My toddler is seriously so much fun! Been making music since I was a teen, still trying to learn to finish tracks.
Faris Chtatou
@farischt
Founder 
@keyrua
- @keyrua
- Paris
- keyrua.dev
- github.com/farischt
- Joined October 2026
Commit activity
109 commits in the last 30 days
longest streak 7 days
2,289 / 2,500 XP211 XP to root
Pinned
Sun, Nov 8
"The AI wrote it" is a strange defense for a bug. I still want to walk through the failure path. We own what happens when that code runs.
Exactly. Even if an LLM wrote part (or all) of the code, we are still 100% responsible for what we commit and merge.
If I make a typo due to auto-complete, that's still on me for not properly re-reading the message before I hit send.
If I copy/paste a code snippet from Stack…
Google Agent Registry's SUCCEEDED scan state can still include findings.
For a shared agency skill, review the exact revision and its findings alongside the access available in each client's runner. Enabling scanning does not rescan older revisions.
Guide and primary sources:…
keyrua.devGoogle Agent Registry: Check Findings Before Approving a SkillGoogle’s new skill scanning controls need a careful rollout. Read findings, check existing revisions and review the client access available when an agent runs.
Sat, Nov 7
chatgpt thinks, add ideas to git issues, ship and create new pr, test and merge all from phone.
I'm fine with duplicated code.
I'm less fine with a shared abstraction that needs six booleans and a séance to change.
Do these bits actually need to evolve together?
REX CVE-2026-122193 affects SSM documents created from a setup example. AWS recommends deleting affected copies in each account and Region.
An upstream guide change doesn't retire deployed resources or stop an old setup script recreating them. Track provenance and callers;…
keyrua.devREX CVE-2026-122193: Find the SSM Documents Your Setup Guide CreatedAWS’s November 6 REX advisory concerns SSM documents created from a setup example. A practical agency guide to finding copies, retiring affected infrastructure and reviewing credential exposure.
Sun, Nov 1
Fri, Oct 30
if you remove all the human features (structure, type system, garbage collection, etc) don't you end up with machine code?
Thu, Oct 29
Example: commit A adds a password, B removes it. Pushing A+B still includes A. Repair every affected unpublished commit; revoke the credential at its issuer if it was exposed elsewhere.
GitHub's Oct 28 AI push-protection preview is opt-in and uses AI credits. Eligibility…
keyrua.devGitHub’s AI Push Protection: An Agency Rollout ChecklistGitHub’s October 28 preview can block unstructured secrets using code context. An agency guide to rollout costs, blocked commits and credential handling.
Mon, Oct 26
Deleting a leaked key from Git doesn’t disable it.
LiteLLM’s October 23 incident report says a key exposed in May remained valid after the commit was rewritten. For agencies managing several client projects, the hard part is tracing where each credential is used: API services,…
keyrua.devLiteLLM’s Supply Chain Attack: What Agencies Should RotateLiteLLM’s October 2026 report traces a malicious release to a leaked key that stayed valid. A practical revocation and recovery guide for software agencies.
and on github the old commit is still reachable by its sha after the force push, forks share the same objects. git doesn't forget, it just stops showing you lol
A request timing out doesn't mean the server stopped working. That makes the retry button a little more interesting when the request creates something.
I was supposed to receive mine, but apparently the wire had a request timeout...
my $salary is just lazy loaded 😅
Ok time to be honest guys. Are you a
- PHP dev81%, 39 votes
- non-PHP dev19%, 9 votes
48 votesFinal results
if i’m writing code, i will prototype in php 90% of the time. the other 10% is typescript. this code doesn’t always see the light of day.
if an agent is writing the code, i will typically have it write typescript or rust.
I mean, I started with integer BASIC and microassembly on the 6502 as a kid. I did C, Pascal, LOGO, Modula-2, Ada, lots of Lisp, C++, D, FalconPL, Perl, and lots of assembly and scripting languages before I got to PHP. And lots since then. Pretty sure nobody should ever know…
Well, I am a "use the right tool for the job" developer, PHP just happens to be prob my favorite language despite its quirks.
Sun, Oct 25
For people who contribute to open source: what was harder than the code itself?
Understanding the project, reproducing a bug, getting the tests running, something else?
Understanding the project, in some cases setting up the dev environment, and also understanding what kind of PRs would be welcomed without prior discussion
PHP is the only language where the dollar sign is mandatory but the salary isn't.
A short intro, what you can expect from me, what I expect from others:
mine is here:
https://risadams.com/about
Ris AdamsRis AdamsSoftware engineer, Scrum Master, dad, and person who thinks a lot about how we work and why it matters.
Show threadA quick one-line pitch, three lines of copy-pasteable curl setup, and a massive Troubleshooting section covering all the weird production edge cases.
basics: tldr, quickstart, where to find more details, license. tailor to human users. focus machine/agent info in AGENTS.md
Sat, Oct 24
I wrote a guide to the October PHP and Node.js security updates for teams maintaining client applications.
It covers patched versions, PHP’s October 23 session follow-up, and checking the runtime actually serving requests, including staging and background workers.
For Node’s…
keyrua.devPHP and Node.js CVEs: What Software Agencies Need to Patch NowA practical guide to the October 2026 PHP and Node.js security updates: affected versions, PHP's follow-up advisory, deployment checks, and secret exposure.