我正在寻找 DevRel 工作机会
Olaf Alders 公开寻求 DevRel（开发者关系）全职或兼职工作。他利用 AI 优化了简历，并强调自己作为开发者在开源社区和 Perl/Raku 基金会筹款工作中的布道经验。文章附带简历 PDF 下载链接及联系方式，提供战略咨询、部分时间工作或捐赠支持。 
评论
点赞
收藏如何废弃一个 CPAN 模块
Perl 社区因 CPAN 安全组获得资助，正在批量处理 CVE。对于不再维护但有安全问题的模块，除了上传新版本标记为废弃，还可以直接在 PAUSE 上申请移交他人接管。文章梳理了这两种处理路径及历史原因导致的操作逻辑。 
Claude Code 误功能解剖：一次静默上线与快速回滚的工程事故
markdownlint-disable MD003 MD033 MD046 markdownlint-disable-line “ 机械蛋钟 “由……” 赫斯特韦特 受许可协议约束。 署名-相同方式共享 3.0. 采用更宽的框架进行加固；这一适配同样采用 CC BY-SA 3.0 的许可协议。 在2026年7月1日加拿大国庆日，Anthropic 向 Claude Code 的用户发送了一则...
Claude 代码的隐藏攻击面：.claude 目录的安全陷阱
Claude Code 在克隆仓库时默认信任该文件夹，且这种信任是持久的。如果仓库包含恶意的.claude/hooks 配置（如自动执行 curl 命令），即使用户首次确认信任，后续所有提交中的恶意钩子都会静默运行，无需再次授权。这揭示了 AI 编程助手在沙箱权限管理上的一个潜在安全漏洞，特别是当网络出口和执行权限未严格限制时。
保持本地化：默认绑定 localhost 的安全实践
分享开发个人工具时默认绑定 localhost 而非 0.0.0.0 的安全实践。通过 Tailscale 实现私有网络访问，避免意外暴露服务导致.env 密钥泄露。强调“默认最小权限”原则，适合关注工程安全和开发体验的技术读者。
把 GitHub Issue 当作不可信输入
将 GitHub Issue 作为 LLM Agent 指令源存在严重安全风险。文章演示了如何通过隐藏字符、折叠区块或社会工程学手段注入恶意 Prompt 甚至 Shell 命令。建议将 Issue 文本视为数据而非指令，严格沙箱隔离，并避免直接将用户输入拼接进 Shell 命令。
驾驭Claude：打造专属Agent监控仪表盘
开发者Olaf Alders分享了他利用Claude Code快速构建个人版Agent仪表盘Clodhopper的过程。针对特定工作流（git worktree, tmux）和供应链安全顾虑，他通过LLM辅助开发实现了私有化监控，解决了多会话状态追踪痛点。项目已开源，提供了从安装到集成Hooks的完整CLI操作指南，适合希望定制AI开发辅助工具的工程技术人员参考。
What the Duck Is Up with Trail Running?
I’m trying to add as many races as possible to My Mind is Racing and the trail and ultra races have pretty consistently stood out as cleverly named. There’s a lot of wordplay and a lot of dark humour.... 
Better Bots via Hooks
It can be tedious trying to get your bot to do exactly what you want to do, but it’s not always necessary. If there are hard conventions that you need to enforce (like tidying, not committing certain ...
Claude Will Find a Way
" bullet hole in mirror " by Jo Naylor is licensed under CC BY 2.0. For the last month or so I’ve been using Nono almost exclusively to sandbox my Claude Code agents. It works well, particularly in bl... 
AI Shoulder Surf V3
What follows is an AI summary of our meeting. The target audience is mostly the folks who were on the call, but I’ll be happy if anyone else gets something out of it. On Thursday, May 28, 2026 we had ... 
On Writing and Failure
" Fountain pen " by matsuyuki is licensed under CC BY-SA 2.0. Failure is the body of a writer’s life. Success is only ever an attire. A paradox defines this business: The public only sees writers in t... 
No Inhibitions
Image via Steve Magness. When I was in university, I started playing in a band with a singer who also did improv comedy. That guy could just let go, no inhibitions. Forgot the lyrics? Not a problem, h...
Enabling Private Vulnerability Reporting
With the rise of LLM usage, the number of vulnerabilities being found in Open Source Software libraries is climbing – perhaps more than you might think. Finding vulnerabilities is getting easier, but ...
The Great Perl Toolchain Summit CLI Throwdown 2026
Last year a few of us at the Perl Toolchain Summit got together to trade command-line tips. I wrote up the notes. This year there was some demand for a repeat, so we continued the tradition. Hopefully... 
AI Shoulder Surf V2
Back on April 1, 2026 we had our second AI Shoulder Surf. I wrote up the first of these sessions last time around. It’s basically an informal Zoom call where we share screens, talk about what we’re wo... 
Cooldowns and Dependabot Tuning
"Iceberg" by longhorndave is licensed under CC BY 2.0. Dependabot’s defaults can make it look like an agent of chaos. There are a couple of things you can do to turn down the churn from 11. package ma...
AI Shoulder Surf V1
A while back I thought of having some regular office hours so that I could share my screen with some friends and we could just talk about what we are learning and working on. I think office hours are ...
Can Others Explain My Work Without Me?
I’ve recently found the time to revisit a passion project. The app has a number of moving parts and I was struggling to distill it down to an elevator pitch. I’m not actually pitching anything to anyo...