how do people blog for thirty years without running out of things to say? I think I was approaching it from the wrong direction. Nobody sits down with thirty years’ worth of material ready to go. They just keep finding things interesting for thirty years.

Blogging for three decades requires to stay curious.

La CNIL est signalée par PURR au Comité Européen pour la Protection des Données le 7 août 2026.

Le signalement est disponible à l'adresse https://asso-purr.eu.org/assets/media/20260807-cepd-incoherences.pdf

Different algorithms can be used:

Full jitter:

sleep = random(0, min(cap, base * 2 ** attempt)

Equal jitter:

temp = min(cap, base * 2 ** attempt)
sleep = temp / 2 + random_between(0, temp / 2)

Decorrelated Jitter (based on the last sleep value):

sleep = min(cap, random_between(base, sleep * 3)

The official CSV file contains comment in parentheses. Why not using a dedicated field per row for it?

If the line is longer, then the text is split to multiple line. The postcode, names are repeated.

issues. There are catch-all postal codes for many areas, where the neighborhood is given as "except the following", and the only thing to do is look for that exact string and exclude it.

The separate romaji file is of low quality.

That's why posuto aims to simplify this.

An alternative to the Lena picture.

The original image has some trouble with its origins https://www.thedrum.com/news/gender-equality-ad-calls-time-playboy-model-lena-image-led-jpeg-invention

Lol. The second parody of cats.txt made by another person.

Lol they are the live HTTP requests of catstxt.org

It shows how using RAM efficiently can increase performance.

All with the help of the Flock

Intercepts CDN usual libraries and resources, then use the local version of it.

Je suis passé d'OpenStreetMap à CoMaps il y a quelque jours, et je dois avouer que c'est vraiment bien réalisé.

L'application fonctionne bien hors-ligne.

A dashboard tracking github incidents.

Their uptime without incident is not so great.

Et comment fait-on dans le lycée alors que tous les services sont numérisées (emploi du temps, travail, encouragement à utiliser les postes fixes au CDI)

Someone is getting a broader idea that the rules of the web are powerful

The project built without JS is https://textlog.cc/hot

textlog is a simple social text log: write short notes, follow people and hashtags, and join conversations without turning every thought into a performance.
Notes are limited to 500 characters. The constraint keeps them quick to write and read, making room for one thought at a time.

textlog is built around words: notes, people, hashtags, and conversations. It is intentionally small, straightforward, and easy to follow. There are no engagement tricks or pressure to build an audience.

The bet is AI can rewrite large portion of codebases. Let's see.

There are cluster wins:

• i18n: Intl.RelativeTimeFormat, Intl.PluralRules, Intl.NumberFormat, Intl.DurationFormat, Intl.ListFormat
• HTTP Clients: fetch can be used instead of axios. Limitations: fetch doesn't reject on HTTP errors, no interceptors, no automatic retries, no upload progress.
• UI Primitives: <dialog>
• Lodash utilities
• sometime in the future: Temporal

A recap of the font specification.

With text-box-trim we gain control over which boundary line text boxes are cropped to, and finally we can trim away this extra space to work with a font’s actual visual height.

One of the most common use cases for a lot of us is visually centering text within elements like buttons or notifications. This is especially handy for fonts that have awkward spacing like Josefin Sans.

There are plenty of creative uses [...] I placed headings with their baseline flush against sections below using negative margins. [Using text-box-trim remove the use of margins and put the heading just on the line of the next section, https://quarterre.com/studio]

Another example is to put the line on the font baseline like https://www.wepioneer.co/

It isn’t often that new image formats land in browsers. In the early 2000s we had JPEG, GIF, and PNG. The 2010s gave us WebP, which was a modest step up from JPEG. But the 2020s have given us two new image formats that are a big step up from previous formats: AVIF and JPEG XL.

What are the advantage of JPEG XL:

• progressive rendering (the whole image can render step by step)
• excels at lossless imagery and compression improvements

AVIF excels at web-quality photographic images and images with a mix of sharp edges and flat surfaces.

They make cool interactive experiences and some board games too.

Secure, single-binary Rust CRUD application for managing CSAF 2.0 and 2.1 security advisories. Provides both a server-side rendered web UI (Hyper + Bootstrap 5 + HTMX) and a RESTful HATEOAS JSON API under /api/v1/.

#audit

A board shared in real time with many users

XCF has been GIMP’s primary project format since 1997, and it has served many users well. Over time however, we’ve observed more and more limitations of the binary XCF format. Among other issues, it does not easily support very large or complex projects, such as the multi-page and animation features currently planned for GIMP 3.6.

The new project file format will follow a more common “zipped XML” structure. While the technical details are still being designed and implemented, this change will allow for faster saving since we’ll only need to update parts of the file instead of the whole thing each time. It will also set the stage for much desired features such as auto-saving, which will now be much more feasible.

Non destructive layer masks are also a great feature. PSD support improvements.

Témoignage d'un ancien ingénieur d'Azure (le cloud de Microsoft). Apparemment, Azure est vraiment un feu de poubelle, monté à la va-vite pour concurrencer Amazon AWS, sans réelle vision. Situation aggravée par le fait que les ingénieurs séniors - ceux qui maitrisaient vraiment le truc - se sont barrés, et le fait que Microsoft préfère investir dans l'IA que dans les personnes.

Partie 1 : https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion
Partie 2 : https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion-8f4
Partie 3 : https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion-f67
Partie 4 : https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion-2f5
Partie 5 : https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion-841
Partie 6 : https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion-b73

(via https://sebsauvage.net/links/?qnz_0A)

La société française paie l'absence du NIS2 dans les textes légaux actuellement. L'obligation de l'authentification multi-facteurs auraient épargné un certain nombre de piratage.

Le NIS2 semble être un excellent standard à suivre. Pourquoi la France prend-t-elle autant de temps alors qu'elle se numérise ?

La CJUE est saisie afin d'imposer des sanctions financières à la France jusqu'à ce que le texte soit totalement transposé.

C'est la double peine.

Alors pour résumer 🧵
Il vaut mieux porter un casque que de ne pas en porter. Porter un casque rédQuit la mortalité.
Il vaut mieux plus de cyclistes non casqués que moins de cyclistes casqués.
Ce second point est clé pour comprendre l'enjeu.

Le second point est détaillé dans le thread: c'est toujours moins risqué que la voiture, et moins accidentogène. En revanche, l'obligation du casque pour les activités sportives / à risque ne fait pas débat.

A parody

• list all active workstreams: every tasks
• assign one accountable owner per workstream
• give every workstream a deadline even if it's synthetic
• get regular green, yello or red updates
• do weekly demos. 2mins per demo.

Les réacteurs sont à l'arrêt afin de préserver l'écologie, puisque les niveaux ne sont pas suffisants.

Cette baisse n’a pas menacé l’équilibre du réseau national, grâce à une production globalement suffisante (29,7 TWh générés en juillet 2026). Grâce au photovoltaïque, qui a produit jusqu’à plus de 30 % de l’électricité hexagonale pendant certaines heures de juillet, le pays est même resté exportateur.

D’ici 2050, RTE prévoit en effet que les risques d’indisponibilité puissent augmenter « d’un facteur deux à trois ».

Distribute books through a WLAN-connected LED

Transform any topic into peak LinkedIn cringe. Our AI-powered engine analyzes current trends and generates authentic thought leadership™ guaranteed to make your followers shudder.

Un développeur qui a pour hobby de demander des documents à l'administration.

Une vulgarisation sur l'accès aux documents administratifs (demande d'accès, recours à la CADA, puis entraîner la justice).

But as Our Changing Climate pointed out in their latest video, those conveniences are a trap of capitalism, designed to give you the illusion of joy (while extracting more money from your pocket) because work robs you of time.

But imagine if you worked for just a few hours in the morning or afternoon.
You’d have time every day to take a relaxing walk to the store, read a book, chat with friends, and so on. The tasks that feel like a slog because the occupy the little free time you have become part of a more complete, balanced life.

Note it's useful to use "pixelated" image rendering for QR Code for examples. Another way is to distribute the QR Codes as SVGs.

Une personne meure aléatoirement sur terre pour 10 000€ est un dilemme moral, mais appuyer sur un bouton et consommer plein d'eau, d'énergie, contribuer à faire monter le fascisme et les températures, en échange d'une image ou d'une mélodie plagiée; c'est OK.

A package manager for .AppImage builds.

PPC Land is your premier source for news and insights in the dynamic world of digital marketing. Originally founded in 2016, in Porto, we've been at the forefront of reporting on adtech, online marketing, advertising, and programmatic ads for over eight years.

A safe, single-binary, offline viewer for the official BSI Grundschutz++ catalog, written in Rust. The complete OSCAL catalog from the BSI Stand-der-Technik-Bibliothek is embedded in the executable at compile time: copying the binary to any machine is a full installation — no install step, no database, no network access required.

So yes, it's one binary and it is one way to transfer data and make it usable.

The project is available on GitLab: https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer

The agent publish the news of the website daily.

Le sujet n’est pas de savoir si Microsoft est coopératif. Le sujet est de savoir quel droit s’applique en dernier ressort.
Et sur ce point, les textes américains ne sont pas une vue de l’esprit. Le Cloud Act oblige les fournisseurs soumis à la juridiction américaine à produire certaines données placées sous leur contrôle, y compris lorsqu’elles sont stockées hors des États-Unis. La section 702 du FISA autorise, elle, des programmes de renseignement visant des personnes non américaines raisonnablement supposées se trouver hors du territoire américain.

Autrement dit, l’acheteur ne peut pas écrire : “je refuse les fournisseurs américains”. Il peut en revanche écrire : “je veux un prestataire capable de garantir qu’aucune donnée ne sera transmise à une autorité étrangère sans autorisation du client ou des autorités françaises ou européennes compétentes ; je veux un prestataire qui ne coupera pas un service critique sous l’effet d’une sanction extraterritoriale non reconnue par la France ou l’Union européenne ; je veux une chaîne de sous-traitance auditée ; je veux une réversibilité documentée ; je veux un droit applicable cohérent avec mes contraintes.”

Alain Issarni résume le mécanisme : « On n’exclut pas les entreprises américaines ou étrangères. On exclut les entreprises qui ne sont pas capables de s’engager sur le fait de ne jamais fournir les données à un tiers. »

« Ces fonctionnalités foisonnantes des clouders américains, personne ne les utilise toutes. Avec le logiciel libre, on peut se concentrer sur nos vrais besoins. »

À voir ce nouveau cadre qu'est Libralis (et l'engagement Omég@1), mais c'est surprenand puisque un des membres SFEIR utilisait (il y a 4 ans) massivement Google Cloud.

Five Rust working groups stance on the AI usage on Rust lang

Hacker news discussion: https://news.ycombinator.com/item?id=44370426

There are different measure of time. Civil time is used in our contemporary society because talking in epoch (seconds since 1st Jananuary 1970) because it's too complicated. The best civil time to use currently is UTC.

While considering precise time keeping, a location can change its timezone (UTC+X) with a short or long notice. One used 14 days for example.
Another rule is leap seconds that are inserted.

The IANA timezone database is preferred to update local date time.

Full of great explanations about securing (hardening) Rust code.

• treat panic behavior as part of your API. Decide explicitly whether panics should unwind or abort, and avoid uncontrolled panics.
• enable stricter Clippy lints (such as indexing and arithmetic checks) when panic freedom is important.
• use a panic hook to shutdown gracefully, set reports, cleanup, collect diagnostics and
• sanitize panic (and logging) messages while logging. veil is a good crate for that.
• avoid unbounded recursion. Prefer iterative algorithms or use depth limits.
• releases builds behave differently. They should be accordingly tested.
• audit dependencies with cargo-audit and cargo-deny
• secure allocation (for defense-in-depth when using unsafe code or FFI) with mimalloc or similar. Measure performance before enabling it globally.
• use minimal runtime images if needed (rust distroless). It reduces the attack surface.
• use multi-stage builds with cargo-chef, --locked and proper .dockerignore
• avoid alpine musl lib c as it introduces subtle runtime differences; at least be aware of them.
• use Linux landlock to restrict filesystem access even after compromission
• never run as root unless absolutely necessary. Drop as much Linux capabilities as possible.
• use Miri to detect undefined behavior, invalid pointer usage and unsafe-ode bugs.
• handle SIGTERM/SIGINT properly. Stop accepting new work, finish inflight requests, flush buffers and then exit cleanly
• protect external dependencies (database, API, cache) with circuit breakers so repeated failures don't cascade
• put explicit limits on everything: upload size, request bodies, queues, timeouts, thread counts,
• expose two health endpoints: a liveness probe and a readiness probe. The liveness probe checks if the process is alive at all, while the readiness probe checks if the process is healthy enough to handle traffic.
• Use fuzzing (cargo-fuzz, honggfuzz), coverage (cargo-llvm-cov), unsafe detection (cargo-geiger), and memory-analysis tools alongside Rust's compile-time guarantees.

Comment éviter le .env, un fichier en clair

Open Apps is a directory of real open-source applications you can run, study, compare, and contribute to. It started from the public-domain Open Source Flutter Apps collection and has grown into a multi-stack directory of mobile, web, and desktop apps.

The paper describe child sexual abuse material (CSAM) on the Fediverse. It relates CSAM exists across essentially every sufficiently large online communications environment. Rather, the researchers argue that federation creates a distinctive set of technical, organizational, and legal problems for detecting, reporting, and removing CSAM: removing content (or stopping content propagation), different rules are used accross the Fediverse,

The existing child-safety technologies designed for centralized platforms do not map cleanly onto federated networks. The researchers conducted an investigation 325 000 posts during two post days.

Human moderators are important for the Fediverse but it's also a burden placed on volunteer administrators. CSAM detection is not enough and account enforcement is also difficult because one user can create another account on another instance.
The report promotes:

• easier access to CSAM hash-matching technologies;
• standardized reporting procedures;
• better tools for volunteer moderators;
• training and support for administrators;
• mechanisms for sharing threat information;
• stronger cross-instance blocking;
• better detection of abusive accounts and repeat offenders; and
• improved coordination with organizations and authorities responsible for child protection.

Building websites by hands mean the solutions to errors are within you somewhere. "You’re also rewarded with greater understanding of the problem and solution, knowledge that you’ll carry with you."

An AI agent hides, obscures and obfuscate the result or the method used to reach such result.

The web can florish with little websites everywhere. It's never about the size of the audience for the OG web, but always about the community.

It took off and https://catstxt.org/ was born.

On the contrary, llms.txt is often ignored by the crawlers.

The trap is this: getting baited into treating a set of observations as evidence, when the observations would occur whether or not the underlying thing were true. It is the intellectual equivalent of concluding your umbrella causes the rain to stop, because every time you put it away the rain does eventually stop.

It's a convenient example: . The same broken chain of inference is being applied to almost every new GEO tactic invented on a monthly basis

When you ask a model whether llms.txt helps, it is not reasoning. It is not running an experiment, consulting a source or weighing evidence. It is returning the most common thing it has seen written on the subject. The web is thick with confident posts declaring llms.txt the future, so the model converges on that consensus and reflects it back, dressed as a considered opinion. It endorsed my cats for precisely the same reason: by the time anyone asked, enough people had written enthusiastically about cats.txt that the average of the discourse said “yes.”

Quite the opposite of GEO: " That is what the “O” in SEO is meant to stand for. Optimisation is the cumulative advantage of doing the small, verifiable things a little better than your competitors, over and over, until it adds up."

Les journalistes grand public semblent plus être des animateurs. Il n'y a pas de remise en question.

Les feux sont causées par des pyromanes, et il s'agit uniquement de crises ponctuelles. Le climat est vu comme un impact sur l'économie.

Acrimed constate: "L’opération rhétorique est claire : changer d’organisation économique et baisser les émissions de CO2 peuvent attendre. Et les bonnes questions – qui a percé la coque ? qui agrandit sans cesse la fuite ? qui détient ces fameux canots ? y’en a-t-il assez pour tout le monde ? – ne seront pas posées."

L'exemple est le principal sujet des médias concerne uniquement la climatisation, ou la consommation des biens et services mis à disposition par le marché. Les médias évitent le climato-scepticisme pour une tendance à raconter le dérèglement climatique presque exclusivement à travers ses manifestations immédiates et les moyens de les absorber.

À mesure que le climatoscepticisme devient intenable face à la multiplication des dégâts, le déni se déplace : de la négation de ce qui arrive, à la négation de ses causes matérielles et historiques.

In this article, crates that only use core and alloc will be referred to as no_std, whereas the subset of crates that can compile without alloc will be called no_alloc.

How AI is impacting negatively the OSS maintainers. It's written as a story.

Un décret publié fin février 2026 autorise en effet Enedis, depuis le 1er mars, à récupérer automatiquement certaines données de consommation, courbe de charge comprise, sans accord préalable de l'abonné.

Parce qu'en croisant les relevés horaires, il devient possible d'identifier des habitudes très précises. L'heure à laquelle vous vous levez et vous couchez, votre présence ou votre absence du logement, le nombre de personnes qui y vivent, ou encore le volume d'eau chaude consommé.

Notifications are mostly annoying.

It uses the :highlight() selector instead of spans.

CSS.highlights.set(category, textRanges) is used to higlight the code blocks.

Le dernier jalon franchi de cette merdification date de juin de cette année, où le nombre de requêtes par minute des flux Atom a été sévèrement réduit à 1 (UNE) requête. PAR MINUTE. Une putain de requête par minute pour récupérer des flux Atom. Vous êtes abonnés à 15 sous-Reddit ? Cela fera QUINZE MINUTES pour tous les récupérer, merci au revoir.

Bref. J’ai donc créé un script Python simple qui vous permet de récupérer les flux désirés, en respectant leur limitation ridicule. Tout est expliqué dans le readme.

Peut-être qu'il serait pertinent que chaque utilisateur contribue à la limitation d'une requête par minute afin que la communauté recrée elle-même les flux RSS ? Ce n'est qu'une course perdue d'avance, tant que Reddit essaie de fermer de plus en plus la plateforme.

I missed it! Maybe next year.

The related website collection is available at https://e2e.html.energy/

<script type="text/python"> lol

A track of the timezones with their name, description and alias

Using DEBUG compilation slows down the compilation by nearly ~40 times.

Why ?
LLVM represents variable locations through DBG_VALUE records. Heavy function inlining can create hundreds of thousands of these records in a single function.

WebAssembly’s Register Stackify pass moves values from virtual registers onto the operand stack to produce compact, efficient wasm. While moving instructions, it repeatedly scans basic blocks to find and update debug records. Those linear scans are repeated for many definitions, while the pass also leaves invalidated records behind and creates new records for duplicated cheap computations. The result is quadratic work on increasingly large instruction lists.

As example:
Module: repro total codegen
Current Rust: 52.58s
LLM fix:7.12s
Author fix: 1.99s

• <details>
• popover
• grouped <details>
• command & commandfor
• native input pickers
• <datalist>
• loading="lazy"
• hidden until-found

How much pressure will Google put on Firefox?

Similar to Signal

"AI” has only accelerated this trend. These days, you’re lucky to get a pull request from a real human being. Discussing changes is no longer fun when you’re talking to a bot 90% of the time.

I hope someone builds a community for developers; we need one now more than ever.

Vehicle Motion Cues uses the device's accelerometer and gyroscope to reduce motion sickness felt when trying to use a device inside a moving vehicle.

According to big-S Science, this type of vehicle motion sickness is caused by the eyes staring at a static display while the inner ear feels the car turning, braking, and accelerating. Motion Cues solve this by placing dots around the periphery of the display that move in harmony with the motion of the car. When the car turns right, the dots sweep across the screen to the left; when the car brakes the dots slide forward.

The takeaway: AI is not always perfect, so it still requires trust and verification. But for lower-risk personal tasks, it can save time and make inaccessible information easier to access.

Listen to the full episode of Accessibility Craft for more on AI, accessibility, inaccessible documents, and how people are using these tools in real life. https://youtube.com/watch?v=JeuiCb564B4

The comments live on a small Phoenix server I run, called Popsicle Boat. Each post has a companion thread there; publishing a post makes one API call that creates the thread and writes its URL into the post’s front matter. That URL is the only coupling between the two systems.

At build time, Hugo fetches each thread’s replies.json and renders the replies as plain HTML once per post per build, cached, capped indentation. If the server is unreachable, the build carries on and renders no comments. The comment system cannot break the blog.

The page is rebuilt every time a comment is added, but the cost is cheap.

A tutorial is available at https://www.popsicleboat.com/for-bloggers/api

Rediriger les bots (qui ne gèrent pas les cookies) lorsqu'un header Set-Cookie est ignoré.

Un simple moyen de contourner les bots (mais aussi les bots de moteurs de recherche).

The idea is to also have a browser extension for it that signals the humans.json is present on the page.

Comme par hasard. « Je n'ai rien à cacher » mais c'est toujours quelqu'un d'autres qui décide ce qu'il y a à cacher.

We can avoid the "System" state because it's the default!

Except, real users don’t generally seek out dark mode toggles to express intent for things to stay as they are, they seek them out when things need to change.

Then toggle the "next" state (that is not the system appearance, or reset the state=.

"Si vous devez désactiver la moitié des paramètres du système, désinstaller une douzaine de logiciels préinstallés inutiles, bidouiller le registre et/ou les stratégies de groupe pour modifier des choses que vous ne comprenez pas, juste en suivant des guides trouvés en ligne, uniquement pour rendre Windows 11 à peine “acceptable”, alors tout le discours du genre «oui mais Linux est plus difficile à installer» a très mal vieilli."

Indeed

Excellent.

La notation en lettre majuscule représente un ensemble de nombre (matrice, ensemble littéralement)

find . -iname '*.flac' -print0 | while IFS= read -r -d '' f; do
  opusenc --bitrate 160 "$f" "${f%.*}.opus"
done

Une autre mauvaise nouvelle. J'espère que Firefox, et à l'avenir Servo et Ladybird pourront prendre la relève.

Retour sur la batterie électrique de la voiture.

The post: https://www.andrewt.net/dithered-qr-codes/wtf/

It allows to include an image inside a QR-Code.

Be careful using these QR codes — they work by putting an image into the redundant parts of the QR code, but those redundant parts are there to make the code easier to scan in less than perfect conditions.

About the AI trend and what it means for programmers: good code is more pertinent than ever, because we add the AI layer to it.

I do believe that talking to users, understanding their experience, empathizing with them, solving customers' problems and having all the stakeholders on the same page is critical to the success of a software project.

I also believe that creating good code is a craft that requires skill, patience, attention to detail, experience and wisdom, and that it will continue to be relevant in the times ahead.

Tips:

Accept that change happens. Be equal parts curious and critical about the new stuff.

Understand there's a lot of hype and try to discriminate between hot air and what really works (and to what extent). Also be aware of ever-shifting goalposts: stand back and look at the past year, or five, and assess the velocity of change (technical, economic, societal).

Your role and your responsibilities will be changing. Be willing to invest time and energy into better understanding fields or roles adjacent to yours.

If you're a senior developer, don't just find solace in deepening your expertise. Learn about user experience, customer interviews, or business strategies for the companies in your domain. It will help you gain a better appreciation of all the work done to put a piece of software into users' hands, whether or not you'll actually ever have to do any of those other bits.

If you're just starting or are junior in your role: invest in deepening your understanding of how software works. Understanding pointers, recursion, or memory hierarchy will help you even if you're a JavaScript developer. Understanding network protocols and how HTTP works will be useful even if you're building WordPress plugins. Do leetcode and learn about algorithms and data structures even if you don't need to. Don't be afraid to ask why and how exactly.

1) Useful for vertical spacing for content. The spacing of two paragraphs become natural.

2) It's precise to build the paper line effect with a background-size: 100% 1lh;.

3) When the image should scale, the lh is perfect to align the image with an amount of line:

.content img {
  float: left;
  height: calc-size(auto, round(up, size, 1lh));
}

Note calc-size is not widely supported, so let's build an alternative:

.content img {
  float: left;
  aspect-ration: 1; // put the ratio of the image here, or remove a `width` limitation
  height: 5lh
}

4) Faded content with a max-height
5) Size an icon based on the line height

lol

How phishing attacks are hard to distinguish because even real pages looks suspicious

Here we go again

From other sources:

• Aikido: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
• Bleeping Computer: https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/
• Microsoft: https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/#mitigation-and-protection-guidance

Some pitfalls and cases where JSON has a default behavior.

Date, BigInt, circular dependencies, undefined property are not preserved and leads to different behaviors.

Serialization executes code and toJSON().

Take care of prototype pollutions (for example a __proto__ property).

There are also optimization with Message Pack that provides a compact ninary representation and CBOR.

Atom has many advantages over RSS. Somehow I still use RSS for most of my feeds.

#idea #project given an RSS feed, search for an Atom feed alternative.

A ripgrep dedicated for Rust

TL;DR: we spend more CPU cycles rendering commits for scrapers than we spend on all other kinds of legitimate access, including git clones. At any one time, across 5 geo-distributed nodes, there are 14 CPU cores doing nothing but rendering git commits as html.

AI crawlers are idiot: their are consuming the HTML diff of the commits insteadof cloning the repository locally...

and its blog post: Why Astro matters

It's bad civic hygiene to build technologies that could someday be used to facilitate a police state. - Bruce Schneier

In this post, I’ll walk through a set of common misconceptions that drive teams to introduce new infrastructure when they don’t need to. All of these can be solved with vanilla PostgreSQL 18 using standard extensions available on RDS, with no special infrastructure and no distributed-systems cosplay.

The database can be used for many things people often miss:

• user roles (finance) for modularity. In particular, a proper role can be used for defining very precise interfaces on top of database objects
• domains can be defined as an application of the abtract data type to database management
• a table for transfers can be stored with a system-time temporal table
• account audits (store old versions for logs)
• transaction state machine with functions
• record size estimation
• Heap-Only Tuple to avoid write amplification when primary keys are aligned with immutable columns. It enables faster updates. See https://ebellani.github.io/blog/2026/all-you-need-is-postgresql/#introduction:~:text=Enabling%20HOT%20Updates%20for%20Transfers,-By
• excellent OLTP (quick read and write individual rows) with a primary key reflecting the access pattern
• view to reuse queries from multiple tables
• excellent OLAP: large volumes of data while allowing quick query response times: a finance.balance_ledger table stores a snapshot of both balances after every transaction.
• incremental maintenance via triggers
• correct isolation with alter role finance set default_transaction_isolation = 'serializable';. If a cyclic transaction is detected, then one of the transaction fails. The application must be prepared to retry aborted transactions, but the invariants are never violated.

Key takeaways:

• 766 TPS overall with 0 failed transactions. The startup target of 10,000 transfers/day is ~0.12 TPS. We exceed that by over 6,000x, confirming massive headroom on modest hardware.
• 0 serialization failures: Despite 10 concurrent clients writing to 100 accounts under SERIALIZABLE isolation, no transactions were aborted. The working set is distributed across enough accounts that write contention is negligible at this scale.
• 8ms average read latency: The UNION ALL view over 4 tables plus the balance ledger lookup completes well within interactive response time, even as the tables grow throughout the 60-second run.
• 33ms average write latency: Each write transaction exercises the full constraint set that implements complex business logic (audit trails, time constraints, balances, etc) all within 33ms. This is the true cost of enforcing every business rule at the data level, and it is more than acceptable.

The full SQL is provided at the end.

Browser extension (Firefox, Chrome, Opera, Edge) to redirect urls based on regex patterns, like a client side mod_rewrite.

It allows to use privacy friendly alternatives to the URL shared online.

@media (scripting: enabled) and @media (scripting: none)

There's also an initial-only value, which is for scripting that is enabled during page load but not after

Before this feature, one approach for detecting JavaScript support was by setting a custom selector on the opening html tag—a common one seen in the wild is the no-js class name.

Quelques problèmes des affiches générées par IA:

• toutes les informations sont mise au même niveau
• toutes les affiches s'uniformisent. Comment se démarquer des autres ?

Ce style explose, tout comme les affiches de type PowerPoint ou Word s'étaient démocratisée auparavant.

Github stats are not pertinent anymore because Claude AI can turn them upside down.

It’s now easy to ask Claude to generate a list of interesting open source projects, then ask Claude to find some problems in them, and then ask Claude to raise some PRs to fix them. You don’t even have to use the projects or care about them, but you can easily create the illusion to outsiders that you care, or that you found a problem, or that you put the time into fixing it. [...]

Maybe this was unreasonable, but truthfully, I’m just not interested in encouraging people to take up our time with this kind of busywork. I do not want to set a precedent of accepting PRs that materially improve nothing, nor do I want our contributor list to become a reward for asking a robot to fix typos.

The largest collection of free stuff on the internet!

A simple Typescript script to scrape the plate available online in Florida

Un résumé des fuites de données des services publics de juin à août

Comment créer une Zip-Bomb si quelqu'un demande une page incongrue.

Il s'agit bien d'un format .gzip pour que la bombe soit décompressée automatiquement en mémoire.

Une alternative en HTML est aussi possible (avec une configuration nginx): https://ache.one/notes/zip_bombe_html

[class^="btn-"],
[class*=" btn-"] 

works but it is 20 times slower (3ms per frame).

The uBlock hard mode is similar to the Matrix browser extension.

The post explains how to set up uBlock to hard mode: disable remote fonts, JS, block large media and enable advanced user. Then disable third party, add shortcuts, add filter lists, picker & zapper, the uBlock Logger, DOM Inspector and how to unbreak things.

Demander à l'IA de saisir les tâches dans un fichier markdown afin de pas les ignorer.

Si tu découvres un problème ou une erreur pendant une tâche, même préexistant(e) et hors du périmètre de la tâche en cours, ne l’ignore pas silencieusement : soit tu le corriges, soit tu ajoutes une description détaillée dans un fichier TODO.md à la racine du projet, pour ne pas perdre cette découverte.

Instead of doing a single join, an innocent looking for loop can end up doing tons and tons of separate queries, resulting in much slower execution.

The 1+N problem occurs if a database request is made for every item returned by the first query.

The programming language Arcadia doesn't have recursion or loops, so the problem can not exist.

Some thoughts about the AI watermarking:

1. the way it's implemented makes it hardly possible to verify the watermark independently of the LLM's owner.
2. It helps the monster to differentiate fresh food from its own vomit, so it will not feed from the low-quality slop it once created.
3. Something that is not immediately visible as a human, and easily removed automatically is basically the opposite of a watermark.

SQLite can be used for many many applications.

Full-Text Search, JSON, high volume time serie data, Queue, Vector database, Cache (redis), file system (file under 100kB), graph database.

and again: the DB can fits in RAM or doesn't need a server. It's a simple file and avoid network requests for everything!

About some comparison:

For blobs under roughly 100KB, SQLite reads and writes faster than individual files on disk, and uses about 20% less space on top of it. The reason is that the file system charges you an open() and a close() and a directory traversal per item, while SQLite charges you one already-open file handle and a B-tree seek.
And here’s the kicker: a Redis GET over localhost is on the order of 100 microseconds. A SQLite point lookup against a warm page cache is on the order of 1 microsecond.

Another feedback about using plain text to keep track of the finances.

The tool used with the plaintext format is https://hledger.org/index.html

Eh oui c'est inutile en fait. Dans la plupart des cas, connaître le sexe de l'individu est inutile.

A collection of spinners created by state (thinking, searching, working, listening, composing, done). There are three types of spinner groups: Academy, Grid and Tape.

Another major outage

L'Amende Forfaitaire Délictuelle (AFD) punit un délit, entraîne une inscription au casier judiciaire (bulletins 1 et 2 si on ne la paye pas dans les temps), de 800-900€ à 3000€ et elle ne peut pas être contestée comme une amende classique.

Elle est délivrée par un policier de la police nationale.

1. En théorie, il est donc possible de refuser une Amende Forfaitaire Délictuelle et le refus de la signer devrait en être une preuve. En pratique, les flics mettent la pression et te font parfois signer des papiers sans dire ce que c’est. C'est prendre le risque d'être enmené en garde à vue ou d'être convoqué pour un procès ultérieurement.
2. L’agent ne peut pas non plus donner d’AFD si plusieurs infractions sont constatées simultanément dont au moins une ne peut faire l’objet d’une procédure d’AFD. De même, cette procédure n’est pas censé être possible s’il y a besoin de plusieurs PV pour caractériser l’infraction.

Le billet de blog renseigne comment contester une telle AFD.

Et conseille de se rapprocher de https://rajcollective.noblogs.org/ au besoin.

Apple founder Steve Wozniak jumped into the Slashdot comments on his 75th birthday last year.

The reason that some successful people aren't billionaires is because they use their wealth to make the world a better place. "Success" isn't measured by the number in a checkbook.

Des photos resplandissantes de l'eclipse du 12 août 2026.

Un sondage sur le thème choisi entre:

• forcé clair
• forcé sombre
• sombre ou clair, celui que j'ai choisi dans le système ou le navigateur
• sombre ou clair, je veux choisir sur chaque site

The fastest way out is to make something concrete.

It could be a sketch, a rough doc, an ugly prototype, a draft API, or a half-working implementation. It only needs enough detail to expose the choices hidden inside the idea.

The first version is not a proposal to defend. Its job is not to be right. Its job is to turn invisible assumptions into visible choices.

Comme d'habitude, les équipes "sont pleinement mobilisées" mais c'est trop tard. Pensez bien à déménager, et changer tous vos biens immobiliers.

2 millions de propriétaires de biens immobiliers. French Breaches fait état sur son site de 678 437 personnes qui seraient concernées, dont 392 867 particuliers et 285 570 professionnels.

La nouvelle est aussi relayée sur Next: https://next.ink/251702/un-pirate-a-accede-a-la-plateforme-des-impots-des-donnees-fiscales-compromises/
et sur LesNumériques: https://www.lesnumeriques.com/societe-numerique/l-education-nationale-se-fait-pirater-par-le-hackeur-des-impots-43-go-de-donnees-dans-la-nature-personnels-eleves-n260530.html

Oh shit here we go again

Bloctel, quelle ironie.

and serving a complete web app

Following the philosophy of uBlock Origins. Pi-hole does the same at the network level.

(via https://sebsauvage.net/links/?XV57kA)

Un site générant des demandes de requêtes d'accès aux enregistrements vidéos.

Malheureusement, seulement certaines caméras de Paris sont référencées.

Then there were the ads in the Weather app! I have said this before, and I’ll say it again: Windows 11 is not a free OS. It should not be showing more ads. I searched for the app in the Microsoft Store and realised that the Windows default Weather app is actually “MSN” Weather, which explains the ads.

and the weather app is a lazy web app consuming 1.2GB.

Après environ 20-30 recharges, les piles lithium-ion rechargeable USB sont rentables. X-Star est mentionné plusieurs fois.

Les piles Ni-MH (rechargeables) ont besoin d'un rechargeur dédié, et leurs tensions baissent avec le temps.

On arrive avec le résultat suivant

Les lithium-ion tiennent plus longtemps sur un millier de recharge au minimum au lieu.

Le français est moins attirant que l'espagnol.

Ces vingt dernières années, le nombre d’élèves apprenant le français a chuté, de près de 1,8 million à moins de 1,3 million actuellement. D’autres matières connaissent des baisses comparables, comme le latin, passé de 820 000 élèves à 540 000 sur la même période.

Comme en France, elle est réputée plus accessible, plus mélodieuse, plus cool et plus sexy.

L'article original est paru dans le Frankfurter Allgemeine Zeitung

The technology giant won the award for publishing a May blog post that threatened security researchers with legal action if they publish zero-days about its products.

KISS if it's enough. It provides more velocity. That's why Sublime Text still has a community.

• cacher ses pseudos
• mixer les transactions entre les envoyeurs et les receveurs
• refaire le protocole de transaction comme Monero

Alors qu'en janvier 2026, Elon Musk twittait « Grokipedia connaît une croissance fulgurante. Elle dépassera largement Wikipédia cette année »

At the time [1990s], there was a new breed of web professionals proudly labeled “webmasters.” Part designer, part developer and part evangelist, webmasters held enough esoteric knowledge about the web to manage, edit and create websites, both large and small.
—Jay Hoffmann: The History of the Web, Volume I (2018).

Yes I wanted to be one when I was 14.

I believe that with the advent of AI, we are about to experience a renaissance. AI-augmented developers are operating well beyond the traditional scope of even a full-stack engineer. [...] AI enables and leverages, but the webmaster orchestrates and takes the responsibility.

But it does harm accessibility

FFmpeg toujours l'OG et le GOAT

L'IA est un outil, qui permet une certaine automatisation du métier de développeur.

Un autre discours qui dénonce l'IA et ö

Les promoteurs de l'IA passent leur temps à dévaluer ce que signifie être humain.

Note: leurs arguments peuvent être justifié, si l'IA elle-même est justifié; nous avons vu l'exemple d'AlphaGo jouer au go contre le champion du monde.

A list of IT projects

Une alternative à Adobe Fill & Sign, plus efficace et légère.

(via https://janlukas.blog/appydroid/mj-pdf)

The entire element such as a card is interactive as a button for visual users. The button or link remains correct for the rest of the users.