages, because that combination of interests just does not exist.

The response:

I totally understand that it is impossible to find someone who is both good enough of a journalist in the space to work for a genuine published magazine and also can edit HTML pages. I have an idea for you. I’m going to make a CMS for your website. That’s just a page that they can go into, like WordPress, and they can do their writing like they do so well. The CMS will ship it over to you, and you figure out which business model that you experimented with will work well with this content.

I pay them pretty well. I have passed on hiring engineers who may be more technically proficient, but they didn’t understand what I wanted. Honestly, guys, as a business owner, do you think I care if you’re using this technology or that? I just don’t give a damn [about technology]. I really don’t.

Nothing motivates people like having their own words repeated right back to them, which is something that you should try to do more often.

Even if you’re building a website for someone, it’s not just a website, right?

There is some particular need that they have for that website, whether it’s for their business purposes or because a lot of business owners are very personally invested in their business.

By the way, guys, for all the engineers in the audience, you sell engineering services to for profit companies because they are the only people who can pay actual professional engineer rates.

The CEO only sees it in the “This is the tool that someone I trust is doing something incredibly valuable with me on. It is cheap at any reasonable price."

Focus on taking your B+ customers/prospects to be A customers. Don’t focus on the D people, trying to turn them into A customers. It will never happen.

Author blog about the business of making and selling software: https://www.kalzumeus.com/blog/

As always: test on the data.

XZ stays my favorite though.

An app on the web performs better on many points. Definitely.

• distribution
• maintenance
• releases
• adoption (shareware funnel to get the desktop app running)

C'est clairement une mauvaise idée

A self version of Shazam

# the api key generation
fn hash_api_key(api_key_id: Uuid, version i16, organization_id: Uuid, secret: &[u8]) -> [u8; API_KEY_HASH_SIZE] {
    let mut hasher = sha3::Sha3_512::new();

    hasher.write(api_key_id.as_bytes());
    hasher.write(&version.to_le_bytes());
    hasher.write(organization_id.as_bytes());
    hasher.write(secret);

    return hasher.sum();
}

the storage in the database

CREATE TABLE api_keys (
  id UUID PRIMARY KEY,
  created_at TIMESTAMP WITH TIME ZONE NOT NULL,
  updated_at TIMESTAMP WITH TIME ZONE NOT NULL,

  name TEXT NOT NULL,
  expires_at TIMESTAMP WITH TIME ZONE,
  version SMALLINT NOT NULL,
  secret_hash BYTEA NOT NULL,

  organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,

  UNIQUE (name, organization_id)
);
CREATE INDEX index_api_keys_on_organization_id_and_expires_at ON api_keys (organization_id, expires_at);

X.400 is arguably a better standard than SMTP, but the simple email address and the ease of implementation won.

« Les attaquants bénéficient d’un avantage asymétrique, puisqu’il leur suffit d’exploiter une seule brèche», alors que les défenseurs doivent couvrir une surface d’attaque qui n’est certes pas infinie, mais suffisamment étendue pour laisser des trous dans la raquette. Les développeurs de Firefox ne peuvent pas se permettre de « réécrire des décennies de code en C++ ».

De l'autre côté, l'IA peut détecter ces failles rapidement. Il est probable que ce genre de détection de faille soit inclus dans les processus avant la livraison d'une nouvelle version par exemple.

l’éditeur PDF intégré, qui permet de réorganiser, copier, coller, supprimer et exporter des pages dans un document PDF.

Oh pas mal

The GNU Coreutils version published a faster version of some tools

An alternative to the frozen NPM which delivers more useful informations per package

Vercel's turn

Changer un identifiant dans l'URL, c'est si simple.

Sur un forum cybercriminel, un certain « breach3d » a mis en vente une base de 18 à 19 millions d'enregistrements, présentée comme issue des systèmes de l'ANTS. Le vecteur d'attaque revendiqué est une vulnérabilité IDOR (Insecure Direct Object Reference) sur l'API du portail moncompte.ants.gouv.fr. Il suffisait de modifier un identifiant dans une requête pour consulter les données d'un autre citoyen.

Intel fabrique ses Core Series 3 dans ses usines américaines (Oregon, Arizona) sur le procédé 18A sans passer par TSMC, concrétisant sa stratégie d'indépendance via le CHIPS Act.
Intel fabrique ses Core Series 3 dans ses usines américaines (Oregon, Arizona) sur le procédé 18A sans passer par TSMC, concrétisant sa stratégie d'indépendance via le CHIPS Act.

Ce sont des puces d'"entrée de gamme", mais quand même 6 coeurs (2 performance Cougar Cove + 4 basse consommation Darkmont), 2 coeurs GPU Xe3, un NPU à 17 TOPS et une prise en charge mémoire en simple canal, des fréquences de 4,3 à 4,8 GHz.

D'un autre côté, ces puces ne sont pas utilisales pour Copilot+
Rien à voir avec mon ordinateur portable de 2017 déjà :D

Source: https://www.theregister.com/2026/04/17/intel_eases_reliance_on_tsmc

Blog: https://www.autisticasfxxk.com/blog/

Links: https://www.autisticasfxxk.com/links/

Source: https://www.ecoticias.com/en/engineers-have-developed-a-material-capable-of-self-repairing-more-than-1000-times-which-promises-to-extend-the-service-life-of-key-components-in-airplanes-cars-and-wind-turbines-for-centuries/30800/

This data structure seems efficient and interesting

The maintainer retires, so there are many projects going unmaintained without help

The cost of indexing: it uses more storage to use the data structure. A table with eight indexes has nine things to keep warm in cache, not just one. The more indexes you have, the more options the query planner must weighs.

Why index is not working?

• composite indexes care about order
• functions defeat the index: case-insensitive does not match an index created on the fly. It applies to any function wrapping the column.

How to avoid these pitfalls? Measure.
There is the tool EXPLAIN in Postgres telling how it plans to run a query. Using it before the query explains it :) The Index Scan instruction is what is looked for.
EXPLAIN ANALYZE runs the query and reports what happened.

Things nobody shares:

functional indexes
CREATE INDEX ON pokemon (lower(name));
but why are the data not stored in lowercase in the first case

partial indexes
avoid a full index
CREATE INDEX ON pokemon (name) WHERE is_legendary = true;

covering indexes
If the index already contains every column the query needs, the database can answer the query from the index alone, never touching the table.
CREATE INDEX ON pokemon (name) INCLUDE (base_attack);. INCLUDE is a way to say “carry this column along for the ride, but don’t bother sorting by it”. Use it if the columns whose data types don’t have an appropriate operator class for the index type, or add columns to a unique index without changing its uniqueness semantic.

"stateless" authentication simply is not feasible in a secure way. You must have some state to handle tokens securely, and if you must have a data store, it's better to just store all the data.

The reason to avoid JWTs comes down to a couple different points:

• The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions need to have longer lifespans than that.
• "stateless" authentication simply is not feasible in a secure way. You must have some state to handle tokens securely, and if you must have a data store, it's better to just store all the data. Most of this article and the followup it links to describes the specific issues: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/
• (Yes, people are doing it, and yes, their applications are flawed, and you should not repeat that mistake.)
• JWTs which just store a simple session token are inefficient and less flexible than a regular session cookie, and don't gain you any advantage.
• The JWT specification itself is not trusted by security experts. This should preclude all usage of them for anything related to security and authentication. The original spec specifically made it possible to create fake tokens, and is likely to contain other mistakes. This article delves deeper into the problems with the JWT (family) specification.

Gowall started as a tool to convert an image ( specifically a wallpaper ) to any color-scheme / palette you like! It has now evolved to a swiss army knife of image prosessing offering (OCR,Image upsacling,image compression and a lot more)

A great FAQs. CommonJS and ESM is still a mess, especially. Yes I am looking at you NestJS.

Topics covered:
How can I move my CommonJS project to ESM?
Can I import ESM packages in my TypeScript project?
How can I make my TypeScript project output ESM?
How can I import ESM in Electron?
I'm having problems with ESM and Jest

Perhaps the most unusual thing about my career trajectory is that I’ve been at the same place for twenty years now. That’s pretty much unheard of in tech. It’s far more usual to see people switch companies—and get a salary bump—every couple of years.

Mon analogie préférée était de comparer des objets S3 à des livres dans une bibliothèque (on ne peut pas modifier une page, il faut remplacer tout le livre) alors que des fichiers sur votre ordinateur peuvent être modifiés page par page

Donc AWS vient de sortir un système de fichiers sur le réseau dans un bucket. C'est plutôt S3 qui manquait de spécification afin d'être. Une fonctionnalité manquante depuis des années.

Les objets S3 sont accessibles « sous forme de fichiers et de répertoires, prenant en charge toutes les opérations du Network File System (NFS) v4.1 + telles que la création, la lecture, la mise à jour et la suppression de fichiers ». Amazon ajoute que « S3 Files utilise les permissions POSIX pour les fichiers et les répertoires ».

Note de Alfred1664: "Il y a plusieurs projets qui existent, certains sont posix:

• S3FS (via FUSE)
• Mountpoint-S3 (Un remake de S3FS par AWS)
• JuiceFS (utilise S3 pour stocker les blocs des fichiers)
• Goofys (pas d’accès aléatoire, mais utile dans certains cas)"

Le prix d'utilisation me semble cependant plus cher que du stockage S3 classique.

Nous sommes en train de connaître la fin de l’intellectualité comme nous avons traversé la fin de la vie privée. Non, ce n’est pas réellement la fin. C’est juste que l’intellectualité, tout comme la vie privée avant elle, a perdu son statut de valeur fondamentale pour devenir un truc underground, uniquement valorisée par quelques cercles de plus en plus considérés comme marginaux, y compris, surtout, au sein des plus prestigieuses institutions académiques.

Tout comme la valeur de la science est socialement plus autant valorisé qu'avant. C'est dommageable pour le progrès.

La bannière de cookies est vraiment quelque chose que les sites s'infligent eux-même et surtout à leurs utilisateurs.

Le FBI, la CISA, la NSA, l'EPA, le département de l'Énergie et le Cyber Command américain ont publié un avis conjoint. [...] Six agences fédérales qui publient un avis commun, ça donne une idée de la gravité du truc. Le fait que des hackers puissent encore trouver des automates industriels directement accessibles depuis internet en 2026, c'est quand même assez idiot. Surtout quand ils contrôlent des stations d'eau ou des centrales énergétiques.

Source: https://edition.cnn.com/2026/04/07/politics/iran-linked-hackers-disrupt-us-industrial-sites

and the development is significant

66% en règle général, mails elle peut atteindre 75% en faveur d'un organisme d'aide aux personnes en difficulté ou en faveur d'un organisme d'aide aux victimes de violence domestique.

Idem pour les dons liés à la conservation du patrimoine, et 66% au delà de 100€, dans la limite de 20% des revenus imposables.

Ce montant était jusque-là de 1 000 € de dons cumulés dans l’année. La loi de finances pour 2026 a porté cette limite à 2 000 € pour les dons effectués depuis le 14 octobre 2025.

Tout repose sur la capacité du compilateur à paralléliser les tâches.

Et Groq, la startup qui fait beaucoup parler d'elle pour la vitesse de ses puces d'inférence, utilise une architecture VLIW où le matériel ne prend aucune décision à l'exécution.

L'inférence de réseaux de neurones, c'est justement le type de calcul idéal pour le VLIW : des opérations régulières, prévisibles, massivement parallèles.

Pas besoin de réordonnancer quoi que ce soit, le compilateur peut tout planifier en amont. Des chercheurs travaillent d'ailleurs sur des extensions RISC-V qui intègrent des principes VLIW pour combiner le meilleur des deux mondes.

Source: https://hackaday.com/2026/04/07/a-history-on-the-impossible-vliw-computing/

1. Implement the Copy trait
2. Take parameters by reference
3. Use the proper iterator
4. Have closures capturing by value also return the value

Contrary to Lit, Elena does not seems to need as much JS, which is awesome for templating.

This tool calculates font metrics for an uploaded font. The values it outputs, such as aspect ratio, can be used with the CSS font-size-adjust property. For more details see MDN.

Avec le retour du HollandaisVolant, il explique bien que les batteries au calcium sont plus lourdes; ce qui engendre aussi une voiture plus lourde.

Nous n'avons pas besoin de batterie légère au lithium-ion tout le temps effectivement. D'autres batteries plus robustes peuvent être utilisée pour le stockage.

À propos de la #voiture électrique:

Si une voiture charge 50 kWh en 1 h, il charge à une vitesse de 50 kW (en moyenne). On dit à « 1 C ».
Certaines voitures chargent à 4 ou 5 C, donc regagnent la totalité de leur énergie en 12 à 15 minutes. C’est très rapide et éprouvant pour les batteries.

À un degré suffisant, la bêtise ou l’incompétence sont indistinguables de la malveillance.

Si vous êtes convain­cus que le télé­tra­vail est la meilleure façon d’or­ga­ni­ser le travail, vous allez instau­rer une culture et une orga­ni­sa­tion qui va avec. Ça peut être plus d’écrit, plus d’asyn­chrone, un dépla­ce­ment du budget des locaux vers le maté­riel ou vers des événe­ments ponc­tuels dans l’an­née pour se retrou­ver, ou quoi que ce soit que vous imagi­nez.

Un autre argumentaire en faveur de la voiture électrique

LinkedIn scans for over 200 products that directly compete with its own sales tools, including Apollo, Lusha, and ZoomInfo. Because LinkedIn knows each user’s employer, it can map which companies use which competitor products. It is extracting the customer lists of thousands of software companies from their users’ browsers without anyone’s knowledge.

And more things:

• Linkedin published one API to the European Commission as compliance. These APIs handle approximately 0.07 calls per second. Meanwhile, another internal API called Voyager handles 163 000 calls per second. In Microsoft’s 249-page compliance report to the EU, the word “API” appears 533 times. “Voyager” appears zero times.
• At the same time, LinkedIn expanded its surveillance of the exact tools the regulation was designed to protect. The scan list grew from roughly 461 products in 2024 to over 6,000 by February 2026. The EU told LinkedIn to let third-party tools in. LinkedIn built a surveillance system to find and punish every user of those tools.
• LinkedIn loads an invisible tracking element from HUMAN Security (formerly PerimeterX), an American-Israeli cybersecurity firm, zero pixels wide, hidden off-screen, that sets cookies on your browser without your knowledge. A separate fingerprinting script runs from LinkedIn’s own servers. A third script from Google executes silently on every page load. All of it encrypted. None of it disclosed.

They use common logic in Rust. The diagram is definitely interesting.

à suivre

1. Share immutable data in threads
2. Mutex while sharing mutable data

An recommended example is provided in the "[Fearless Concurrency]"(https://blog.rust-lang.org/2017/11/14/Fearless-Concurrency-In-Firefox-Quantum.html) post of Mozilla about the success they has in parallelizing the CSS renderer.

Comme les humains sont assez mauvais à créer des logiciels sans bugs, Rust est grâce au compilateur un très bon moyen d'en éviter un certain nombre.

Recently, Nextcloud, IONOS, and a bunch of other European tech companies came together to launch a new open source project called "Euro-Office", described as a "sovereign replacement for Microsoft Office with intuitive interface and strong compatibility backed by European open source community. Now, ONLYOFFICE has suspended its 8-year-old partnership with Nextcloud, citing license violations after the Euro-Office coalition forked the ONLYOFFICE repo.

They [...] claimed that ONLYOFFICE discourages contributions, ignores pull requests, and lacks transparency, since commit messages frequently reference internal issue trackers only.

ONLYOFFICE is criticized by its open-source competitor LibreOffice for being fake open source. The software defautls to Microsoft Office formats.

There is a way to performs actions while connecting a keyboard (of course!).
It's a udev rule.