Home on Omid Farhang

App credentials are site-wide, but refresh tokens are not shared in .env.

Passkeys and authenticator apps in plain PHP: relying-party identity, session ceremonies, trusted-device cookies, recovery codes, and an explicit CLI exception.

The hard part of hosting yt-dlp is not the CLI call—it is Deno in the image, cookie handling, path confinement, and owning the operational risk.

On Apache, background exec() children often die with the request.

A reusable method for checking a product's purpose, evidence, dose, quality, interactions, and duplicate ingredients before deciding whether to use it.

A practical way to choose between monitoring, supportive care, medication, and medical help—and to know when the plan should change.

A practical framework for evaluating treatment decisions, based on what I got wrong about colds, antibiotics, probiotics, and familiar remedies.

Update every installed Node major via nvm, refresh global npm packages, upgrade npm, and enable corepack.

Install or update Cursor IDE from the official stable AppImage API on Linux — skip download when already current, force reinstall, or uninstall cleanly.

Live companion demos and interactive labs for omid.dev articles — open a working example in the browser, then read the post for the full walkthrough.

The real developer-AI upgrade isn't a smarter model.

Cheap generation gets you a demo.

Router Resources (Angular 22.2, developer preview) load independent route data as a parallel resource graph.

Open the research repo as an Obsidian vault if you want links and a graph.

The skill list did not get a new bubble called AI.

Ethernet does not stretch across hosts by itself.

How I interview frontend candidates for a team that is not mine — intake with their lead, choosing the real level, and why I now weigh architecture, ownership, and AI judgment over syntax recall.

Isolate network stacks with netns, connect them with veth, and choose bridge vs macvlan vs ipvlan — the kernel primitives containers reuse.

Linux leaves the bridge domain: IP forwarding, policy routing for two uplinks, and nftables input vs forward.

Long-form research does not fit in one ChatGPT conversation.

On an Intel + NVIDIA hybrid laptop, native HDMI can keep the dGPU in the display path.

Cross-team trust is a career asset.

Do not punish cross-team friendliness.

On a small development team, the senior who talks to other teams may be the most valuable person in the room—until influence becomes unofficial ownership.

The browser is untrusted, but the system that builds and delivers the frontend is not.

Arch Linux froze all AUR writes after a third supply-chain attack wave, then restored pushes and adoption on August 11 with review gates.

“Get up and fight!

Build a reproducible Linux command-line workspace with portable dotfiles, terminal, shell, multiplexer, SSH, and editor layers that remain maintainable across machines.

Stop storing JWTs in localStorage.

Browser frameworks still own sanitization, request protection, and SSR isolation.

Security for Angular Progressive Web Apps: HTTPS and service worker scope, cache strategies that do not leak auth-dependent data, and offline sessions without raising XSS or CSRF risk.

Build an SBOM and CI security pipeline for Angular monorepos: npm audit, ng update --dry-run, fail on high-severity CVEs, Dependabot/Snyk, and post summaries to Slack or Mastodon.

Ship CSP for Angular without breaking the build: report-only first, nonces via autoCsp or ngCspNonce, nginx/Apache/Cloudflare headers, and a small scanner for inline handlers, eval, and other footguns.

TypeScript 7's native port delivers dramatic build-time speedups, but editor plugins, framework tooling, and monorepo workflows are catching up at different speeds.

A list of the hardware, software, and tools I use on a daily basis.