suchar

This is not privilege separation/sandboxing. Separate virtual machine for an agent with limited credentials is reasonably safe approach

With remote development (vscode and remote extension in jetbrains with ssh to VM) performance is good with headless VM in UTM. Although it always (?) uses performance cores on Apple Silicon Macs, so battery drain is a problem

In my case (although I have not yet flown with APP3) the ANC works great, however, transparency mode (and adaptive mode) have issue with a noise. In a silent room I hear quiet noise in transparency mode (not present in ANC nor in "Off") which wasn't present in APP1. I tried different tips

Also, transparency mode felt more "natural" in APP1 in comparison to APP3. Currently it feels like a downgrade from APP1 (unfortunately my pair of APP1 broke recently), because I used transparency a lot and it feels worse

They need to keep KV cache to avoid prompt reprocessing, so they would need to move it to ram/nvme during longer api calls to use gpu for another request

Could you point to some functionalities removed from dbt Core? I love dbt and use it where applicable but I have not yet encountered a loss of features upon upgrade yet - it would be useful to be aware what kind of features get removed

I would imagine that good IDE integration would summarise each module/file/function and feed high-level project overview (best case: with business project description provided by the user) and during CoT process model would be able to ask about more details (specific file/class/function).

Humans work on abstractions and I see no reason to believe that models cannot do the same

Sometimes you can avoid writing multiple queries with different filters by creating single parameterized query with conditions like:

    WHERE (name LIKE :name OR :name IS NULL)
      AND (city = :city OR :city IS NULL)
      AND ...

By no means it is perfect, but can save you from writing many different queries for different filters while being easy to optimize by db (:name and :city are known before query execution).

Still, I prefer explicit SQL in webservices/microservices/etc. the code and its logic is "irrelevant" - we care only about external effects: database content, result of a db query, calls to external services (db can be considered to be nothing more than an external service). And it's easier to understand what's going on when there is one less layer of abstraction (orm)

For remote development there is Fleet from JetBrains which is still in preview but mostly works (year ago it had a lot of issues). Nonetheless, it still needs a lot of improvements (rendering performance IME is poor, some functionality is missing in comparison to full-fledged IDEs like IntelliJ)

There is also JetBrains Gateway which allows you to run IntelliJ/PyCharm/etc. remotely. I'm using it and it is very usable, however, there are occasional bugs which could be explained by synchronization issues

Btw. Vim should be very usable over ssh (especially with tmux and maybe iTerm2/other terminal integration with tmux' control mode - tmux panes are native windows, new terminal window/tab creates new tmux window/pane etc.). Why are you using VSCode over Vim for remote development?

Tmux integration: tmux is running remotely in control mode and local iTerm2 is managing it. This way tmux panes and windows are mapped to native windows and iTerm2's split panes. Makes remote feel like a local machine

Same here, but IMO, if company believes that such software is useful (and they wouldn't be using it if company believed otherwise), then why do they often (always?) include node_modules in exclusion rules? After all, node_modules usually contains a lot of untrusted code/executables

I do not see license in either repository and it seems that this tool only has 30 day evaluation tier for free. Anyway, using this means that you have dependency on a single vendor and you accept their future pricing changes.

Now compare this with JSON ecosystem

Some time ago I tried Retool and it does have "Query JSON with SQL": https://docs.retool.com/queries/guides/sql/query-json (it is somewhat relevant because it was extremely convenient)

It is somewhat similar to Linq in C# although SQL there is more standardised so I like it more. Also, it would be fantastic to have in-language support for querying raw collections with SQL. Even better: to be able to transparently store collections in Sqlite.

It is always sad to see code which takes some data from db/whatever and then does simple processing using loops/stream api. SQL is much higher level and more concise language for these use cases than Java/Kotlin/Python/JavaScript

I'm not sure if there is any open source XSLT tool as complete as jq is for JSON. There is xsltproc but IIRC it does not support streaming scenarios (jq has some support for streaming processing)

Though, personally, I prefer JSON. Probably due to superior tools (thanks to its popularity) and less-bloated syntax (it is somewhat easier for me to read raw JSON file than raw XML file).

For DigitalOcean (and several other providers) you can build your own image with provided configurations, e.g.: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/v...

(see `virtualisation` folder for other providers)

Then you can do something like:

    nix build .#nixosConfigurations.doImage.system.build.digitalOceanImage

And in the `result` directory you will have droplet image which can be uploaded to digital ocean as droplet template.

Its probably best to also create separate configuration only for the image. As a bonus, its already configured, so no need to run `nixos-rebuild switch` after droplet creation. Partitioning configuration is also handled by the builded, however, filesystem choice (and partitioning schema) is limited

(I'm not saying that this is easier than out of the box support for NixOS: IMO if you are even aware how to create custom NixOS image then you are probably somewhat experienced NixOS user)

From my personal experience, the first example doesn't really happen: thankfully I rarely see people randomly throwing annotations at methods/classes hoping one of them will stick. For most of the time annotations are self-explanatory.

However, there are some real issues with annotations in Spring/Java: - Application will sometimes run just fine without annotation processor/interceptor. Think of `@EnableScheduling` in Spring: you won't know that `@Scheduled` is not working (because of missing `@EnableScheduling`) until you observe that method is not executed. In this case static code is a clear win. - Annotation order: not all annotation processors/interceptors in Spring support specifying order. Annotation order in the code doesn't matter: it is lost during compilation. Good luck figuring out what is applied first in a method with `@Retry`, `@Transactional` and `@Cached` - will retry be executed within transaction or each retry will have its own transaction? This also is easily solved with static code instead of annotations.

As for compile-time error vs runtime-error: personally I don't really care as long as there is any error (which is not always the case in the first example) during the build/test/init/assembly phase. When I'm writing SQL queries in the code, I'm getting SQL parsing/compilation errors during application runtime - but that's fine, because I've written SQL-s against DB execution engine. When I'm writing Spark SQL job, I'm getting errors during query planning phase - and that's also fine, because I'm writing code against Spark's execution engine. Writing annotations against "annotation execution engine" (annotation processor/interceptors) doesn't seem any different or wrong in principle. Although, there are things that could be improved.

Stacktraces: there are a few additional interceptor method calls in the stacktrace when annotations are in use, however, most of the complexity comes from library/framework structure and developer's familiarity with it. Spring covers a lot of use cases thus it has its share of complexity. I'm not sure if "Spring without annotations" would be noticeably easier to work with, although I assume that feature-parity with Spring (MVC) is not a goal of this project so it probably will be easier to understand.

The main issue with Java-based projects (possibly using Spring) is the amount of existing resources: there are thousands/millions of example projects, code snippets, answers on StackOverflow etc. and majority of them is very old (as far as software development is considered). Even fresh resource are often using outdated techniques.

Modern Java is pretty good (although Kotlin is a bit cleaner IMO), but you should really use Spring documentation (if you are using Spring) and avoid code snippets from SO/Github.

Yup, it's "funny" that even basic functionality doesn't work as expected: https://gitlab.com/gitlab-org/gitlab/-/issues/350662

I encounter this issue pretty often and it makes code review experience miserable. It's not blocking any work, but it is frustrating enough that for any new project I would try to avoid using Gitlab

One major disadvantage of triggers is the inability to do canary deployments and vastly increased complexity of rolling deployments. When SQL code lives within the application, we can trivially run multiple variants of such code simultaneously. Running alternate version of a trigger for e.g. 10% of traffic is way harder.

What I would recommend instead is making use of CTE (Common Table Expression), because DML (modifying queries) inside `WITH` are allowed and taking leverage of `RETURNING` keyword in both `UPDATE` and `INSERT` we can execute multiple inter-dependent updates within single query.

With such approach we can trivially run multiple versions of an application in parallel (during deployment, for canary deployment etc.) and we have similar performance advantage of a single roundtrip to database. Additional advantage is the fact that there is only one statement which means that our query will see consistent database view (with very common read committed isolation level it is easy to introduce race conditions unless optimistic locking is used carefully).

This is true for SSH key, but not for all data on MacOS, e.g. if you run `find ~/Library/Application Support/AddressBook` the OS will ask you if you want to give access to contacts to iTerm2/whatever (unless you have given it before). I'm not aware of a way to create additional sandboxed "folders".

Also, some applications on MacOS are sandboxed, IIRC Mail is one of them. Also, some (all?) applications installed from AppStore. That's the reason I prefer installing applications from AppStore: they seem to be at least somewhat sandboxed.

For development, I try as much as possible to leverage remote development via [JetBrains Gateway](https://www.jetbrains.com/remote-development/gateway/) and [JetBrains Fleet](https://www.jetbrains.com/fleet/). VSCode also has remote development but they explicitly assume that remote machine is trusted (in the security note in the remote extension plugin readme). In the case of JetBrains tools I have not seen any explicit declaration whether remote host is trusted (as in: if remote machine is pwnd then we may as well let pwn your personal machine), but at a glance it seems like there are minimal precautions (if you run web application and open it in a browser, the Gateway will ask if you want to be redirected to a browser etc.)

Probably best scenario for such remote development clients on MacOS would be to put them in AppStore: this way they could leverage sandboxing and in the case of thin client, the sandboxing likely won't limit functionality.

Major benefit of Airflow is the number of already implemented integrations. Importing data from GCS to BigQuery, copying data from Postgres to GCS, KubernetesPodOperator and so on. IIUC with Temporal you get only workflow management which can be easily integrated with any application to implement business logic. And this is great, because implementing business workflow in Airflow is even more awful than the Airflow itself. But for any ETL or plumbing job Airflow is IMO better due to existing integrations.

I used Ansible in the past for the exact same purpose and it has one major flaw: Ansible is imperative. What I mean is: if I add a line in a config file and want to rollback then I have to manually handle revert (create playbooks with `delete` flag etc.) With Nix you get this for free.

Also, with Nix you can trivially create image for your configuration (even with slightly different options, e.g. only enable ssh on 0.0.0.0 for a fresh install, but disable it after first config apply) which I find useful when working with a cloud.

Readme says: https://marketplace.visualstudio.com/items?itemName=ms-vscod...

> A compromised remote could use the VS Code Remote connection to execute code on your local machine.

So I would say that it might be a bit harder for an attacker to gain access to your local machine, but you should not rely on it, because it's more like security by obscurity.

As long as your are creating web applications then browsers are pretty good at limiting blast radius of a single attacked website. Well, at least until attacker discovers that he can inject some fancy phishing into trusted site.

With local development environment it is a bit different, because unless you are running build/test etc. in a container/vm/sandbox, then attacker has access to all of your files, especially web browser data.

It is not a zero-day if it has been fixed in a newer OS version. I would say, the main risk here are known vulnerabilities, like, bug in a system library which does image rendering, font rendering etc.

Targeting known CVE for old (no longer updated) MacOS versions might actually be quite good targeted attack: probably a bunch of users of such computers are technical folks with access to production servers, cloud credentials etc.

With crappy Internet connection you still can do remote development (it doesn't take much bandwidth, after all it's mostly text). But what if you need to download dependencies/docker images or upload e.g. docker image? With a remote development you can offload that to a beefy server with gigabit connection.

Probably not that much if you are not looking forward to a remote development:

- new UI (they couldn't change it in any meaningful way without breaking workflows, but with a new IDE there are no existing workflows)

- single IDE for all languages (it was possible for most of them with IJ ultimate, but for e.g. Python the experience was slightly worse than with PyCharm)

> - Part of me think that Jetbrains should have created paid extensions for Vscode much like Resharper for Visual Studio

IIRC, JetBrains considers LSP to be too limiting for refactoring and code-insight capabilities that they want to provide (I think they said that when there was discussion about language server for Kotlin). So it's possible that such extension wouldn't be on par with a "real" JetBrains IDE.

You can always run development environment in a local VM, although that would be rather slow (I assume that if somebody is going remote development way then they would buy cheaper notebook and use savings to pay for the cloud instance).

It's not for everyone, but you are paying for your development environment either way (upfront by buying powerful notebook, or as-you-go by renting cloud instance). Seems fine as long as it is conscious choice.

I've recently tested UTM and Parallels Desktop (Intel Mac) with Linux workloads (Ubuntu and NixOS). IME, UTM seems to be considerably slower than Parallels. I haven't investigated this much, but it looked like a very slow IO (despite using a disk in raw format) + htop showed that the CPU spent a lot of time in the kernel.

Nonetheless, it is a pretty nice tool

Well, this is exactly what I meant: you need to know your tools. Rename is very basic functionality. What makes real difference is, for example, automatic removal of unused variables/classes (quickly search for all occurrences, review the list, and then apply). Or rewrite some deprecated construct with a new one. Or structural search and replace (works on a code structure, not text).

There is way more to a fantastic language support in an IDE than symbol rename.