🐥 YellowDuck.be

🔗 Top 10 backend frameworks for enterprise development in 2026

2026-08-10T17:00:00Z

In 2026, choosing a backend framework is more nuanced than ever. Enterprise teams now balance performance, ecosystem maturity, and developer availability against long-term costs. The guide delves into the top frameworks crucial for enterprise development this year. It outlines the strengths and limitations of each framework, guiding teams on aligning choices with their specific constraints rather than popular trends.

Among the contenders, Spring Boot remains dominant due to its vast ecosystem, but alternatives like Quarkus and FastAPI offer compelling advantages in speed and memory efficiency. For Python enthusiasts, Django and FastAPI cater to varying needs, emphasizing security and async capabilities. This year’s choices underscore the importance of matching frameworks to organizational goals, serving both current needs and future demands with a focus on scalability, security, and developer capacity.

Continue reading on blog.vaadin.com

#reading-list #development #python #best-practice #django #java

🔗 AI coding tip 027 - Force code standards

2026-08-10T13:00:00Z

Style errors double when nobody enforces them. Maximiliano Contieri outlines a critical aspect of AI coding: enforcing standards. A CodeRabbit analysis revealed that AI-generated code contains about 1.7 times more defects than human-written code, particularly in the areas of naming and style consistency. Instead of relying on human memory to remember coding standards, Contieri advocates for integrating machine-checkable rules through hooks and validators. This can block violations before any human review occurs, allowing developers to focus on design rather than mechanical checks. With each violation logged as a rule, the enforcement grows stricter over time, promising a measurable drop in defects and allowing for faster reviews. This shift emphasizes the need for automation in maintaining code quality.

Continue reading on maxicontieri.substack.com

#reading-list #development #best-practice #ai #testing

🔗 Jurassic Park computers in excruciating detail

2026-08-10T08:00:00Z

What does the technology in Jurassic Park reveal about the era it was made? Fabien Sanglard delves into the specifics of every computer and software showcased in the film. From the Apple Powerbook 100 to SGI IRIS Crimson, he breaks down the specs and functionalities of these machines, noting how they contributed to the movie's iconic scenes. The article highlights the impressive real-time 3D animations powered by SGI workstations and discusses the hefty value of the computer hardware loaned during production, which rose to $4 million in today’s dollars. By examining the devices in the chaos of the Control Room, Sanglard provides a refreshing take on a nostalgic element of the film that many may overlook. Whether it’s the monitors or the personal digital assistants, each piece tells a story about the technology of the early '90s.

Continue reading on fabiensanglard.net

#reading-list

🔗 Are we offloading too much of our thinking to AI?

2026-08-09T17:00:00Z

This article examines the growing trend of offloading cognitive tasks to AI, including both trivial and complex decisions. Yennie Jun illustrates this by referencing Ken Liu's short story "The Perfect Match," where the protagonist relies on an AI assistant for personal choices, reflecting a concerning loss of autonomy. The piece discusses real-life encounters with individuals who let AI dictate their thoughts and decisions, raising questions about the impact of this dependency on critical thinking and originality. Jun encourages a balance between leveraging AI for efficiency and retaining our own thought processes, exploring how automation in daily tasks might enhance productivity versus leading to lazy thinking. Ultimately, the article provokes a deeper introspection about the consequences of allowing AI to make decisions that shape our identities and desires.

Continue reading on www.artfish.ai

#reading-list #development #best-practice #ai

🔗 Lobste.rs is now running on SQLite

2026-08-09T13:00:00Z

Lobste.rs has officially migrated from MariaDB to SQLite. This decision, which began in August 2018 with plans initially focused on PostgreSQL, culminated successfully over the past weekend. The new architecture has shown performance improvements, including reduced CPU and memory usage, making the site feel snappier. The Lobsters Rails application now operates on a single VPS with an SQLite database file of approximately 3.8GB, supplemented by a cache and queue database, and a rack_attack database. The migration PR optimized the code significantly, reflecting a modern approach to server management with minimal resources. This case study serves as a potent reminder of how effective SQLite can be for smaller applications in 2026.

Continue reading on simonwillison.net

#reading-list #laravel #database #sqlite

🔗 I could've rickrolled the entire FIFA World Cup. All I needed was my ID.

2026-08-09T08:00:00Z

What if a simple registration process could expose live broadcasts of one of the biggest sporting events in the world? In this article, the author outlines a shocking incident where a flaw in FIFA's security allowed access to the Streaming Management panel for the FIFA World Cup 2026. By just registering as a football agent, they gained entry to live match feeds, RTMP ingest URLs, and even the ability to manipulate match statistics. This breach highlighted a critical failure in server-side security, where backend APIs trusted authenticated users without proper role checks. Despite multiple attempts to report the issue to FIFA and related entities, the author faced significant hurdles in getting the problem acknowledged. Ultimately, the vulnerability was patched quickly, but FIFA did not respond or thank the whistleblower, raising concerns about security practices in mega sporting events.

Continue reading on bobdahacker.com

#reading-list #best-practice #auth

🐥 Distributing a Go CLI via a Homebrew tap

2026-08-08T17:00:00Z

Homebrew is the package manager that macOS developers reach for first. If you want your CLI tool to feel like a first-class citizen on macOS — installable with a single command, updatable with brew upgrade, and auto-completed by the shell — a Homebrew tap is the right solution. This post covers how to set one up for a Go CLI, including the formula, CI validation, and the update workflow.

What is a tap?

A Homebrew tap is just a GitHub repository named homebrew-. Once a user runs brew tap org/something, Homebrew knows to look for formulas in that repo. From that point on, brew install org/something/mycli works exactly like installing any official Homebrew package.

The naming convention is the only magic: no registration, no approval process. Anyone can host a tap.

The formula

Formulas live in a Formula/ directory and are written in Ruby using Homebrew's DSL. For a pre-built Go binary, the formula is remarkably simple:

class MyCli < Formula
  desc "CLI interface for My App"
  homepage "https://example.com"
  url "https://cdn.example.com/mycli/5c7b6ef47a682ffe.../mycli-macos.tar.gz"
  version "1.47.0"
  sha256 "48e146382b0f527549328da4bed9d90f2d584e1b05a8f94846cf47c3c66a9343"
  license "MIT"

  def install
    bin.install "mycli"
  end

  test do
    system "#{bin}/mycli", "--version"
  end
end

There are only four things that change on each release:

url — points to the new tarball on the CDN
version — the semver string shown by brew info
sha256 — the checksum Homebrew verifies before unpacking

The install block copies the binary into the Homebrew prefix (/opt/homebrew/bin/ on Apple Silicon, /usr/local/bin/ on Intel). The test block is a smoke test Homebrew runs after install — here, just confirming the binary exits cleanly when asked for its version.

Building a universal macOS binary

The URL points to a .tar.gz containing a single binary. Rather than shipping separate arm64 and x86_64 tarballs and maintaining two formula entries, we use lipo to merge them into one universal binary:

define build-binary-mac
    @echo "Building for macos"
    GOOS=darwin GOARCH=arm64 go build -o mycli-arm .
    GOOS=darwin GOARCH=amd64 go build -o mycli-x86 .
    lipo -create -output mycli mycli-x86 mycli-arm
    tar czf ./mycli-macos.tar.gz mycli
    rm -f mycli-x86 mycli-arm mycli
endef

GOOS=darwin GOARCH=arm64 go build and GOOS=darwin GOARCH=amd64 go build produce two binaries. lipo -create stitches them into a Fat Binary that macOS automatically runs under the native architecture. The result: one tarball, one formula URL, works on both Apple Silicon and Intel Macs without any user-facing complexity.

The CDN URL strategy

The binary is uploaded to object storage (DigitalOcean Spaces in our case, but S3 or any public CDN works equally well). The URL path includes the git commit SHA:

https://cdn.example.com/mycli/{git-sha}/mycli-macos.tar.gz

Embedding the commit SHA rather than the version tag means:

Uploads are naturally immutable — the same SHA always points to the same build
Multiple release candidates for the same version cannot collide
The create-index.py script (which generates a index.json listing all build artifacts) uses the same SHA, keeping the release artefacts coherent

Updating the formula

When a new version ships:

Build and upload the tarball: make build-all produces mycli-macos.tar.gz; CI uploads it to the CDN under the new commit SHA.
Compute the SHA256 of the tarball: sha256sum mycli-macos.tar.gz
Update three lines in the formula: url, version, sha256
Open a PR against the tap repository

The tap CI then validates the change before it merges (more on that below).

CI: validating formulas with `brew test-bot`

The tap repo includes a GitHub Actions workflow that runs on every push and pull request:

name: brew test-bot
on:
  push:
    branches: [main]
  pull_request:

jobs:
  test-bot:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: Homebrew/actions/setup-homebrew@main

      - run: brew test-bot --only-cleanup-before
      - run: brew test-bot --only-setup
      - run: brew test-bot --only-tap-syntax
      - run: brew test-bot --only-formulae
        if: github.event_name == 'pull_request'

      - name: Upload bottles as artifact
        if: always() && github.event_name == 'pull_request'
        uses: actions/upload-artifact@main
        with:
          name: bottles
          path: '*.bottle.*'

brew test-bot is Homebrew's own CI harness. The steps do progressively more:

Step	What it checks
`--only-tap-syntax`	Ruby syntax, formula naming conventions, `brew audit` rules
`--only-formulae`	Actually installs the formula and runs the `test do` block

Running on both ubuntu-latest and macos-latest catches issues specific to either platform — important because Homebrew has first-class Linux support (Linuxbrew) and many teams use it in Docker-based CI.

CI: Merging PRs with `brew pr-pull`

The second workflow handles the merge step:

name: brew pr-pull
on:
  pull_request_target:
    types: [labeled]

jobs:
  pr-pull:
    if: contains(github.event.pull_request.labels.*.name, 'pr-pull')
    runs-on: ubuntu-22.04
    steps:
      - uses: Homebrew/actions/setup-homebrew@main
      - uses: Homebrew/actions/git-user-config@main

      - name: Pull bottles
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
          PULL_REQUEST: ${{ github.event.pull_request.number }}
        run: |
          brew pr-pull --debug --tap="$GITHUB_REPOSITORY" "$PULL_REQUEST"

      - uses: Homebrew/actions/git-try-push@main
        with:
          token: ${{ github.token }}
          branch: main

      - name: Delete branch
        if: github.event.pull_request.head.repo.fork == false
        run: git push --delete origin "$BRANCH"

Instead of merging PRs normally, a maintainer applies the pr-pull label. brew pr-pull then:

Downloads any pre-built bottles attached to the PR as GitHub Actions artifacts
Commits the bottle checksums into the formula
Pushes directly to main and deletes the PR branch

This mirrors the workflow used by the official Homebrew/homebrew-core tap and means the merge is always handled by Homebrew's own tooling rather than GitHub's merge button.

For a simple pre-built binary formula (no compilation step, no bottle needed), this is mostly ceremony — but it is good practice because it keeps the tap workflow consistent with the broader Homebrew ecosystem and makes it easy to add bottles later if the build-from-source path is ever needed.

The user experience

After all of this, the user-facing story is clean:

# One-time setup
brew tap myorg/mycli

# Install
brew install mycli

# Upgrade when a new version ships
brew upgrade mycli

And because Homebrew auto-discovers shell completions in share/zsh/site-functions/, share/bash-completion/, and similar paths, completions are picked up automatically if the binary generates them into those locations at install time.

Summary

Component	What it does
`homebrew-mycli` repo	The tap — a public GitHub repo Homebrew reads formulas from
`Formula/mycli.rb`	Declares the URL, version, checksum, install path, and smoke test
Universal binary (`lipo`)	One tarball covers both Apple Silicon and Intel in a single formula entry
CDN + commit SHA URL	Immutable, content-addressed artifact storage
`brew test-bot` CI	Validates formula syntax and install on every PR
`brew pr-pull` CI	Homebrew-native merge flow that handles bottle attachment

The tap repository itself is under 20 lines of real content. Most of the work is a one-time setup; after that, each release is a three-line diff to the formula and a label click to merge.

#golang #tools #mac

🔗 How I use HTMX with Go

2026-08-08T13:00:00Z

Not sure how to structure your Go web application? Alex Edwards shares his insights on integrating HTMX to enhance interactivity seamlessly. His approach allows developers to maintain server-side HTML rendering consistency while minimizing JavaScript overhead. The article covers structuring HTML templates, managing partial and full-page responses, and handling redirects with HTMX often used in Go applications. Readers can explore the practical steps involved in setting up a project with HTMX, including file structuring and best practices for embedding assets in Go binaries. This guide is a valuable resource for those looking to build dynamic, user-friendly web applications with Go and HTMX.

Continue reading on www.alexedwards.net

#reading-list #golang #frontend #best-practice #http #html

🔗 The strangest hobby at the table

2026-08-08T08:00:00Z

Handing everyone an LLM subscription might seem sufficient, but it actually limits their potential. A shared, self-hosted agent creates a configured environment tailored to company context, ensures that connected tools are accessible, and maintains clear boundaries. This article argues that companies benefit more from owning this layer rather than renting it. The piece outlines strategic ways for businesses to begin this transition, emphasizing that a self-hosted solution allows for greater customization and adaptability, which are crucial in a competitive landscape. It reassures organizations that starting small is a viable tactic, making it easier to implement significant changes.

Continue reading on madewithlove.com

#reading-list #best-practice #ai #devops

🔗 Nginx vs Caddy vs Traefik in 2026 — I Ran All Three Under Real Production Load

2026-08-07T17:00:00Z

Same Kubernetes cluster, same microservices, same TLS requirements. One proxy broke during ingress-nginx migration week. Guess which.

Continue reading on medium.com

#reading-list #best-practice #devops #testing #kubernetes

🔗 How to hire engineers for strong judgment and taste

2026-08-07T13:00:00Z

Judgment and taste are now critical hiring signals in engineering, as Sage Lazzaro explains. With AI taking over execution, developers must rapidly evaluate outputs and make informed product decisions. Companies are evolving their hiring practices, moving towards open-ended projects and assessing candidate thought processes rather than sheer knowledge. Candidates who struggle to articulate their decision-making raise red flags. Emphasis is placed on curiosity and nuanced thinking, reflecting the need for engineers to balance technical judgment with product sense. For example, roles like Forward Deployed Engineers require deep engagement with customer needs, making thoughtful decision-making more crucial than ever. This article highlights the shift in hiring strategies and the importance of identifying candidates who excel in both judgment and taste.

Continue reading on leaddev.com

#reading-list #development #best-practice #ai

🔗 Why Pogačar rides on a car tire brand

2026-08-07T08:00:00Z

Why are pro cyclists like Tadej Pogačar riding on tires made by car manufacturers? Jan Heine reveals the surprising truth behind tire sponsorship in the Tour de France. While companies like Continental dominate road racing sponsorships, it's primarily car tires being promoted, not bike tires. With costs running into millions, small brands struggle to compete despite offering quality products. Heine highlights that while small makers find success in gravel races, the high stakes of pro cycling often favor larger brands willing to invest heavily. The article provides an insightful look into the financial strategies behind sponsorships in elite road racing, illustrating how marketing priorities can overshadow the sport's rich cycling heritage.

Continue reading on www.renehersecycles.com

#reading-list #sports

🔗 Your Dropbox is now a skill server

2026-08-06T17:00:00Z

sx 2.0, a new app for Mac, Windows, and Linux, addresses the challenge of sharing AI skills among non-technical teams. By using a shared folder in Dropbox or similar services, teams can easily publish and synchronize their skills without needing git or terminal access. The app translates skills into various AI client formats seamlessly, allowing for effortless integration.

Moreover, the release includes a pluggable extension system that enables teams to customize their workflows without bloating the core product. With built-in tools to monitor skill usage and ensure content quality, sx 2.0 targets marketing, legal, and sales teams who can now leverage AI without technical barriers through a simple, user-friendly interface. The emphasis on distribution aims to democratize access to AI knowledge across organizations.

Continue reading on sleuth-io.github.io

#reading-list #tools #ai #announcement

🔗 Kubernetes Dashboard to Headlamp: A Step-by-Step Guide

2026-08-06T13:00:00Z

Kubernetes Dashboard and Headlamp serve different roles in a cluster. Headlamp connects via kubeconfig, allowing for desktop or in-cluster usage, while the Kubernetes Dashboard is strictly in-cluster. This article breaks down the processes for migrating from Dashboard to Headlamp. It highlights key differences in user experience, installation methods, and permissions management. A pre-migration checklist ensures a smooth transition, emphasizing the importance of understanding RBAC rules. By suggesting rollout plans, it gives teams structure in their migration approach. Ultimately, Headlamp simplifies managing multiple clusters with its user-friendly interface. It caters to both individual and shared access needs. This guide demystifies what it takes to move from Dashboard to Headlamp, equipping users with the information they need for a successful shift.

Continue reading on kubernetes.io

#reading-list #tools #best-practice #devops #kubernetes

🔗 Markdown support coming in NetNewsWire

2026-08-06T08:00:00Z

NetNewsWire is about to embrace source:markdown elements in its next release. This move makes it the first mainstream RSS client to fully support Markdown. The integration allows WordLand-written WordPress posts, which already feature the necessary RSS feeds, to be published and rendered in Markdown. Users can simply log into WordLand and start creating content that will automatically be displayed in NetNewsWire via this format. A GitHub thread has been initiated to address any questions regarding this capability.

Continue reading on daveverse.org

#reading-list #tools #announcement

🔗 Introducing Mishka Chelekom v0.0.9

2026-08-05T17:00:00Z

Mishka Chelekom v0.0.9 revolutionizes how AI agents interact with Phoenix UI. This release adds a built-in MCP server, enabling AI to utilize your components accurately. In addition, it boasts over 35 new headless components that are unstyled yet fully accessible, allowing complete design customization without sacrificing functionality. The new Kit allows users to reuse and restyle components easily without altering original code, preserving project integrity. With a growing community behind it and over 55,000 downloads, this version solidifies Mishka Chelekom's position as a powerful tool for developers looking to integrate AI effectively into their Phoenix applications.

Continue reading on mishka.tools

#reading-list #ai #phoenix

🔗 Kubernetes architecture

2026-08-05T13:00:00Z

Kubernetes isn’t just another container orchestration tool; it’s an essential piece of cloud-native architecture that transformed how applications are managed. Neo Kim and Ayaan explain Kubernetes architecture, breaking down its components like the control plane and worker nodes. They illustrate how Kubernetes operates as a distributed system, ensuring applications stay available and resilient even as demands change. The authors emphasize the importance of concepts like desired state versus actual state, highlighting Kubernetes’ ability to self-heal and maintain the system’s equilibrium. This article not only provides a solid foundation for understanding how Kubernetes works but also makes a compelling case for why mastering its architecture is crucial for modern developers and architects.

Continue reading on newsletter.systemdesign.one

#reading-list #development #devops #kubernetes

🔗 Best and worst software projects: What developers really think

2026-08-05T08:00:00Z

AI significantly accelerates software delivery, but human decision-making remains crucial. Engineers recently discussed the role of AI in their projects, emphasizing its ability to enhance speed without replacing critical thinking and strategic choices. The insights reflect a balanced perspective on technology's place in development processes, highlighting the importance of creativity and judgment. In a rapidly evolving tech landscape, understanding the boundaries of AI's capabilities is essential for developers who aim to leverage it effectively while retaining control over their projects.

Continue reading on shiftmag.dev

#reading-list #development #best-practice #ai

🔗 Prefer strict tables in SQLite

2026-08-04T17:00:00Z

Strict tables in SQLite avoid datatype issues by enforcing rigid typing, preventing common mistakes like inserting text into integer columns. By appending STRICT to a table’s definition, users ensure that type mismatches are not allowed during inserts and updates. In contrast to non-strict tables, which permit any type in any column, strict tables help maintain data integrity and clarity. This article highlights the advantages and limitations of using strict tables, including better validation and avoiding creating columns with invalid types. While strict tables might introduce some performance considerations, the author argues that the benefits in data integrity far outweigh the potential drawbacks. The preference for strict tables is supported by examples and a discussion on SQLite's flexible typing.

Continue reading on evanhahn.com

#reading-list #database #best-practice #sqlite

🔗 Rewriting Bun in Rust

2026-08-04T13:00:00Z

Bun's evolution from Zig to Rust was not just a coding challenge; it aimed to resolve fundamental stability issues. The article details the ambitious journey of rewriting Bun's large codebase to enhance memory safety and eliminate bugs inherent in manual memory management. Originally a port from Go to Zig, the developer recognized weaknesses in Zig's handling of garbage-collected and manually-managed memory. By leveraging a new model from Anthropic, the team performed an efficient mechanical port to Rust, thus enabling safer code practices through Rust's strong type system and automatic memory management. The result? A more robust Bun, aiming for long-term stability and performance enhancement without sacrificing its original feature set. It's a case study in planning, execution, and leveraging AI in software development for increased reliability.

Continue reading on bun.com

#reading-list #rust #development #ai

🔗 Ever run into a PostgreSQL query that you can figure out what it does??

2026-08-04T08:00:00Z

Ever encountered an indecipherable PostgreSQL query that you still need to support? This article outlines how DBeaver's AI Assistant can demystify complex queries for users. With DBeaver 26.1.2, the AI Assistant analyzes queries and provides understandable explanations. The author illustrates this tool's efficacy using a sample query that identifies the top 10 most popular films by rental count and total revenue. From common table expressions (CTEs) to subqueries, the breakdown makes clear how the query's elements interact to produce results, highlighting the AI's utility when faced with obfuscated SQL. This guide empowers developers and database administrators to tackle intimidating SQL queries with confidence, showcasing an essential feature for anyone working with PostgreSQL.

Continue reading on stokerpostgresql.blogspot.com

#reading-list #database #ai #postgresql #sql

🐥 Adding 2FA to Phoenix LiveView with phx.gen.auth

2026-08-03T17:00:00Z

Two-factor authentication (2FA) is a great way to improve account security. This post walks through how to add TOTP-based 2FA to a Phoenix LiveView app using the built-in phx.gen.auth authentication system.

We’ll cover:

Adding required fields and dependencies
2FA setup flow using LiveView
TOTP challenge during login
LiveView-specific login handling

Add dependencies

Add the following libraries to mix.exs:

defp deps do
  [
    {:nimble_totp, "~> 1.0"},
    {:qr_code, "~> 2.2"}
  ]
end

Then run:

mix deps.get

Extend the user schema

Add two fields to your users table:

# priv/repo/migrations/*_add_totp_to_users.exs
alter table(:users) do
  add :totp_secret, :string
  add :totp_confirmed_at, :utc_datetime
end

Migrate:

mix ecto.migrate

In your user schema:

schema "users" do
  field :totp_secret, :string
  field :totp_confirmed_at, :utc_datetime
  # ...
end

Ensure your changeset/2 casts these fields:

def changeset(user, attrs) do
  user
  |> cast(attrs, [:email, :totp_secret, :totp_confirmed_at])
  |> validate_required([:email])
end

Add 2FA setup LiveView

Create a new LiveView at /settings/two_factor that generates a secret, renders a QR code, and lets the user enter their TOTP code.

defmodule MyAppWeb.TwoFactorSetupLive do
  use MyAppWeb, :live_view
  alias NimbleTOTP
  alias QRCode
  alias MyApp.Accounts

  def mount(_params, _session, socket) do
    user = socket.assigns.current_user

    if user.totp_secret do
      {:ok, assign(socket, setup?: false)}
    else
      secret = Base.encode32(NimbleTOTP.secret())
      uri = NimbleTOTP.otpauth_uri("MyApp:#{user.email}", Base.decode32!(secret), issuer: "MyApp")
      {:ok, png} = QRCode.create(uri, :png)
      b64 = Base.encode64(png)

      {:ok,
       assign(socket,
         setup?: true,
         secret: secret,
         qr_code: "data:image/png;base64,#{b64}",
         code: "",
         error: nil
       )}
    end
  end

  def handle_event("verify", %{"code" => code}, socket) do
    secret = Base.decode32!(socket.assigns.secret)

    if NimbleTOTP.valid?(secret, code) do
      {:ok, _} =
        Accounts.update_user(socket.assigns.current_user, %{
          totp_secret: socket.assigns.secret,
          totp_confirmed_at: DateTime.utc_now()
        })

      {:noreply,
       socket
       |> put_flash(:info, "2FA enabled.")
       |> push_redirect(to: "/settings")}
    else
      {:noreply, assign(socket, error: "Invalid code")}
    end
  end
end


<h1>Two-Factor Authenticationh1>

<%= if @setup? do %>
  <p>Scan this QR code in your authenticator app:p>
  <img src={@qr_code} />

  <form phx-submit="verify">
    <label>Code:label>
    <input type="text" name="code" />
    <button>Verifybutton>
  form>

  <%= if @error, do: content_tag(:p, @error, class: "text-red-500") %>
<% else %>
  <p>2FA is already enabled.p>
<% end %>

Add a TOTP challenge LiveView

When a user logs in with 2FA enabled, redirect them to a LiveView at /two_factor to enter their code.

defmodule MyAppWeb.TwoFactorChallengeLive do
  use MyAppWeb, :live_view
  alias MyApp.Accounts
  alias NimbleTOTP
  alias MyAppWeb.UserAuth

  def mount(_params, %{"pending_user_id" => id}, socket) do
    {:ok, assign(socket, user: Accounts.get_user!(id), code: "", error: nil)}
  end

  def handle_event("verify", %{"code" => code}, socket) do
    user = socket.assigns.user

    if NimbleTOTP.valid?(Base.decode32!(user.totp_secret), code) do
      {:noreply,
       socket
       |> put_flash(:info, "Logged in with 2FA.")
       |> UserAuth.log_in_user(user, %{})}
    else
      {:noreply, assign(socket, error: "Invalid code")}
    end
  end
end


<h1>Enter your 2FA codeh1>

<form phx-submit="verify">
  <input type="text" name="code" />
  <button>Verifybutton>
form>

<%= if @error, do: content_tag(:p, @error, class: "text-red-500") %>

Update login logic

After validating the user’s password (in your LiveView or controller), check if TOTP is enabled:

if user.totp_confirmed_at do
  socket
  |> Phoenix.LiveView.put_session(:pending_user_id, user.id)
  |> Phoenix.LiveView.redirect(to: "/two_factor")
else
  UserAuth.log_in_user(socket, user, %{})
end

In controllers, you’d use put_session(conn, ...) and redirect(conn, ...) instead.

Update `UserAuth` helper

Make sure your UserAuth module has a LiveView-compatible log_in_user/3:

def log_in_user(socket, user, _params \\ %{}) do
  token = MyApp.Accounts.generate_user_session_token(user)

  socket
  |> Phoenix.LiveView.put_session(:user_token, token)
  |> Phoenix.LiveView.redirect(to: "/")
end

Done

You now have a working TOTP 2FA flow in Phoenix LiveView:

Users opt in to 2FA in their settings
A QR code is shown and confirmed
2FA is required on next login
All handled with clean LiveView flows

From here, you can extend the system with:

Disabling 2FA
Backup codes
Remembering trusted devices

Let me know if you'd like a follow-up on any of those features.

#elixir #phoenix #auth

🔗 More shell patterns I use weekly

2026-08-03T13:00:00Z

This article shares useful Bash patterns and techniques that boost productivity for everyday tasks. The author highlights various methods like using sed and xargs for find-and-replace operations, employing while loops until success, and parallelizing commands with wait. The discussion emphasizes the importance of clean output and error handling, using temporary directories for logs with mktemp, and enhancing user legibility with color-coded output. The author also advocates for efficient file manipulation using shell constructs, recommending awk for filtering data instead of grep. These patterns, though simple, can significantly streamline workflows, especially for those working with commands regularly.

Continue reading on will-keleher.com

#reading-list #best-practice #terminal #linux

🔗 Why backlogs are harmful, why they never shrink, and what to do instead

2026-08-03T08:00:00Z

Backlogs never shrink, and their existence often leads to unproductive practices. When teams rely on them, they merely accumulate tasks that distract from prioritizing what truly matters. The article points out that important tasks rarely enter the backlog as teams instinctively know what needs immediate attention. This misalignment causes waste and elongates cycle times, as tasks languish unattended. A well-managed product team can avoid the pitfalls of backlogs by employing a high-level roadmap and maintaining close communication with engineers. In practice, this means regularly revisiting goals, effectively filtering bugs, and keeping the focus on immediate tasks. The author argues that instead of allowing unnecessary tasks to clutter workflows, it’s essential to be ruthless in prioritization and decision-making to enhance productivity and strategic alignment.

Continue reading on www.lucasfcosta.com

#reading-list #development #best-practice

🔗 The Laravel Scheduler Under the Hood

2026-08-02T17:00:00Z

Laravel's Scheduler features an API that simplifies task scheduling, but its underlying mechanics are crucial to understand. When cron triggers php artisan schedule:run, Laravel takes over to determine which events are due. This article dives deep into the Laravel Scheduler, explaining how it processes scheduled tasks, from command definitions to execution. It clarifies concepts like onOneServer() and withoutOverlapping(), which are essential for managing concurrent tasks. Readers learn how Laravel creates event objects from command definitions and how frequency methods adjust cron expressions. The article emphasizes the distinctions between the Scheduler and the Queue system, underpinning the operational design decisions that make task scheduling effective in production environments. Armed with this insight, Laravel developers can better leverage the Scheduler for reliable task execution.

Continue reading on wendelladriel.com

#reading-list #development #laravel #best-practice

🐥 YellowDuck.be

🔗 Top 10 backend frameworks for enterprise development in 2026

🔗 AI coding tip 027 - Force code standards

🔗 Jurassic Park computers in excruciating detail

🔗 Are we offloading too much of our thinking to AI?

🔗 Lobste.rs is now running on SQLite

🔗 I could've rickrolled the entire FIFA World Cup. All I needed was my ID.

🐥 Distributing a Go CLI via a Homebrew tap

What is a tap?

The formula

Building a universal macOS binary

The CDN URL strategy

Updating the formula

CI: validating formulas with brew test-bot

CI: Merging PRs with brew pr-pull

The user experience

Summary

🔗 How I use HTMX with Go

🔗 The strangest hobby at the table

🔗 Nginx vs Caddy vs Traefik in 2026 — I Ran All Three Under Real Production Load

🔗 How to hire engineers for strong judgment and taste

🔗 Why Pogačar rides on a car tire brand

🔗 Your Dropbox is now a skill server

🔗 Kubernetes Dashboard to Headlamp: A Step-by-Step Guide

🔗 Markdown support coming in NetNewsWire

🔗 Introducing Mishka Chelekom v0.0.9

🔗 Kubernetes architecture

🔗 Best and worst software projects: What developers really think

🔗 Prefer strict tables in SQLite

🔗 Rewriting Bun in Rust

🔗 Ever run into a PostgreSQL query that you can figure out what it does??

🐥 Adding 2FA to Phoenix LiveView with phx.gen.auth

Add dependencies

Extend the user schema

Add 2FA setup LiveView

Add a TOTP challenge LiveView

Update login logic

Update UserAuth helper

Done

🔗 More shell patterns I use weekly

🔗 Why backlogs are harmful, why they never shrink, and what to do instead

🔗 The Laravel Scheduler Under the Hood

CI: validating formulas with `brew test-bot`

CI: Merging PRs with `brew pr-pull`

Update `UserAuth` helper