Un service d'impression de livre. Est-ce qu'il y a encore besoin d'utiliser une maison d'édition pour ses livres personnels? Non.
Est-ce qu'on en a besoin pour avoir le réseau des librairies. Oui.

dickover n. : a modal panel, popover, or curtain presented by a website or app, deliberately obscuring its own content to frustrate the user with an unwanted, unnecessary, mandatory interaction; e.g. asking the user to accept “cookies”, subscribe to a newsletter, install the website’s mobile app, agree to terms of service, or anything else that the user couldn’t give two shits about.

Similarly there are the dickbar

safe-area-insert is useful to provide some padding to avoid cameras and virtual buttons. This is not needed because the browser handles it for you already.

It's still needed for elements with position: absolute or position: fixed

Browsers by default will prevent your site from being obscured by the notch or home indicator, so your content will be safe without any special handling.

Ideally we want the content to stretch edge-to-edge, but we want to make sure they're not obscured by system UI. To get that, you need to opt in to the full viewport and handle safe areas yourself.

Even the best have "No idea" for "Safety" at some places. Another one: https://github.com/rust-lang/rust-analyzer/blob/932186d9c2046257c0a1fc38c1cecf7bc19736c3/crates/hir-def/src/lib.rs#L536

There is an "// SAFETY: Come fight me" in the rust uuid crate :D

C'est bien pratique pour manipuler un format plus simple que les vcards.

La version 2 rend l'uid optionel afin de suivre le format vCard

. If you add all the providers’ estimates up, Sommer said, you get 100 to 200 quadrillion tokens a year. But to achieve the the $2 trillion in annual spend Gartner calculated, providers would need to be generating, by conservative estimates, a cumulative 10 sextillion tokens per year.

So the token consumption would need to grow by 50 000 - 100 000 until 2030.

It's hard for the market though because developers or users are known to switch between models.

The foundation has currently 3 projects:

• Define the AGENT.md file
• Develop Goose: Open-source AI agent to install, run, edit, and test with any LLM
• Define the MCP protocol

L’incident en question a notamment exposé les données d’état-civil des adhérents (nom, prénom, date et rang de naissance), le numéro de sécurité sociale, le numéro de contrat, et les dates de début et de fin de couverture.

Il est question d'un fichier de 44 millions de lignes contenant notamment 15.45 millions de numéros de sécurité sociale unique.

Comme Cerballiance, c'est la deuxième fois en deux ans.

I won’t post my text here, since it needs to be in your natural voice. But here’s my outline, in case it helps:

1. a clear “no” right away
2. gratitude, since I’m honored by my value implied in the ask
3. explanation that to stay focused on a bigger “yes”, I’m saying “no” to everything else
4. good wishes, and if my situation is temporary, an invitation to ask again next year

Four sentences is enough. Nobody wants verbosity he

Sanitize -> Désamorcer: je dirais plutôt "nettoyer".

La plupart des traductions semblent cohérentes.

AI costs more than it brings value compared to human worker

Alors comme pour le choix de retirer Pluton des planètes, il faudrait alors considérer d'autres astres comme Éris, Hauméa ou Makémaké.

On estime qu'elle renferme plus de 100 000 objets de plus de 100 km de diamètre. Pluton en est le représentant le plus connu, mais d'autres mondes [...] y résident également, considérés comme des vestiges de la formation du Système solaire.

Peut-être considérer certains astres comme planètes naine lorsqu'ils ont une géologie active.

Effectivement, l'ouverture a la concurrence ne va pas aider à maintenir un réseau de qualité entre les différents opérateurs concurrents.

L'exemple est déjà montré par l'Angleterre.

Le recul du service public ferroviaire est déjà quantifié par l’Autorité de régulation des transports : entre 2017 et 2024, le volume global d’arrêts en gare de rames TGV a reculé de 8 %. C’est même -12 % dans les agglomérations de moins de 700 000 habitants.

Alors que dans le même temps, la SNCF récolte de plus en plus d'argent.

Les régions se sont endettés pour créer des sociétés publiques locales dédiées aux TER. Les candidats peuvent être indemnisés à hauteur de 1.2 million d'euros, record des appels d'offres des lignes J et N du Transilien.

Ensuite, chaque région possède sa "marque" de train. Transilien en Île-de-France, TER en nouvelle-Aquitaine (normal), NOMAD en Normandie, Fluo dans le Grand Est.

L'auteur Serge Zaka explique que l’épisode de chaleur attendu fin mai en France est totalement inédit (précoce et intense). Les météos de devraient plus banaliser ces vagues de chaleurs : on pourrait atteindre des niveaux jamais observés aussi tôt dans l’année.

Cette chaleur intense et précoce a des conséquences notables

• les oiseaux nichant sous les toits risquent la déshydratation et la mortalité ;
• les jeunes cultures et potagers peuvent “brûler” rapidement ;
• les céréales (blé, orge) pourraient subir des pertes importantes de rendement ;
• les arbres et les sols vont entrer très tôt en stress hydrique ;
• la faune sauvage sera perturbée en pleine période de reproduction ;
• les animaux d’élevage vont subir un stress thermique important.

Cette chaleur survient à une période où les organismes vivants ne sont pas préparés à de telles températures, ce qui la rend particulièrement dangereuse.

A gameboy advanced startup screen for "The Weekend ladies and gentleman"

Signal client uses SQLcipher database to store conversation messages. Since SQLcipher
is essentially SQLite with encryption, it inherits SQLite features.

To update the database, SQLite (and consequently SQLcipher) uses Write-Ahead Logging.
All transactions are written to a Write-Ahead Log file, which is then merged to the
main database file when a certain number of pages are written to the log file, the
database is manually checkpointed, or the database file is reopened.

This results in an unexpected situation when messages are deleted in Signal, either
manually or by a timed deletion. The deletions from the database are recorded to the
Write-Ahead Log file, but they are not actually deleted from the database file until
the Write-Ahead Log is committed back to the main database.

By default, the Write-Ahead Log has a threshold size of 1000 pages. Depending on how
busy your Signal app is, this transaction limit could take several days to reach. This
means that the messages deleted in Signal will linger on disk far longer than expected.
The database file with the supposedly deleted messages can easily end up being backed
up to Time Machine backups, adding unexpected data persistence.

Since its reporting 29 months ago, the vulnerability remained unknown except to Chromium developers. Then on Wednesday morning, it was published to the Chromium bug tracker. Rebane initially assumed the vulnerability was finally fixed. Shortly thereafter, she learned that, in fact, it remained unpatched. While Google removed the post, it remains available on archival sites, along with the exploit code.

Another proof that using User-Agent is a wrong idea. The DB forbids requests when the UA contains "Linux".

They had to mitigate a DDoS attack mid-February, so they could have acted quickly.

Les investissements des GAFAMs dans ChatGPT et Anthropic retournent en investissement d'infrastructure (Cloud, Hyperscaler) pour les GAFAMs.

Mais en plus, ces entreprises voient leur valeurs augmentées augmentent en même temps la valeur des actions détenues.

Si la valeur des entreprises d'IA baisse alors cela fera très mal aux revenus de ces entreprises, ainsi que leurs actions.

Implementing raw text is hard on native

Mis à part le sport en direct, les chaînes de télévision n'ont plus de grande part de marchés.

Describes tracking capabilities a website can do on behalf of the user consent.

The client is not a thin view requesting permission to show data. The client is a node in a distributed system with its own database.

It’s overkill for simple CRUD apps with no offline or collaboration needs.

But here’s where it shines: note-taking, document editing, collaborative design tools, project management, field apps with unreliable connectivity, basically anything where data privacy is a selling point, as well as anything with real-time collaboration.

One more thing I wish someone had told me earlier: you don’t have to go all-in. I’ve had the best results using local-first for specific features within otherwise traditional apps. Offline drafts in a blog editor. Real-time collaborative notes inside a project management tool that’s otherwise standard REST.

To do so: SQLite in the browser via WebAssembly; persisted to the Origin Private File System (OPFS). The author describes the method used.

To avoid conflicts: CRDT. Yjs exists. There is also Automerge and the newer Loro.

To grasp the data: replicate rows via database replication.
PowerSync does this well from Postgres to SQLite.
Triplit is a full-stack database with sync built-in.
LiveStore use an event-based approach.
TinyBase for prototyping or small apps.
PGLite (Postgres compiled to WASM) but it has a significant bundle size and memory footprint for mobile browsers.

Often the last-write-wins (LWW) is the best strategy at the field level.
For a document body, CRDT should be used.
To book a meeting, one must verify there is no other meeting booked by someone else. " The approach I’ve landed on (after getting it wrong twice) is: validate on the server during the write-back phase, but flag violations rather than silently rejecting them. When the client pushes mutations to the server during sync, the server runs them through a constraint validation layer before applying them to Postgres". See the example.
The conflict should then be resolved by the user.

For something like inventory management where two people “buy” the last item, that window is unacceptable, and that’s exactly why I said earlier that local-first is wrong for systems requiring strong transactional consistency.

Conflict resolution works well for texts with CRDT.

See such app architecture: https://www.smashingmagazine.com/2026/05/architecture-local-first-web-development/#building-a-real-app-architecture-auth-and-migrations

Example of E2E (local, on device) encryption for https://anytype.io/

One thing to consider is migrations: Design your migrations to be additive. New columns with defaults. New tables. Don’t rename or drop columns unless you absolutely must, because users running old app versions will still be syncing data, and your server needs to handle the mismatch. I learned this the hard way when I dropped a column that an older client was still writing to, which caused silent sync failures for about 200 users over a weekend.

Performance are awesome (< 10ms for read or writes). The initial sync is where the cost occurs.

The architecture can be tested with Playwright and context.setOffline(true).

I’m excited about where this is going. PGlite (full Postgres in the browser) feels like a glimpse of a future where the client/server data layer distinction just dissolves. You write SQL, it runs everywhere, sync is a runtime concern rather than an architectural decision. We’re not there yet, but you can see it from here.

There is also no standard for a sync engine. Migrating away a sync engine is not trivial. I’m also worried about the complexity budget. Local-first adds real architectural complexity: sync engines, conflict resolution, client-side migrations, partial replication, and auth at the sync boundary.

"Unix was named (phonetically) by bwk. I don't think he ever spelled it, but, since it was a play on multics, he thought it was unics. (you can ask him)

at the time, unix was compiled on the central computer at bell labs (GE-635) that produced a PDP--7 paper tape. usuallly i just ran the tape and threw it away. when i needed to save a tape, i wrote "unix" on the tape. it stuck after that.

Problème : le kit choisi par l’Europe se connecte en Lightning, le port contre lequel la Commission européenne a lutté pendant plus d’une décennie. Une erreur évidente de communication, alors que l’USB-C a remplacé le port d’Apple grâce aux efforts de l’Europe. Encore plus amusant : il existe bien une version USB-C du micro cravate sur le catalogue de Devia… mais elle est plus chère.

C'est le problème lorsque les responsabilités sont diluées, plus personne n'est responsable de rien et il n'y a plus de structure commune. C'est ici un exemple mineur qui n'a pas vraiment d'impact.

A Finite State Transducer seems to be the best algorithm instead of a full index search.
The data don't need to be stored in a database indeed. They only need to be searched as text.

Practical resources created by the author, grouped by references

Cette nouvelle méthode permet de sécuriser plus rapidement Firefox, puisque l'IA montre une faille et essaie de résoudre le problème. Cela sert de base de travail.

Rappelons que d’un point de vue réglementaire, les informations qui révèlent l’orientation politique relèvent de ce que le RGPD qualifie, dans son article 9, de « données sensibles ».

ainsi que l'article de Korben https://korben.info/les-donnees-de-120-000-adherents-lfi-dans-la-nature.html

1. Clarity is job #1
2. Interfaces exist to enable interaction
3. Conserve attention at all costs
4. Keep users in control
5. Direct manipulation is best
6. One primary action per screen
7. Keep secondary actions secondary
8. Provide a natural next step
9. Appearance follows behavior
10. Consistency matters
11. Strong visual hierarchies work best
12. Smart organization reduces cognitive load
13. Highlight, don't determine, with color
14. Progressive disclosure
15. Help people inline
16. A crucial moment: the zero state
17. Great design is invisible
18. Build on other design disciplines
19. Interfaces exist to be used

• Convert external sources to motivation: a bot that reminds a new subscription for example
• Leave tasks unfinished: I try to leave a task 90% finished at the end of a working session. It feels slightly worse than closing out the work, but it makes starting the next day 10x easier.
• Use the thing myself, as much as possible
• Address the pain, instead of pushing through: The trick, is that you can almost always make these less painful.
• do nothing before work
• update the users (or keep a notebook)
• get a partner
• no zero days, to avoid listless guilt

Every attempt to score open source is not accurate.

The most consequential mistake is treating the absence of a signal as a low value of that signal.

Missing FUNDING file

Easy to collect doesn't mean something

Stars on Github (ICU only 3.5k, 2.5k), CVE counts (compare the Linux kernel to

One number, many units

npm "download" is mostly a count of CIcache misses. Dependent counts are different between a string-padding helper on npm and a C compression library that is statically linked and distributed as vendor or a git submodule.

Github as the visible universe

Not everything is on GitHub. Contributors (so the bus factor count too)

Project identity is different on different platform

curl has many names across platforms.

Invisible funding

The most common funding arrangement for critical infrastructure is none of those. It’s a maintainer employed by Red Hat, Google, Intel, Canonical, or a hardware vendor, with the project as some or all of their job, and that arrangement leaves no trace in any file a crawler can fetch. The second most common is consulting and support contracts around the project, which is similarly invisible.

and it compounds because the project doesn't look like an npm package. "The quiet system library with one tired maintainer and no dashboard footprint is exactly what we built all of this tooling to find, and it remains the thing the tooling is structurally worst at seeing."

2% for the Linux Kernel.
4% for the blockchain
12% to AI, ML and Data analytics

6 times more to AI, ML and data analytics than the kernel.

Per project type:
72% to OSS
17% to standard and specification
5% to community initiative
2% to open hardware
2% to open data
1% to open governance network
1% to peer network

The member of the Linux foundation changed and their priorities too.

After JSON-LD, the working group announced a CBOR-LD.

It follows the JSON-LD philosophy of connecting and structuring data, but for CBOR https://json-ld.org/.

There are reasons to be negative about the future of the web. The author reminds what is awesome about the web. There are many topics: Accessibility, animations, building stuff, optimizing, semantic markup, styling.

An example of scripts rewritten in Rust

Validate the wrapped HTML

Lazy Imports
Frozendict & sentinel (symbols ofJS) built-in type
UTF-8 encoding by default
...
and better performances

Step into a smoky 80s detective agency, question suspects with SQL queries, and crack the case one statement at a time.

Turns a folder into a website

• Your best users are the ones who complain. A user told me at 10pm that my uninstaller just nuked his shell config. My instinct was to get defensive. Instead I traced it — and found it was worse than reported. That one message led to rewriting the entire uninstall logic from scratch. Every angry bug report is a gift.
• Your favorite metric can lie to you. I built a cache that reduced file reads from 2,000 tokens to 13. Great numbers. Then a user told me: "Models waste more tokens working around stale cache than the cache saves." He was right. The fix wasn't removing caching — it was making invalidation smarter. Your dashboard can look great while the experience is terrible.
• Saying no is the hardest part. A new feature would have let me compress all tool output automatically. Massive savings on paper. I designed it, prototyped it, then killed it. Because when compression eats an error message, there's no undo. Protecting quality beats shipping features.
• Community is a relationship, not a channel. When someone reports a bug, my first response matters more than the fix. "Will check" buys time but shows I'm listening. Following up shows respect. Shipping the fix shows they matter. My best testers are people who once filed angry reports.
• Ship the boring stuff first. Nobody cares about your adaptive entropy-based compression algorithm if the installer breaks their dotfiles. Get the fundamentals right — install, uninstall, doctor, setup — before you get clever.
• Focus means killing good ideas. My backlog has 50+ ideas. Each one is good. But spreading across all of them means none become great. Rust helps here — the compiler forces you to finish what you start.

Display a diagram of the automate created by the regex

Exactly similar to https://regexplained.com/

Pour naviguer et décoder des formats binaires

Explains the hashes visually

Lichen is the simplest possible CMS for the web that is friendly enough for non-technical users. Comprised of just a few Forth CGI scripts, it is extremely lightweight. This site is built in Lichen. It can also be used as a static site generator.

Un exemple d'acharnement judiciaire?

I learned the content property has an alt (similar to images) if needed.

The snippet:

[href^="http"]:not(.btn, :has(svg)):not([href^="https://gomakethings.com"], [href^="http://localhost"])::after {
background-color: currentColor;
    content: "" / "(external link)";
    display: inline-block;
    mask: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8.636 3.5a.5.5 0 0 0-.5-.5H1.5A1.5 1.5 0 0 0 0 4.5v10A1.5 1.5 0 0 0 1.5 16h10a1.5 1.5 0 0 0 1.5-1.5V7.864a.5.5 0 0 0-1 0V14.5a.5.5 0 0 1-.5.5h-10a.5.5 0 0 1-.5-.5v-10a.5.5 0 0 1 .5-.5h6.636a.5.5 0 0 0 .5-.5"/><path fill-rule="evenodd" d="M16 .5a.5.5 0 0 0-.5-.5h-5a.5.5 0 0 0 0 1h3.793L6.146 9.146a.5.5 0 1 0 .708.708L15 1.707V5.5a.5.5 0 0 0 1 0z"/></svg>');
    mask-size: cover;
}

The post poses one argument: AI empowers learning and it's easier than ever to learn 80% of the useful things in 20% time.

Maybe useful for later, but I see some advantages.

wcag2(aa) seems to be a good and self explanatory function.

It has limitations though:

• it doesn't guarantee perceptual or AAA compliance
• transition snaps because contrast-color returns a discrete value and
• tie goes to white
• gradients and images are out
• transparent colors are composited first
• windows high contrast mode takes over. It is defined in https://www.w3.org/TR/css-color-adjust-1/#forced-colors-mode

The generated colors can be combined with other color functions.

I am still concerned more and more computation will be put on simple webpages.

La vidéo a été strike sur youtube: https://www.youtube.com/watch?v=ld-f9b3OSTg

Trouver des chantiers participatifs ou des professionnels de la construction

IMHO they are ideas only, not key elements.

One good rule is: focus on th content !

• bio
• photo
• work examples / projects / what you do
• testimonials
• contact information
• links to social media accounts

La recherche d'argent se poursuit.

elles offrent des fonctionnalités supplémentaires d’analyses statistiques et l’accès à une audience plus large.

Donc l'"audience plus large" n'est pas celle des abonnés sur Instagram ou Facebook. Ces réseaux sociaux masquent donc volontairement une partie du contenu publié.

1. Fixing issues in the design phase is 100 times cheaper

2. Performance impacts user experience

3. Your site has 50 milliseconds to impress your customers

4. Hick’s Law: The cost of overwhelm

   Stakeholders often think “more options” equals “more value.” Psychology proves the opposite. Hick’s Law states that the time it takes to make a decision increases with the number of options available.

5. White space improves comprehension

6. The power of “fake” progress

7. Make your content readable: roper typography, specifically line spacing (leading) and paragraph width, can increase content comprehension and reading speed by up to 20%.

8. Your users only read 20% of your content

9. User testing with 5 people is the magic number

10. The financial ROI of 9 900%

« Nous vivons dans un monde où l’idée de s’optimiser s’est banalisée au point de devenir un schème grammatical »

The Luddite Lab Resource Hub provides resources for unions, labor organizations, and worker-organizers fighting AI and automation at work.

Mis à part que Linus ne pète pas les plombs, il établit les règles pour que Linux soit maintenu.

En deux ans, la liste de sécurité du noyau est passée de deux rapports par semaine à près de dix par jour, principalement à cause de chercheurs lançant les mêmes scanners IA en boucle sur les mêmes fichiers.

I don't like the way firefox is pushing its features instead of showing the configuration the user can change.

The part about customization and accessibility can only be good though.

The ecosystem is fragmented

One example to illustrate why Go is so great for backend services is that the Go services I'm working on don't even have a reverse proxy / load balancer in front of them. Thanks to Go built-in TLS and ACME (Automatic Certificate Management Environment), they are directly exposed to the internet, something that may not be possible due to the complexity of wiring together rustls and axum and ACME. Small details like that compound fast and considerably improve the deployment, management and operation of your backend services. Hey, even UUIDs are coming to Go's standard library.

Also async Rust will waste your time compared Go and your CI/CD pipelines may take 10 times more time (e.g. 4 minutes for Go, 40 minutes for Rust, for a service of the same size).

Sur iPhone et MacOS, les applications Facebook et Instagram peuvent lire vos conversations WhatsApp. Donc malgré le chiffrement, Facebook peut lire vos conversations WhatsApp.

Les chercheurs de Mysk ont identifié que WhatsApp enregistre l'historique des conversations dans un fichier nommé "Axolotl.sqlite". Ce dernier est placé dans un conteneur partagé entre les applications d'un même développeur, désigné sous l'identifiant "group.net.whatsapp.WhatsApp.shared"

Des explications plus profondes sont trouvées sur https://blog.cryptographyengineering.com/2026/02/02/whatsapp-encryption-a-lawsuit-and-a-lot-of-noise/

Pour la vie privée, Signal, DeltaChat ou Threema sont recommandées.

(via https://sebsauvage.net/links/?fc3u_A)

Technique si vous recevez du spam clairement illégal.

1. Prendre le nom de domaine de l'adresse email (après le @)
2. Rechercher ce nom de domaine sur whois https://www.whois.com/whois/
3. Regarder la ligne "Registrar Abuse Contact Email" (ou dans le groupe Registrar Information, la ligne Abuse Email)
4. Transmettre le mail frauduleux, et donner un peu de contexte dans le mail. Le service devrait faire le reste

Ou comment les États-Unis peuvent récolter les données de santé.

Merci PURR pour ce partage d'informations

Pertinent comments here about the importance of a large or a small standard library.

L’an dernier [en 2025], la France a connu « 873 cas, dont 128 importés, déclarés » de rougeole, soit une « augmentation de 80 % par rapport à 2024 », résume l’agence de santé publique.

« L’existence d’épidémies majeures dans des pays proches et avec des échanges fréquents avec la France (Maroc, Roumanie notamment) [a] pu favoriser et multiplier les importations de virus »

Ainsi que toutes les personnes qui ne veulent pas se faire vacciner.

Greg Kroah-Hartman is the main Linux kernel maintainer. He uses AI models on its own Framework laptop with fuzzing to discovers new bugs in the Linux kernel. The commits are listed with Assisted-by: gkh_clanker_t1000.

clanker is a funny name for a AI :D

Il reste que ces appareils de paiement fonctionnent sur une version certifiée d'Android ou d'IOS, avec du matériel américains.
Remplacer et maîtriser une partie de la technologie est cependant utile et autant saluer l'initiative.

These are definitely the rules I follow. I still not reach for <menu> yet.

in HTML5 they realized it was kinda annoying that the spec didn’t allow us to clump the terms and definitions together. So now a

is permitted as a non-semantic wrapper to help us clump those terms and definitions together:

Action list should be put inside <menu>. The nav element is a sectioning element whereas the `menu element is a list element.

RFC -> Review -> Decision meeting -> ADR

An explanation of a diamond journey

Another security issue in the kernel

LA seule chose qui retient Facebook en France, c'est la communauté. Il y a beaucoup de personnes qui utilisent ce réseau car tout le monde est dessus.

ses bilans financiers reconnaissaient 60 milliards de dette fin 2025, soit le double de l’année précédente, et ce malgré une comptabilité très créative.

Instead of Sentry: https://www.bugsink.com/
Instead of Stripe: https://www.mollie.com/

It’s not how much you have. It’s the difference between what you have and what you spend. If you have more than you spend, you’re rich. If you spend more than you have, you’re not. If you live cheaply, it’s easy to be free.

That's the ladybird browser's website by the way

CoMaps est plus simple. OsmAnd requiert de bien comprendre les différentes couches de l'application.

CoMaps est plus simple à mettre en navigation GPS uniquement; soit l'assistance réseau (Wi-Fi, Bluetooth, triangulation via Google Play Services) est activable. Cela est plus complexe sur OsmAnd.

OsmAnd est un couteau suisse: : couches météo, relief, courbes de niveau, profils multiples, traces GPX, plugins…

CoMaps fait moins mais plus simple.

Why?

Async in Rust is hard. The biggest drawback of async is the fragmentation of the ecosystem. Now you have sync functions and libs, async functions and libs, and different runtimes that are incompatible and thus require dedicated libraries for I/O.

An anemic standard library for daily needs.

The steep learning curve before being productive.

When Rust makes the most sense?

• common core for cross-platform apps. Proton leads the way.
• system programming
• embedded development
• insane scale

The client must have CA Root. Once the CA Root is verified, the client cana trust the certificates signed by the root and its other intermediate certificates.

Verification starts from the certificate of the domain. If it’s valid, the client verifies its issuer, and continues this process until reaching a certificate where the issuer is itself, indicating it is a Root.

For lyokolux.space, it goes as follow:

$openssl s_client -showcerts -connect lyokolux.space:443 -servername lyokolux.space 2> /dev/null | grep -A1 s:

 0 s:CN = lyokolux.space
     i:C = US, O = Let's Encrypt, CN = E8
--
 1 s:C = US, O = Let's Encrypt, CN = E8
     i:C = US, O = Internet Security Research Group, CN = ISRG Root X1

lyokolux.space is certified by Let's Encrypt. Let's Ecrypt is certified by the root certificate ISRG Root X1. The browser also tells ISRG Root X1 is a Certificate Authority.

Following the incident of DST Root CA X3 with a notable certificate expiration, the browsers started to trust Let's Encrypt directly. It seems openssl does it too because we don't see the certificate of ISRG Root X1 in the openssl output. The let's encrypt certificate is trusted because of ISRF Root XA.

1. A certificate can have only one issuer because the issuer is a fixed field in the certificate, not a list.
2. The essence of signing is just appending a hash value encrypted with a private key.
3. Intermediate certificates are not directly trusted by clients; clients only trust Root CAs.

To increase security, a certificate can be cross-signed and verified by one or the other sources. It's up to the client or the software to trust root certificates. When the client further narrows down the trusted list to only its certificates (or its CA), this is Client Certificate Pinning. For example, the TikTok app uses this.

Next: https://shaarli.lyokolux.space/shaare/13012
Previous: https://shaarli.lyokolux.space/shaare/1ar20g

Ça fait plusieurs fois que je vois passer la notion de "instant software", pour du logiciel qui serait tellement facile et peu cher à produire par des agents de codage que ça ne vaudrait plus la peine de le conserver au-delà de ses usages immédiats.

L'auteur propose "touillette logicielle" pour les nommer en français.

A new model emerges after the cathedral and the bazaar: the kitchen. The author describes it.

Every kitchen evolves around the habits of its cook. Tools sit where they are convenient. Ingredients are substituted freely. Recipes are modified on instinct. Two people may start from the same dish and end up with completely different results.

Kitchen rarely converge into a universal standard.

There are a number of serialization libraries that outperform JSON in NodeJS.

It's important to avoid generating extraneous garbage when doing these kinds of benchmarks.

It's important to provide an appropriately sized buffer when performing serialization.

If you care about serialization performance, consider using a different programming language with better tradeoffs.

You're running Android but not the official one? reCAPTCHA does not work anymore.

Maps are unrelated to the software release. That's definitely a good thing.

Les liens de téléchargement du logiciel ont été modifié.

D’après Thomas Klemenc de Malcat, le fichier distribué par les pirates contient bien l’installeur de JDownloader, associé à une charge malveillante de type RAT (Remote Access Trojan) écrite en Python.

Their relationship is:

• The client trusts the CA (for example Let's Encrypt)
• The CA issues certificates to websites (often certified by the industry standard ACME Challenge) .
• When a client visits a website, the website presents its certificate. Since the client trusts the CA, it also trusts the certificate issued by the CA.

To adress a privacy key leak by the CA, they often use intermediate certificates. That's the standard x509. The CA:FALSE value on certificates issued to entities means that even if they issue a certificate, it won't be trusted. So only root and intermediate certificates can be trusted to issue other certificates.

To trust a CA, the client store the CA locally.

Two posts follows:

• clients: https://www.pixelstech.net/article/1722050582-All-I-Know-About-Certificates----Clients
• websites: https://www.pixelstech.net/article/1722050937-All-I-Know-About-Certificates----Websites

Next: https://shaarli.lyokolux.space/shaare/hamcqA

Google course on error messages

The point is many actors can detect the flaw during the same week. A 90 days window to deliver a fix no longer holds

Somewhere out there, someone wrote a really good blog post today. You'll probably never find it. Google won't show it to you. Social media buried it under engagement bait.

Bubbles tries to surface it. Community voting applied to thousands of personal, independent blogs, with identity and discussion routed through the Fediverse.

Hacker News and Lobste.rs have community voting figured out, but non-tech content gets drowned by the tech majority. Kagi Small Web curates thousands of personal sites, but has no community-driven ranking. Blog directories help you find blogs, not today's best blog post. Social platforms own the conversation. Mastodon is decentralized and ad-free, but you only see what the people you follow share. RSS is great, but solitary. There's no collective signal telling you what's worth reading today.

Amos Bar-Joseph, PDG de Swan AI, s'est même vanté de sa facture Anthropic sur LinkedIn, y voyant la preuve qu'il bâtit une « entreprise autonome » qui grandit par l'intelligence et non par les effectifs.

La justification repose sur un calcul simple : un investissement massif aujourd'hui pour des économies permanentes demain. Les entreprises parient que le coût actuel, bien que supérieur aux salaires, est un ticket d'entrée pour se débarrasser à terme de la majorité des coûts liés à la main-d'œuvre.

Another color palette generator

A small efficient website.

The header is different: it's a text. It's always the same and only the rest of the view changes.

A system is what a system produces, and generative AI produces dangerously flawed code, ignorable copy, and, primarily, an excuse that protects companies’ valuations during layoffs. Generative AI provides these things at tremendous cost to the environment, while smothering the web that I’ve spent twenty years building.

I don’t use these tools. Not for writing, not for code, not for design, not for images, not for note-taking — not in whole or in part.

Another security vulnerability similar to copy.fail

Source extensions for Hayase

See https://miyomi.pages.dev/

Ein Text-Adventure-Lernspiel für die Datenbanksprache SQL

A trend emerges for specialized specification file (such as LICENSE or README). The author proposes one for HTML.md:

* Use the elements most appropriate semantically.
* Use as little HTML as possible.
* Validate all HTML output against an HTML validator (preferably the W3C one), and fix any errors.

s’il y a une chose que j’ai apprise dans cette recherche, c’est ceci : la plupart des trajets ne déraillent pas sur de la mauvaise technologie. Ils déraillent sur l’absence d’une réponse partagée à la question : qu’est-ce qu’on veut réellement atteindre ?

Suite au mail qui faisait perdre 2-3h par semaine aux

Et puis le ministre a fait quelque chose que je reconnais dans chaque trajet de transformation que j’ai étudié. En pleine crise, il a dit : on n’apprend pas à faire du vélo en regardant.

Le Schleswig-Holstein a économisé 15 millions d'euros sur les licences Microsoft, entre autres grâce à ce choix.

Based on the example of Russmedia: how does the fediverse blocks a content?

Build a web of trusted domains to avoid or detect AI slop

A quick prototyping tool: why should AI be used when you can do it quickly :D

A script checking all NPM dependencies that have a commit from Claude AI in their 100 latest commits.

It will only ping the GitHub API thought. So dependencies hosted elsewhere won't work.

This document specifies a network-layer protocol, IPv7, that extends
the Internet Protocol model with an identity-carrying address form
and an origin-validation mechanism intended to mitigate abuse of
residential proxy infrastructure. IPv7 replaces purely numerical
source addressing with a hierarchical identity string and a Variable-
Length Identity Block (VLIB) that carries an Ephemeral Identity Token
(EIT), provider and tenant identifiers, role/policy signalling, and
an Origin Signature verifiable by the originating provider. The
protocol enables routers to apply policy and reputation signals at
the network layer while limiting disclosure of a subscriber's long-
term identity to intermediate systems. This document addresses
growing security challenges in Internet-connected devices (IoT),
including smart TVs, appliances, and other residential endpoints that
are vulnerable to residential proxy exploitation and botnet
infection.

n8n

Following the basics of anchor positioning, there are many more use cases for this layout specification. Note this is not supported by browsers yet.

Logical properties can be used for the alignment.

position-try-fallbacks can be defined by the developer with @position-try. It accepts few rules: inset properties, margins, sizing, self-alignment, position-anchor, position-area.

Selon lui, le premier argument qui plaide pour un tel investissement en France est « l’énergie » : « Le fait que le pays soit producteur et exportateur d’énergie est absolument décisif pour des investissements d’infrastructure dans l’intelligence artificielle. Surtout pour des data centers. »

Pour les acteurs du secteur, la France offre l’avantage de proposer une électricité abondante et décarbonée à 95 %, indispensable au fonctionnement des data centers très gourmands en énergie.

There is an @page to set the property of a page. There is also rules to break the page at desired.

The navigation can be hidden.
Links and <abbr> content must be placed in the view with content: attr(href).
Check the forms.

It can be worth checking for a black and white version while printing it.

Utilisé une clé USB, fait un scan avec un scanner, une impression, lire un livre papier, rempli un document administratif en papier, payé en espèces ou en liquide.

Des commits publiés dans la version 3.4.3 de rsync provoquent de sérieuses régressions (remplissage des disques, incremental backup failure)

Nous savons que ces dispositifs sont dépassés. Des travaux de recherche montrent depuis des années qu’ils regardent vers le passé, peuvent biaiser les comportements et négligent la collaboration ainsi que l’apprentissage. Nous savons qu’ils reposent sur une évaluation rétrospective d’une « performance » individuelle définie de manière étroite. Et nous savons qu’ils reflètent souvent mal le travail réel – par opposition à ce qui est effectivement valorisé. Pourtant, année après année, ils perdurent. Alors pourquoi continue-t-on à les utiliser ?

Les indicateurs classiques de performance – production horaire, nombre de tâches réalisées, objectifs de vente – ont été conçus pour une époque où le travail était prévisible et ancré dans un lieu.

Parmi les évolutions qui favorisent davantage la motivation et l’engagement des salariés :

• des retours continus, en temps réel,
• des objectifs à court terme, ajustables,
• des échanges informels et réguliers entre managers et collaborateurs,
• des dispositifs à « 360 degrés », où les retours proviennent de plusieurs collègues, offrant une vision plus équilibrée du travail collectif,
• une logique de développement tournée vers l’avenir, plutôt que la notation des performances passées.

Level 1: What they say
Level 2: What they think & feel
Level 3: What they do
Level 4: Why they do it

There is for example different reasons for a cancellation: https://www.linkedin.com/feed/update/urn:li:activity:7140680577552117760/

The wheel of emotions https://uca.edu/bewell/files/2020/11/Feelings-Wheel-Learn-How-to-Label-Your-Feelings.pdf

Observe instead of asking whereas possible: https://www.smashingmagazine.com/2026/05/four-levels-customer-understanding/#observe-and-diagnose-don-t-validate

Practical ways to uncover user needs:

• Exposure hours, when every employee must be exposed to their customers for at least 2 hours every 6–12 weeks.
• Live UX testing, where we invite everyone in the company to join and observe.
• Co-design with users, where we show new features and ask users to rank them.
• Helpdesk insights, where we ask for frequent complaints and questions from the support every 3–6 months.
• Listening in, where we tune in on a customer service call, web chat, or eavesdrop where users hang out.

Global Threat Intercept — Real-Time Geospatial Intelligence Platform

Use cases:

• track air force one and private jets
• connect an AI agent as co-analyst
• communicate on the InfoNet testnet
• Retrieve live country dossier
• 11 000+ CCZV cameras
• monitor satellites overhead
• track naval traffic
• follow earthquakes, volcanic eruptions, active wildfires
• map military bases, 35 ++++ power plants, 2k data centers and internet outage regions
• connect to Meshtastic mesh radio nodes and APRS amateur radio networks
• detect ground changes through cloud cover
• track trains

It seems Ruby is better with Ruby on Rails

You might think that the JS version is slower [than CSS, but it's not for the right reason]

But there’s one significant difference: the JavaScript version runs on the main thread, along with everything else happening in our application. CSS transitions and keyframe animations run on a separate thread, so they aren’t disrupted when stuff happens in JavaScript.

Motion can create more smooth APIs but GSAP is more powerful.

• the efficient relational SQL databases
• the more recent NoSQL databases
• the rise of specific databases in the last years
  • time-series metrics
  • high-dimensional vector search
  • massive analytical queries
  • event sourcing / append-only streams
  • spatial queries

Présentation de la police sur Eduscol: https://eduscol.education.gouv.fr/6690/marelle-une-police-cursive-libre

La police présente des fonctionnalités particulières:

• majuscules bâtons ou cursives ;
• avec ou sans lignage Seyès ;
• hauteur des ascendantes et descendantes en un ou deux interlignes.

Un exemple d'architecture numérique pour le Service Départemental d'Indencie et de Secours (SDIS) (du 57).

Voter pour les partis selon leurs votes déjà effectué

#todo #rss

Illustration with a glass of water for
Optimist, Pessimist, Realist, Physicist, Surrealist, Relativist, Utopist, Scepticist, Artist

Meet hihtml, a convenient abstraction that allows you to validate HTML pages using HTML-validate, that checks on deprecated markup using ObsoHTML, that comes with a built-in link checker, and that minifies the respective web pages using HTML Minifier Next!

A container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop environments.

A radical simplification for a logging strategy: one log level. The rest can be handled with string prefixes.

Mais pourquoi Nolan est-il si sûr de lui ? La réponse tient en un mot : l’humain. Le réalisateur explique que regarder un film chez soi, seul sur son canapé, n’aura jamais le même impact psychologique et émotionnel que de partager des vibrations avec des inconnus dans le noir.

Et la réponse laconique:

Je suis tout à fait d’accord avec Nolan : aller au cinéma a un fort impact psychologique, entre le volume toujours trop fort, les pubs avant voire pendant, le bruit des gens, les odeurs, les téléphones portables, les (jeunes) gens qui racontent leur vie comme s’ils étaient seuls dans la salle, la clim un coup trop chaude puis trop froide, se déplacer, la queue, le prix, etc.

Je suis tout à fait d'accord: le cinéma est compliqué lorsque les règles de vivre ensemble brise l'immersion.

Print 128 bits on a punch card and read it from the webcam.

The goal isn't to program a computer; it's to store highly sensitive data on a medium that won't get erased. Like a crypto wallet key or a master password.

The webcam is used to read the punchcard via another python script.

It's more robust than a USB storage, an old paper or something similar.

via https://korben.info/des-cartes-perforees-imprimees-en-3d-et-lues-par-une-webcam-parfait-pour-stocker-vos-mots-de-passe-a-vie.html

other source: https://hackaday.com/2026/05/16/21st-century-punch-cards-are-3d-printed-and-read-by-opencv/

Let's return to Jarred's stated reasons for migration: the Zig codebase had too many use-after-free bugs, double-frees, and memory leaks on error paths.

This is true. But the conclusion that "Zig doesn't work" drawn from this diagnosis is wrong.

The correct diagnosis is: in a commercial project that prioritizes rapid iteration, the cognitive tax of manual memory management exceeded the team's budget. This isn't a bug in Zig – it's a structural mismatch between Zig's design goals and Bun's business model.

I think that what you're actually looking for is The Rule of Least Power, just applied to types. You should choose the lightest weight, conceptually simplest approach you can that keeps the code intelligible to others.

Smart Pointers should be used only when regular borrowing does not work.

D'un autre côté, il s'agit d'une négligence du client, alors que la voiture était rappelé au garage par Volkswagen, stationner en extérieur et éviter de charger la batterie au delà de 80%.

#1 : Island by Aldous Huxley
#2 : Doing Music and Nothing Else by Peter Knickles
#3 : Personal Development for Smart People by Steve Pavlina
#4 : How to Get Rich by Felix Dennis

j'aime beaucoup le système de grille du planning. Il permet de situer plusieurs évènements dans la journée.

L'implémentation est décrite sur https://fourbi.eu/billet/2026-05-13-paris-web-2026-la-grille-de-programmes

AppWrite support Rust with a dedicated SDK

A cybersecurity researcher has published proof-of-concept (PoC) exploits for two unpatched Microsoft Windows vulnerabilities named YellowKey and GreenPlasma, which are a BitLocker bypass and a privilege-escalation flaw.

"The result of this is that the X:\Windows\System32\winpeshl.ini is deleted, and when Windows Recovery is entered, rather than launching the actual Windows Recovery environment, it pops up a CMD.EXE. With the disk still unlocked" - Will Dormann

The websites must renew their certificates. Certificates are issued for two years but it's hard to renew certificates after two years! Let's Encrypt came up with a brilliant idea: all certificates are valid for only 90 days.

It has two advantates: it rotates the private key every 90 days and it pushes website owner to automate the renewal process.

In case of private key compromission, there are two methods to revoke the certificates: CRL and OCSP.

In principle, CA certificates themselves carry this information, informing clients that when verifying a certificate, they should visit this URL list to check if the certificate they are validating is in the revocation list. If it is, they should not trust it.

The CRL provides exactly that with the DER format.

The OCSP method needs to verify every URL of each certificates. This method has downsides:

1. The website's performance will decrease due to the additional time required for CA requests. The OCSP servers could become htspots and might be overloaded by clients.
2. The CA will know which domain names the client has accessed.
3. If the CA's OCSP service is down, the client has two choices: ignore verification or no trust the target site.

There can be workarounds with the OCSP Stapling: the website itself query the CA's OCSP service and when a client visits the website, the website provides the OCSP response.

All of these methods works if the CA can be trusted. WoSign had for example a chaotic organization that issued certificates for websites directly, whereas the CA should have issued certificates for Chinese users only.

That's what Certificate Transparency (CT) should address after the DigiNotar incident in 2011.n CT must log the issued certificate in a CT database and the CT will provide a Signed Certificate Timestamp (SCT) back to the website. The clients will only trust certificates that have an SCT when visiting websites and websites (and everyone) can monitor the CT database to check if any certificates have been issued for their domains.

Previous: https://shaarli.lyokolux.space/shaare/hamcqA

lol

Adding query string for a referral (with ?via for example)

1. can broke the URL such as https://int10h.org/oldschool-pc-fonts/fontlist/?foo. Altering a URL gives you a new URL. The new URL could point to a completely different resource, or to no resource at all, even if the alteration is as small as adding a seemingly harmless query string.
2. There is already the HTTP Referrer header for that. It's governed by the Referrer-Policy

Another post describe this problem: https://chrismorgan.info/no-query-strings

The project is available at https://github.com/kadir/cloakrs

Je suis bien déçu de Deepl et GitLab.

La restructuration en supprimant des niveaux hiérarchique me semble sensé pour un produit numérique. Je ne sais pas si cela est pertinent pour les autres domaines comme le marketing.

Tout le monde peut utiliser la config git user.name et user.email.

Afin de vérifier ces commits, ils faut indiquer à Git de les signer

Générer une clé
ssh-keygen -t ed25519 -C "votre@email.com"

Puis instruire à git de l'utiliser:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true

Puis ajouter cette clé de signature dans la forge logicielle.

Pour GitLab: https://docs.gitlab.com/user/project/repository/signed_commits/

Github place ce bug comme "ineligible", puisque cela ne donne pas accès aux repos ni privilèges, donc ce n'est pas une faille au sens strict.
Cepeeendaaaaaant, l'identité affichée influence les décisions; et il incombe à l'utilisateur de vérifier les signatures.

Source: https://infosecwriteups.com/the-curious-case-of-github-commit-spoofing-a-lighthearted-exploration-54ddbaaaf40a?gi=861657732a48

During my research I identified nine types of comments:

• Function comments: They prevent the reader from reading code in the first place. Instead, after reading the comment, it should be possible to consider some code as a black box that should obey certain rules
• Design comments: they states how and why a given piece of code uses certain algorithms, techniques, tricks, and implementation. [...] With such background, reading the code will be simpler.
• Why comments: explain the reason why the code is doing something, even if what the code is doing is crystal clear.
• Teacher comments: They teach instead the domain (for example math, computer graphics, networking, statistics, complex data structures) in which the code is operating, that may be one outside of the reader skills set, or is simply too full of details to recall all them from memory.
• Checklist comments: sometimes because of language limitations, design issues, or simply because of the natural complexity arising in systems, it is not possible to centralize a given concept or interface in one piece, so there are places in the code that tells you to remember to do things in some other place of the code
• Guide comments: they do a single thing: they babysit the reader, assist him or her while processing what is written in the source code by providing clear division, rhythm, and introducing what you are going to read.
• Trivial comments: a bad one, a guide comment where the cognitive load of reading the comment is the same or higher than just reading the associated code.
• Debt comments: debt comments are technical debts statements hard coded inside the source code itself:
• Backup comments: the developer comments older versions of some code block or even a whole function, because she or he is insecure about the change that was operated in the new one. We have git now.

Comments can be considered analysis tools; and they are often harder to write than code.

L'espagne a tranché: l'homéopathie, c'est du flan

The migration to Codeberg is really easy.

The bar is lower than common thought: uninteresting topics is a relative subject. The author's rule is anything that they’ve said more than once in a conversation.
There is also another effect in play: readers don't usually give this feedback, so it's hard to know.

So: lower your bar for what’s worth writing about! My personal standard is anything that I’ve said more than once in a conversation.

How?

1. Write consistently: every week and briefly, every day.
2. Notice and pay attention to feedback

Come with a good title: one that makes a promise about what the reader will get from reading the post that is (1) exciting, and (2) accurate.

Find the right framing. Provide examples. Use microhumor if you want to go for this tone. Write like you talk.

Dedicated to colors. it's a "an ongoing exploration of digital color tools shaped by art theory, historical systems, and practical design work".

The website has many themes.

With 3 columns and CSS grid.

Cloudflare got rid of 1 100 employees and AI usage increased 600%.

Stock options dropped 18% https://www.cnbc.com/2026/05/07/cloudflare-net-q1-2026-stock-earnings-layoffs.html

Forty years ago, a family moved from India to Canada, and raised their children with “Indian values”. When those children visited India last year, the locals laughed at their outdated beliefs. What their family had said were facts were just a perspective from 1980.

En 2024, le salaire net médian dans la fonction publique d’État s’élève à 2 823 euros. 10 % gagnent moins de 1 761 euros nets par mois en équivalent temps plein ; 10 % gagnent plus de 4 330 euros nets.

En 2024, un agent de la fonction publique de l’État (FPE) perçoit en moyenne 3 018 euros nets par mois en équivalent temps plein (EQTP). Corrigé de l’inflation, le salaire net moyen augmente de 2,6 % par rapport à 2023.

Ah oui, soit la moyenne est tirée très fortement vers le haut, soit les salaires sont pas mauvais dans la fonction publique.

Les fonctionnaires territoriaux n'ont pas les mêmes salaires effectivement.

This is clearly a dark pattern as the user is not aware and Chrome is forcing the installation. That's one more reason to use an other browser.

L'article de Next: https://next.ink/237140/chrome-peut-stocker-4-go-associes-a-gemini-sur-votre-machine-sans-crier-gare/

An MMDB-compatible IP Geolocation database with ASN, country, and continent data. Free to use. No license keys required. Updated every day.

The native applications lost the battle.
Windows is not able to offer a consistent native UI over a decade.

The UI inconsistency in Linux was created by design.

MacOS is no longer the safe heaven where designers can work peacefully.

Electron Apps have , but they also lack off visual consistency and keyboard-driven workflows.

Some restartet from scratch with Dart and Flutter UI to replace Android legacy things. Google gave up because they needed a monopoly or a large enough market to succeed.

Zed did the same thing in Rust: they designed their own cross-platform GPU-renderer library. It lacks integration with the host OS on itself though.

On the contrary, TUIs are fast, easy to automate and work reasonably well in different operating systems.

A voxel engine

We can use the oklch (OK L C H) and adjust the lightness and chroma from the hue, thus generating colors.

Creating colors from oklch is tedious, but they can derivated from other color codes from [#007ab8](./add-tag/007ab8) calc(l - 0.05) c h)

Tip: very light and very dark lightness levels have a tendency to look oversaturated.. a lot of color palettes look more cohesive when you reduce the chroma slightly as you move away from the middle-range of lightness towards the edges.

Example: https://codepen.io/cferdinandi/pen/zxoYpeL

This example is good for dynamic colors.

Generate anything related to security. It can't be used for serious project though.

It provides a binary representation of the sign, exponent and mantissa

How a player often play minecraft steps by steps

The post lists practices to improve user-experience of command-line interface.

Problematic patterns

1. Borders in TUIs should always be drawn with characters specifically intended for textual interfaces (e.g., boxdraw characters).
2. Borders should be used sparingly, as they end up causing issues when the window is re-sized
3. Decorative content in CLI output should be limited, since the output of CLI utilities can be piped through other programs.
4. Nearly all animated spinners are extremely problematic for screenreaders. A simple progress meter and/or numeric percentage combined with flags to enable/disable them is preferable.
5. Excessive animation and color can harm users with attention and/or vestibular disorders, and some on the autism spectrum. Tools should respect the NO_COLOR environment variable.

Accessibility

6. Does the tool is usable once sended in espeak-ng?
7. Have a look to the WCAG
8. Avoid ASCII-art
9. Keep it boring to other common utilities to reduce the learning curve.
10. Follow convention: POSIX-like options
11. Be predictable with the options. The command only do one thing well.

Documentation

12. Write man pages. If your utility has a config file with special syntax or vocabulary, write a dedicated man page for it in section 5 and mention it in a “SEE ALSO” section.
13. Ennsure whatis and apropos work as intended after installing your man pages.
14. Try adding shell completions for your program, so users can tab-complete options.
15. Use a well-understood -h. It helps to generate shell completions. See https://www.busybox.net/ as example

Miscellaneous

1. Delegate output wrapping or detect the number of columns and format output to fit
2. Be safe. Addd a --dry-run or equivalent option.
3. Disable the colors when the tool is not a TTY, or when the user explicitly enables them.
4. Check the binary name or the packages first. It can already be used. dnf can help.

Opinionated

1. --help should be blazingly fast as user can be stressed using it
2. Include example usage in the man page and accompanying documentation.
3. Send example usages to the tldr pages project if the tool gets popular.
4. Include an extended list of example command invocations and expected output. Make that document double as a test suite.
5. Make your man pages as similar to other man pages on the target OS as possible. Many programs parse man pages, and expect them to follow a predictable structure. w3mman handles hyperlinks; editer like vim support looking up man pages; Pandoc can convert man pages to a variety of different formats.
6. Conform to tools that share a similar niche. If you’re using Rust to make a fast alternative to popular coreutils. ripgrep or fd for Rust, go vet for Go are good examples.
7. Make the output readable to both humans and machines
8. Consider splitting related functionality between many executables (the UNIX way) or subcommands (like Git). See https://www.lucasfcosta.com/blog/ux-patterns-cli-tools#consistent-commands-trees for more
9. Don’t conflate CLIs and TUIs. A CLI should be non-interactive; a TUI should be interactive.