Podcasts about vs code

Justin Grote (posh.guru) rejoins the PowerShell Podcast a year after his last appearance to talk about how fast the agentic AI world has moved since then. He walks through his experiments with the agent host protocol, running coding agents in isolated dev boxes and spot VMs so a stray command can only trash a container instead of his laptop. He and Andrew dig into what a "harness" actually is, how tools like these steer raw model output into something useful, and why that shift pushed Justin into a real existential dip this past summer, wondering what the point of hand building modules is when an agent can spin one up on demand. He works through how he came out the other side (doing it for the love of the game and the community), then gets into the practical stuff: a from-scratch C# rewrite of ModuleFast that cut Az module install time from seven seconds to three, the ExcelFast beta for slinging PowerShell objects in and out of Excel, and how he's tuning prompts using VS Code's new debug view and token caching. They also cover the rise of agent plugins (bundled skills plus MCP), his favorite lightweight plugin Ponytail, and Justin's read on where PowerShell fits once AI can talk to APIs directly. The conversation closes on advice for people getting into PowerShell right now and where to find Justin online. Key Takeaways: Agentic coding is moving fast enough that "harnesses" (the coordination layer around an LLM, like GitHub Copilot or Claude Code CLI) matter as much as the underlying model, and running agents in isolated dev boxes or spot VMs lets you hand over real autonomy without real risk. Feeling threatened by AI generating modules on the fly is common right now. Justin's answer was to keep building for the love of the craft and the community rather than chasing relevance. PowerShell's role is shifting from "the way you talk to a computer" toward a rapid prototyping and troubleshooting tool that both humans and AI agents reach for, especially anywhere a GUI or a full compiled language is overkill. Guest Bio: Justin Grote is a PowerShell MVP and the author of ModuleFast and ExcelFast, along with other tools in the PowerShell ecosystem like PoshNmap and several SecretManagement extensions. He works for a managed services provider and has been a fixture of the PowerShell community for years, known online as posh.guru. Resource Links: Justin Grote on GitHub https://github.com/JustinGrote Justin Grote on Bluesky (posh.guru) https://bsky.app/profile/posh.guru ModuleFast https://github.com/JustinGrote/ModuleFast ExcelFast https://github.com/JustinGrote/ExcelFast Ponytail (the agent plugin Justin mentioned) https://github.com/DietrichGebert/ponytail PowerShell Discord https://discord.com/invite/powershell The PowerShell Podcast on YouTube: https://youtu.be/MsgZoIKYnY0  

Broadcast date: September 28th, 2026, 19:00 CET SysML v2 is shaping up to be more than a modeling language. It is becoming a shared, standardized foundation for digital engineering. But what does it take to build an open, high-performance, and commercially friendly implementation that strictly conforms to the specification? In this upcoming episode of the MBSE Podcast, we sit down with Chris Delp and Robert Karban from OpenSysML (opensysml.org) to take a deep dive into building a complete, spec-conformant SysML v2 stack for the open-source community and industry alike. In this episode, we cover: The Vision of an Open SysML Runtime: Why the ecosystem needs an unencumbered, commercial-friendly, spec-conformant open-source implementation, and why open-source and community needs are essential for driving standards forward. The Full v2 Stack & Flexo: How Flexo serves as the model management service with SysML v2 compliance, offering a v2 API–compliant performant architecture. Developer Tooling & Ecosystem: From the CLI and Language Server Protocol (LSP) to seamless integrations with VS Code, Python, and WebAssembly. Multi-Language SDKs: Bringing native, object-oriented programmatic interfaces to engineering teams in Python, C#, C++, Kotlin/Java, and TypeScript. Views, Documents & Beyond: A look into view and viewpoint document generation, as well as where execution fits into the long-term roadmap. There is a huge amount happening in the open-source SysML v2 space, and this conversation gives a direct look under the hood. Watch the livestream on YouTube or catch it later on YouTube, Spotify, iTunes, or Amazon Music. Stay tuned and subscribe to the MBSE Podcast on your favorite platform! Stay tuned and subscribe to the MBSE Podcast on your favorite platform! Der Beitrag Episode 70: OpenSysML with Chris Delp and Robert Karban erschien zuerst auf The MBSE Podcast.

Microsoft offers a surprising number of ways to build agents in Microsoft 365. Which one should you choose? Richard talks to Andrew Connell about the evolving Microsoft 365 Copilot landscape and the four major approaches to building agents. Starting with SharePoint Agents for document-focused scenarios, Andrew walks through Agent Builder inside Microsoft 365 Copilot, the increasingly popular Copilot Studio in the Power Platform ecosystem, and the often-overlooked Agents Toolkit for VS Code. Along the way, he discusses governance, licensing, publishing models, security concerns, and when Azure Foundry makes sense. The result is a practical guide to understanding Microsoft's growing agent platform and choosing the right tool for your organization.LinksMicrosoft Copilot ArchitectureSharePoint AgentsAgent Builder in Microsoft 365 CopilotMicrosoft Copilot StudioAgents ToolkitMicrosoft FoundryRecorded Sep 2, 2026

Hi, Spring fans! In this conversation, Spring Tools lead Martin Lippert joins us for a fascinating look at how developer tooling has evolved from Eclipse to VS Code and beyond. We dig into the architecture behind Spring Tools, language servers, MCP, and how the same ideas that once helped developers stay in flow are now helping AI coding agents understand Spring projects better. If you care about the future of Java, IDEs, and AI-assisted development, this one's packed with insight.

Join host Steven Dickens in this episode of I Am a Mainframer featuring Jakub from Broadcom, chair of the Zowe Technical Steering Committee and an active contributor to the open-source mainframe community.Jakub explains how Zowe helps integrate z/OS with modern enterprise tools and workflows through components such as Zowe Explorer for VS Code and IntelliJ, the Zowe CLI, the API Mediation Layer, virtual desktop capabilities, and the Zowe MCP Server.The conversation explores Zowe's evolution from a vendor-supported project into a growing open-source community, with customers and service providers increasingly contributing code. Jakub also discusses how AI and MCP-based tools could change mainframe development, while highlighting the importance of secure integration and human review in open source projects.He shares his unexpected journey from software engineering and the space industry into the mainframe ecosystem, offers advice to early-career professionals about staying curious and building lasting relationships, and discusses the importance of giving developers hands-on access to z/OS.Looking ahead, Jakub envisions the mainframe as an optimised and critical part of enterprise infrastructure, supporting core transaction processing while its data helps power AI-driven innovation.Subscribe for more conversations from Mainframe Connect and the I Am a Mainframer series.#IAmAMainframer #MainframeConnect #OpenMainframeProject #Zowe #Broadcom #OpenSource #zOS #AI #MCP #MainframeModernization

Hoy te traigo un episodio que llevaba tiempo queriendo grabar. En el episodio 829 te hablé sobre skills, pero me quedé con la sensación de haberme enrollado sin mostrar nada concreto. Así que le he dado la vuelta a la tortilla y en esta ocasión te traigo siete MCPs que he seleccionado uno a uno para que veas de qué va esto del Model Context Protocol y, sobre todo, para que compruebes cómo transforman lo que puede hacer tu inteligencia artificial.Porque hay que decirlo claro: la IA es tonta. Literalmente. No sabe qué hora es, no sabe leer un archivo, no sabe si tienes issues abiertos en GitHub, no sabe cómo te llamas. Cada vez que empiezas una conversación con cualquier modelo de lenguaje, empiezas de cero. Y aquí es donde entran los MCPs, que no son ni más ni menos que herramientas: manos, ojos y oídos para que la IA pueda hacer cosas útiles de verdad.El Model Context Protocol es un estándar abierto creado por Anthropic que funciona como un *USB-C para la IA*. Un conector universal que permite que cualquier aplicación de IA se conecte con cualquier fuente de datos o herramienta externa. Y lo mejor es que no es propietario, al contrario que los plugins de ChatGPT. Cualquiera puede crear un MCP, y de hecho te cuento cómo hacerlo con Python o Rust.En este episodio repaso siete MCPs que uso en mi día a día. Empiezo por el Filesystem, que permite a la IA leer, escribir, buscar y editar archivos en tu sistema, con control de acceso para que no haga tonterías. Sigo con el SQLite, ideal para consultar bases de datos locales de agenda, finanzas o cualquier aplicación que uses. Después llega el GitHub, el servidor oficial de GitHub escrito en Go, que te permite gestionar issues, pull requests, repositorios y mucho más sin salir del chat.También te hablo del Web Fetch, que permite a la IA leer páginas web y convertirlas a Markdown ahorrando una barbaridad de tokens. Y del Time, que es una tontería pero imprescindible: la IA puede saber la hora en cualquier huso horario del mundo. Luego está el Memory, que construye un grafo de conocimiento persistente para que la IA recuerde quién eres, qué prefieres y qué proyectos tienes entre manos, incluso entre sesiones. Y por último, el Sequential Thinking, una herramienta de razonamiento paso a paso que obliga a la IA a pensar de forma estructurada cuando se enfrenta a problemas complejos.También hablo de cómo configurar estos MCPs en OpenCode, Claude Desktop y VS Code, y cuánto consumen de RAM y tokens. Porque no es lo mismo activar veinte servidores que tener solo los que necesitas. Y para rematar, comparo MCPs con skills: las skills le dicen a la IA cómo comportarse, los MCPs le dan capacidades para actuar.Y si te pica la curiosidad por crear tu propio MCP, también te cuento las diferencias entre usar el SDK de Python (súper rápido de prototipar) y el de Rust (más rendimiento, menos consumo de RAM).Capítulos del episodio:0:00 - Introducción: la IA necesita herramientas para ser útil2:30 - ¿Qué es MCP? Arquitectura host-cliente-servidor y JSON RPC 2.05:30 - Cinco razones para adoptar MCPs8:00 - MCP Filesystem: leer, buscar y crear archivos11:00 - MCP SQLite: consultar bases de datos y el no-determinismo14:00 - MCP GitHub: issues, pull requests y repositorios17:00 - MCP Web Fetch: búsquedas en internet con ahorro de tokens19:30 - MCP Time: la hora en cualquier huso horario21:30 - MCP Memory: grafo de conocimiento persistente23:30 - MCP Sequential Thinking: razonamiento paso a paso25:30 - Configuración en OpenCode, consumo de tokens y RAM27:30 - Crear tu propio MCP: Python SDK vs Rust28:30 - Cierre y despedidaMás información y enlaces en las notas del episodio

Côté IA : MCP devient stateless, Claude watermarke ses textes, GPT-6 Astra défie Claude Fable, et une étude JetBrains confirme Claude Code en tête des agents de code. Côté JVM : JDK 27 généralise G1, Kotlin 2.4 stabilise les context parameters, une API JSON arrive dans le JDK, et Quarkus comme Micronaut enchaînent les versions. En bonus, trois pannes IA simultanées et un câble débranché chez Google Cloud. Enregistré le 11 septembre 2026 Téléchargement de l'épisode LesCastCodeurs-Episode-343.mp3 ou en vidéo sur YouTube. News Langages Les Types Algébriques de Données (ADTs) en Java rockthejvm.com/articles/algebraic-data-types-in-java Le problème : L'approche classique (champs nullables, hiérarchies de classes ouvertes) crée des états invalides et des erreurs à l'exécution (comme le NullPointerException). Types Produits (ET logique) : Implémentés en Java avec les Records. Ils regroupent plusieurs champs de manière immuable et concise. Types Sommes (OU logique) : Implémentés avec les Sealed Interfaces. Elles définissent un ensemble strictement fermé de sous-types connus à la compilation. ADTs (Types Algébriques) : La combinaison des Sealed Interfaces et des Records. Ils garantissent que les états invalides sont impossibles à représenter dans le code. Pattern Matching : L'extraction des données se fait via des expressions switch exhaustives, supprimant le besoin de casts manuels et obligeant le développeur à traiter tous les cas possibles. Généralisation : Ce modèle est idéal pour créer des types comme Result, forçant le traitement explicite et sécurisé des succès et des erreurs typées. Pourquoi "Algébrique" ? Parce que les types sont combinés mathématiquement (Produits = multiplication, Sommes = addition) pour limiter strictement le nombre d'états possibles d'une donnée. JDK 27 : fonctionnalités et calendrier de sortie openjdk.org/projects/jdk/27 infoworld.com/article/4202901/jdk-27-the-new-features-of-java-27.html JDK 27 est la prochaine version majeure de Java, une version non-LTS avec seulement 6 mois de support, qui succède à JDK 26. La disponibilité générale est prévue pour le 15 septembre 2026, avec des release candidates les 6 et 20 août 2026. Le périmètre est désormais figé (feature freeze) avec neuf JEP au programme. Le ramasse-miettes G1 devient le collecteur par défaut dans tous les environnements, et plus seulement en mode serveur. Ajout d'un support de la cryptographie post-quantique pour TLS 1.3, via des échanges de clés hybrides combinant algorithmes classiques et résistants au quantique. Finalisation de l'API PEM pour encoder et décoder clés, certificats et listes de révocation au format PEM. L'API Vector poursuit son incubation pour la douzième fois, permettant d'exprimer des calculs vectoriels compilés en instructions CPU optimisées. Les en-têtes d'objets compacts, introduits en JDK 24, sont désormais activés par défaut et réduisent l'empreinte mémoire du tas. Plusieurs previews sont reconduites : constantes paresseuses (3e preview), types primitifs dans les patterns (5e preview) et concurrence structurée (7e preview). Ajout d'une fonctionnalité de rédaction in-process pour JFR, afin de masquer les données sensibles dans les enregistrements de profiling. Kotlin 2.4 : nouveautés du langage et outillage kotlinlang.org/docs/whatsnew24.html Kotlin est un langage moderne, multiplateforme (JVM, Android, iOS, JavaScript, Wasm) développé par JetBrains, souvent utilisé comme alternative à Java. Les context parameters passent en stable : ils permettent de fournir des dépendances implicites à une fonction sans les déclarer en paramètre explicite, un peu comme une injection de dépendances. Les collection literals arrivent en expérimental : on peut écrire une liste avec des crochets, comme en Python, par exemple val fruits = ["pomme", "banane"]. L'API UUID de la bibliothèque standard devient stable, pour générer et manipuler des identifiants uniques nativement. Nouvelles fonctions utilitaires comme isSorted() pour vérifier si une collection est déjà triée. Support de Java 26 côté JVM et alignement automatique des versions Java et Kotlin dans les projets Maven. Kotlin/Native, la compilation vers du code natif iOS et macOS, active par défaut un nouveau ramasse-miettes plus rapide et améliore l'export vers Swift. Kotlin/Wasm, la compilation vers WebAssembly pour faire tourner du Kotlin dans le navigateur, rend la compilation incrémentale stable. Kotlin/JS permet désormais d'exporter des value classes vers JavaScript et TypeScript. Le compilateur K1, l'ancienne génération, n'est plus supporté : seul le nouveau compilateur K2 reste disponible. JEP 540 : une API JSON simple intégrée au JDK (incubation) openjdk.org/jeps/540 Le JDK ne propose aujourd'hui aucune API JSON native, obligeant à dépendre de bibliothèques externes comme Jackson, Gson ou Jakarta JSON pour parser ou générer du JSON. Cette JEP remplace la JEP 198 de 2014 et cible JDK 28 avec le nouveau module incubateur jdk.incubator.json. L'objectif est de couvrir les besoins simples d'extraction de données sans binding de données ni API de streaming, en laissant ces cas avancés aux bibliothèques existantes. L'API s'articule autour de l'interface scellée JsonValue avec six sous-types : JsonString, JsonNumber, JsonBoolean, JsonNull, JsonObject et JsonArray. Le parsing est strict et conforme à RFC 8259 : pas de virgules finales, pas de commentaires, et les noms de membres dupliqués provoquent une erreur. Donc pas de JSON5 La navigation se fait via get et tryGet, et la conversion vers des types Java via asInt, asLong, asDouble, asString, asMap ou asList. En cas d'erreur, une JsonValueException précise le chemin exact dans le document et sa position en ligne et colonne. Le pattern matching sur les sous-types de JsonValue permet de gérer proprement l'évolution du format d'un document JSON dans le temps. La génération se fait via toString pour une sortie compacte ou Json.toDisplayString pour une sortie indentée et lisible. À terme, le JDK pourrait utiliser cette API en interne, par exemple pour remplacer les fichiers de configuration au format property par du JSON. Autres nouvelles du JDK openjdk.org/jeps/535 openjdk.org/jeps/541 le mode generationel pour Shenandoah est prévu par défaut et deprécue le non générationel en 28 fini le support de Java sur Apple Intel GraalVM 25.2 : références compressées et Graal Script Agent medium.com/graalvm/… GraalVM est une machine virtuelle polyglotte d'Oracle offrant compilation JIT avancée et compilation en image native pour accélérer les applications Java et d'autres langages. Cette version 25.2 fait partie du train de releases innovation qui livre les nouveautés plus vite, pendant que GraalVM 25.0 reste la version stable recevant les correctifs de sécurité critiques. Nouveauté phare, le Graal Script Agent transforme des demandes en langage naturel en plugins sandboxés exécutés localement, en JavaScript ou Python, avec un accès restreint aux APIs de l'application. Les références compressées sont désormais activées par défaut dans Native Image sur les systèmes 64 bits, remplaçant les adresses complètes par des valeurs 32 bits relatives au tas. Cette optimisation réduit de 39% la consommation mémoire RSS d'une application Micronaut connectée à Oracle Database, comparée à la version 25.0. Contrepartie de cette optimisation, le tas géré est désormais plafonné à 32 Go. Le garbage collector G1 est maintenant disponible sur toutes les plateformes, y compris Windows, via l'option –gc=G1. G1 apporte de meilleures performances, une latence réduite et un démarrage plus rapide, avec des images natives plus petites grâce à l'optimisation guidée par profil. Le Vector API de Java est activé par défaut pour exploiter les instructions SIMD, utile pour le machine learning et le traitement de données. Bonne intégration avec l'écosystème via Micronaut 5.1, Quarkus et WebAssembly. Shopify arrête React Native pour ses applis mobiles iOS et Android et repasse à du natif avec Swift et Kotlin shopify.engineering/back-to-native Les progrès majeurs des LLM (IA) réduisent drastiquement le coût du développement sur deux plateformes distinctes. Les bénéfices du natif pur restent supérieurs, moins de couches d'abstractions, de dépenfances externes, et plus rapide pour adopter les dernières fonctionnalités des OS Les bibliothèques open-source (Skia, FlashList, Restyle) évoluent : Skia sera forkée par William Candillon, FlashList cherche un nouveau repreneur, Restyle sera archivée fin 2026. Migration des applications (Shop, Shopify, etc.) réalisée en mode "greenfield" (reconstruction totale) assistée par IA. Utilisation du système "Helix" pour un développement itératif et contrôlé par des agents IA. Découplage de la logique métier et de l'interface via une CLI pour accélérer les tests et éviter les lenteurs des simulateurs. L'application Shop a été entièrement reconstruite en natif en 12 semaines ; les autres suivront. Librairies LangChain4j CDI est une extension CDI qui intègre LangChain4j avec CDI de Jakarta EE langchain4j.github.io/langchain4j-cdi LangChain4j CDI : Extension intégrant LangChain4j à Jakarta EE et MicroProfile. Services IA : Injection et gestion de cycle de vie via @RegisterAIService. Orchestration d'agents : 11 topologies d'agents configurables par annotations. Serveur MCP : Conversion de beans CDI en serveurs Model Context Protocol. Fonctionnalités d'entreprise : Configuration externe, tolérance aux pannes et observabilité OpenTelemetry. Installation Maven : Deux extensions disponibles selon l'environnement (build-time pour Quarkus/Helidon, portable pour WildFly/GlassFish/Liberty). Prérequis techniques : Java 17+, Jakarta EE 10, MicroProfile 6.1. Quarkus 3.36, 3.37 et 3.38 : trois releases avant Quarkus 4 quarkus.io/blog/quarkus-3-38-released quarkus.io/blog/quarkus-3-37-released quarkus.io/blog/quarkus-3-36-released Quarkus est un framework Java cloud natif optimisé pour GraalVM et HotSpot, conçu pour les microservices et les environnements conteneurisés. En 3.38 (29 juillet), l'équipe allège les nouveautés pour se concentrer sur Quarkus 4, la communauté atteint 1213 contributeurs. 3.38 introduit l'éviction basée sur le poids mémoire pour le cache Caffeine de second niveau d'Hibernate, en plus de l'éviction par comptage. 3.38 apporte l'extension Quarkus HTTP Problem qui implémente la RFC 9457 pour mapper les exceptions en réponses application/problem+json, intégrée à OpenAPI. 3.37 (24 juin) ajoute l'extension expérimentale quarkus jlink pour générer des images runtime JDK sur mesure et réduire la taille des conteneurs. 3.37 active par défaut la sérialisation Jackson sans réflexion pour de meilleures performances. et 3.39 lesdesactivent et les rement en opt-in 3.37 introduit dans REST Client RestMultiResponse pour lire codes de statut et en-têtes sur des réponses REST en streaming, avec passage à Hibernate ORM 7.4 qui exige PostgreSQL 14 minimum. 3.36 (27 mai) propose Quarkus Signals en expérimental, un système de communication typée entre composants inspiré des events CDI et de l'EventBus Vert.x. 3.36 embarque des SBOM applicatifs exposés via /.well-known/sbom, y compris en image native selon la spécification GraalVM. 3.36 ajoute l'authentification OIDC via JWT SPIFFE, facilitant l'identité de charge de travail en environnement zero trust. Micronaut Framework 5.1.0 : injection de dépendances, IA et sécurité renforcées github.com/micronaut-projects/micronaut-platform/…/v5.1.0 Micronaut est un framework JVM pour microservices et applications cloud-natives, avec injection de dépendances à la compilation et démarrage rapide. Introduction d'Open DI 1.0.0, une implémentation CDI Lite s'appuyant sur l'infrastructure d'injection de dépendances de Micronaut. Côté données, support officiel de SQLite et intégration MyBatis, avec ETags basés sur les valeurs pour le verrouillage optimiste. En sécurité, arrivée d'un module OWASP HTML Sanitizer, délégation d'authentification @RunAs et résolution de locale via OIDC. Côté IA, LangChain4j ajoute le support Chroma, la mémorisation de chat Oracle et l'authentification Google injectée pour Vertex AI, avec passage du MCP en version 2.0.0. Mises à jour majeures des dépendances : Spring Boot 4.1.0, Jetty 12.1.10, Tomcat 11.0.23, OpenTelemetry 1.64.0 et Kubernetes Java Client 27.0.0. SSL activé par défaut par service pour les clients HTTP Infrastructure Ça coûte combien de faire tourner un LLM local sur son Apple Silicon ? towardsdatascience.com/how-much-does-a-local-llm-actually-cost-to-run-i-measured-every-watt-on-apple-silicon Coût électrique des LLM locaux sur Mac Apple Silicon Un modèle 120B (MoE) coûte 5x à 10x moins cher qu'un modèle 27B (Dense). Le coût dépend du débit (tokens/seconde), pas du nombre de paramètres. Modèle dense –> Charge 100% des poids par token = lent et très énergivore. MoE (Mixture of Experts) –> N'active qu'une fraction des poids = rapide et économe. Conclusion : Pour réduire la facture électrique, choisir des modèles MoE quantifiés (haut débit). Kubernetes 1.36 (Haru) : sécurité renforcée et alignement IA infoq.com/news/2026/05/kubernetes-1-36-released Kubernetes est la plateforme open source de référence pour l'orchestration de conteneurs, portée par la CNCF. La version 1.36 nommée Haru apporte 70 améliorations : 18 passent stables, 25 en bêta et 25 en alpha, avec 106 entreprises et 491 contributeurs. Les user namespaces passent en disponibilité générale, isolant le root du conteneur de celui de l'hôte. Les Mutating Admission Policies passent en GA, remplaçant les webhooks par des règles CEL natives plus performantes. L'autorisation de l'API kubelet devient plus fine, remplaçant le droit trop large nodes/proxy. Le labeling SELinux des volumes utilise désormais mount -o context, accélérant le démarrage des pods. Plusieurs avancées ciblent les charges IA : gang scheduling en bêta, préemption consciente des groupes de pods, et allocation dynamique de ressources activée par défaut pour le partage fin des GPU. Le redimensionnement vertical des pods en place passe en bêta et activé par défaut, ajustant CPU et mémoire sans redémarrage. Suppression du plugin gitRepo, source de risque de sécurité, et du mode IPVS de kube-proxy, tous deux dépréciés de longue date. Avec la sortie de 1.36, la version 1.34 devient la plus ancienne branche encore supportée et entre en maintenance, ne recevant plus que des correctifs critiques avant sa fin de support. Terraform vs OpenTofu en 2026 : la divergence est actée ecorpit.hashnode.dev/terraform-vs-opentofu-in-2026-the-fork-has-diverged-so-which-do-you-standardize-on env0.com/insights/opentofu-in-2026-what-the-terraform-fork-became-after-three-years-of-independence Terraform est l'outil historique d'Infrastructure as Code de HashiCorp, OpenTofu en est le fork open source lancé après le changement de licence. HashiCorp est passé de la licence MPL 2.0 a la BUSL 1.1 en aout 2023, ce qui a poussé une partie de la communauté a créer OpenTofu sous la Linux Foundation. IBM a racheté HashiCorp pour 6,4 milliards de dollars, finalisé en février 2025, tandis qu'OpenTofu rejoignait le CNCF comme projet sandbox en avril 2025. OpenTofu prend de l'avance sur des fonctionnalités inédites : chiffrement du state côté client depuis la v1.7, valeurs éphémères qui gardent les secrets hors du state depuis la v1.11, et prevent_destroy dynamique en v1.12 (mai 2026). Terraform garde l'avantage sur l'orchestration managée avec Terraform Stacks, désormais en disponibilité générale, sans équivalent natif côté OpenTofu. Le coût diverge fortement : HCP Terraform facture jusqu'à 0,99 dollar par ressource gérée et par mois, alors qu'OpenTofu reste une CLI gratuite couplée au backend de son choix. Fidelity Investments a migré plus de 2000 applications et 50000 fichiers d'état vers OpenTofu, la complexité venant surtout de l'écosystème (CI/CD, gouvernance) plutôt que du binaire lui-même. OpenTofu reste compatible avec les configurations Terraform jusqu'a la version 1.6.x, mais les versions Terraform plus récentes n'offrent plus aucune garantie de compatibilité. Pour les secteurs régulés, le chiffrement natif du state par OpenTofu et sa gouvernance ouverte sont des arguments forts face aux exigences de protection des données. La recommandation qui ressort des deux articles : partir sur OpenTofu pour les projets neufs et rester sur Terraform si l'on est déjà investi dans HCP Terraform et ses fonctionnalités de gouvernance. OTel est à la peine ? matduggan.com/otel-isnt-going-well-and-i-made-a-spreadsheet-about-it Le développement d'OTel est un peu au point mort Périmètre démesuré : Volonté de supporter un nombre gigantesque de langages, bibliothèques et frameworks. Pénurie critique de mainteneurs : Les données montrent une hyper-concentration du travail ; de nombreux SDK (comme PHP ou Ruby) dépendent d'une ou deux personnes seulement. Stabilité paralysante : La règle interdisant toute modification d'une fonctionnalité déclarée « stable » crée une peur de valider les nouveautés, entraînant des mois de débats. Solutions proposées par l'auteur : Créer un niveau « Bêta » temporaire (ex: 12 mois) entre les statuts « Expérimental » et « Stable ». Faire preuve de transparence sur les différences de qualité/maintenance entre les langages (ne pas mettre Go et Ruby sur le même plan). Communiquer activement sur le besoin urgent de nouveaux mainteneurs. Assouplir la politique de stabilité en acceptant des breaking changes bien documentés. Honeycomb transforme son infrastructure Kafka honeycomb.io/blog/transforming-how-we-run-kafka-honeycomb Honeycomb est une plateforme d'observabilité dont Kafka est le coeur du pipeline d'ingestion, traitant des millions d'événements par seconde. L'entreprise a migré de Confluent Platform auto-hébergée vers Apache Kafka 4.1.1 en mode KRaft. Le nouveau cluster tourne sur AWS EKS avec Strimzi comme couche d'orchestration Kubernetes. Motivation principale : la récupération après remplacement de broker était passée de 8-12h à 48-72h avec l'ancienne stack. Confluent imposait aussi sa solution propriétaire de Tiered Storage, impossible à corriger en interne. Un incident de décembre 2025 ayant vidé un cluster a révélé une fenêtre d'opportunité pour migrer. La migration s'est faite progressivement sur six clusters, de dogfood jusqu'à la production. Les producteurs sont basculés avant les consommateurs, avec une courte fenêtre de downtime assumée entre les deux. Le stockage utilise des NVMe en instance store plutôt que de l'EBS pour minimiser la latence. interessant de voir une société reprendre en main sa compétence et de voir les contraintes de certaines fonctionalités propriétaires Cloud AWS us-west-2 : panne réseau régionale et effet domino chez les fournisseurs SaaS blog.incidenthub.cloud/aws-us-west-2-outage-jul-24-2026 AWS us-west-2 (Oregon) est une région cloud majeure hébergeant de nombreux services et fournisseurs SaaS. Le 24 juillet 2026, une panne matérielle réseau a coupé la connectivité entre la région et le Seattle Metro pendant environ 20 minutes. Particularité notable, seule la couche de connectivité externe a été touchée, le trafic interne à la région a continué de fonctionner normalement. Après la réparation matérielle, une phase distincte de reconvergence des routes a de nouveau causé une connectivité intermittente pendant plusieurs dizaines de minutes. Les clients Direct Connect via EqSe2 ont subi une coupure bien plus longue que le reste, 1h17 au total. Neuf incidents chez sept fournisseurs ont cité explicitement AWS comme cause, dont SendGrid, SparkPost et NinjaOne. Fait marquant, les temps de rétablissement des fournisseurs tiers ont largement dépassé la durée de la panne AWS elle même. NinjaOne a mis 9h29 à se rétablir totalement, avec 150000 appareils tentant de se reconnecter simultanément freinés par des mécanismes de backoff et jitter. SparkPost a mis 6h45 à absorber l'arriéré de courriels accumulé pendant la coupure, avec encore 80 à 90 minutes de retard des heures plus tard. L'article recommande d'identifier ses dépendances en us-west-2 et de prévoir capacité et bascule, l'effet différé pouvant durer bien plus longtemps que l'incident initial. Rapport Cloudflare Radar sur les perturbations Internet au Q2 2026 blog.cloudflare.com/fr-fr/q2-2026-internet-disruption-summary Cloudflare Radar est la plateforme qui analyse en temps réel le trafic mondial pour détecter pannes, coupures et censures Internet. l'instabilité est le nouveau normal Le super-typhon Sinlaku a fait chuter le trafic de près de 80% à Guam les 13 et 14 avril. Deux séismes de magnitude 7,5 ont fortement dégradé la connectivité au Venezuela le 24 juin. Une coupure électrique a provoqué cinq heures de perturbation en Tanzanie le 27 juin. En Iran, la connectivité s'est stabilisée à 59% du niveau normal après 88 jours de coupure. Le Soudan a imposé dix coupures programmées pendant les examens nationaux mi-avril. L'Irak a coupé Internet à trois reprises pour lutter contre la fraude aux examens. Des frappes de drones ont endommagé la région AWS me-central-1 aux Émirats arabes unis. Un renouvellement de clés DNSSEC a rendu les sites .de inaccessibles en Allemagne le 5 mai. Une rupture de câble sous-marin a fait chuter le trafic de 60% à Sainte-Lucie fin juin. l'instabilité est le nouveau normal Un ingénieur Google débranche une zone entière de Google Cloud https://www.theregister.com/off-prem/2026/09/04/google-engineer-unplugged-every-fiber-they-could-see-and-surprise-took-down-a-chunk-of-the-g-cloud/5294418 Google Cloud est la plateforme d'infrastructure cloud de Google, organisée en régions et zones de disponibilité comme us-central1. Le 1er septembre 2026, un ingénieur a débranché par erreur des câbles fibre optique lors d'une opération de maintenance matérielle routinière dans la zone us-central1-b. En 13 minutes, il a déconnecté 100 % des chemins de fibre optique de tous les équipements de cette portion de la zone. Les machines virtuelles hébergées dans la zone touchée sont devenues injoignables, avec une perte de paquets élevée. Le taux de chute du trafic réseau pour les ressources concernées a atteint 100 %. L'incident a duré 4 heures et 11 minutes, de 7h41 à 11h52 heure du Pacifique. Google a détecté l'anomalie, reroute le trafic, identifié les liaisons optiques débranchées puis rebranché physiquement les fibres avant le retour à la normale. Les post-mortems d'incident cloud sont un classique du podcast, mais l'erreur humaine sur du câblage physique chez un hyperscaler mérite une minute d'antenne. ChatGPT, Claude et Grok en panne presque simultanément le 3 septembre theregister.com/ai-and-ml/…/5294322 ChatGPT, Claude et Grok sont les assistants IA et coding agents désormais utilisés au quotidien par de nombreux développeurs. xAI loue ses datacenters à un certains nombre de fournisseurs de cloud et d'IA. ils ont fait tombé ses concurrents :slightly_smiling_face: Arreter là Le 3 septembre 2026, les trois services sont tombés en panne quasiment en même temps. ChatGPT a connu une panne de 7h43 à 8h17 PT, soit environ 34 minutes, due à une erreur de routage rendant ChatGPT et Codex indisponibles. Claude a subi une panne partielle de 3 heures et 6 minutes touchant Claude.ai, Claude Code, Claude Cowork et l'API Claude, résolue à 16h16 UTC. xAI a commencé à enquêter sur les problèmes de Grok dès 6h30 PT, puis SpaceX a confirmé une panne de son centre de calcul de Memphis. La coïncidence des trois pannes a fait suspecter un fournisseur commun à l'origine du problème. Pour les développeurs devenus dépendants de ces coding agents, l'épisode illustre le risque d'un point de défaillance unique xAI loue ses datacenters à un certains nombre de fournisseurs de cloud et d'IA. Web Nouveautés CSS 2026 : mixins, masonry natif et animations pilotées par le scroll modern-css.com/whats-new-in-css-2026 animation-timeline: scroll() et view() atteignent le baseline cross-browser, Firefox et Safari ayant livré le support complet. Plus besoin de préfixes ni de librairie JS. @starting-style devient cross-browser : animations d'entrée depuis display: none sans hack de timing JS. Firefox 147 amène l'anchor positioning au baseline, plus les view transition types et la Navigation API. Les menus contextuels via popover CSS arrivent aussi. Data et Intelligence Artificielle Guillaume a porté le SDK Python d'Antigravity en Java… en utilisant Antigravity lui même comme assistant ! glaforge.dev/posts/…/the-unofficial-antigravity-sdk-for-java SDK Java non officiel pour Antigravity, rétro-ingénierie du SDK Python pour exploiter un binaire Go sous-jacent. Cas d'usage : pipelines CI/CD, applications d'entreprise (Spring Boot), outils internes, surveillance en arrière-plan, interfaces personnalisées. Gestion des ressources : implémente AutoCloseable(try-with-resources) pour lancer et fermer proprement le processus Go. Exécution de code Java personnalisé : exposition de méthodes Java comme outils IA via les annotations @Toolet@Param. Streaming et programmation réactive : prise en charge des CompletableFuture, des callbacks (chatStream), et deFlow.Publisher. Fonctionnalités avancées : persistance de session, protocole MCP, politiques de sécurité, entrées multimodales, et sorties structurées mappées sur des records Java. Le SDK Java pour le protocol Agent2Agent sort sa version 1.2.0 medium.com/google-cloud/a2a-java-sdk-1-2-0-final-released… Prise en charge de la spécification A2A 1.0. Sécurité renforcée : Vérification stricte des autorisations de lecture sur les tâches référencées et implémentation d'une logique de blocage par défaut (fail-closed). Intégration facilitée : Support du câblage programmatique des autorisations pour les environnements non-CDI (comme Spring). Contrôle des flux : Ajout du Task Stream Lifecycle Hook pour surveiller et gérer le cycle de vie des abonnements aux flux d'événements. Stabilité des données : Immutabilité stricte imposée sur les enregistrements de spécifications pour empêcher toute modification accidentelle. Documentation : Lancement d'une documentation web multi-versions et d'un Javadoc agrégé pour tous les modules. Corrections de bugs : Résolution de problèmes liés à la synchronisation des tâches, aux réponses de streaming et aux conditions de concurrence HTTP. Breaking changes : Nécessite une migration suite à la modification de certaines méthodes d'autorisation, la réorganisation de packages et le renommage de l'état TaskState.UNRECOGNIZED en TaskState.TASK_STATE_UNSPECIFIED. Article sur le blog de JetBrains : blog.jetbrains.com/idea/2026/08/intellij-idea-goes-lsp pas trop de temps Langchain4j continue sa progression github.com/langchain4j/langchain4j/…/1.18.0 github.com/langchain4j/langchain4j/…/1.19.0 github.com/langchain4j/langchain4j/…/1.17.0 Introduction du pattern Debate pour lancer des sous agents dans rechercehnt et entrent dans un debat critique sur une decision avant qu'un juge decide (1.17) compensation d'action d'un outil avec @ReverseTool (1.17) Ajout du pattern Belief-Desire-Intention (1.18): belief est l'état du monde cru, desire est la liste des objectifs, intention est le plan pour avancer un ou plusieurs objectif Support d'un systeme crash resilient dans l'approche Human in the loop avec des checkpoints nestés (1.18) Support Open AI TextToSpeech (1.18) Support de Mistral batch chat (1.18) support MCP client 2026-07-28 (1.19) Anthromic batch chat et Google thinking mode (1.19) Embabel atteint 1.0 GA github.com/embabel/embabel-agent/…/v1.0.0 embabel d'eloigne de Spring AI ne s'appuie que sur Spring (notamment tool calling) nettoyage des explorations autour du pattern GOAL avant a 1.0 ajout observabilite (dont le cout) les approches de retry solidifiées et d'autres choses toujours basées sur la description de goals typés et des dependences entre eux via les types MCP 2026-07-28 : le protocole devient stateless blog.modelcontextprotocol.io/posts/2026-07-28 MCP (Model Context Protocol) est le protocole standard permettant aux LLM et agents IA de communiquer avec des outils, ressources et serveurs externes. Cette version marque le plus gros changement depuis le lancement du MCP distant il y a 18 mois. Le protocole passe d'un modèle bidirectionnel avec état à un modèle stateless en requête/réponse. Suppression de la poignée de main initialize/initialized et du header Mcp-Session-Id, chaque requête devient autoportante. N'importe quelle requête peut désormais être routée vers n'importe quelle instance de serveur derrière un load balancer classique, sans stockage partagé. Introduction des Multi Round-Trip Requests (MRTR) pour remplacer les requêtes initiées par le serveur, via un resultType input_required et des inputResponses. Nouveaux headers Mcp-Method et Mcp-Name pour permettre aux gateways de router et autoriser sans parser le JSON. Les résultats de tools, prompts et resources deviennent cacheables grâce aux paramètres ttlMs et cacheScope. Renforcement sécurité avec la validation d'issuer RFC 9207 pour éviter les attaques de confusion entre serveurs d'autorisation, et transition de DCR vers CIMD. Roots, Sampling et Logging sont dépréciés avec douze mois de support garanti, tout comme le transport legacy HTTP+SSE. Un site qui référence les skills pour la JVM (framework, langage, build…) jvmskills.com Frameworks : Spring, Quarkus, Jakarta EE, Reactor, Camel Java : bonne pratiques, conventions, guides de mise à jour à niveau LTS, API spécifiques (streams, optionals, logs…) Bases de données : ORM, validation, modélisation PostgreSQL, vectorielle avec pgvector Tests et qualité : TDD, mutation testing, debogage avec JDB Workflows dev et archi : commits git, domain modeling Outils et diagnostics JVM : JFR, Jstall, JSpecify Une skill n'est pas une librairie https://devx.writizzy.blog/p/un-skill-nest-pas-une-lib Les skills sont des éléments de configuration en prose pour agents IA comme Claude, distribués via des marketplaces à la manière de librairies logicielles. Frédéric Camblor critique cette analogie car partager un skill n'est pas la même chose que le mutualiser durablement. Écrire un skill prend 30 minutes mais l'adopter ailleurs coûte cher en appropriation et en maintenance. Forker un skill s'avère souvent plus efficace que de chercher à converger vers une version commune. Contrairement au code, les régressions d'un skill ne sont pas détectables automatiquement. Un skill peut se dégrader silencieusement sur plusieurs cas d'usage en corrigeant un autre. Les skills vieillissent vite car les modèles progressent et intègrent naturellement certaines bonnes pratiques. Le skill-creator d'Anthropic permet d'évaluer un skill via des jeux de cas et des mesures de variance. L'auteur distingue quatre sphères de partage : personnelle, équipe, outil et marketplace. Il propose un cycle partage puis appropriation puis duplication puis divergence plutôt qu'une installation collective figée. Les modèles Anthropic introduisent un filigrane (watermark) dans les textes qu'ils génèrent https://www.anthropic.com/news/claude-text-watermark Claude est l'assistant IA d'Anthropic, et le watermarking est une technique permettant de marquer discrètement un contenu généré par IA pour en tracer l'origine. Anthropic annonce que les futurs modèles Claude intégreront un filigrane numérique invisible dans le texte généré. Le principe exploite les choix de mots équivalents que le modèle fait naturellement, en les orientant via une clé cryptographique plutôt qu'un tirage aléatoire. Le texte produit reste indiscernable à l'œil nu, sans caractères cachés, sans ralentissement ni coût supplémentaire. Seule la personne possédant la clé correspondante peut détecter la présence du filigrane. Le filigrane est plus fiable sur les textes longs et créatifs, moins sur du texte factuel, du code ou après une édition manuelle poussée. Il ne prouve pas qu'un texte est écrit par IA, ni n'identifie l'auteur ou la conversation d'origine, il donne seulement une probabilité d'implication de Claude. Une API de détection est proposée en accès restreint aux régulateurs, forces de l'ordre, médias et vérificateurs de faits. Pour les fichiers non textuels comme les images ou les PDF, Anthropic s'appuie sur le standard C2PA. Cette initiative s'inscrit dans le Code de Pratique de l'UE sur la transparence des contenus IA, signé par Anthropic et environ 190 autres acteurs, en lien avec la loi européenne sur l'IA. GPT-6 Astra, le nouveau modèle d'OpenAI face à Claude Fable 5.1 https://openai.com/index/gpt-6-astra/ GPT-6 Astra est le nouveau modèle phare d'OpenAI, annoncé le 3 septembre 2026 comme le plus intelligent et le plus aligné de l'entreprise. Le modèle arrive deux jours après Claude Fable 5.1, à un tarif affiché comparable, dans une course accélérée aux modèles de code et de raisonnement. Astra revendique 98 % sur FrontierMath Tier 4, 99,9 % sur ARC-AGI-3 et 100 % sur ExploitBench. Fenêtre de contexte d'environ 1,05 million de tokens. Tarification API, 10 dollars par million de tokens en entrée, 50 dollars en sortie, et 1 dollar par million pour les tokens en cache. Au-delà de 272 000 tokens en entrée, toute la requête est facturée au double sur l'entrée et une fois et demie sur la sortie. Astra est le premier modèle d'OpenAI à franchir le seuil interne critique en cybersécurité. La version publique refuse les tâches offensives avancées comme générer des preuves de concept d'exploits. Le déploiement est progressif, les entreprises du programme de cybersécurité Daybreak d'OpenAI y accèdent en premier, avant ChatGPT Plus, Pro, Business, Enterprise, l'API et AWS. Même logique de diffusion contrôlée que chez Anthropic avec Mythos 5.1 : deux jours d'écart, deux modèles de tête, et la même question de savoir qui accède en premier aux capacités les plus sensibles. Outillage JetBrains s'est lancé dans les LSP (Language Server Protocol) avec une extension IntelliJ pour VS Code et assimilés marketplace.visualstudio.com/items?itemName=JetBrains.intellij-s… Nouveau produit : Lancement de l'extension Java & Kotlin by IntelliJ IDEA pour les éditeurs basés sur VS Code (incluant Cursor). Technologie : Utilisation du standard LSP (Language Server Protocol). Objectif : S'adapter au développement piloté par les agents IA, qui nécessite des fonctionnalités IDE légères et standardisées. Fonctionnalités clés : Support des projets Java, Kotlin et mixtes. Débogage (DAP). Complétion intelligente, navigation et analyse de code. Refactoring. Prise en charge de Maven, Gradle et Bazel. Disponibilité : Téléchargeable via le Visual Studio Marketplace et l'Open VSX registry. Licence / Prix : Gratuit durant la phase de preview (évaluation renouvelable de 30 jours). Nécessitera un abonnement IntelliJ IDEA Ultimate après la preview. (Note : Le LSP purement Kotlin reste gratuit et open-source). Avenir : Développement en cours pour optimiser les flux de travail avec les agents IA en ligne de commande (ex: Claude Code, Codex) afin de réduire la consommation de tokens. Après son acquisition par SpaceX, Cursor perd l'accès aux modèles OpenAI https://openai.com/index/our-decision-on-cursor-following-its-acquisition-by-spacex/ decision difficile mais Elon ment comme un arracheur de dent (et c'est un competiteur donc bon ça nous arrange) David Pilato a créé un thème spéciale pour les gens pour les devrel, ou qui font des talks à droite à gauche, pour le moteur Hugo https://david.pilato.fr/posts/2026-09-07-hugo-theme-devrel/ hugo-theme-devrel, thème Hugo (MIT) pour Developer Advocates et conférenciers, fonctionnant comme un module superposé au thème Dream. Gestion des conférences (cartes Leaflet), présentations (PDF, YouTube, co-auteurs), vues dédiées (archives, sujets récurrents, vidéos) et recherche Pagefind. Chaque intervention est un page bundle YAML structuré comme une base de données relationnelle compilée par Hugo. Architecture Airbnb refond son authentification en architecture server-driven, 60 % de code en moins https://www.infoq.com/news/2026/09/airbnb-server-driven-login/ Airbnb a restructuré son authentification autour d'un modèle en deux phases, identification du compte (email, téléphone ou connexion sociale) puis choix du challenge d'authentification décidé côté serveur selon le contexte utilisateur. Ce qui est interessant c'est que choisir la method d'authentification est côté serveur et adaptative, comme si c'était une révolution Arreter là Un moteur de politique serveur sélectionne la méthode d'authentification optimale avec des solutions de repli, permettant des adaptations régionales comme l'OTP WhatsApp au Brésil ou des fournisseurs d'identité locaux en Corée du Sud sans nouvelle version client. Un Challenge Picker propose des méthodes alternatives classées par probabilité de succès en cas d'échec. Résultat chiffré, 60 % de code d'authentification en moins et 100 Ko de moins sur le bundle client web. Méthodologies Les nouvelles règles d'ingénierie du contexte pour les modèles Claude 5 x.com/trq212/status/2080710971228918066 Partage par Thariq des apprentissages sur l'ingénierie du contexte et le prompt engineering pour les nouveaux modèles Claude 5 (comme Claude Opus 5 et Claude Fable 5) utilisés dans Claude Code. Évolution majeure vers le dés-empirement (unhobbling) : plus de 80 % du prompt système de Claude Code a pu être supprimé sans perte sur les évaluations de code, les modèles récents faisant preuve d'un bien meilleur jugement contextuel. Passage des règles strictes au jugement : au lieu d'interdire les commentaires ou d'imposer des contraintes lourdes, les modèles s'adaptent désormais au code environnant et font appel à leur propre discernement. Remplacement des exemples par la conception d'interfaces : fournir des exemples figés restreint l'exploration du modèle, d'où l'importance de concevoir des outils et des fichiers plus expressifs. Adoption de la divulgation progressive (progressive disclosure) : chargement dynamique du contexte (via des compétences ou des outils à chargement différé comme ToolSearch) pour éviter de saturer la fenêtre de contexte avec des instructions fixes. Utilisation d'une mémoire automatique et de références riches (artefacts HTML, suites de tests, fonctions de référence) plutôt que de fichiers CLAUDE.md pléthoriques ou de consignes répétitives. Recommandation pour les fichiers CLAUDE.md et les Skills : les garder légers, se concentrer sur les pièges spécifiques (gotchas) du dépôt, et structurer les guides sous forme d'arborescences modulaires pour ne charger que le nécessaire. Niveau d'adoption des agents IA de codage selon une étude de JetBrains blog.jetbrains.com/research/2026/08/ai-coding-agent-adoption-2026 Adoption massive : 90 % des développeurs professionnels utilisent des agents d'IA de codage au moins une fois par semaine, et 68 % quotidiennement. Claude Code domine : Il devient le nouveau leader du marché avec 39 % d'adoption mondiale (47 % aux États-Unis), détrônant largement ses concurrents. Déclin de GitHub Copilot : L'ancien leader perd de sa superbe, passant de 29 % à 21 % d'adoption, bien qu'il conserve une très forte notoriété (79 %). Percée de Codex : Sa croissance est fulgurante, son taux d'adoption ayant été multiplié par 5 en quelques mois (de 3 % à 16 %). Recul de Cursor : L'outil connaît une légère baisse, passant de 18 % à 12 % d'adoption, principalement due à une forte chute sur le marché chinois. Écosystème diversifié : JetBrains AI atteint 9 % d'adoption. Des alternatives comme OpenCode (7 %) et Google Antigravity (6 %, mais très populaire en Inde à 15 %) continuent de s'implanter. L'IA a cassé les hypothèses de la CI… ou pas https://stack72.dev/ai-broke-the-assumptions-behind-ci/ Paul Stack (ex-Pulumi) explique que l'intégration continue a toujours mêlé deux rôles distincts, exécuter la vérification du code et coordonner les fusions. avec les agents, la pression sur la CI augmente, car ils ne testent pas end to end tout le temps ils ont maintenant des workflows qui verifient tests, lint, revue d'agent etc dans un env local isolé donc c'est pre PR push Il propose de séparer vérification (exécution), attestations structurées (hash de commit, checksums SHA256) et CI, réduite à la validation et à la coordination des fusions. Sa thèse, les agents IA peuvent désormais vérifier tout le code localement avant même l'ouverture d'une pull request, ce qui bouleverse cet équilibre. l'attestation vient ensuite et la CI est une étape de vérification (attestation de commit et de tests et si branche a bougé, repart à l'execution) Martin Fowler, qui a repéré l'article dans ses Fragments du 1er septembre 2026, réplique que la vraie CI a toujours exigé une vérification locale avant de pousser le code. ca demande une chaine d'attestation forte quid de garder les metriques historique de CI Sécurité France Passoire: une analyse sur les différents vols de données des services publics de ces dernières mois https://www.cybernetica.fr/piratage-des-impots-comment-en-est-on-arrive-la/ Analyse du piratage massif de la DGFiP et d'autres administrations françaises en 2026, révélateur de failles systémiques de cybersécurité de l'État. Intrusion détectée fin juin à la DGFiP, mais l'exfiltration de 678 000 entrées fiscales n'a été découverte qu'en août lors de leur mise en vente. Données volées : noms, revenu fiscal de référence, taux de prélèvement, adresse, téléphone. Une seconde attaque du même pirate a visé le cadastre fin juillet, exposant plus de 2 millions de personnes. L'Éducation nationale a aussi été piratée fin juillet, données de tous les agents depuis 2001 exposées. Cause principale : modèle de sécurité fondé sur le périmètre physique plutôt que sur le zero trust, sans contrôle après authentification. Le télétravail post Covid a étendu les accès distants sans reconstruire les modèles de confiance. Aucun système de détection d'exfiltration n'existait, la fuite n'a été révélée que par le pirate lui-même. La transposition de la directive NIS2 est bloquée en France depuis septembre 2025, la CJUE a condamné le pays à des astreintes. L'article souligne un désengagement croissant des Etats-Unis en matière de cybersécurité internationale et une dépendance technologique accrue de la France. Loi, société et organisation Ce que l'IA change vraiment au métier de manager shapeandship.ai/p/ce-que-lia-change-vraiment-au-metier-de-manager Retour d'expérience et analyse par Mathilde Rigabert sur l'impact réel de l'IA générative dans le quotidien d'un Engineering Manager. L'IA excelle pour automatiser la reconstitution factuelle de l'activité (lecture de PRs, commits, reviews) nécessaire aux 1:1 et entretiens annuels, mais elle offre une vision uniquement quantitative et nécessite d'être croisée avec des notes de terrain. L'IA rend le maintien de la qualité et des standards plus difficile : selon une étude Faros AI sur 22 000 développeurs, les PRs mergées sans aucune revue ont augmenté de 31 %, fragilisant la compréhension commune apportée par le pairing et les revues de code. Le temps gagné par l'IA ne permet pas d'augmenter massivement le span of control (seulement 2 ou 3 personnes de plus), car l'IA compresse la collecte d'informations mais pas les conversations humaines complexes ou l'accompagnement du changement. Les compétences d'orchestration et de gestion de sujets multiples acquises par les managers facilitent leur transition vers le pilotage de plusieurs agents IA en contribution individuelle. Le piège actuel réside dans l'accumulation des casquettes (manager, tech lead, product owner, contributeur, pompier), conduisant à l'épuisement et au délaissement du travail de fond sur l'organisation et l'humain. Le temps libéré par l'IA doit être réinvesti dans le travail invisible qui fait tenir le système (suivi des actions de rétro, analyse de métriques, coaching), que personne ne réclame à court terme mais dont l'absence fragilise les équipes à long terme. Je regrette d'avoir migré vers Codeberg xn–gckvb8fzb.com/i-regret-migrating-to-codeberg L'auteur explique pourquoi il regrette d'avoir quitté GitHub pour Codeberg, à la suite des récentes modifications des conditions d'utilisation (ToS) de la plateforme. Codeberg a interdit les projets principalement générés par des LLM ainsi que les projets liés aux cryptomonnaies via des propositions de l'Assembly 2026, au motif qu'ils nuisent à sa réputation. blog.codeberg.org/protecting-our-floss-commons-from… Critique de l'argument de Codeberg sur l'absence de communauté des vibe coders, en rappelant que la majorité des logiciels libres (FOSS) sont créés par des développeurs solos sans communauté au sens romancé du terme. Ironie soulignée concernant la posture de Codeberg et Forgejo, qui a hérité de la communauté de Gitea après un hard fork avant de faire la leçon aux développeurs individuels. Alerte sur le risque de censure idéologique : interdire des catégories entières plutôt que de traiter les abus réels ou la consommation d'infrastructure crée un précédent dangereux pour une forge qui se veut libre. Proposition de solutions alternatives pour gérer l'impact des LLM et de la crypto : déclaration obligatoire via des cases à cocher, hébergement sur des tiers d'infrastructure spécifiques payants ou sous quotas, et disclaimers automatiques. Décision de l'auteur de quitter Codeberg pour mettre en place son propre serveur Git personnel afin d'éviter la dépendance à une plateforme qui modifie ses règles de manière unilatérale. Cloud souverain : Airbus choisit Scaleway pour l'hébergement de ses applications critiques https://www.usine-digitale.fr/aeronautique-spatial/airbus/cloud-souverain-airbus-choisit-scaleway-pour-lhebergement-de-ses-applications-critiques.OHBVBMSZIJELNOKN6G5F6B7NSI.html Scaleway est le cloud provider français filiale du groupe Iliad, positionné comme alternative souveraine aux hyperscalers américains. Airbus a lancé un appel d'offres de six mois consultant une cinquantaine d'acteurs dont OVHcloud, Thales, Google S3NS et Microsoft Bleu. Scaleway a été retenu pour héberger les applications critiques liées à la conception d'aéronefs, l'ingénierie, la production industrielle et les opérations. Le contrat prévoit la migration d'environ 70 applications d'ici 2028, puis jusqu'à 900 applications sur 5 à 6 ans. Le montant du contrat n'a pas été communiqué. Scaleway revendique zéro actionnaire, zéro employé et zéro filiale hors Union européenne pour garantir une protection contre les lois extraterritoriales. Damien Lucas, PDG de Scaleway, évoque une immunité complète face aux évolutions politiques et législatives externes. La plateforme doit aussi accélérer les usages d'intelligence artificielle d'Airbus, avec les modèles de Mistral AI déjà déployés chez Scaleway. Catherine Jestin, responsable numérique d'Airbus, souligne que cette intégration accélère la démarche IA du groupe. Ce choix ne remet pas en cause la stratégie multicloud d'Airbus, Scaleway venant compléter les fournisseurs existants pour les charges nécessitant le plus haut niveau de gouvernance et de résilience. Debian adopte une résolution sur l'usage responsable de l'IA générative lwn.net/Articles/1091231 La discussion sur l'usage des LLM dans Debian s'est tenue du 23 juillet au 13 août 2026, suivie d'un vote du 15 au 28 août 2026. 1045 développeurs Debian étaient éligibles à voter, avec un quorum de 48,49 votes largement dépassé par les huit options en lice. Les options allaient d'une interdiction stricte des contributions générées par LLM inscrite dans le contrat social à une acceptation encadrée des contributions IA. L'option gagnante au classement Condorcet est Responsible Use of Generative AI, devant Allow AI-Assisted Contributions with conditions et A cautious approach to generative AI. Le texte adopté n'interdit ni n'encourage l'usage d'outils d'IA générative dans le développement de Debian. Il exige que toute contribution, quels que soient les outils utilisés pour la produire, respecte les mêmes standards de qualité, correction, maintenabilité et conformité légale. Les contributeurs doivent comprendre, relire, tester et si besoin modifier la production assistée par IA avant de l'intégrer à Debian. Les informations sensibles du projet ne doivent pas être transmises à des fournisseurs d'IA non fiables, et la divulgation de l'usage de l'IA est encouragée sans être obligatoire. Le détail du vote et le texte complet de la résolution sont disponibles sur la page officielle [debian.org/vote/2026/vote_002](https://www.debian.org/vote/2026/vote_002). Contraste direct avec l'OpenJDK, qui a publié une politique interdisant le code généré par LLM (épisode 340), et avec l'auteur de jqwik qui a piégé sa librairie contre les agents. Conférences Nous contacter Pour réagir à cet épisode, venez discuter sur le groupe Google https://groups.google.com/group/lescastcodeurs Contactez-nous via X/twitter https://twitter.com/lescastcodeurs ou Bluesky https://bsky.app/profile/lescastcodeurs.com Faire un crowdcast ou une crowdquestion Soutenez Les Cast Codeurs sur Patreon https://www.patreon.com/LesCastCodeurs Tous les épisodes et toutes les infos sur https://lescastcodeurs.com/

Nesse episódio trouxemos as notícias e novidades do mundo da programação que nos chamaram atenção dos dias 05/09 a 11/09.

Nesse episódio trouxemos as notícias e novidades do mundo da programação que nos chamaram atenção dos dias 05/09 a 11/09.

This week, we discuss the VS Code documentary, Ed Zitron's rise to fame, and a 10% AI extinction forecast. Plus, the NFL's Australia travel gamble Watch the YouTube Live Recording of Episode 589 Runner-up Titles Sleep Strategy Obviously I Have Issues Not Sure It Was an Exciting Thing At One Point, I Knew That Bitterness Rug Pull The American in Me Would Be Bitter Gaping Pit of Despair They Don't Care if They Never Sell a Thing It's the First Time Silicon Valley Has Done Something Irresponsible With VC Money We've Got to Drive as Fast Into This Wall and See if We Get Through It We're Already Having to Keep Track of Which Time AGI Actually Started Nobody Can See That You Have Size Eighteen Fonts The Dystopian Future Always Takes Place in Australia We Gotta Drive as Fast as We Can Into This Wall and See if We Get Through It Even the Dutch Have Problems With Internet We Could Do Better, Slack Rundown The Rams think they've figured out jet lag. Australia is about to test their theory The Story of VS Code | Official Documentary He Did Tech PR. Now He Rails Against AI for a Living. How accurate have Ed Zitron's AI skeptic predictions been? Jacob Coxon leaves Anthropic and says no one is acting responsibly. Apple's iPhone Duo Relevant to your Interests The AI Engine That Re-Accelerated Snowflake 1Password wades into a right-wing mess after funding a Linux project I Asked 100 Companies for My Data. I Got Deletion Notices Instead Clouded Judgement 9.4.26 - Recurrent Depth I've factored the RSA keys of a Certificate Authority… Mistral secures €3B Series D to push sovereign AI into its next phase Clouded Judgement 9.4.26 - Recurrent Depth Write Things Down Nonsense Southwest Airlines to construct first-ever airport lounge at Austin airport The Netherlands Will Never Be Rid of Louisiana Crawfish Listener Feedback OpenAudible - Download, Backup and Manage Audible Audiobook Libraries Conferences WeAreDevelopers NA, Sept 23-25, 2026, Discount Code: DEVPOD50 25 Free Tickets DevOpsDays Graz, Sept 4-5, 2026 Cloud Foundry Summit, Sept. 21st to 22nd, Heidelberg, Coté speaking. DevOpsDays Rockies, Sept. 22 – 23, 2026, Discount Code: 26DODSWEDEFTALK DevOpsDays Dallas, Sept 28-29, 2026 DevOpsDays Vilnius, Sep 30 - Oct 1, 2006, Lithuania. DevOpsDays Prague, Oct 5, 2026 - Coté speaking. DevOpsDays Istanbul, Oct 24th, 2026, Coté keynoting. VMware User Group, Orlando, Oct 20-22, 2026 Cloud Native Denmark, Nov 19th, 2026, Copenhagen, Coté keynoting. Build Stuff, Dec 2-4, 2026, Vilnius, Lithuania. cfgmgmtcamp, February 1st to 3rd, 2027, Ghent. SCALE 24x Pasadena, CA, April 1-4, 2027 SDT News & Community Join our Slack community Email the show: questions@softwaredefinedtalk.com Free stickers: Email your address to stickers@softwaredefinedtalk.com Follow us on social media: Twitter, Threads, Mastodon, LinkedIn, BlueSky Watch us on: Twitch, YouTube, Instagram, TikTok Book offer: Use code SDT for $20 off "Digital WTF" by Coté Sponsor the show Sponsor more podcasts with Failover Media Recommendations Brandon: Base Power Matt: Ubiquiti UniFi Express 7 Pole: Wald Aaron: World Summit, Amsterdam Dungeon Crawler Carl YINYOO KBEAR Storm Professional in Ear Monitor Special Guest: Aaron Delp.

En este episodio de Declarando Variables, Jhonny Ventiades conversa con Karen Arequipa, ingeniera de software y colaboradora recurrente del podcast, sobre las novedades de agosto de 2026 en el mundo del desarrollo. Repasan el ataque a la cadena de suministro de NPM que comprometió más de 2.200 paquetes con ganchos apuntando a Claude Code y VS Code, la compra que hizo Google de los datos internos de Spirit Airlines por 10 millones de dólares, y un modelo de código sin dueño declarado que iguala a Claude Opus 4.8. También cuentan cómo cambió su flujo de trabajo diario con Cursor y Claude Code, explican la marca de agua que Claude deja en los textos que genera, y cierran debatiendo si la inteligencia artificial está en una burbuja financiera.━━━━━━━━━━━━━━━━━━━━━━━━

Claude skills are useful when you keep repeating the same instructions. In this episode, I walk through the writing, editing and WordPress skills in my library, what earns a place and how one canonical folder can serve Claude Code, Codex and VS Code.You'll hear how skills load, why a large library consumes context, how my own edits shape the voice rules and where skills, agents and MCP servers each belong. The practical goal is a smaller library you can maintain, with clear approval boundaries around publishing and other side effects.Chapters00:00 What a skill is, and the working rule03:46 How skills load, and who is allowed to start one06:30 What a big library costs, and the census09:14 The voice skills: gaurav and voice-dna-creator12:59 The editing and publishing skills17:02 The public sets: anti-slop, WordPress, graphics21:28 One library, three tools24:05 What quietly ruins a library, and the monthly pass28:39 Skills vs agents vs MCP, the limits, and the closeSources and Related ReadingRead the Full Article and ResourcesHow to Train AI to Write Like YouStop Slop skill walkthroughRank Math MCP ServerWhy I Built WP-MCPHow to Format Your Blog Posts for AI SearchGenerateBlocks skillsBricks Builder skillsThe community pack (freebies page)AI ToolboxClaude Code: Official Skills DocumentationMore From GauravGauravTiwari.org: Articles, Tools and TutorialsGatilab: Web Development, Design and Growth

Este episodio 828 es la carta de presentación de la Temporada 9 de atareao con Linux. Treinta y cuatro episodios ya guionizados, siete etapas, y un objetivo claro: construir tu cerebro digital sobre Linux con herramientas locales, sin depender de nubes ni suscripciones.Pero antes de mirar adelante, toca hacer balance. La T08 empezó prometiendo Docker, selfhosting y Android, y sí, hablé de todo eso. Pero en abril de 2025 la IA local irrumpió con fuerza y la temporada viró hacia Ollama, modelos locales, RAG, MCP. Fue un giro desordenado, lo reconozco. Pero también fue el germen de todo lo que viene ahora.De eso va esta T09: de poner orden al caos. Siete etapas, de menos a más, para que sigas el hilo hagas el nivel que hagas.Etapa 1 — Recursos básicos: los cimientos de tu laboratorio de IA. Skills para tu agente, herramientas de publicación, el botiquín del explorador.Etapa 2 — Skills y MCPs: el pegamento. El Model Context Protocol ha madurado hasta ser un estándar abierto — lo soportan Claude, ChatGPT, VS Code, Cursor. Ya no es un experimento, es el USB-C de la IA. Y de paso, herramientas del ecosistema atareao como watchbeat (monitor de uptime en Rust) y alloy (dashboard Docker con OIDC).Etapa 3 — GraphRAG, el gran hito: de RAG vectorial a grafos de conocimiento. Mientras el RAG clásico devuelve fragmentos sueltos y tú unes los puntos, GraphRAG construye un grafo con entidades y relaciones. Preguntas como "qué contenedores están detrás de Traefik" pasan a ser una consulta directa a tu mapa de conocimiento. Usaremos LightRAG, que con 39.000 estrellas ya superó al Microsoft GraphRAG original. Esto ocupa tres episodios.Etapa 4 — Multimedia: Whisper para speech-to-text, TTS local, ffmpeg, visión artificial, y el pipeline de YouTube a conocimiento con yt-dlp. Rematamos con RAG multimodal.Etapa 5 — Orquestación: systemd timers, asyncio, just, y CrewAI para montar equipos de agentes.Etapa 6 — Proyecto final: dos episodios para construir El Asistente que te Conoce y ponerlo en producción con Quadlets.Etapa 7 — El futuro: mantenimiento de tu cerebro digital y hacia dónde va todo esto.Entre medias, herramientas Linux: shuul, sqlite-utils, yq + jq, Rust en el kernel, Wayland vs X11, la guerra de los filesystems.No necesitas una GPU de 3000 euros ni un doctorado. Con 16 GB de RAM y un CPU decente ejecutas modelos de 7B a 14B. Esto es IA local, en tu máquina, con tus datos.Capítulos del episodio:00:00 — Introducción y bienvenida a la Temporada 901:47 — Balance T08: de Docker y Selfhosting al boom de la IA04:37 — El momento adecuado para cada tecnología06:46 — El gran objetivo: tu cerebro digital08:44 — Roadmap T09: 30 episodios ya guionizados11:28 — Skills y MCPs imprescindibles12:43 — GraphRAG: de RAG a grafos de conocimiento14:01 — RAG vs GraphRAG: el mapa de tu conocimiento17:28 — Herramientas del ecosistema: alloy, populater, watchbeat20:08 — ¿Para quién es esto? De veteranos a escépticos22:08 — No es hype: es un cambio de paradigma24:30 — El momento perfecto para el linuxeroToda la info y el roadmap completo en atareao.es/828.Más información y enlaces en las notas del episodio

a16z General Partners Martin Casado, Sarah Wang, and Matt Bornstein unpack the story of Cursor: how a small, product-obsessed team entered one of the most competitive markets in technology, took on incumbents with seemingly unbeatable advantages, and repeatedly made decisions that ran against conventional startup wisdom. They revisit the early bet that the interface between humans and AI would matter more than building a coding-specific foundation model, why Cursor built its own product rather than a VS Code plugin, and how the founders' ability to say "no" became one of the company's defining strengths. They also discuss Cursor's rapid evolution from IDE to agent and model platform, and why the team was willing to cannibalize its own products as AI capabilities improved. The conversation gets into what founders can learn from Cursor's approach to competition, hiring, enterprise sales, M&A, and company culture, including why the team remained unfazed by competitors from Microsoft to Anthropic and how its obsessive focus on product ultimately extended into every part of building the company. Resources: Explore Cursor Compile: https://cursor.com/compile Follow Martin Casado on X: https://x.com/martin_casado Follow Matt Bornstein on X: https://x.com/BornsteinMatt Follow Sarah Wang on X: https://x.com/sarahdingwang Stay Updated:Find a16z on YouTube: YouTubeFind a16z on XFind a16z on LinkedInListen to the a16z Show on SpotifyListen to the a16z Show on Apple PodcastsFollow our host: https://twitter.com/eriktorenberg Please note that the content here is for informational purposes only; should NOT be taken as legal, business, tax, or investment advice or be used to evaluate any investment or security; and is not directed at any investors or potential investors in any a16z fund. a16z and its affiliates may maintain investments in the companies discussed. For more details please see a16z.com/disclosures. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

An airhacks.fm conversation with Steve Hannah about: meeting Steve Hannah at JavaOne years ago via Codename One, the Apple IIGS as a first computer, floppy disk games and Bob Whitehead's Hardball!, starting web development in 1997 with Perl and CGI, the O'Reilly Perl camel book, CGI security issues and the parallel to LLM tools, choosing Java Servlets over CGI for startup-time performance, moving to PHP for quick and dirty web development, PHP evolving toward enterprise patterns with Zend, Symfony and Laravel, PHP at Cloudbeds as a serious enterprise language, Facebook compiling PHP with HipHop, connection pooling and data sources impressing PHP developers, convergence of ideas across Java, JavaScript classes and React moving from object orientation to hooks, web components as JavaScript classes with properties, TypeScript versus JavaScript with JSDoc types in VS Code, LLMs reducing the importance of web frameworks that follow standards, porting React to Java on TeaVM using Claude, Flash and ActionScript for rich interfaces before HTML5, key frames hiding the full code base in Flash, VisualAge for Java showing only methods and printing source to understand it, the Xataface open-source PHP/MySQL CRUD framework started in 2005, the Dataface to Xataface rename, FileMaker as a low-code database tool and its licensing constraints, joining Codename One as the first hire in 2012, front-end Java versus back-end Java culture at JavaOne, the extreme GUI makeover Swing session, coding with LLMs in 2026 using Claude Code and Codex, building a personal Swing-based IDE for multi-repo multi-branch agentic workflows, work trees and terminal-organized agent sessions, a possible Swing and JavaFX revival because they ship with Java and LLMs know them, Java 25 source-mode shebang scripting replacing Python scripts, Java shipping more built-in functionality than Python for regular expressions and dependencies, Ruby versus Python popularity, LLMs understanding Java (~87%) better than JavaScript (~60-70%), type safety enabling LLM self-correction, grounding LLMs with MicroProfile and Jakarta EE normative specifications, the JSR normative language read by LLMs, business annotations and rich JavaDoc and package-info improving LLM output, reducing external dependencies so LLMs avoid decompiling JARs, token savings from standards-based Java, AWS Bedrock for stable and private Claude access with Claude Code, Quarkus on AWS Lambda with cold starts and Provisioned Concurrency, pinging a AWS Lambda every minute within the free tier to avoid cold starts, cost calculation for Quarkus on Lambda with 2 GB RAM, constructions.cloud Quarkus serverless CDK examples, Google Cloud Run versus AWS App Runner, AWS Lambda and Azure Functions, AWS CDK as infrastructure as code in Java, JDeploy for packaging and distributing desktop apps, the AIRails.dev skills site and the microprofile-server skill, zero-dependency Java scripts and agents, migrating a WordPress blog to a Jekyll static site with Claude Steve Hannah on twitter: @shannah78

An AI agent works inside your Windows 365 Cloud PC from a Teams chat on your phone — finding downloaded files, editing documents, and drafting emails with your laptop lid closed. Microsoft Scout, a new Autopilot agent powered by the open source OpenClaw project, runs on your own Cloud PC using your identity, your files, and your apps. Developers get a Developer Optimized Cloud PC preloaded with GitHub, VS Code, and Node.js that runs Foundry Local for token-free AI coding, and input and output protection capabilities black out the screen when anyone tries to capture a sensitive file. Bhavya Chopra, Windows 365 Partner Director, joins Jeremy Chapman, Microsoft 365 Director, to show how Windows 365 now covers every seat — end users, developers, admins, and the AI agents working alongside them. 

Domingo Widen is a Staff Product Designer at Fin (formerly Intercom), where he leads the Frontend Infrastructure team — the team that builds the tools, design system and AI setup everyone else uses to ship. In this episode he opens up his actual workflow: a "Design Playground" repo every designer, PM and researcher can clone, prototyping directly in production, and "Search Intelligence" a persistent knowledge layer that teaches Claude how Fin designs and codes.We talk about what happens when the Figma file stops being the deliverable: how a complex filtering system got built as a working prototype instead of ten mockups, how handoff turns into a PR plus an auto-generated spec, and why engineers ended up being the biggest users of the design team's skills. If you want a concrete, unhyped look at what an AI-native design team actually does day to day, this one is for you.Key LearningsThere are two modes of AI prototyping and you need both. The design system is the guardrail that makes this safe. Because everyone builds on the same components and tokens, a PM or researcher can prototype without producing something off-brand or unusable.Skills are only as good as the information behind them. Fin's early skills gave mixed results — so they built "Search Intelligence", a persistent information layer that every skill reads from. Handoff becomes a PR + a generated spec. A "Search Handoff" skill reads the prototype code and writes the doc: architecture, what was built, which workarounds were needed, what broke. The engineer picks it up from there and focuses on plumbing, data and edge cases.The biggest users of the design team's skills are engineers. Everyone works in the same medium now. PM, designer and engineer used to live in Google Docs, Figma and VS Code. Now it's one shared artifact — which makes conversations concrete but also creates an identity crisis for designers who defined their value by the file.Curiosity + critical thinking are the two traits that survive.Play is back — and it counts. Side projects (a baby sleep tracker, a garden planner that checks on tomatoes) are now part of a portfolio.Domingo WidenLinkedIn: https://www.linkedin.com/in/domingowidenPortfolio: https://www.domingowiden.comX: https://x.com/DwidenR24Fin: https://fin.aiFin Operator (the tool Domingo prototypes on in production): https://fin.ai/operatorAI for Designers: 5-week Bootcamp

Scott and Wes answer your questions about coding in the AI era, atrophying skills from too much autocomplete, whether it's finally time to leave VS Code, chasing flow state with agents, and which single AI subscription is worth your money. Plus: AT Protocol vs Solid, making your AI config portable across tools, and bringing Shadcn-level UX to server-rendered frameworks. Show Notes 00:00 Welcome to Syntax! 00:57 AI-Generated Code: Are My Skills Atrophying? 06:03 Is It Time to Move On from VS Code? 13:19 Hitting Flow State with AI Coding See Wes' Post on X 19:15 AT Protocol vs Solid: Decentralized Web Approaches 24:55 Which AI Should You Subscribe To? 30:23 Making Your AI Setup Portable Across Tools 33:56 When to Drop a Tool That Still Works 40:12 UX Quality for Traditional Server-Side Frameworks FluxUI GraffitiUI 44:14 Using Hermes and Self-Hosted AI Assistants 49:27 Sick Picks + Shameless Plugs Sick Picks Scott: ESP32-S3 Wes: Sharge ICEMAG3 Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Welcome to episode 368 of The Cloud Pod, where the forecast is always cloudy! Justin, Matt, and Ryan are in the studio this week, and the major story is the GitHub outage – are you still digging out from that one too? We have MANY thoughts. Plus, we have news from EKS, CloudShell, and some major Microsoft changes to the Copilot ecosystem. There's a lot to cover, so let's get started!  Titles we almost went with this week Amazon Quick Crashes Microsoft’s Copilot Party Bin-Packing Pods Like a Kubernetes Tetris Champ AWS Agents Go GA and Grab Your Wallet AWS Finally Shows You The Money Trends AWS Hands Out Power (User Access) Like Candy AWS Builds Lofts, Developers Build Everything Else Front Door Now Checks IDs Before Letting Traffic In CloudShell Ditches Vim, Editors Rejoice Everywhere AWS Sign-In Gets a Facelift, Scripts Get Nervous Azure Front Door Gets Mutual TLS, Trust Issues Resolved One Copilot to Rule Work and Play GPT-5.6 Sol Hits Warp Speed With Cerebras OpenAI Ditches Overnight Batches for Ultrafast Gratification Ultrafast API Proves Speed and Smarts Aren’t Rivals Terraform Plans Meet Their IAM Autopilot Match AWS Autopilot Now Reads Your Terraform Tea Leaves A big thanks to this week's sponsors: We're sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You've come to the right place! Send us an email or hit us up on our Slack channel for more info. Follow Up 01:02 Microsoft confirms GitHub is down worldwide GitHub confirmed a widespread Github outage starting at 9:40 AM EDT on August 17, 2026, affecting web, API, Actions, Pull Requests, Issues, Webhooks, and authentication services including SAML, OIDC, and SCIM. As of the 11:42 AM EDT update, GitHub has moved into mitigation mode, but error rates remain unchanged at roughly 20% for web and API traffic and approximately 50% for archive and raw repository content downloads. Copilot was added to the list of affected services at 10:31 AM EDT, extending impact beyond core Git functionality into GitHub’s AI coding tools. Git Operations, Packages, Pages, and Codespaces remain listed as operational, indicating the outage is concentrated in specific service areas rather than the entire platform. GitHub has not disclosed a root cause, and the incident remains under investigation, meaning listeners relying on CI/CD workflows through Actions should expect continued disruption until further updates are posted. Complicating factors that impeded recovery included a number of scraping attacks on codeload endpoints. To prevent recurrence, our follow-up actions include: Correcting autoscaling policies to account for service-mesh sidecar concurrency and capacity. Auditing Istio request, concurrency, and scaling limits across affected services. Reviewing retry limits and backoff behavior across gateways and clients. Addressing the VS Code retry behavior that amplified Copilot token traffic.

Join host Steven Dickens in this August episode of I Am a Mainframer featuring Geoffrey Decker, instructor at Northern Illinois University, as he shares how he has spent more than 24 years teaching assembler, COBOL, and foundational mainframe skills to thousands of students.With back-to-school season in full swing, Geoffrey discusses why teaching mainframe fundamentals matters, how students react when they first encounter assembler and 3270-style environments, and why hands-on learning with tools like ISPF, VS Code, IntelliJ, and Zowe helps prepare them for real careers.He also explores the ongoing debate around the mainframe skills gap, the strong career outcomes his students are seeing, and why he believes employers should do more to recognize the talent already coming out of universities and training programs.From student success stories and curriculum challenges to AI's role in documenting legacy systems, this episode highlights the value of a proven academic pipeline and the importance of keeping mainframe education relevant for the future.If you enjoyed this episode, subscribe for more conversations from Mainframe Connect and the I Am a Mainframer series.#IAmAMainframer #MainframeConnect #OpenMainframeProject #BackToSchool #MainframeEducation #Assembler #COBOL #NIU #TechCareers

This week: When you are not at summer camp you can't read about it The Fettle continues Using the CFAA against AI Social contracts are not security models VSCode extentions, again Bugtraq is back! NVIDA, LVFS, and unraveling AI infrastructure More routers that come with backdoors Do we care about LPE? Even more AI that finds vulnerabilities When AI breaks its own guardtails Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-938

This week: When you are not at summer camp you can't read about it The Fettle continues Using the CFAA against AI Social contracts are not security models VSCode extentions, again Bugtraq is back! NVIDA, LVFS, and unraveling AI infrastructure More routers that come with backdoors Do we care about LPE? Even more AI that finds vulnerabilities When AI breaks its own guardtails Show Notes: https://securityweekly.com/psw-938

This week: When you are not at summer camp you can't read about it The Fettle continues Using the CFAA against AI Social contracts are not security models VSCode extentions, again Bugtraq is back! NVIDA, LVFS, and unraveling AI infrastructure More routers that come with backdoors Do we care about LPE? Even more AI that finds vulnerabilities When AI breaks its own guardtails Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-938

This week: When you are not at summer camp you can't read about it The Fettle continues Using the CFAA against AI Social contracts are not security models VSCode extentions, again Bugtraq is back! NVIDA, LVFS, and unraveling AI infrastructure More routers that come with backdoors Do we care about LPE? Even more AI that finds vulnerabilities When AI breaks its own guardtails Show Notes: https://securityweekly.com/psw-938

AI can now help almost anyone turn an idea into a working prototype. But what happens when that vibe-coded experiment needs to become secure, reliable software that real customers can trust—and pay for?Corey Noles and Grant Harvey speak with Deap Ubhi, Global Director of Technology for Startups at AWS, about AWS Startup Advisor, an AI-powered builder assistant designed to bring AWS architecture, security, cost, deployment, and scaling guidance directly into a founder's workflow.Deap explains why generative AI has compressed startup iteration cycles from months into days or hours, how nontechnical founders can test ideas before making major technical investments, and why human judgment, product taste, and focus matter even more when building becomes dramatically easier. The conversation also explores the crucial leap from proof of concept to production, including the infrastructure, authentication, resilience, observability, and security decisions that first-time builders may not know to ask about.Listen to hear how Startup Advisor works inside tools including Claude Code, Cursor, Codex, VS Code, and Kiro—and why the next generation of founders may start with an AI coding agent and a virtual AWS solutions architect on their shoulder.For more practical conversations about how AI is changing work, business, and technology, subscribe to The Neuron and The Neuron: AI Explained.https://www.theneurondaily.com/Explore AWS Startup Advisor:https://aws.amazon.com/aws-startups/advisor/Learn more about the launch:https://aws.amazon.com/aws-startups/from-idea-to-revenue-at-startup-speed-with-ai/The Neuron Academy helps professionals build practical AI skills they can use right away, with lessons on prompting, workflows, and real workplace use cases. Check out https://theneuronacademy.com/ today!

This one is a short one. But it's also a big one. We'd invite you to listen to it, but you don't need to follow us. You don't need to follow anybody! You've got to think for yourselves! You're all individuals!## Timestamps(00:00:00) INTRO(00:00:36) PART 1: GUIDO VAN ROSSUM(00:01:09) Monty Python reference only GvR understood(00:01:27) Math Olympiad anniversary(00:03:31) Silly hats(00:05:20) perchance(00:09:51) PR OF THE WEEK (not really)(00:11:04) The Grail Web Browser(00:14:31) Generational gaps(00:17:24) Changes in beliefs(00:21:43) Pablo Galindo Salgado was never right(00:23:11) Aesthetics in coding(00:29:16) Rietveld(00:34:14) VScode is the new Emacs(00:35:41) On recognition outside of tech(00:38:11) Taste in music(00:39:51) Cameo in a movie?(00:40:52) OUTRO

The era of the weird, different storefront is over. On Shopify, design that converts beats design that surprises.That is the argument in the third and final episode of our Enterprise Shopify series. Rick Watson sits down with Elara Verret, Chief Digital and Customer Officer at Reitmans, and Isaac Newton, Co-Founder of Pattern (part of Domaine).Reitmans is a 100-year-old retailer with roughly 400 stores. It moved its flagship onto Shopify in under a year. Elara's own team had scoped that work at two to three years.The conversation stays specific. Why the enterprise case for Shopify is agility and focus rather than cost cutting. Where customization earns its keep and where it just leaves you a maintenance bill. What happens when merchants start editing the storefront in VS Code and someone has to ask, politely, to turn off their Sidekick access. And the plateau Isaac sees over and over: brands that grew fast three to five years ago, then watched a dozen copycats erase what made them different.Headless comes up. Both have opinions.The Big Green Bag Of Promise: Enterprise Shopify Webinar Series is sponsored by Avalara, Domaine, and Pattern.The Big Green Bag Of Promise: Enterprise Shopify Webinar Series is not sponsored by Shopify.

Matt Putra runs Eightx, a fractional CFO firm for consumer goods companies. He is not a marketer. He is not technical. And in about 60 days, using Claude, he took his site from roughly 3,000 impressions a day to 76,000 — indexing 20 blog articles a day and beating "old school" SEO agencies who don't even know it's happening.In this episode, Matt screen-shares the exact marketing hub he built and walks Jordan through the whole stack: the DataForSEO audit loop, the 40+ MCP data connections, the parallel-agent writing pipeline, the Pinecone vector database of three years of client calls that clones his voice, and the PR/backlink play he's running next. If you own a marketing agency and you're not doing this yet, consider this your wake-up call.The uncomfortable takeaway for agency owners: a CFO with no marketing background is out-executing full SEO agencies — because he's willing to spend the tokens and do the volume no agency will.What You'll LearnWhy AEO/GEO (answer/generative engine optimization) is a wide-open gold mine right now, and why most SEO agencies are still playing the old gameThe exact starting point: rebuild the site with Claude, hand Claude a DataForSEO key ($200/mo), and knock out the audit listHow to run competitor audits and 45-day SEO sprints that finish in 9 daysThe technical-SEO checklist Claude gave him: llms.txt, llms-full.txt, robots.txt, and schema (FAQ, datasets, breadcrumbs) as "formatting for AIs"How to index 20 articles a day without getting flagged as thin/templated contentThe content pipeline: 40+ MCPs into free data sources (SEC EDGAR, census.gov, World Bank, OECD, national stats) for genuinely valuable postsDynamic workflows / parallel agents — up to 50 agents writing and reviewing at once (~5–6M tokens per 10 articles)The voice engine: a Pinecone vector DB of 3 years of Fireflies call transcripts (~10–12M words), with oversized chunks for richer retrieval, so Claude "interviews" his own past words for every articleWhy PR/backlinks (Forbes, WSJ) are the next authority moat for GEO — and how he's using HARO/Connectively to startThe real economics: ~$400/mo in tokens (Claude Max 20x) against $6–8K CFO retainersChapters / Timestamps — Intro: who is Matt Putra and what is Eightx — The "marketing hub" and why visibility is the whole game now — Two months in: crushing competitors in the LLMs and GEO — Tour of the hub (PR, blog, news signals, trends, Reddit, newsletter, socials) — The #1 ROI channel: the native blog — How a non-technical founder learned SEO from scratch (a Hampton tip + Claude) — DataForSEO for $200/mo, and a 45-day sprint finished in 9 days — The results: April to July, ~3K to 76K impressions/day — Capturing the traffic: RB2B, Apollo, and the NoLeadLost widget — Technical SEO: llms.txt, robots.txt, and schema for AIs — Indexing 20 articles a day (and why it takes ~30 days to start) — Getting Claude to write content Google actually indexes — The writing pipeline and 40+ MCP data sources — Show-and-tell: Claude Code in VS Code — The cost: Claude Max 20x, ~$400/mo in tokens — Building skills and reviewing the early (bad) drafts — Dynamic workflows: up to 50 agents in parallel — CFO retainer economics that justify the spend — The voice engine: a vector DB of 3 years of client calls — Chunking theory and RAG, explained simply — Channel #3: PR and GEO via Connectively (HARO) — The next play: backlinks and a Forbes/WSJ authority moat — Where to find Matt + wrapTools & Resources MentionedClaude Code (in VS Code) — the primary build environment for the whole systemClaude Max 20x — the subscription tier covering ~$400/mo of token usageDataForSEO — pay-per-call SEO data ($200/mo) handed to Claude via APIPinecone — vector database storing 3 years of call transcripts for voice/RAGFireflies — call recording/transcription source for the voice databaseNetlify — site hosting (migrated off WordPress)Connectively (formerly Featured / HARO) — PR question sourcing for backlinksApollo / RB2B — visitor identification and enrichmentNoLeadLost.com — the ~$99 site widget Jordan recommends for booking callsMCP data sources — SEC EDGAR (10-Ks/8-Ks), census.gov, World Bank, OECD, national statistics officesConcepts worth Googling: AEO, GEO, schema markup, chunking, RAG, dynamic workflowsConnect with Matt PutraFirm: Eightx — fractional CFO for consumer goods companiesBlog (called a "gold mine" in the episode, with a chatbot trained on all his content): eightx.co/blogWant help building this or something like it for your agency?Go to 8figureagency.co to book a call

Topics covered in this episode: Free-threaded Python: past, present, and future django-admin-site-search Qwen 3.6 27B is the sweet spot for local development A large batch of PEPs are finalized Extras Joke Watch on YouTube Show Intro Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Free-threaded Python: past, present, and future The GIL has prevented true multi-threaded parallelism in CPython since the beginning — multiple past attempts to remove it failed on performance grounds Sam Gross at Meta finally solved it; his work became PEP 703 and ships as free-threaded CPython today Python 3.13 was experimental with 20–40% single-threaded slowdown; 3.14 brought that to 0–10% Python 3.15 (October 2026) delivers a unified ABI — one extension binary works on both GIL and free-threaded builds Already >50% of the top PyPI binary wheels support free threading Wouters predicts free-threaded becomes the default between 3.16–3.20 (2027–2031), with the GIL eventually disappearing next decade Michael #2: django-admin-site-search via Adam Parkin A global/site search modal for the Django admin, by Ahmed Aljawahiry. Hit cmd+k anywhere in the admin and you get a command-palette-style search window, kind of like the one in VS Code. It doesn't just search one model's list page. It searches your entire site in one box: App labels Model labels and field attributes Actual model instances (your data) Two ways to search the instances: model_char_fields (the default): runs an __icontains across every CharField (and subclasses) on the model. Zero config, works out of the box. admin_search_fields: defers to each ModelAdmin's existing get_search_results(), so it respects the search_fields you've already set up. The part I like: it's permission-aware out of the box. Users only see results for the apps and models they actually have view permission on, so you're not leaking anything through search. Results appear as you type, with throttling/debouncing so you're not hammering the server on every keystroke, and it's full keyboard nav: cmd+k to open, up/down to move, enter to go. It's responsive, does dark and light mode, and it pulls Django's built-in admin CSS variables so it just matches whatever admin theme you're running. Under the hood it's Alpine.js, but bundled into static so there's no external CDN dependency. Setup is about what you'd expect: pip install django-admin-site-search, add it to INSTALLED_APPS, mix the AdminSiteSearchView into your AdminSite, and drop a few template includes into base_site.html. Supports Python 3.8 through 3.14 and Django 3.2 through 6.0, MIT licensed, and everything is overridable if you want to skip certain models, add TextField matching, etc. Calvin #3: Qwen 3.6 27B is the sweet spot for local development Qwen 3.6 27B is being called the first local model that genuinely competes as a general-purpose intelligence — benchmarks put it at roughly mid-2025 frontier level (comparable to GPT-5 / Claude Sonnet 4.5) Runs locally via llama.cpp; on an M5 MacBook Max with 8-bit quantization + multi-token prediction, it hits ~32 tokens/sec using ~42GB RAM 4-bit quantization gets it under 18GB, runnable on 32GB devices; Nvidia RTX cards run it even faster The dense 27B is recommended over the faster MoE 35B A3B — author prefers higher quality output over raw speed Privacy and reliability are the pitch: fine-tunable, can't be taken down, suitable for sensitive/proprietary data Author sees this as a stepping stone — frontier open-weight models like GLM 5.2 are now locally runnable with company-grade hardware, and smarter-still local models are coming Michael #4: A large batch of PEPs are finalized A bunch of PEPs went from accepted to final. 668, 687, 691, 699, 701, 703, 728, 770, 773, 829 But this wasn't them making their way into CPython. It's an admin sorta thing. (Thanks PyCoders) See the commit. Extras Calvin: More fun bling for your terminal this time - https://charm.land/ Michael: Follow up from pls, What the pls? Thanks Pito. Joke: BEMoji A production-grade utility and component framework built entirely on emoji class names via Jeff Triplett

What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime https://isc.sans.edu/diary/What%20do%20Ports%20Hear%20When%20Nobody%27s%20Listening%3F%20An%20Assessment%20of%20Automated%20Cybercrime%20%5BGuest%20Diary%5D/33104 Linux Process Name Masquerading https://isc.sans.edu/diary/Linux+Process+Name+Masquerading/33102 Amazon Q VS Code Extension Vulnerability https://www.wiz.io/blog/amazon-q-vulnerability My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

Show DescriptionWhat to do when you have more ideas than time, getting new musical gear, nerding out and getting excited about things, the state of conferences in 2026, Cursor being bought, and Dave's got a minimum viable design system idea. Listen on WebsiteWatch on YouTubeLinks FFConf Figma Config 2026 SpaceX locks in $60 billion Cursor deal Google Antigravity Devon: An open-source pair programmer Introducing Composer 2 @function CSS at-rule A tale of two browsers Google's Prompt API SponsorsNotionWrite custom tools for Notion Agents that generate assets, query live data, and hit any API. Listen for incoming webhooks from any app, then run workflows with Notion Agents, pages, databases, and external APIs. All of this, on a hosted runtime. Workers are isolated sandboxes managed by Notion, so the code behind your syncs, tools, and workflows runs on our infra instead of your servers.

Azure HorizonDB is a new Postgres service on Azure built for scale, availability, and performance across any workload. In this episode of Azure Friday, we look at how HorizonDB delivers predictable performance with built-in zone resilience. We also explore new in-database AI features like AI Model Management and AI Pipelines, and walk through the developer experience in VS Code to build, query, and manage efficiently using AI. Chapters 00:00 - Introduction 00:47 - HorizonDB Architecture Overview 02:47 - Performance Demo 03:37 - AI Model Management 04:19 - VS Code Postgres Tools Overview 06:44 - Debugging Query Plans with GitHub Copilot 09:16 - AI Pipelines 14:32 - Wrap Up Recommended resources Learn Docs Azure Product page Connect Scott Hanselman | Twitter/X: @SHanselman Microsoft for PostgreSQL | LinkedIn: Microsoft for PostgreSQL Azure Friday | Twitter/X: @AzureFriday

Azure HorizonDB is a new Postgres service on Azure built for scale, availability, and performance across any workload. In this episode of Azure Friday, we look at how HorizonDB delivers predictable performance with built-in zone resilience. We also explore new in-database AI features like AI Model Management and AI Pipelines, and walk through the developer experience in VS Code to build, query, and manage efficiently using AI. Chapters 00:00 - Introduction 00:47 - HorizonDB Architecture Overview 02:47 - Performance Demo 03:37 - AI Model Management 04:19 - VS Code Postgres Tools Overview 06:44 - Debugging Query Plans with GitHub Copilot 09:16 - AI Pipelines 14:32 - Wrap Up Recommended resources Learn Docs Azure Product page Connect Scott Hanselman | Twitter/X: @SHanselman Microsoft for PostgreSQL | LinkedIn: Microsoft for PostgreSQL Azure Friday | Twitter/X: @AzureFriday

PHP Podcast – June 25, 2026 Hosts: Eric Van Johnson & John Congdon Eric and John are back. Sara and Holly did a better job. Eric’s computer still hates him. Eric’s Connectivity Saga: A Possible Resolution For weeks, Eric has been dealing with a maddening streaming issue — he could see and hear everyone, but nobody could hear or see him. It only happened during Zoom, Slack huddles, and Restream sessions. No one could explain it, including Eric. The apparent fix came by accident: while helping his kid troubleshoot a similar issue, Eric pulled up his own DNS settings and discovered they were only pointing to his router with no upstream fallback. He manually added Google’s 8.8.8.8 and Cloudflare’s 1.1.1.1 — and for the first time in weeks, had zero issues all week. Does DNS explain streaming dropouts? Almost certainly not. Does it appear to have fixed it? So far, yes. Computers are stupid. Eric needs to retire and open a landscaping business. Two Weeks Off: Road Trip, Pittsburgh, and a Graduation John took the family on a road trip that included national park hikes, biking across the Golden Gate Bridge, and a swing through Universal Studios. Eric headed to Pittsburgh, technically West Virginia, for his niece’s high school graduation. Eric came away impressed with how much Pittsburgh has changed: what was once a gritty steel city has quietly become a genuinely beautiful place. He’s half-serious about looking at it as a future PHP Tek location. Sara and Holly: The Better Hosts Eric and John opened with a heartfelt thank-you to Sara Golemon and Holly Schilling for covering the last two weeks. John’s take: Sara and Holly showed up with documents, had a plan, and ran a tighter show. He’s joking about handing over the keys — mostly. PHP Architect Takes Over Laravel Magazine Here’s the announcement Eric was teasing before the break: PHP Architect has taken over the Laravel Magazine brand. It was originally a Statamic, which Eric rebuilt from scratch over the past couple of weeks. No plans to create a print magazine — it will remain a web-only publication. Eric is thinking about opening it to outside contributors, and there’s a real possibility of a dedicated Laravel column eventually appearing in the PHP Architect magazine. The new consulting section Eric built for the site looks sharp enough that John immediately pointed out it looks better than what’s currently on phparch.com. Foam Burner Feature: Proof of Concept Wars John got a big feature in Foam Burner across the finish line — or at least mostly across — recorded a screencast, and sent it off to the people who care. The immediate response: a list of compliance concerns and edge cases. This is a proof of concept. John is sympathetic, having just had to tell Eric the same thing about Laravel Magazine. The cycle of building something you’re proud of and then having someone find the things that aren’t done yet is a universal developer experience. Code Review in the Age of AI — What’s the Point? John is in a strange spot: he’s doing careful code review on pull requests written entirely by Claude, submitted by non-developers. His detailed, educational feedback — the kind meant to help a developer understand why something was done a particular way — is just being fed back into Claude to generate revisions. Nobody’s learning anything. An incident during his vacation reinforced why the reviews matter: someone deployed AI-generated code that wasn’t well reviewed, it broke overnight, and the team had to revert it the next morning. His position: keep reviewing, even if the audience is an AI. But the nature of what you’re reviewing for has to change — you’re no longer nurturing a developer; you’re being a gate. Eric’s broader point: if you’re a developer who cares about the craft, don’t let AI make you lazy. Learn from how it implements things. Ask it why. The thing that will differentiate developers when AI really matures is genuine understanding of what the code is doing — and that only comes from staying curious. PHP Generics RFC — Closed The Generics RFC was shut down while Eric and John were away, and Eric is genuinely disappointed. The proposal was for syntax-only generics: type annotations that static analyzers could read but that would be stripped at the opcode level, meaning no runtime performance impact. The goal was to standardize the generics syntax so PHPStan, Psalm, and other tools all read it the same way — right now they each implement their own dialect. Sara voted no (she explained her reasoning in the June 17 episode). Joe abstained. Whether an active abstain requires a deliberate action or is the default for a non-vote is apparently still a matter of some debate. PHP Tek 2026 Talks Now on PHP Tech TV Talks from PHP Tek 2026 are being uploaded to phptech.tv. Subscribers can watch the full library. Several speakers have given permission to make their talks free, and Ben Ramsey’s is one of them. John also added video progress tracking to the platform — it now remembers how far into a video you’ve watched. This Week in PHP Internals (Artisan Build) While looking for a PHP Internals podcast that Nuno appears to have started (possibly in connection with the PHP Foundation after PHPverse), Eric stumbled on a different show: This Week in PHP Internals, hosted on the Artisan Build site, with four episodes out. Eric doesn’t know who runs it but says it’s good — short, focused, and gets to the point. He’s also still looking for confirmation on what exactly Nuno’s new podcast is and who it’s for. For reference: the original PHP Internals podcast was Derick Rethans’ show, which he hasn’t updated in four or five years. The ecosystem growing new shows is a good sign. PHP Friends RFC — Under Discussion John has been watching the friends RFC, currently in the discussion phase. The idea: a class can explicitly declare another class as a “friend,” granting it access to private properties without requiring inheritance. The canonical use case is a builder pattern — a UserBuilder that needs to set private fields on User without a thousand public setters, and without making those fields non-private. Holly, in chat, noted that the friend model is a special case of a “surfaces” model she proposed a few years back. She also shared that Swift doesn’t have protected at all (just public and private) — something she initially found frustrating but has come to appreciate. Eric admits he’s been guilty of abusing inheritance over the years and is more thoughtful about it now. The RFC is still under discussion; no vote yet. Eric Drops PHPStorm — Falls Back in Love with Vim Eric canceled his JetBrains All Products subscription. Not because there’s anything wrong with PHPStorm — he’s explicit about that — but because he’s been doing so much work via Claude Code and making only targeted, smaller changes himself that the license fee no longer made sense. His replacement workflow: VS Code for some things, Vim for others. The Vim part was supposed to be supplemental. Instead, his terminal has taken over: it went from a panel alongside PHPStorm to taking up two-thirds of his screen to now living on its own separate virtual desktop. He’s running Spotify in the terminal. He briefly ran Slack in the terminal. He uses Tmux religiously. “I have problems,” he acknowledged. He would not take this back. Links from the show: Laravel Magazine — Now under PHP Architect PHP Tech TV — PHP Tek 2026 talks now uploading PHP RFC Wiki — All RFCs under discussion PHP Tek 2027 — April 27–29 (phptek.io) PHP Architect Discord Host: Eric Van Johnson X: @shocm Mastodon: @eric@phparch.social Bluesky: @ericvanjohnson.bsky.social PHPArch.me: @eric John Congdon X: @johncongdon Mastodon: @john@phparch.social Bluesky: @johncongdon.bsky.social PHPArch.me: @john Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners Displace Infrastructure Management, Simplified Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease. https://displace.tech/ PHPScore Put Your Technical Debt on Autopay with PHPScore CodeRabbit Cut code review time & bugs in half instantly with CodeRabbit. Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.06.25 appeared first on PHP Architect.

Foundry Observability empowers developers to take agents from prototype to production with end-to-end observability. We demonstrate how evaluations, tracing, monitoring, and optimization work together to identify issues, measure quality, and improve outcomes over time. Through a live demo spanning the Foundry portal and VS Code, we showcase a practical workflow for building more reliable, production-ready agents. Chapters 00:00 - Introduction 01:33 - Foundry portal demo 06:58 - VS Code demo 17:43 - Wrap up Recommended resources Observability in Generative AI - Microsoft Foundry Build 2026 Resources Connect Scott Hanselman | Twitter/X: @SHanselman Azure Friday | Twitter/X: @AzureFriday

Foundry Observability empowers developers to take agents from prototype to production with end-to-end observability. We demonstrate how evaluations, tracing, monitoring, and optimization work together to identify issues, measure quality, and improve outcomes over time. Through a live demo spanning the Foundry portal and VS Code, we showcase a practical workflow for building more reliable, production-ready agents. Chapters 00:00 - Introduction 01:33 - Foundry portal demo 06:58 - VS Code demo 17:43 - Wrap up Recommended resources Observability in Generative AI - Microsoft Foundry Build 2026 Resources Connect Scott Hanselman | Twitter/X: @SHanselman Azure Friday | Twitter/X: @AzureFriday

Topics covered in this episode: pi + superpowers Terminal: Warp.dev + OhMyZSH {Blink,kitty} + mosh + tmux Claude code MacWhisper or Handy Tailscale Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training Six Feet Up is hosting a LinkedIn Live Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Calvin: @calvinhp@sixfeetup.social / @calvinhp.com (bsky) Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: pi + superpowers terminal-first, open-source coding agent Session management is a first-class citizen Extension model is what makes pi special — it's aggressively composable Superpowers brings a structured software development methodology as loadable skills Steps back and asks you what you're really trying to do “hand you the keys to the car” mode vs guardrails might not be for everyone Michael #2: Terminal: Warp.dev + OhMyZSH If you're using the base terminal with default settings, you have so much head-room for improvement. I've been using Warp.dev since Elvis talked me into it. ;) Remarkable terminal but the AI side of things is a bit junky, can be turned off OhMyZSH gives better autocomplete e.g. git branch [HTML_REMOVED] lists all branches in the local repo! Commandbookapp.com is excellent to keep the terminal focused on terminal things and more server commands and other automation in Command Book. Calvin #3: {Blink,kitty} + mosh + tmux Kitty Terminal — GPU-accelerated terminal emulator for macOS, Linux, and Windows with support for graphics, ligatures, and a powerful tiling layout system built right in. Blink Shell — The go-to terminal for iPad/iPhone power users; full SSH and Mosh client with a gorgeous interface built specifically for mobile professional workflows. Mosh — Mobile Shell replaces SSH for remote connections, surviving network switches, sleep cycles, and flaky Wi-Fi with zero dropped sessions — essential for staying connected to long-running agentic jobs. tmux — Terminal multiplexer that keeps sessions alive on your Linux server indefinitely; detach from a Mosh session on your Mac, reconnect from your iPad, and your agent is right where you left it. The combo — Kitty or Blink + Mosh + tmux creates a "persistent remote brain" pattern: your beefy Linux homelab runs the compute-heavy agent sessions 24/7, and any device becomes a thin client to drop in and out at will. Michael #4: Claude code I prefer the IDE experience, the new PyCharm + Claude integration is really good. VS Code too. Why IDE? Because we should still be present with our code and managing context is much easier. Use the best/latest models on high thinking. “Speed” is not your friend, it's just shortcuts. Create skills and agents and use them. Curate your own rules (e.g. Talk Python's Claude.md) Works well on non-coding things. Just create a folder, put a ton of files in there and it's like NotebookLM + Chat + more. Calvin #5: MacWhisper or Handy Transcribes your speech using your choice of Whisper or Parakeet models. All transcription is done on your device, no data leaves your machine. Automatic Speaker Recognition with local models. Handy is more basic, but open source and runs on all platforms. Michael #6: Tailscale No need to open ports at all, Tailscale makes machines inside the same network accessible to each other Works great for laptops, desktops, etc. But also available for servers. Though I still use cloud firewalls for servers. How I use it: My dev database server, preloaded with QA data, is always running on my home mac mini m4 pro. All my apps look for that server before looking locally and tailscale makes them always accessible to each other My local LLMs expose OpenAI API compatible APIs. Tailscale makes these accessible even while traveling or at a coffee shop. Use my mini as an exit node. All traffic is routed outbound from my local fiber network. Great to restricted IPs like accessing my servers without caring about the local IP. Screen share back to my home machines even while traveling. Listen to the Talk Python episode with Alex for a deeper conversation. Extras Calvin: Telescopo great Mac Markdown viewer/editor. Michael: One more: Typora markdown editor. Created formal documentation for many of my open source packages using Great Docs. Via Mark Little: Statement on the US government directive to suspend access to Fable 5 and Mythos 5 Joke: No second date

The back episodes finally make it online, this is number 3 in a series of episodes that did not get posted, but are now!Brett is out (which is why these didn't get posted) - but the show is very fine, up to our usual standards.  Computex hits (and misses), the 5800X3D comeback, our RX 9070 GRE review, the ZimaCube 2 Pro and even a VS Code zero day and ZeroSpace gaming!  Enjoy!Timestamps:0:00 Intro1:09 Patreon1:38 Food with Josh (or not)3:38 Computex highlights begin - AMD was busy6:47 Ryzen 7 5800X3D returns8:57 Reviewing the RX 9070 GRE (and extended pricing discussion)22:57 NVIDIA at Computex34:00 Intel wants to build back their reputation36:36 Noctua at Computex40:11 Corsair's announcements include a pretty sweet looking case46:32 RIP 24-pin ATX connector as everything shrinks49:52 Qualcomm has potentially gone insane with the 6G stuff58:43 MSI has world's first triple mode QD-OLED gaming monitor1:01:02 A very fast NAS (just don't try to buy big HDDs right now)1:06:43 (In)Security Corner1:13:55 Gaming Quick Hit1:19:52 Picks of the Week1:32:55 Outro ★ Support this podcast on Patreon ★

In this episode: Martin transforms Neovim into an unyielding modeless VSCode-style IDE with CUA keybindings. Some of this was achieved with novim-mode and snacks.nvim. Mark has been playing Solasta: Crown of the Magister. Alan wants you all to install flatpak with a snap. Gather round children, it’s story time. You can send your feedback via show@linuxmatters.sh or the Contact Form. If you’d like to hang out with other listeners and share your feedback with the community, you can join us on: The Linux Matters Chatters on Telegram. The Linux Matters Subreddit. If you enjoy the show, please consider supporting us.

In this episode: Martin transforms Neovim into an unyielding modeless VSCode-style IDE with CUA keybindings. Some of this was achieved with novim-mode and snacks.nvim. Mark has been playing Solasta: Crown of the Magister. Alan wants you all to install flatpak with a snap. Gather round children, it’s story time. You can send your feedback via show@linuxmatters.sh or the Contact Form. If you’d like to hang out with other listeners and share your feedback with the community, you can join us on: The Linux Matters Chatters on Telegram. The Linux Matters Subreddit. If you enjoy the show, please consider supporting us.

June 2026 has no headliner. Instead of one critical bug, the release spreads thin across the kernel, the network stack, a code editor, an AI assistant, a bootloader, and a nine-year-old Linux root bug. It's a breadth problem, not a severity one, and it changes how you triage.Jason Kikta and Landon Miles break down the whole release, then step off the patch list for the breaches that never got a CVE: GitHub's internal repos reached through a poisoned VS Code extension, a TanStack compromise carrying valid SLSA provenance, and a Red Hat npm namespace compromise that fired the moment anyone ran npm install.

https://novacut.ai/  https://genaimeetup.com/  Anthropic has officially closed a $65 billion Series H at a $965 billion valuation, nearly 2.5x its valuation from just 100 days ago. Meanwhile, funding is flowing across the ecosystem: Frameworks AI at $15B, Baseten at $11B, OpenRouter's $113M Series B, and Cognition AI's $1B Series D. NVIDIA went on an open-source super week with Nemotron 3 Ultra, Cosmos 3, and Nemotron 3.5 ASR. Microsoft dropped 5 new MAI models. Google released Gemma 4 12B, and Anthropic shipped Opus 4.8. On the benchmarks front, DeepSWE crowns GPT-5.5 as the leader in long-horizon coding tasks, while ITBench shows even frontier models struggle with real-world SRE incidents — Claude Opus 4.7 tops out at just 47%. Plus: Cloudflare acquires VoidZero to build the future of AI-native edge development, and Google is paying SpaceX $920M/month for compute. Topics covered: • Anthropic's $65B Series H and path to $1T • Fireworks AI, Baseten, OpenRouter & Cognition funding rounds • Microsoft's 5 new MAI models • NVIDIA's open-source super week (Nemotron, Cosmos 3) • MiniMax M3, Gemma 4 12B, JetBrains Mellum2, Opus 4.8 • DeepSWE benchmark: GPT-5.5 leads long-horizon coding • ITBench: Frontier models under 50% on real SRE tasks • Cloudflare + VoidZero for AI-native edge dev • Google's $920M/month SpaceX compute deal #AI #Anthropic #NVIDIA #OpenAI #AInews #TechNews #LLM     Funding rounds Anthropic formally confirmed the closure of its $65 billion Series H funding round at a post-money valuation of $965 billion. This represents a 2.5-fold increase over its $380 billion Series G valuation from February 2026, adding $585 billion in value in approximately 100 days https://www.anthropic.com/news/series-h  Frameworks AI raising at 15B valuation representing a near fourfold increase from its $4 billion Series C valuation recorded in October 2025 processing 15 trillion tokens daily for major production clients including Cursor, Notion, and Perplexity https://finance.yahoo.com/sectors/technology/articles/fireworks-ai-eyes-15-billion-174609357.html Baseten is raising 1B at 11B valuation annualized revenue, which skyrocketed from $200 million to $600 million over a single quarter https://techstartups.com/2026/05/26/ai-inference-startup-baseten-in-talks-to-raise-1-billion-at-11-billion-valuation/  OpenRouter has secured a $113 million Series B funding OpenRouter has experienced exponential traffic growth, with weekly production throughput expanding fivefold from 5 trillion to 25 trillion tokens over a six-month horizon https://www.businesswire.com/news/home/20260526953416/en/OpenRouter-Raises-%24113-Million-CapitalG-led-Series-B-as-Weekly-Volume-Explodes-to-25T-Tokens  Further up the stack: Cognition AI secured a $1 billion Series D round led by Lux Capital and 8VC https://cognition.ai/blog/series-d   Model Releases MAI models: MAI-Code-1-Flash: A 5-billion active parameter model optimized for ultra-low latency within GitHub Copilot and VS Code. MAI-Image-2.5: A high-fidelity image generation model ranking third on global image evaluation arenas, outperforming competing architectures like Nano Banana Pro. MAI-Transcribe-1.5: A multi-lingual speech processing engine offering fivefold speed improvements across 43 languages. MAI-Voice-2: Natural audio and voice generation across 15 languages, available at a highly competitive price point. Web IQ: A search-grounding API engineered to directly compete with Perplexity. https://microsoft.ai/models/    https://www.peoplematters.in/news/ai-and-emerging-tech/uber-imposes-dollar1500-monthly-ai-spending-limit-on-employees-amid-rising-costs-50073    Nvidia has executed an "Open-Source Super Week," positioning itself as a dominant software and model publisher: Nemotron 3 Ultra (best US open source open weights model but behind china): A massive 550-billion parameter MoE (55 billion active) designed with a 1-million token context window, optimized specifically for high-throughput, cyclical agent loops. It achieved peak throughput rates of 400 tokens per second on day-zero optimized clusters. Cosmos 3: A physical AI world-modeling framework comprising 16-billion Nano and 64-billion Super variants. Built on a Mixture-of-Transformers (MoT) architecture, Cosmos 3 natively binds textual, visual, auditory, and physical kinetic vectors. Nemotron 3.5 ASR: A highly compact 0.6-billion parameter streaming speech recognition model pushing sub-100 millisecond latencies across 40 language locales.   https://www.minimax.io/models/text/m3  MiniMax M3: A 1-million token context model hitting 59.0% on SWE-Bench Pro and 74.2% on MCP Atlas, though noted for high token consumption due to intensive internal self-validation loops.   https://blog.google/innovation-and-ai/technology/developers-tools/introducing-gemma-4-12b/  Gemma 4 12B: Google's Apache 2.0 on-device model, which utilizes an encoder-free architecture that projects vision and audio vectors directly into the text-token space, bypassing separate CLIP-style encoders to minimize local memory footprints. https://www.jetbrains.com/mellum/  JetBrains Mellum2: A compact 12-billion parameter MoE (2.5 billion active) engineered for ultra-low latency routing and retrieval-augmented generation (RAG) sub-agents within developer IDEs. Opus 4.8 https://www.anthropic.com/news/claude-opus-4-8    https://www.cnbc.com/2026/06/05/google-to-pay-spacex-920-million-a-month-for-xai-compute-capacity.html      Benchmarks: https://deepswe.d atacurve.ai/blog https://venturebeat.com/technology/deepswe-blows-up-the-ai-coding-leaderboard-crowns-gpt-5-5-and-finds-claude-opus-exploiting-a-benchmark-loophole (GPT 5.5 the winner in long horizon tasks) a highly complex software engineering benchmark focused on original, long-horizon tasks across five distinct programming languages. Comprising 113 chaotic tasks across 91 live, production-grade repositories, DeepSWE forces agents to generate 5.5 times more code and modify an average of 7 separate files per task compared to standard evaluations. On this challenging leaderboard, GPT-5.5 leads with a score of 70%, establishing a significant 16-percentage-point lead over contemporary alternatives I think older benchmarks where models reach ~90% accuracy can be considered saturated. Few percentage points don't give us any good signal.  https://research.ibm.com/publications/developing-ai-agents-for-it-automation-tasks-with-itbench  ITBench-AA, an evaluation framework focusing on live Kubernetes incident response and Site Reliability Engineering (SRE) operations. Comprising 59 live, containerized SRE incident snapshots, the results are remarkably sobering: every frontier model scored under 50% on successful incident resolution, with Claude Opus 4.7 leading at 47% and GPT-5.5 following closely at 46%.   Edge AI announcements: https://www.cloudflare.com/press/press-releases/2026/cloudflare-acquires-voidzero-to-build-the-future-of-the-ai-native-web/  The consolidation of the AI-native developer stack has reached the runtime virtualization layer. Cloudflare recently completed the acquisition of VoidZero, the development group responsible for Vite, Vitest, Rolldown, and Oxc, backing the transaction with a $1 million open-source ecosystem fund. This acquisition is highly strategic; as autonomous agents write an increasing proportion of production software, local development environments, compilation pipelines, and bundlers must be optimized for execution speeds that match agent speeds. Cloudflare's goal is to construct a localized, full-stack edge playground. In this sandbox, AI agents can generate, test, bundle (utilizing the highly parallelized, Rust-based Oxc and Rolldown engines), and deploy entire web applications end-to-end within milliseconds. This architecture completely bypasses traditional local machine container bottlenecks, enabling high-velocity agent loops to execute in a fully sandboxed, web-scale edge runtime.

Show DescriptionDave's changing up his camera angles, Chris has been upgrading his Sprinter van, how many hobbies is too many, what kinds of web tech was popular years ago that now seems normal, why isn't the DX around web components better, how can I structure my code to compose other custom elements, and what still can't be done on the web these days? Listen on WebsiteLinks Custom Elements Manifest Diffs, Trees, and VS Code 2.0 - Syntax #1008 CodePen Radio SponsorsMacroMacro is a tool to cut through the noise - It's a workspace built for engineers; One place for all your emails, tasks, team chat, and documents. Sign up at Macro.com and get $100 of your subscriptions using code SHOPTALK100

This episode covers a CISA contractor's accidental exposure of AWS GovCloud credentials and internal system details on GitHub, the FBI's efforts to patch vulnerable routers, and a critical NGINX vulnerability with public proof-of-concept code. The team also discusses Microsoft's handling of a disputed Azure Backup security finding, the challenges of vulnerability disclosure and CVE assignment, and GitHub's ban of security researcher Nightmare Eclipse following the publication of unpatched Windows vulnerability research.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis

Scott and Wes sit down with Alex Sexton and Amadeus De Marzi from Pierre Computer to dig into the gnarly performance challenges behind building blazing-fast code review tools, covering virtualization, progressive rendering, and why GitHub's UI feels so sluggish. They also chat about how major AI coding tools like Claude, Codex, and Cursor are adopting Pierre's diffs library, plus the role of web components, benchmarking, and what it takes to build “VS Code 2.0.” Show Notes 00:00 Welcome to Syntax! 04:00 The Need for Better Infrastructure 05:53 Understanding Diffs and Trees diffs.com Trees by the Pierre Computer Co 08:16 Performance Challenges in Code Review 10:49 Virtualization Techniques for Smooth Scrolling 15:04 In-Page Find and Virtualization Limitations 17:00 Browser Limitations and Content Visibility 19:29 Progressive Rendering and Syntax Highlighting 23:05 Tools and Techniques for Performance Testing 33:35 Optimizing Performance with AI 36:31 Mastering Auto Research for Efficiency 42:00 Exploring Web Components and State Management 44:05 Innovations in Rendering and Virtualization 49:12 Business Insights and Future Directions 53:58 Sick Picks Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

James and Frank unpack AI-driven development shifts—agent SDKs, session management, and the rise of agent-first UIs like Google's anti-gravity and GitHub Copilot—showing how VS Code's Agents window, worktrees, sub-sessions and tunnels help manage multi-repo cloud and local workflows. They share practical takeaways—why SDKs are essential, when to stay code-first, how subsessions and remote tunnels protect your machine, and what to watch for in sandboxing and integration gaps. Follow Us Frank: Twitter, Blog, GitHub James: Twitter, Blog, GitHub Merge Conflict: Twitter, Facebook, Website, Chat on Discord Music : Amethyst Seer - Citrine by Adventureface ⭐⭐ Review Us ⭐⭐ Machine transcription available on http://mergeconflict.fm

GitHub Breach https://x.com/github/status/2056949168208552080 Agentic Threat Intelligence Feed - VS Code Extensions https://agentmesh.knostic.ai/extensions More NGINX Vulnerabilities https://x.com/nebusecurity/status/2057071579876753643 https://my.f5.com/manage/s/article/K000161307 Microsoft Publishes YellowKey Mitigation CVE-2026-45585 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585 Incomplete Sonicwall Patch CVE-2024-12802 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001

GitHub confirms a breach tied to a malicious VS Code extension. Anthropic fights a Pentagon blacklist as the White House weighs new AI security rules. Drupal scrambles to patch a critical flaw. Cisco Talos tracks the evolution of BadIIS malware-for-hire. Signal adds anti-phishing safeguards, Microsoft cracks down on malware-signing services, and China says foreign spies hijacked domestic routers for phishing operations. Wireless carriers collaborate to kill dead zones. Our guest is Rob T. Lee, Chief AI Officer, Chief of Research, SANS Institute, discussing The Cloud Security Alliance's “AI Vulnerability Storm” report. A book about misinformation contains helpful examples. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Rob T. Lee, Chief AI Officer, Chief of Research, SANS Institute, sharing Cloud Security Alliance's The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program. Selected Reading GitHub confirms breach of 3,800 repos via malicious VSCode extension (Bleeping Computer) Trump AI executive order seeks early government access to frontier models (Axios) DC Circuit slams Pentagon blacklisting of Anthropic as overreach (Courthouse News Service) Drupal Issues Urgent Warning for Highly Critical Core Vulnerability (Beyond Machines) From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat (Cisco Talos) Signal adds security warnings for social engineering, phishing attacks (Bleeping Computer) Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware (Microsoft)   China's state security authorities uncover foreign agency using domestic routers as cyberattack proxies; users notice only slower speeds (Global Times) ‘The Future of Truth' Contains Quotes Made Up by A.I. (The New York Times) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Scott and Wes break down the “Mini Shai-Hulud” supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm's security defaults, dev containers, and other practical defenses. Show Notes 00:00 Welcome to Syntax! 00:25 Understanding the Shai-Hulud Worm Post Mortem of Shai Hulud Attack 02:47 Mechanics of the Attack: GitHub Actions and Cache How the attack happened Who Was Involved in the Attack Several npm latest releases are compromised Socket.dev Step Security 05:44 Brought to you by Sentry.io 06:09 Propagation and Impact of the Worm 09:30 Preventative Measures for Developers Dead Man's Switch 12:33 The Role of Package Managers in Security Block Exotic Subdeps 18:39 Using Dev Containers Why You Should Use Dev Containers Scott Tolinski's Security Review 20:57 Conclusion and Final Thoughts Sentry has Skills! Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

When OpenAI trained GPT-3, they didn't roll their own orchestration layer. They used Ray, an open source Python framework born out of the same Berkeley research lab lineage that gave us Apache Spark. And here's the twist: Ray was originally built for reinforcement learning research, then quietly faded as RL hit a wall. Until ChatGPT showed up. Suddenly reinforcement learning was back, as the post-training step that turns a raw language model into something genuinely useful. Edward Oakes and Richard Liaw, two founding engineers behind Ray and Anyscale, join me on Talk Python to tell that story. We'll trace Ray from its RISE Lab origins at UC Berkeley to powering some of the largest training runs in the world. We'll talk about what Ray actually is, a distributed execution engine for AI workloads, and how a few lines of Python become work running across hundreds of GPUs. We'll cover Ray Data for multimodal pipelines, the dashboard, the VS Code remote debugger, KubRay for Kubernetes, and where Ray fits alongside Dask, multiprocessing, and asyncio. If you've ever stared at a single-machine Python script and thought, "there has to be a better way to scale this", this one's for you Episode sponsors Sentry Error Monitoring, Code talkpython26 AgentField AI Talk Python Courses Links from the show Guests Richard Liaw: github.com Edward Oakes: github.com Ray: www.ray.io Example code (we used for walk-through): docs.ray.io Getting Started with Ray: docs.ray.io Ray Libraries: docs.ray.io kuberay: github.com Watch this episode on YouTube: youtube.com Episode #547 deep-dive: talkpython.fm/547 Episode transcripts: talkpython.fm Theme Song: Developer Rap