adeptima

Extremely happy user of Vite, Vitest, Rolldown, tsdown, Oxlint, and Oxfmt.

I do have lot of hardforked packages, and dont want to look back. Everything just works.

If you confused by the naming, start from Oxlint https://oxc.rs/docs/guide/usage/linter Rolldown https://rolldown.rs/

Did very little changes to tsconfig during past 6 months adoption

My day-to-day process - get the new package unless it some antd6, echart or some rendering engine or geo spatial lib, clean up with Claude, strict and unify type system and align it with my vite, tsconfig, oxlint tastes. The result - no need to follow libs bloat and supply chain attack issues. Easy to read, easy to fix.

exactly! allowlist or some sort of marketplace or app store like you like or not

appreciate all your work Hydra, Kratos and my favorite small RBAC lib - ory/ladon

the original sin of internet - it’s not secure, and for many it’s not the bug it’s a feature to make money or gain power. all nested layers to cover up previous fails. example - nonce, state, encryption bumps in oidc/oauth2.1

Mixed fealings cause the full context should include plans on both Authorization and Authentication flows at least withing Cloudflare ecosystem. No github examples

Anyway good start in the right direction from Cloudflare, yet still long way to go especially compare to the full Ory's offering its built on. Ory's Kratos handles identity, login, registration, recovery, MFA... https://github.com/ory

IMHO full scope should include plans on user store, SAML, multi-tenant org model. Good example - Zitadel https://github.com/zitadel has managed UI for orgs multitenancy, OIDC/PKCE supports, etc you can even partial glue RBAC to it

Subabase offers managed and opensource https://github.com/supabase/auth

Siding "MCP is dead, Skills forever" what bother me about all of them is planning to plug MCPs and rotate keys ... this start hitting the fan very soon

OAuth 2.0 Dynamic Client Registration (RFC 7591) https://datatracker.ietf.org/doc/html/rfc7591

https://modelcontextprotocol.io/specification/2025-03-26/bas...

Any comments greatly appreciated. Especially in multitenant saas and built-in "AI assistants" context

same experience. any good claude skills to ease the pain?

My expectations to dear fellow humans - more sophisticated personal insults (ex. give me your cute comments), a freudian slips, hidden messages and motives, first viewer experience with the next cool toy from the hype train, sharing all kind of insecurities, heavy f.. word if very dramatic first person experience happened, border line exposure to the insider info, sharing something your corporate HR gestapo wont appreciate but might help another guy on the line, "i knew the guy who actually did it" stories, motivational statement toward my non-native english, etc

->> ◕ ‿ ◕ <<--

real learning- copy paste the content and ask for “critical and constructive feedback and potential false narratives from industry professionals” to get 10x from it

https://chatgpt.com/share/695e125f-1254-800a-8661-d7a046f4c2...

Real tip - find someone who loves outbound, can create a funnel outside of Linkedin or convert traffic from Linkedin to something more reliable and can talk about numbers non-stop for hours.

Ex. I never did more than 1k whatsapp messages with 20% open rate in a month ...

Know a friend who is doing 190k MRR with 12k whatsapp messages open rate 40%-60% (no AI SDRs!, fake avatars, etc) and what to double it next year. All he wants to talk is outbound ... and how it will make rich and how it should cost no more than 20% revenue.

99,999% hates outbound with passion, want to dump on someone else, can't retain SDRs for more than 6 months, etc

There are already public memos from large companies where leaders tell their staff that any request for headcount has to come with a justification for why an AI system cannot do the job

spot on! at my place - playwright + prompts instead of hiring QA. data analytic guy is gone ... noone is missing him

today's random quotes

- "AI isn't replacing jobs. AI spending is" ...

- "he job market in India has grown 9% in 2025, so far. 53 million in new jobs. I wonder, how many jobs came from U.S. companies being off shored?"

5 trilllion off the global IT bubble funded by VC money taken somewhere else poured into GPUs and data centers

look at number of linkedin profiles in US companies like Accenture in India .... 450 000 + ... feel really bad biggest transfer of head-counts from US, chatgpt just fuelled it

10+ years in Japan. The message here is much deeper from my perspective. “Let’s jump on the call” is not the solution. The guy was stripped off of his face. I love Japan for being human. Small business bar or restaurant with 3 tables. Not everything should be streamlined for a quick call solution… the process was pushed on his head. Google nemawashi decision making process

100% agree

Did research on accent, pronunciation improvement, phoneme recognition, kaldi ecosystem, etc … nothing really changed in the public domain past few years. There’s no even accurate open source dataset. All self claimedccc manually labelled dataset with 10k+ hours was partly done with automation. Next issue, model models operates in different latent space often with 50ms chunks while pronunciation assessment requires much better accuracy. Just try to say B loud - silent part gathering energy in the lips, loud part, and everything what resonates after. Worst part there are too many ml papers from the last year students or junior phd folks claiming success or fake improvements, etc

The article itself is just a vector projection in 3d space … the actual reality is much complex.

Any comments on pronunciation assessment models are greatly appreciated

QGIS is a gold standard to verify you tools works fine and data is in a correct format ...

if you are a web based first, you have even better options to build and extend

kepler, protomaps, maplibre-gl-js

https://kepler.gl

https://protomaps.com

https://github.com/maplibre/maplibre-gl-js

the rest can be found on great Qiusheng Wu’s (aka @giswqs) Geo/GeoAI tutorials channels and repos

https://www.youtube.com/@giswqs/videos

https://x.com/giswqs

but what really amazed me is how geo spatial support is growing inside of databases recently

https://duckdb.org/docs/stable/core_extensions/spatial/overv...

all mighty postgis https://postgis.net/docs/manual-3.5/postgis_cheatsheet-en.ht...

https://sedona.apache.org/latest/

https://geoparquet.org/releases/v1.0.0/

and many unlocked dataset compare to other industries

https://docs.overturemaps.org/getting-data/duckdb/

https://www.openstreetmap.org/

https://hub.arcgis.com/search

lot great webtools are comming for sure and you still can be 100% of most of your geospatial pipeline

p.s. want to extend the above list with self-hosted tools with minimum or none dependencies on paid APIs, and recommendations are greatly appreciated

miss it heavily! it could read code dumps and was superior for code analysis and todos

checked my network - no one is using GPT 5 Pro ...

any feedback is greatly appreciated!!! especially comparing with o3

same sentiments with an article author - gpt5 looks like a cost-cut initiative.

my personal feeling gpt5-thinking is much faster but doesnt produce the same quality results as o3 which were capable to scan through the code base dump with file names and make correct calls

dont feel any changes with https://chatgpt.com/codex/

my best experience was to use o3 for task analysis, copy paste the result in https://chatgpt.com/codex/, work outside and vibe code from mobile

Foursquare has another open source project worth noting on DuckDB - SQLRooms

https://sqlrooms.org/

“Build data-centric apps with DuckDB An Open Source React Framework for Single-Node Data Analytics powered by DuckDB”

this guy .....

Meilisearch is great, used it for a quick demo

However if you need a full-text search similar to Apache Lucene, my go-to options are based on Tantivy

Tantivy https://github.com/quickwit-oss/tantivy

Asian language, BM25 scoring, Natural query language, JSON fields indexing support are all must-have features for me

Quickwit - https://github.com/quickwit-oss/quickwit - https://quickwit.io/docs/get-started/quickstart

ParadeDB - https://github.com/paradedb/paradedb

I'm still looking for a systematic approach to make a hybrid search (combined full-text with embedding vectors).

Any thoughts on up-to-date hybrid search experience are greatly appreciated

Look at Superset chart implementations and component choice all the time.

same experience

Happy eChart user. Added a tiny Reactjs wrapper on the top and ditched all D3 libraries. Never look back. Easy to inline and embed into slatejs based documents. Usable on mobile and responsive enough for my use cases.

if author covers cgroups,io_uring,namespaces,ebpf topics and update the book repo, i would just buy it to support.

https://github.com/stewartweiss/intro-linux-sys-prog

IMHO having up-to-date broad range of simple examples is worth of 100 bucks

Accurate word timestamps seems an overhead and required a post processing like forced alignment (speech technique that can automatically align audio files with transcripts)

Had a recent dive into a forced alignment, and discovered that most of new models dont operate on word boundaries, phoneme, etc but rather chunk audio with overlap and do word, context matching. Older HHM-style models have shorter strides (10ms vs 20ms).

Tried to search into Kaldi/Sherpa ecosystem, and found most info leads to nowhere or very small and inaccurate models.

Appreciate any tips on the subject

And by the way, has anyone researched on GNAP (published 20 March 2024)?

GNAP (Grant Negotiation and Authorization Protocol) is an in-progress effort to develop a next-generation authorization protocol

From spec https://oauth.net/gnap/

GNAP is not an extension of OAuth 2.0 and is not intended to be directly compatible with OAuth 2.0. GNAP seeks to provide functionality and solve use cases that OAuth 2.0 cannot easily or cleanly address.

GNAP and OAuth 2.0 will likely exist in parallel for many deployments, and considerations have been taken to facilitate the mapping and transition from existing OAuth 2.0 systems to GNAP

Doesnt look like GNAP will fly any time soon, however there is a very interesting part - Security Considerations section. Looks like it was made by people who are familiar with all varieties of cyberops and usability issues in OAuth2/OIDC spec.

Security Considerations section

https://datatracker.ietf.org/doc/html/draft-ietf-gnap-core-p...

If any cyberops, pentester pro reading this, please advise how to research more. Thanx in advance.

Thanx for sharing!

What if pre-signed URL is leaked, you cannot invalidate a pre-signed URL without rotating credentials or changing bucket policies, right?

I was thinking about signed cookies or API gateways type of solutions.

Some specs should be mandatory 100% agree

OpenID Foundation seems took a path of making "profiles" like FAPI rather consolidation and enforcing the best practices and depricating the bad.

FAPI (Financial-grade API Security Profile 1.0) https://openid.net/specs/openid-financial-api-part-1-1_0.htm...

I hope the community will combine it all at some point and add specifications for proper policy and resources management too by looking at the full lifecycle of modern applications.

my guess the idea and intension of .well-known was good, so generic end-user libraries can be implement ... the reality is ugly and generate lot of man hours for cyberops consultancies

And this is why OIDC and IDPs exists to expand more with nonce, user agent footprints and other validation mechanisms