The scenario is painfully familiar: your API requests work perfectly on localhost with hardcoded credentials. Then you need to test in staging. Suddenly, you're manually updating base URLs, swapping API keys, and modifying authorization headers across dozens of requests. Hours disappear into repetitive configuration changes.

When sharing your collection with teammates, you resort to sending credentials through Slack DMs with instructions to "replace these values with your own." Your sensitive keys scatter across chat histories, creating security vulnerabilities that keep you awake at night.

This broken workflow isn't just frustrating—it's actively sabotaging your productivity and security posture.

The solution? Mastering environment and secret management transforms amateur API workflows into professional, secure operations. And you don't need multiple tools to achieve this transformation.

<h2>
 
 
 Why Environment and Secret Management Drives Productivity
</h2>

The hidden costs of poor environment management compound quickly:

<ul>
<li>Configuration Inconsistency: The classic "works on my machine" problem stems from environment mismatches. Local development uses one configuration set, staging another, production a third. Without systematic management, bugs and misconfigurations become inevitable.</li>
<li>Security Vulnerabilities: Hardcoded credentials in requests create massive security risks. Sharing collections means sharing credentials. One leaked file compromises entire services.</li>
<li>Time Drain: Manually updating URLs, keys, and tokens across request collections wastes hours that should fuel innovation and development.</li>
<li>Onboarding Friction: New team members face cryptic README files and credential treasure hunts. If setup takes hours instead of minutes, your process needs fixing.</li>
</ul>

Proper environment and secret management isn't optional — it's foundational to secure, collaborative API development.

<h2>
 
 
 Apidog: The Ultimate API Client for Environment Management
</h2>

<a href="https://apidog.com/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret">Apidog</a> delivers comprehensive API development capabilities with powerful environment and secret management at its core. The platform eliminates hardcoded values, scattered credentials, and manual configuration updates that plague traditional approaches.

Two pillars support Apidog's approach:

<ol>
<li>
Environment Management: Centralized configuration control across all development stages</li>
<li>
Vault Secrets Integration: Enterprise-grade external vault connectivity for maximum security</li>
</ol>

<h2>
 
 
 Building Your Environment Infrastructure
</h2>

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fj3j49faf1m791r47hem9.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fj3j49faf1m791r47hem9.png" alt="environment management panel in Apidog" width="800" height="442"></a>

Environments in Apidog function as configuration contexts—organized sets of key-value pairs that define how your APIs behave in different scenarios. Create environments for local development, staging, production, or specific testing scenarios.

<h3>
 
 
 Creating Environment Structures
</h3>

Access the <a href="https://docs.apidog.com/environment-management-584758m0/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret">environment management section</a> within your Apidog project. Create new environments with descriptive names that clearly indicate their purpose.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6wwnvvet1gv1eeap7ai4.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6wwnvvet1gv1eeap7ai4.png" alt="environment management entry" width="800" height="480"></a>

Common environment setup:

<ul>
<li>
<code>Local Dev</code>: <code>http://localhost:8080</code>
</li>
<li>
<code>Staging</code>: <code>https://api-staging.yourcompany.com</code>
</li>
<li>
<code>Production</code>: <code>https://api.yourcompany.com</code>
</li>
</ul>

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6m2o7t2aqkrzmyjusp1v.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6m2o7t2aqkrzmyjusp1v.png" alt="creating different environments" width="800" height="445"></a>

<h3>
 
 
 Populating Environment Variables
</h3>

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fneaoxd0ugzemy651g7g3.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fneaoxd0ugzemy651g7g3.png" alt="defining variables within an environment" width="800" height="445"></a>

Each environment contains variables representing dynamic data that changes between contexts:

<ul>
<li>
<code>base_url</code>: API endpoint addresses</li>
<li>
<code>api_key</code>: Authentication keys</li>
<li>
<code>access_token</code>: JWT or OAuth tokens</li>
<li>
<code>user_id</code>: Test user identifiers</li>
</ul>

<h3>
 
 
 Implementing Variables in Requests
</h3>

Apidog uses <code>{{variable_name}}</code> syntax for variable references. Insert variables anywhere:

<ul>
<li>
Headers: <code>Authorization: Bearer {{access_token}}</code>
</li>
<li>
Query Parameters: <code>?user_id={{user_id}}</code>
</li>
<li>
Request Bodies: Both raw and form-data formats</li>
</ul>

Switching environments updates all variable references instantly. One dropdown selection changes every request in your collection to use the appropriate configuration.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Ftl18o9bwhjzd9p3fgxlo.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Ftl18o9bwhjzd9p3fgxlo.png" alt="switching environments to get actual variable values" width="800" height="476"></a>

<h3>
 
 
 Enabling Team Collaboration
</h3>

Environment sharing amplifies productivity across teams. Mark environments as <code>Shared</code> to grant team-wide access.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F4ttoqovuil7x5tbnglk5.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F4ttoqovuil7x5tbnglk5.png" alt="setting the environment as " width="800" height="440"></a>

Collaboration benefits:

<ul>
<li>
Unified Configuration: Teams use identical staging setups, eliminating confusion</li>
<li>
Automatic Updates: One person updates shared variables; everyone receives changes instantly</li>
<li>
Access Control: Administrators manage viewing and editing permissions</li>
</ul>

<h2>
 
 
 Enterprise Vault Integration for Maximum Security
</h2>

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fbx3sf80zl2k9qsdkgdx0.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fbx3sf80zl2k9qsdkgdx0.png" alt="vault secrets in Apidog" width="800" height="442"></a>

Environment variables provide efficiency but remain visible to users with environment access. Ultra-sensitive credentials—production API keys, master tokens, database passwords—require enhanced security.

<a href="https://docs.apidog.com/vault-secret-in-apidog-778134m0/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret">Apidog's Vault Secrets feature</a> integrates with enterprise vault providers, ensuring credentials never leave your secure infrastructure:

<ul>
<li>
<a href="https://docs.apidog.com/hashicorp-vault-780714m0" rel="noopener noreferrer">HashiCorp Vault</a> (Community and Cloud editions/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret)</li>
<li><a href="https://docs.apidog.com/azure-key-vault-781845m0/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret">Azure Key Vault</a></li>
<li><a href="https://docs.apidog.com/aws-secrets-manager-781902m0/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret">AWS Secrets Manager</a></li>
</ul>

<h3>
 
 
 Vault Integration Workflow
</h3>

1. Configure Vault Provider

Administrators establish vault connections at team or project level—a one-time setup linking Apidog to your vault infrastructure.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fnqy44hw8q5tmoqa9k526.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fnqy44hw8q5tmoqa9k526.png" alt="Configure Vault Provider" width="800" height="521"></a>

2. Link Secrets

Users provide metadata (engine, path, key) pointing to vault-stored secrets. Example: linking <code>prod_payment_gateway_key</code> from HashiCorp Vault.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fkgb3mxue0gi5vdjwbcnm.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fkgb3mxue0gi5vdjwbcnm.png" alt="Link Secrets" width="800" height="521"></a>

3. Fetch and Encrypt Locally

Clicking "Fetch Secrets" retrieves values and encrypts them locally on your client. Secrets never upload to Apidog servers or share with teammates.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fpee47inhg6g2ikvwri63.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fpee47inhg6g2ikvwri63.png" alt="Fetch Secrets and Encrypt Locally" width="800" height="521"></a>

4. Use in Requests

Reference secrets via <code>{{vault:key}}</code> syntax anywhere variables work. In scripts, use <code>await pm.vault.get("key")</code> for secure access.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F5qbr1ub0efv6iinie30p.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F5qbr1ub0efv6iinie30p.png" alt="use vault secrets in requests" width="800" height="521"></a>

<h3>
 
 
 Security Architecture Advantages
</h3>

Vault-Resident Secrets: Actual values remain in your organization's vault infrastructure (HashiCorp, Azure, AWS)—never on Apidog servers.

Local-Only Encryption: Fetched secrets encrypt and store exclusively on individual clients.

Authentication Requirements: Users authenticate with vault providers (OAuth2.0, access tokens) for proper access control.

Automatic Masking: Console logs automatically mask secret values, preventing accidental exposure.

Collaborative Privacy: Teams share variable names and metadata while maintaining individual secret access through personal authentication.

<h2>
 
 
 Conclusion: Professional API Development Starts Here
</h2>

API developer evolution follows tool adoption. Moving from hardcoded values to dynamic, variable-driven systems represents a productivity quantum leap. Securing secrets through enterprise vault integration separates good workflows from enterprise-ready excellence.

<a href="https://apidog.com/?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret">Apidog</a> delivers comprehensive capabilities in one cohesive platform. It recognizes that environments, variables, and secrets aren't isolated features—they're interconnected components of professional API workflows. By unifying them with focus on usability and enterprise security, Apidog doesn't just test APIs—it builds robust, scalable, collaborative API practices.

Stop copying API keys. Stop worrying about collection sharing. Embrace tools designed for modern team workflows with security infrastructure your organization trusts.

<a href="https://app.apidog.com/user/login?utm_source=dev.to&amp;utm_medium=wanda&amp;utm_content=api-client-environment-secret" class="ltag_cta ltag_cta--branded">Try Apidog Now</a>

تم تقديم عميل API جديد يبسط إدارة البيئات والأسرار، مما يعالج الإحباطات الشائعة التي يواجهها المطورون عند الانتقال من الاختبار المحلي إلى بيئات staging. هذه الأداة تقضي على العملية المملة لتحديث بيانات الاعتماد والتكوينات يدويًا، مما يسمح للفرق بالتعاون بشكل أكثر كفاءة دون مخاطر مشاركة المعلومات الحساسة عبر قنوات غير آمنة. من خلال تبسيط هذه العمليات، يمكن للمطورين توفير الوقت والتركيز على بناء تطبيقات أفضل.

Se ha presentado un nuevo cliente API que simplifica la gestión de entornos y secretos, abordando las frustraciones comunes que enfrentan los desarrolladores al pasar de pruebas locales a entornos de staging. Esta herramienta elimina el tedioso proceso de actualizar manualmente credenciales y configuraciones, permitiendo a los equipos colaborar de manera más eficiente sin el riesgo de compartir información sensible a través de canales inseguros. Al optimizar estos procesos, los desarrolladores pueden ahorrar tiempo y centrarse en construir mejores aplicaciones.

Un nouveau client API a été introduit pour simplifier la gestion des environnements et des secrets, répondant aux frustrations courantes des développeurs lors de la transition des tests locaux aux environnements de staging. Cet outil élimine le processus fastidieux de mise à jour manuelle des identifiants et des configurations, permettant aux équipes de collaborer plus efficacement sans risquer de partager des informations sensibles par des canaux non sécurisés. En rationalisant ces processus, les développeurs peuvent gagner du temps et se concentrer sur la création de meilleures applications.

A new API client has been introduced that simplifies environment and secret management, addressing common frustrations developers face when transitioning from local testing to staging environments. This tool eliminates the tedious process of manually updating credentials and configurations, allowing teams to collaborate more efficiently without the risk of sharing sensitive information through insecure channels. By streamlining these processes, developers can save time and focus on building better applications.

Here is the API Client with Environment and Secret Management Capability

&nbsp;As US educators embrace AI in the classroom, firms are selling software to flag mentions of self-harm, raising concerns over privacy and control.

مع تزايد استخدام تقنية الذكاء الاصطناعي في الفصول الدراسية في الولايات المتحدة، بدأ المعلمون في استخدام الدردشة الآلية لمراقبة رفاهية الطلاب. بينما يمكن أن تساعد هذه الأدوات في تحديد علامات السلوكيات الذاتية الضارة، فإنها تثير أيضًا مخاوف كبيرة بشأن الخصوصية ومدى المراقبة في البيئات التعليمية. قد يؤثر هذا التحول نحو المراقبة المستمرة على ثقة الطلاب وحريتهم، مما يجعله قضية حاسمة للآباء والمعلمين على حد سواء.

A medida que la tecnología de IA se vuelve más común en las aulas de EE. UU., los educadores están utilizando cada vez más chatbots para monitorear el bienestar de los estudiantes. Si bien estas herramientas pueden ayudar a identificar signos de autolesionismo, también plantean preocupaciones significativas sobre la privacidad y el alcance de la vigilancia en los entornos educativos. Este cambio hacia la vigilancia constante podría afectar la confianza y la libertad de los estudiantes, convirtiéndolo en un tema crítico para padres y educadores.

Alors que la technologie de l'IA devient de plus en plus courante dans les salles de classe aux États-Unis, les éducateurs utilisent de plus en plus des chatbots pour surveiller le bien-être des élèves. Bien que ces outils puissent aider à identifier des signes de comportements autodestructeurs, ils soulèvent également d'importantes préoccupations concernant la vie privée et l'étendue de la surveillance dans les établissements éducatifs. Ce passage vers une surveillance constante pourrait affecter la confiance et la liberté des élèves, ce qui en fait un enjeu crucial pour les parents et les éducateurs.

As AI technology becomes more prevalent in classrooms across the US, educators are increasingly using chatbots to monitor student well-being. While these tools can help identify signs of self-harm, they also raise significant concerns about privacy and the extent of surveillance in educational settings. This shift towards constant monitoring could impact students' trust and freedom, making it a critical issue for parents and educators alike.

Chatbots Are Sparking a New Era of Student Surveillance

The TRADE sits down with Nicholas Phillips, market structure research analyst at Bloomberg Intelligence (BI), following the publication of BI's 'European institutional equity trading study 2025’ report, to explore Europe’s renewed trading momentum, what to look out for in 2026, and the continued developments in post-trade, dark trading caps, rising bilateral, and more.
The post <a href="https://www.thetradenews.com/fireside-friday-with-bloomberg-intelligences-nicholas-phillips/">Fireside Friday with… Bloomberg Intelligence’s Nicholas Phillips</a> appeared first on <a href="https://www.thetradenews.com">The TRADE</a>.

في مناقشة حديثة، شارك نيكولاس فيليبس من بلومبرغ إنتليجنس رؤى حول نتائج تقريرهم 'دراسة تداول الأسهم المؤسسية الأوروبية 2025'. وأبرز انتعاش نشاط التداول في أوروبا وما يمكن توقعه في عام 2026، بما في ذلك التقدم في عمليات ما بعد التداول وتنظيمات التداول المظلم. هذه المحادثة مهمة لأنها تسلط الضوء على المشهد المتطور لتداول الأسهم، وهو أمر حاسم للمستثمرين والمشاركين في السوق الذين يسعون للتنقل في تعقيدات السوق الأوروبية.

En una reciente discusión, Nicholas Phillips de Bloomberg Intelligence compartió información sobre los hallazgos de su informe 'European institutional equity trading study 2025'. Destacó el resurgimiento de la actividad de trading en Europa y las tendencias que se anticipan para 2026, incluyendo avances en los procesos post-negociación y regulaciones sobre trading oscuro. Esta conversación es significativa ya que arroja luz sobre el paisaje en evolución del trading de acciones, lo cual es crucial para los inversores y participantes del mercado que buscan navegar por las complejidades del mercado europeo.

Lors d'une récente discussion, Nicholas Phillips de Bloomberg Intelligence a partagé des informations sur les résultats de leur rapport 'European institutional equity trading study 2025'. Il a souligné la résurgence de l'activité de trading en Europe et les tendances à anticiper en 2026, y compris les avancées dans les processus post-négociation et les réglementations sur le trading obscur. Cette conversation est importante car elle éclaire l'évolution du paysage du trading d'actions, ce qui est crucial pour les investisseurs et les acteurs du marché cherchant à naviguer dans les complexités du marché européen.

In a recent discussion, Nicholas Phillips from Bloomberg Intelligence shared insights on the findings of their 'European institutional equity trading study 2025' report. He highlighted the resurgence of trading activity in Europe and what trends to anticipate in 2026, including advancements in post-trade processes and dark trading regulations. This conversation is significant as it sheds light on the evolving landscape of equity trading, which is crucial for investors and market participants looking to navigate the complexities of the European market.

Fireside Friday with… Bloomberg Intelligence’s Nicholas Phillips

Hi there. In this article, I'll be going over the process of how you can create a macOS 26 Tahoe USB bootable installation drive.

<h2>
 
 
 YouTube Video
</h2>

If you would prefer to see a video of this article, there is a video version available on YouTube below:

<iframe width="710" height="399" src="https://www.youtube.com/embed/BBiWy6FrtM4">
</iframe>


<h2>
 
 
 Requirements
</h2>

To do this, you'll need macOS 10.15 or above (I used macOS 15) and a 32GB USB stick or higher to create the installation drive.

Before you start, make sure to backup any data that is on the USB stick as the USB stick will be erased as part of the process.

<h2>
 
 
 Downloading the macOS 26 Tahoe Installer
</h2>

Unlike previous versions of macOS, macOS 26 Tahoe is not available in the App store. It can only be downloaded via the command line for the full version that is used to create an installation disk.

To begin with, you'll need to open the terminal application. To this, use spotlight by pressing command and space together. Then, type terminal and hover over to the terminal application. It looks like a black box with a white arrow. Left click on it to open the application.

Your terminal may look different to mine but don't worry.

You can also get to it by opening a Finder window, going to Applications, then Utilities and then double clicking on Terminal.

First, you need to determine what the latest version of Tahoe is. There are two ways to do this. First, you can use this <a href="">webpage</a>, which shows it is being 26.1 at the time of writing this article.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F7p6roxf0ufy5frukae2c.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F7p6roxf0ufy5frukae2c.png" alt="Image 1" width="800" height="354"></a>

The second method is to run the following command in the terminal: 


<div class="highlight js-code-highlight">
<pre class="highlight shell"><code>softwareupdate --list-full-installers
</code></pre>

</div>



The latest version is at the top, which again is 26.1.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fcogm6l42kciu08k750nl.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fcogm6l42kciu08k750nl.png" alt="Image 2" width="800" height="461"></a>

The next step is to download the installer for macOS 26.1. To do that, run the following command. If a newer version is available, replace <code>26.1</code> with that version, if you want to: 


<div class="highlight js-code-highlight">
<pre class="highlight shell"><code>softwareupdate --fetch-full-installer --full-installer-version 26.1
</code></pre>

</div>



It will now download the installer. This will take some time.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Ffqmovocs202pw2bwdjib.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Ffqmovocs202pw2bwdjib.png" alt="Image 3" width="800" height="462"></a>

<h2>
 
 
 Creating the USB Installation Drive
</h2>

Now that the installer has finished downloading, you should be able to see it in the Applications folder in Finder.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F9gkffyhw77ufowhtpd54.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F9gkffyhw77ufowhtpd54.png" alt="Image 4" width="800" height="495"></a>

The next step is to make the USB installation drive. First, make sure your USB stick is connected to your Mac.

Mine is connected and it's called usbstick.

I would recommend renaming your USB stick to a name that has no spaces to make it easier.

Once again, remember to backup anything that is on the USB stick that you want to keep.

When you are ready, run the following command in the terminal. Replace <code>usbstick</code> with the name of your USB stick. 


<div class="highlight js-code-highlight">
<pre class="highlight shell"><code>sudo /Applications/Install\ macOS\ Tahoe.app/Contents/Resources/createinstallmedia --volume /Volumes/usbstick
</code></pre>

</div>



Press enter and then type in your password, or the username and password for an administrator account if your account doesn't have that level of permission.

When it asks you to confirm the USB stick can be erased, press <code>y</code> and then enter.

Your USB stick will disappear from Finder and then come back with the name of Install macOS Tahoe. This is normal.

The progress will be shown on the screen.

Once it has completed, the terminal will look like the below image.

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Ff69snvwmd4xsra2ugsos.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Ff69snvwmd4xsra2ugsos.png" alt="Image 5" width="800" height="462"></a>

You can now use that to boot from and install, or reinstall macOS 26 Tahoe on a <a href="">supported Mac</a>.

Thanks for reading and have a nice day!

يوفر هذا المقال دليلًا بسيطًا حول كيفية إنشاء محرك USB قابل للتشغيل لتثبيت macOS 26 Tahoe، مما يسهل على المستخدمين تثبيت أو ترقية نظام التشغيل. مع تعليمات واضحة وتوافر فيديو تعليمي على يوتيوب، يلبي احتياجات المتعلمين البصريين وأولئك الذين يفضلون الإرشادات المكتوبة. هذا مهم بشكل خاص لأن وجود محرك قابل للتشغيل يمكن أن يبسط عملية استكشاف الأخطاء وإصلاحها واستعادة النظام، مما يضمن أن المستخدمين يمكنهم الحفاظ على أجهزتهم بفعالية.

Este artículo ofrece una guía sencilla sobre cómo crear una unidad USB de instalación de macOS 26 Tahoe, facilitando la instalación o actualización del sistema operativo. Con instrucciones claras y un tutorial en video disponible en YouTube, se adapta tanto a los aprendices visuales como a aquellos que prefieren la orientación escrita. Esto es especialmente importante, ya que tener una unidad de arranque puede simplificar la solución de problemas y la recuperación del sistema, asegurando que los usuarios puedan mantener sus dispositivos de manera efectiva.

Cet article propose un guide simple pour créer un lecteur USB d'installation bootable macOS 26 Tahoe, facilitant ainsi l'installation ou la mise à niveau du système d'exploitation. Avec des instructions claires et un tutoriel vidéo disponible sur YouTube, il s'adresse à la fois aux apprenants visuels et à ceux qui préfèrent les conseils écrits. Cela est particulièrement important car avoir un lecteur bootable peut simplifier le dépannage et la récupération du système, garantissant que les utilisateurs peuvent maintenir efficacement leurs appareils.

This article provides a straightforward guide on creating a macOS 26 Tahoe USB bootable installation drive, making it easier for users to install or upgrade their operating system. With clear instructions and a video tutorial available on YouTube, it caters to both visual learners and those who prefer written guidance. This is particularly important as having a bootable drive can simplify troubleshooting and system recovery, ensuring that users can maintain their devices effectively.

How To Create A macOS 26 Tahoe USB Installation Drive

You don’t need to shout to be heard; you need to be clear and verifiable. Teams that treat publishing like a product discipline consistently outperform those chasing hacks. That’s why many engineering leaders pair solid writing with measurable distribution and—only where it helps—specialist partners offering <a href="https://techwavespr.com/services/" rel="noopener noreferrer">digital marketing services</a> to keep the pipeline of attention honest and repeatable. This piece distills a pragmatic framework for content that survives scrutiny and compounds over time.

<h2>
 
 
 The Operating Model: From “Post and Pray” to Repeatable Pipelines
</h2>

Great articles don’t appear out of nowhere—they move through a pipeline with explicit gates. Think of it as CI/CD for ideas:

<ul>
<li>Discovery → Drafting → Review → Publish → Observe.</li>
</ul>

At each stage, you’re validating something different: whether the topic matters, whether the draft is clear, whether claims are supported, whether the page renders fast and clean, and how readers actually engage. This isn’t bureaucracy; it’s how you protect your future self from firefighting.

Discovery is about narrowing to problems your readers already feel. The fastest test is to write the problem in one sentence and ask a skeptical colleague if it describes a real moment they’ve lived. If they hesitate, refine until they can retell it in their words.

Drafting prioritizes specificity. Replace abstractions with measurements (“p95 latency dropped from 480 ms to 160 ms”) and name the trade-offs. Engineers recognize truth in constraints. Avoid performative flourishes; ship facts.

Review is a multidisciplinary check: technical accuracy, legal and privacy considerations, and plain-language clarity. The review should be adversarial but bounded—identify a small set of non-negotiables (e.g., security statements must be vetted; benchmarks must be reproducible). Everything else is style, not a blocker.

Publish with a minimum of ceremony but maximum reliability. If your site breaks on mobile, the message never lands. If you embed media, ensure fallbacks. If you annotate with structured data, verify it. This sounds obvious until you audit a few dozen pages and find preventable failures.

Observe like an engineer: define a hypothesis before release (“We expect 40%+ of readers to expand the code sample and average time-on-page of 2:30”), then log events and read them. If the hypothesis fails, write a brief note and iterate. That humility builds more credibility than any slogan.

<h2>
 
 
 Signals That Help Machines and Humans Understand Your Page
</h2>

We don’t have to guess how parsers and browsers treat core elements—there’s public guidance. For example, the robots meta tag is precisely documented by <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#robots" rel="noopener noreferrer">MDN Web Docs</a>. Misusing it can quietly hide your excellent work. Likewise, clear directives for crawlers are outlined in Google’s official documentation on <a href="https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag" rel="noopener noreferrer">robots meta directives</a>. You don’t need to become a specialist to benefit: read the short sections relevant to your use case, pick defaults that match your intent (e.g., indexable article pages, non-index utility endpoints), and avoid contradictory signals.

Beyond directives, content earns trust through coherence:

<ul>
<li>
Titles that promise exactly what the body delivers. If the headline says “How We Cut p95 by 3×,” your method and measurement must be visible above the fold.</li>
<li>
Stable URLs. Breaking links is reputational debt. Treat slugs like API versions; change only with migration plans.</li>
<li>
Readable structure. Short paragraphs, code blocks that run, diagrams with alt text, and captions that say what the reader should notice.</li>
<li>
Transparent authorship. A byline with real identity and a sentence on why this person is qualified. Anonymous thought leadership rarely persuades engineers.</li>
</ul>

<h2>
 
 
 The Only Checklist You Actually Need
</h2>

Use this once per article. If you can’t check a box truthfully, fix the cause instead of gaming the symptom.

<ul>
<li>
One-sentence reader problem is clear (share with a skeptic; they should nod).</li>
<li>
Core claim is measurable (numbers, method, and where data lives).</li>
<li>
Page renders fast and clean (mobile first; images sized; no layout shift).</li>
<li>
Directives match intent (no accidental <code>noindex</code>; canonical is correct; no conflicting hints).</li>
<li>
Source links are authoritative (stand on primary docs or peer-reviewed material, not hearsay).</li>
<li>
Reproducibility where relevant (runnable code, version pins, or data snapshot).</li>
<li>
Post-publish hypothesis defined (what success looks like and what you’ll do if it doesn’t happen).</li>
</ul>

Keep this list visible to your team. It’s short on purpose; bloat turns checklists into theater.

<h2>
 
 
 Writing That Respects the Reader’s Time
</h2>

Engineers are allergic to hand-waving. To earn trust, write like you debug:

<ol>
<li>
State the claim. Put the outcome up front. Don’t make people dig.</li>
<li>
Show the path. Provide the minimal context to reproduce. If there are three plausible methods, say why you chose one.</li>
<li>
Expose trade-offs. Every decision has a downside—latency for compute, privacy for convenience, simplicity for flexibility. Calling that out makes the win believable.</li>
<li>
Acknowledge prior art. Name the people and projects you built upon. It’s generous and prevents reinventing the wheel.</li>
<li>
Invite falsification. Offer a way to challenge your result—dataset link, script, or a note on environments where your approach might fail.</li>
</ol>

This style doesn’t just “sound technical.” It protects your team when later decisions reference your document. You’ll thank yourself when a VP says, “Why did we pick this?” and you can point to a paragraph that still holds up.

<h2>
 
 
 Distribution Without the Guilt
</h2>

You don’t need tricks to reach the right readers—you need consistency and fit. Publish where developers already hang out (like Dev.to and your project’s repo), cross-post summaries to communities that value your topic, and keep the voice consistent. Avoid anchor spam and cartoonish calls to action. Invite contact for real reasons: bug reports, benchmarks on different hardware, adoption stories, or counterexamples.

When you link to resources, choose anchors that fit naturally into the sentence. The goal is to be helpful first. Over-optimized phrasing reads strangely to humans and invites the wrong kind of attention from machines. Think of links as citations, not bait.

<h2>
 
 
 Governance: Tiny Rituals That Prevent Big Headaches
</h2>

A lightweight content guild—two to four people who care—can review each draft for clarity, risk, and usefulness. Rotate the “final approver” so the process never bottlenecks. Archive decisions in a living doc: when a topic performed poorly, say so and explain what you learned; when an article exceeded expectations, annotate why (timing, community tie-in, or a strong demo). Over a quarter, this becomes an internal playbook your future teammates will treat as gold.

<h2>
 
 
 The Payoff
</h2>

When you adopt an engineering posture toward content, the benefits accumulate: fewer hotfixes after publish, fewer awkward retractions, more inbound from readers who actually implemented your work, and a library you can confidently resurface months later. Most importantly, you build an audience that trusts you—because your writing respects their time and intelligence.

Bottom line: publish less often, but make each piece unarguably useful. Measure outcomes, admit misses, and iterate in public. That honesty travels further than any tagline.

في عالم إنشاء المحتوى، تعتبر الوضوح والقابلية للتحقق مفتاحًا لكسب الثقة. يبرز هذا المقال أن الفرق التي تتعامل مع النشر كأحد تخصصات المنتج تميل إلى التفوق على تلك التي تعتمد على الحيل السريعة. من خلال الجمع بين الكتابة الجيدة والتوزيع القابل للقياس والتعاون مع شركاء متخصصين عند الحاجة، يمكن لقادة الهندسة إنشاء قناة موثوقة للاهتمام. لا تعزز هذه الطريقة جودة المحتوى فحسب، بل تضمن أيضًا فعاليتها في الوصول إلى الجمهور، مما يجعلها استراتيجية حاسمة للنجاح في المشهد الرقمي اليوم.

En el mundo de la creación de contenido, la claridad y la verificabilidad son clave para ganar confianza. Este artículo enfatiza que los equipos que tratan la publicación como una disciplina de producto tienden a superar a aquellos que dependen de trucos rápidos. Al combinar una escritura sólida con una distribución medible y colaborar con socios especializados cuando es beneficioso, los líderes de ingeniería pueden crear un canal de atención confiable. Este enfoque no solo mejora la calidad del contenido, sino que también asegura su efectividad para llegar a la audiencia, convirtiéndolo en una estrategia crucial para el éxito en el panorama digital actual.

Dans le monde de la création de contenu, la clarté et la vérifiabilité sont essentielles pour gagner la confiance. Cet article souligne que les équipes qui considèrent la publication comme une discipline de produit ont tendance à surpasser celles qui s'appuient sur des astuces rapides. En combinant une rédaction solide avec une distribution mesurable et en collaborant avec des partenaires spécialisés lorsque cela est bénéfique, les leaders en ingénierie peuvent créer un pipeline d'attention fiable. Cette approche améliore non seulement la qualité du contenu, mais garantit également son efficacité pour atteindre le public, ce qui en fait une stratégie cruciale pour réussir dans le paysage numérique d'aujourd'hui.

In the world of content creation, clarity and verifiability are key to earning trust. This article emphasizes that teams treating publishing as a product discipline tend to outperform those relying on quick hacks. By combining solid writing with measurable distribution and collaborating with specialist partners when beneficial, engineering leaders can create a reliable pipeline of attention. This approach not only enhances the quality of content but also ensures its effectiveness in reaching the audience, making it a crucial strategy for success in today's digital landscape.

Build Content Like an Engineer: Systems, Signals, and Checks That Earn Trust

If you've ever seen "TBA/TBA" as a passenger name in a flight booking, it's not a glitch—it's a feature. After booking a cheap group fare on Yatra.com, I discovered the hidden world of airline group bookings, and uncovered a real bug with same-name passengers.

In this post, we'll unpack:

<ul>
<li>How group fare booking systems work</li>
<li>Why "TBA" exists in airline PNRs</li>
<li>What developers building travel systems should know</li>
<li>
A critical bug I found: Same-name passengers causing seat swaps</li>
</ul>




<h2>
 
 
 ✈️ 1. What Are Group Fares?
</h2>

Group fares are special airline rates for 10+ passengers traveling together on the same flight and date.

Common use cases:

<ul>
<li>🏢 Corporate trips</li>
<li>💒 Weddings and family gatherings</li>
<li>🕌 Pilgrimage or religious tours</li>
<li>🏀 School or sports teams</li>
</ul>

Unlike individual bookings, group fares are:

<ul>
<li>
Negotiated directly with airlines or via GDS</li>
<li>More flexible with payment schedules</li>
<li>Allow placeholder names initially</li>
</ul>




<h2>
 
 
 2. Business Logic: The Group Booking Flow
</h2>

Here's how it works from an OTA or travel agent's perspective:

<div class="table-wrapper-paragraph"><table>
<thead>
<tr>
<th>Step</th>
<th>Process</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>1️⃣</td>
<td>Group Quote Request</td>
<td>Agency requests fare for route, date, and passenger count</td>
</tr>
<tr>
<td>2️⃣</td>
<td>PNR Creation (TBA stage)</td>
<td>Airline/GDS creates group PNR with placeholders like <code>TBA/TBA</code>
</td>
</tr>
<tr>
<td>3️⃣</td>
<td>Deposit &amp; Hold</td>
<td>Group pays deposit to hold seats</td>
</tr>
<tr>
<td>4️⃣</td>
<td>Name Finalization</td>
<td>12–72 hours before flight, replace "TBA" with real names</td>
</tr>
<tr>
<td>5️⃣</td>
<td>Ticketing</td>
<td>Once names finalized, tickets are issued</td>
</tr>
</tbody>
</table></div>




<h2>
 
 
 📋 3. What Does "TBA" Actually Mean?
</h2>

TBA = To Be Advised

When creating a group booking, actual passenger details may not be known yet.

Example in GDS (Amadeus/Sabre):

Each entry reserves a seat while allowing the agent to:

<ul>
<li>
Hold inventory without final names</li>
<li>
Track blocked seats in airline systems</li>
<li>
Display flight details before passenger confirmation</li>
</ul>

<h4>
 
 
 How GDS Systems Power This Magic
</h4>

Behind the scenes, OTAs don't talk directly to each airline. They use GDS (Global Distribution System) — think of it as the "API gateway" of the travel industry.

The Big Three:

<ul>
<li>
Amadeus (European dominance)</li>
<li>
Sabre (Strong in Americas)</li>
<li>
Travelport (Galileo/Worldspan/Apollo)</li>
</ul>




<h2>
 
 
 ⏰ 4. The 12-Hour Rule
</h2>

Most airlines require final passenger names no later than 12 hours before departure.

What happens at finalization:

<ul>
<li>✅ All "TBA" placeholders updated with real names</li>
<li>⚠️ Unnamed passengers may auto-cancel</li>
<li>🎫 Group PNR transitions to ticketed state</li>
</ul>

This is why Yatra/MMT show "flight details visible before 12 hours" — the system holds the group block, but names are pending.




<h2>
 
 
 5. System Architecture Flow
</h2>

Key technical points:

<ul>
<li>Placeholders stored in PNR until replaced</li>
<li>Airlines track via group booking IDs (not individual tickets)</li>
<li>Background jobs handle PNR sync and updates</li>
</ul>




<h2>
 
 
 💻 6. How OTAs Handle This (Developer View)
</h2>

For platforms like Yatra or MakeMyTrip: 


<div class="highlight js-code-highlight">
<pre class="highlight javascript"><code>// Simplified model
const groupBooking = {
 pnr: "ABC123",
 status: "TBA_PENDING",
 passengers: [
 { firstName: "TBA", lastName: "TBA", title: "MR" },
 { firstName: "TBA", lastName: "TBA", title: "MS" }
 ],
 finalizationDeadline: "2025-11-08T10:00:00Z",
 flightDetails: { visible: false } // visible after name update
};
</code></pre>

</div>



Backend requirements:

<ol>
<li>Handle placeholder data models</li>
<li>Schedule PNR refresh/update jobs</li>
<li>Implement deadline alerts</li>
<li>Validate against duplicate names (see bug below!)</li>
</ol>




<h2>
 
 
 7. CRITICAL BUG I DISCOVERED: Same-Name Collision
</h2>

<h3>
 
 
 The Problem
</h3>

When booking through Yatra's group fare system, I found:

If two passengers have the same name:

<ul>
<li>❌ During web check-in, the system will display both passengers names when the PNR and last name are entered together.</li>
<li>❌ Boarding passes get mixed up</li>
<li>❌ Airport staff can't distinguish passengers</li>
<li>❌ Potential security and check-in issues</li>
</ul>

<h3>
 
 
 Example Scenario
</h3>



<div class="highlight js-code-highlight">
<pre class="highlight javascript"><code>// Booking for two people with same name
passengers: [
 { firstName: "Amit", lastName: "Kumar", seat: "12A" },
 { firstName: "Amit", lastName: "Kumar", seat: "12B" }
]

// What happens in airline system:
// PNR shows: KUMAR/AMIT MR + KUMAR/AMIT MR
// Boarding pass generates wrong seat for one passenger
</code></pre>

</div>



<h3>
 
 
 Why This Happens
</h3>

<ol>
<li>
GDS Name Formatting: Airlines use <code>PNR and LASTNAME</code> combination</li>
<li>
Duplicate Detection: System may treat as duplicate entry</li>
<li>
Seat Assignment Logic: Uses last name as primary key</li>
<li>
Group PNR Merge: Multiple "AMIT KUMAR" entries cause confusion</li>
</ol>

Recommended fixes for OTAs:

<ul>
<li>🔍 Pre-booking validation for duplicate last names</li>
<li>📝 Force middle name or mobile number for duplicates</li>
</ul>




<h2>
 
 
 🔮 8. Future: NDC and Modern APIs
</h2>

IATA's NDC (New Distribution Capability) is modernizing group fares:

<ul>
<li>⚡ Real-time quotes and seat holds</li>
<li>🔄 Easier passenger data updates via REST APIs</li>
<li>📉 Reduced reliance on "TBA" placeholders</li>
<li>🤝 Direct airline-to-OTA connections</li>
</ul>

Though many airlines still support TBA for backward compatibility.




<h2>
 
 
 9. Key Takeaways
</h2>

<div class="table-wrapper-paragraph"><table>
<thead>
<tr>
<th>Point</th>
<th>Reality Check</th>
</tr>
</thead>
<tbody>
<tr>
<td>✅ "TBA" is a feature, not a bug
</td>
<td>Intentional placeholder system for group inventory management</td>
</tr>
<tr>
<td>⏰ The 12-hour rule has a twist
</td>
<td>Names often start reflecting from midnight (not exactly 12 hours), which can frustrate travelers expecting earlier updates</td>
</tr>
<tr>
<td>💰 How OTAs really make money
</td>
<td>Indian OTAs like Yatra/MMT book group fares and mark them up—this is on top of convenience charges. That "cheap fare" might just be a group booking arbitrage</td>
</tr>
<tr>
<td>🚨 Same-name = system chaos
</td>
<td>Multiple passengers with identical last names create PNR conflicts, seat swaps, and boarding issues</td>
</tr>
<tr>
<td>🎭 The agent model
</td>
<td>OTAs aren't always direct airline partners—many operate as super-agents booking group blocks and reselling individually</td>
</tr>
</tbody>
</table></div>




<h2>
 
 
 💬 Discussion
</h2>

For developers building travel systems:

<ol>
<li>How does your system handle group booking placeholders?</li>
<li>Ever encountered the same-name bug I found?</li>
</ol>

Drop your experiences in the comments! 👇




<h2>
 
 
 🔗 Useful Resources
</h2>

<ul>
<li><a href="https://www.iata.org/en/programs/airline-distribution/retailing/ndc/" rel="noopener noreferrer">IATA NDC Program</a></li>
<li><a href="https://developers.amadeus.com/" rel="noopener noreferrer">Amadeus API Documentation</a></li>
<li><a href="https://developer.sabre.com/" rel="noopener noreferrer">Sabre Dev Studio</a></li>
</ul>




This post is based on real-world experience booking through Yatra.com. If you found this helpful, consider sharing it with your travel-tech friends! ✈️




Tags: #traveltech #backend #systemdesign #api #devstory

يتناول المقال عالم حجوزات المجموعات في شركات الطيران، مع التركيز بشكل خاص على التسمية 'TBA/TBA' التي تظهر في حجوزات الرحلات. هذه ليست خللًا، بل ميزة مقصودة تنشأ من تعقيدات حجز أسعار المجموعات. يشارك الكاتب تجارب شخصية من تجربة حديثة مع Yatra.com، موضحًا كيفية عمل هذه الأنظمة للحجز وتأثيراتها على المطورين في صناعة السفر. يمكن أن يساعد فهم ذلك كل من المسافرين والمهنيين في التكنولوجيا على التنقل بشكل أكثر فعالية في تفاصيل السفر الجماعي.

El artículo se adentra en el intrigante mundo de las reservas de grupo de aerolíneas, centrándose específicamente en la designación 'TBA/TBA' que se ve en las reservas de vuelos. Esto no es un error, sino una característica deliberada que surge de las complejidades de reservar tarifas grupales. El autor comparte experiencias personales de una reciente experiencia con Yatra.com, arrojando luz sobre cómo funcionan estos sistemas de reserva y las implicaciones para los desarrolladores en la industria de viajes. Comprender esto puede ayudar tanto a los viajeros como a los profesionales de la tecnología a navegar más eficazmente por las sutilezas de los viajes en grupo.

L'article explore le monde fascinant des réservations de groupe dans les compagnies aériennes, en se concentrant spécifiquement sur la désignation 'TBA/TBA' que l'on voit dans les réservations de vol. Ce n'est pas un bug, mais une fonctionnalité délibérée qui découle des complexités de la réservation de tarifs de groupe. L'auteur partage des expériences personnelles d'une récente expérience avec Yatra.com, éclairant le fonctionnement de ces systèmes de réservation et les implications pour les développeurs de l'industrie du voyage. Comprendre cela peut aider à la fois les voyageurs et les professionnels de la technologie à naviguer plus efficacement dans les nuances des voyages en groupe.

The article delves into the intriguing world of airline group bookings, specifically focusing on the 'TBA/TBA' designation seen in flight reservations. This isn't a glitch but a deliberate feature that arises from the complexities of booking group fares. The author shares personal insights from a recent experience with Yatra.com, shedding light on how these booking systems function and the implications for developers in the travel industry. Understanding this can help both travelers and tech professionals navigate the nuances of group travel more effectively.

How Airline Group Fares Really Work: The Business & Tech Behind 'TBA' Passenger Names

<a href="https://www.techspot.com/news/110174-nearly-2026-most-people-use-123456-password.html" target="_blank"><img src="https://www.techspot.com/images2/news/ts3_thumbs/2025/11/2025-11-07-ts3_thumbs-819.jpg" width="800" height="560" style="padding: 15px 0" title="It's nearly 2026 and most people still use '123456' as a password" /></a> The latest shame-inducing most-common-passwords report comes from tech research and review site Comparitech. Using information leaked on data breach forums in 2025, its researchers aggregated more than 2 billion real account passwords, creating a list of the 100 most-used. <a href="https://www.techspot.com/news/110174-nearly-2026-most-people-use-123456-password.html">Read Entire Article</a>

مع اقتراب عام 2026، يكشف تقرير جديد من Comparitech أن العديد من الأشخاص لا يزالون يعتمدون على كلمات مرور ضعيفة مثل '123456'. هذا أمر مقلق لأنه يسلط الضوء على مشكلة مستمرة في الأمن السيبراني، حيث يفشل الأفراد في اعتماد ممارسات كلمات مرور أقوى على الرغم من التحذيرات المستمرة بشأن خروقات البيانات. إن الاستخدام المستمر لكلمات مرور يسهل تخمينها يعرض المعلومات الشخصية والحساسة للخطر، مما يجعل من الضروري للمستخدمين إعطاء الأولوية لتدابير أمان أفضل.

A medida que nos acercamos a 2026, un nuevo informe de Comparitech revela que muchas personas todavía dependen de contraseñas débiles como '123456'. Esto es preocupante porque resalta un problema persistente en la ciberseguridad, donde los individuos no adoptan prácticas de contraseñas más fuertes a pesar de las advertencias sobre las violaciones de datos. El uso continuo de contraseñas tan fáciles de adivinar pone en riesgo la información personal y sensible, lo que hace crucial que los usuarios prioricen mejores medidas de seguridad.

À l'approche de 2026, un nouveau rapport de Comparitech révèle que de nombreuses personnes continuent de s'appuyer sur des mots de passe faibles comme '123456'. Cela est préoccupant car cela met en lumière un problème persistant en matière de cybersécurité, où les individus ne parviennent pas à adopter des pratiques de mots de passe plus solides malgré les avertissements continus concernant les violations de données. L'utilisation continue de mots de passe aussi facilement devinables met en danger les informations personnelles et sensibles, rendant crucial pour les utilisateurs de donner la priorité à de meilleures mesures de sécurité.

As we approach 2026, a new report from Comparitech reveals that many people still rely on weak passwords like '123456'. This is concerning because it highlights a persistent issue in cybersecurity, where individuals fail to adopt stronger password practices despite ongoing warnings about data breaches. The continued use of such easily guessable passwords puts personal and sensitive information at risk, making it crucial for users to prioritize better security measures.

It's nearly 2026 and most people still use '123456' as a password

<h2>
 
 
 Day 21 – External Libraries (pip, requests)
</h2>

Project: Build a “Simple API Client” that fetches and sends data using the <code>requests</code> library.




01. Learning Goal

By the end of this lesson, you will be able to:

<ul>
<li>Install external libraries using pip
</li>
<li>Understand how to use the <code>requests</code> module
</li>
<li>Send GET and POST HTTP requests
</li>
<li>Handle API responses and errors gracefully
</li>
</ul>




02. Problem Scenario

Python’s built-in modules are powerful, but sometimes you need more advanced tools — for example, when connecting to web APIs. 
The <code>requests</code> library makes it easy to send HTTP requests and interact with online data sources.



03. Step 1 – pip: Python Package Installer

<code>pip</code> is Python’s package management tool for installing and managing third-party libraries. 


<div class="highlight js-code-highlight">
<pre class="highlight shell"><code># Install a package
pip install requests

# Install a specific version
pip install requests==2.31.0

# Upgrade a package
pip install --upgrade requests

# List installed packages
pip list
</code></pre>

</div>



After installation, you can import and use the library in your project.




04. Step 2 – The requests Module

The <code>requests</code> module allows you to easily send HTTP requests such as <code>GET</code>, <code>POST</code>, <code>PUT</code>, and <code>DELETE</code>.




05. Step 3 – GET Request (Fetching Data)

Use <code>GET</code> to retrieve information from an API. 


<div class="highlight js-code-highlight">
<pre class="highlight python"><code>import requests

res = requests.get("https://jsonplaceholder.typicode.com/todos/1")

print("Status Code:", res.status_code)
print("Text:", res.text)

data = res.json()
print("JSON:", data)
print("Title:", data["title"])
</code></pre>

</div>






06. Step 4 – POST Request (Sending Data)

Use <code>POST</code> to send new data to a server. 


<div class="highlight js-code-highlight">
<pre class="highlight python"><code>import requests

payload = {"title": "Buy milk", "completed": False}
res = requests.post("https://jsonplaceholder.typicode.com/todos", json=payload)

print("Status Code:", res.status_code)
print("Response JSON:", res.json())
</code></pre>

</div>






07. Step 5 – Error Handling

Always handle exceptions when working with external APIs to prevent crashes. 


<div class="highlight js-code-highlight">
<pre class="highlight python"><code>import requests

try:
 res = requests.get("https://jsonplaceholder.typicode.com/todos/1", timeout=5)
 res.raise_for_status() # Raises an error if response status is 4xx or 5xx
 print(res.json())
except requests.exceptions.RequestException as e:
 print("Error occurred:", e)
</code></pre>

</div>






08. Step 6 – Practice Examples

Example 1: GitHub API – Get User Info 


<div class="highlight js-code-highlight">
<pre class="highlight python"><code>import requests

url = "https://api.github.com/users/octocat"
res = requests.get(url)
data = res.json()

print("Name:", data["name"])
print("Public Repos:", data["public_repos"])
</code></pre>

</div>






Example 2: Weather API – Get Weather Data

To use most APIs, you’ll need an API key. 
Here’s how you could use the OpenWeatherMap API: 


<div class="highlight js-code-highlight">
<pre class="highlight python"><code>import requests

city = "London"
api_key = "YOUR_API_KEY"
url = f"http://api.openweathermap.org/data/2.5/weather?q={city}&amp;appid={api_key}"

res = requests.get(url)
print(res.json())
</code></pre>

</div>






09. Step 7 – Mini Project: Simple API Client

Let’s build a small app that fetches user data and posts new content. 


<div class="highlight js-code-highlight">
<pre class="highlight python"><code>import requests

def get_user(user_id):
 res = requests.get(f"https://jsonplaceholder.typicode.com/users/{user_id}")
 if res.status_code == 200:
 return res.json()
 return None

def create_post(title, body, user_id):
 payload = {"title": title, "body": body, "userId": user_id}
 res = requests.post("https://jsonplaceholder.typicode.com/posts", json=payload)
 return res.json()

user = get_user(1)
print("User:", user["name"])

post = create_post("My first API post", "Learning requests in Python!", user["id"])
print("New Post Created:", post)
</code></pre>

</div>



Output example: 


<div class="highlight js-code-highlight">
<pre class="highlight plaintext"><code>User: Leanne Graham
New Post Created: {'title': 'My first API post', 'body': 'Learning requests in Python!', 'userId': 1, 'id': 101}
</code></pre>

</div>






10. Reflection

You have learned how to:

<ul>
<li>Use pip to install third-party Python packages</li>
<li>Send and handle GET and POST HTTP requests using <code>requests</code>
</li>
<li>Work with JSON API responses</li>
<li>Handle exceptions safely during API communication</li>
<li>Build a Simple API Client that interacts with real-world APIs</li>
</ul>

Next → Day 22 – Debugging and Logging 
Learn how to detect, handle, and record errors in your Python programs.

في اليوم الحادي والعشرين من دورة أساسيات بايثون، يغوص المتعلمون في المكتبات الخارجية، مع التركيز بشكل خاص على pip ووحدة requests. هذه الدرس مهم لأنه يزود الطلاب بالمهارات اللازمة لتثبيت المكتبات وبناء عميل API بسيط يمكنه استرجاع وإرسال البيانات. إتقان هذه الأدوات لا يعزز فقط قدراتهم البرمجية، بل يفتح أيضًا الأبواب لمشاريع أكثر تعقيدًا في المستقبل.

En el Día 21 del curso de fundamentos de Python, los estudiantes se adentran en las bibliotecas externas, centrándose específicamente en pip y el módulo requests. Esta lección es crucial ya que equipa a los estudiantes con las habilidades para instalar bibliotecas y construir un cliente API simple que puede recuperar y enviar datos. Dominar estas herramientas no solo mejora sus capacidades de programación, sino que también abre puertas a proyectos más complejos en el futuro.

Au jour 21 du cours de bases de Python, les apprenants se plongent dans les bibliothèques externes, en se concentrant spécifiquement sur pip et le module requests. Cette leçon est cruciale car elle permet aux étudiants d'acquérir les compétences nécessaires pour installer des bibliothèques et créer un client API simple capable de récupérer et d'envoyer des données. Maîtriser ces outils améliore non seulement leurs capacités en programmation, mais ouvre également la voie à des projets plus complexes à l'avenir.

On Day 21 of the Python basics course, learners dive into external libraries, specifically focusing on pip and the requests module. This lesson is crucial as it equips students with the skills to install libraries and build a simple API client that can fetch and send data. Mastering these tools not only enhances their programming capabilities but also opens doors to more complex projects in the future.

Python basics - Day 21

Often, there is feedback from users that the IP shown in the SafeLine attack logs is problematic.

Here, I will explain why there might be issues with the attack IP displayed in SafeLine in some situations.

<h2>
 
 
 Problem Description
</h2>

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6n2087d1fra7p7hh6x75.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F6n2087d1fra7p7hh6x75.png" alt=" " width="800" height="473"></a>

By default, SafeLine reads the client IP through the Socket of the HTTP connection. 
When SafeLine is the outermost network device, there is no problem, and the IP obtained by SafeLine is the real IP of the attacker.

However, in some cases, we need to add other proxy devices (such as Nginx, CDN, application delivery, API gateway, etc.) in front of SafeLine. 
In this case, the actual connection to SafeLine is not the real website user but these proxy devices. 
Therefore, we need to adjust the way SafeLine obtains the IP according to the actual network topology.


<h2>
 
 
 Understanding X-Forwarded-For
</h2>

X-Forwarded-For is a relatively common HTTP request header.

When HTTP traffic passes through a proxy, the network connection is intercepted, and the server cannot know the real client IP. 
At this time, the proxy device will add an X-Forwarded-For header to the current traffic, and the content is the client IP that connects to this proxy.

In the following example, the HTTP proxy tells the server through the X-Forwarded-For header that the real client address is <code>1.2.3.4</code>: 


<div class="highlight js-code-highlight">
<pre class="highlight plaintext"><code>GET / HTTP/1.1
Host: demo.waf.chaitin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36
X-Forwarded-For: 1.2.3.4

</code></pre>

</div>



X-Forwarded-For is actually a chain structure. 
If the traffic passes through multiple proxy devices, X-Forwarded-For will record all the IPs passed.

In the following example, the HTTP proxy tells the server through the X-Forwarded-For header that the traffic has passed through three layers of proxies, and the real client address is <code>1.2.3.4</code>, the first layer of proxy is <code>11.12.13.14</code>, the second layer of proxy address is <code>21.22.23.24</code>, and the third layer of proxy address can be obtained directly through the Socket connection: 


<div class="highlight js-code-highlight">
<pre class="highlight plaintext"><code>GET / HTTP/1.1
Host: demo.waf.chaitin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36
X-Forwarded-For: 1.2.3.4, 11.12.13.14, 21.22.23.24
</code></pre>

</div>



<h2>
 
 
 Is the X-Forwarded-For Header Reliable?
</h2>

The content transmitted by the X-Forwarded-For header is very reliable when the proxy device and proxy chain are trustworthy, and it can be used with confidence.

However, if the proxy device is untrustworthy, then attackers can forge the source IP by forging the X-Forwarded-For header.

<h2>
 
 
 SafeLine Configuration
</h2>

<a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fiegd9bqbmkm8lntt5qos.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fiegd9bqbmkm8lntt5qos.png" alt=" " width="800" height="405"></a>

SafeLine has an option in the global configuration that is specifically designed to solve this problem.

SafeLine provides several options in this configuration. 
Based on the knowledge mentioned above, everyone can choose the most suitable option according to the actual situation.

<h3>
 
 
 Options:
</h3>

<ul>
<li>Obtain from the network connection: 
Choose this when SafeLine is the outermost proxy device and there are no other forward proxies.</li>
<li>Obtain the address of the previous proxy from X-Forwarded-For: 
Choose this when there is one layer of proxy device (such as Nginx, CDN, etc.) before the traffic reaches SafeLine.</li>
<li>Obtain the address of the second-level proxy from X-Forwarded-For: 
Choose this when there are two layers of proxy devices (such as Nginx, CDN, etc.) before the traffic reaches SafeLine.</li>
<li>Obtain the address of the third-level proxy from X-Forwarded-For: 
Choose this when there are three layers of proxy devices (such as Nginx, CDN, etc.) before the traffic reaches SafeLine.</li>
<li>
Obtain from other HTTP Headers: 
There are several situations:

<ul>
<li>The traffic passes through some special reverse proxy devices that do not send X-Forwarded-For headers, but you can configure the IP to be sent through other headers.
</li>
<li>The traffic reaches SafeLine through multiple paths, which may have one layer of proxy or two layers of proxy. You can configure the front proxy device to unify the HTTP header.</li>
</ul>


</li>

</ul>

GitHub Repository: <a href="https://ly.safepoint.cloud/rZGPJRF" rel="noopener noreferrer">https://ly.safepoint.cloud/rZGPJRF</a> 
Official Website: <a href="https://ly.safepoint.cloud/eGtfrcF" rel="noopener noreferrer">https://ly.safepoint.cloud/eGtfrcF</a> 
Live Demo: https:<a href="https://ly.safepoint.cloud/DQywpL7" rel="noopener noreferrer">https://ly.safepoint.cloud/DQywpL7</a>

في مقال حديث، يتناول المؤلف المخاوف الشائعة بشأن عناوين IP المعروضة في سجلات هجمات SafeLine. أبلغ المستخدمون عن تناقضات، ويشرح النص الأسباب المحتملة لهذه المشكلات، مؤكدًا على أهمية التكوين الصحيح لضمان تسجيل دقيق. هذا الموضوع مهم للمنظمات التي تعتمد على SafeLine لأمان الويب، حيث يمكن أن يؤدي فهم وحل هذه التناقضات إلى تحسين قدراتها في اكتشاف التهديدات.

En un artículo reciente, el autor aborda las preocupaciones comunes sobre las direcciones IP que se muestran en los registros de ataques de SafeLine. Los usuarios han informado discrepancias, y el texto explica las posibles razones de estos problemas, enfatizando la importancia de una configuración adecuada para asegurar un registro preciso. Este tema es crucial para las organizaciones que dependen de SafeLine para la seguridad web, ya que entender y resolver estas discrepancias puede mejorar sus capacidades de detección de amenazas.

Dans un récent article, l'auteur aborde les préoccupations courantes concernant les adresses IP affichées dans les journaux d'attaque de SafeLine. Les utilisateurs ont signalé des incohérences, et l'article explique les raisons potentielles de ces problèmes, soulignant l'importance d'une configuration appropriée pour garantir un enregistrement précis. Ce sujet est crucial pour les organisations qui comptent sur SafeLine pour la sécurité web, car comprendre et résoudre ces incohérences peut améliorer leurs capacités de détection des menaces.

In a recent article, the author addresses common concerns regarding the IP addresses displayed in SafeLine's attack logs. Users have reported discrepancies, and the piece explains potential reasons for these issues, emphasizing the importance of proper configuration to ensure accurate logging. This topic is crucial for organizations relying on SafeLine for web security, as understanding and resolving these discrepancies can enhance their threat detection capabilities.

Here is the API Client with Environment and Secret Management Capability

Here is the API Client with Environment and Secret Management Capability

Was this article worth reading? Share it