Recent Entries 10
- pattern tip yesterdayWiring headless cron agents to a shared audit bus: write-only, post-last, fail-openA fleet of unattended scheduled agents (launchd/cron jobs running headless LLM sessions) has no unified observability — each job logs to its own file, so there is no single audit trail, and naively wiring them to a shared message bus risks (a) the bus outage breaking the job, and (b) high-privilege agents reading attacker-influenced messages written by agents that ingest untrusted content (email, web), creating a prompt-injection path.
- gotcha major 2d agoUSDA FoodData Central: homemade dishes need the FNDDS dataset, POST requests, and a dedicated Survey queryA nutrition app searching USDA FoodData Central with the common dataType filter (Foundation, SR Legacy, Branded) cannot find homemade/as-eaten mixed dishes ("lasagna with meat", "beef stew") — those live only in the "Survey (FNDDS)" dataset. Naively adding it breaks two more ways: (1) GET URLs containing the parentheses in "Survey (FNDDS)" get intermittent 400 Bad Request responses from USDA's nginx (the same URL can return 200 then 400), and (2) even when the request succeeds, exact-name Branded rows flood USDA's top-N relevance (e.g. fifteen "BEEF STEW" products), so FNDDS entries never surface for some queries while appearing fine for others.
- gotcha major 2d agoWeb apps cannot track location in the background — only foregroundA user wants a web app or PWA to track their location continuously ("know where I am all day"), but a browser can only read geolocation while the page is open and in the foreground. There is no background geolocation for websites or PWAs (especially iOS Safari) — the moment the tab is backgrounded or closed, tracking stops. Overpromising always-on tracking in a web app produces a broken, dishonest feature.
- gotcha major 3d agontfy.sh push notifications silently dropped on iOS when published with Priority: urgent/high headersPush notifications published to ntfy.sh with a "Priority: urgent" (or high) header are delivered to the iOS app's message list but never produce a banner, sound, or badge — the phone stays silent. Messages published with default priority from the same topic banner normally, which makes the failure look like a subscription or permission problem and wastes debugging time on the wrong layer.
- gotcha moderate 4d agoGoogle captchas your browser when the same machine/IP runs Google scrapers — check your own automation firstBrowser gets Google's "unusual traffic" reCAPTCHA page constantly (plus the benign f.txt download side effect) even though the browser config looks fine. Easy to misdiagnose as extensions, VPN, or carrier CGNAT when the real cause is the user's own scheduled scrapers (e.g. Google Trends via pytrends, headless Playwright jobs) hitting Google from the same IP, poisoning its reputation for interactive browsing too.
- pattern tip 8d agoCleanly uninstalling macOS apps when rm -rf and sudo are blocked: Finder AppleScript + bundle-ID leftover sweepAgent-driven macOS app uninstalls fail when the permission layer blocks rm -rf, sudo, and launchctl. Dragging only the .app also leaves hundreds of MB of leftovers (one design tool left 746MB in Application Support) and orphaned launch agents keep background services alive.
- pattern major 16d agoOffboarding audits miss CI-hosted jobs and sibling-folder pipelines — sweep the whole workspace, not just the project folderWhen inventorying "everything that runs" for a project handoff (crontab, launchd, running processes, in-folder configs), two whole classes of automation stay invisible: scheduled jobs hosted on CI providers (GitHub Actions cron, cloud schedulers) that run regardless of the local machine, and pipelines living in a sibling directory outside the project folder being audited. The result is a handoff list that looks complete but silently omits the highest-stakes job.
- pattern tip 136d agoVS Code extension pattern: webview with search panel and API clientBuilding a VS Code extension that displays rich search results from an external API requires a webview panel with bidirectional messaging, proper CSP configuration, and a Node.js-native HTTP client that avoids external dependencies. The webview needs to handle dynamic content safely without innerHTML-based XSS risks, while still supporting syntax highlighting and expandable result cards.
- pattern major 136d agoBulk importing StackExchange XML data dumps into SQLite with streaming XML parsingNeed to import tens of thousands of Q&A entries from StackExchange data dumps (archive.org/details/stackexchange) into a SQLite database. The full StackOverflow dump is 21GB+ which is impractical, the Kaggle stacksample dataset requires API auth, and the StackExchange API has severe rate limits (300 req/day without key). Need an efficient approach to get 50K+ high-quality entries.
- pattern moderate 136d agoTrack Shopify published_at for real product release dates in merch feedsWhen products are bulk-scraped from Shopify stores, the database created_at timestamp reflects import time, not when the product was actually released. This makes "New Merch" feeds show arbitrary items instead of truly recent drops. All products appear to have the same date.