DEV Community: Gerardo León

Do you assume or confirm?

Gerardo León — Fri, 07 Aug 2026 05:21:41 +0000

Note: This article describes a debugging case from 2023. Some of the technologies mentioned here have since changed in relevance. In particular, Moment.js is now considered a legacy project in maintenance mode and is generally not recommended for new applications. The debugging lessons and reasoning process described here are still applicable, but the specific technical choices should be understood in their original context.

Chapter 1: How I learnt to distrust JavaScript `Date`

Daniel Kahneman’s famous book Thinking, Fast and Slow describes two modes of thinking:

System 1 is automatic, fast, emotional, and quick to respond to stimuli. It constantly operates in the background and often bases its output on assumptions.
System 2 is invoked consciously. It is slower, more deliberate, logical, and methodical, basing its output on reasoning.

When it comes to problem-solving, we usually expect System 2 to take over. However, familiarity with a domain gradually builds a stack of assumptions that System 1 may stop revalidating.

That overconfidence can mislead us and make our decisions less reliable than we think.

If we were to visualize both systems while debugging, a good analogy would be Wile E. Coyote realizing that he has been running on thin air while chasing the Road Runner.

Leaving System 1 in command for too long, without verifying the premises we have already accepted as valid, is basically us playing Coyote.

Therefore, it is worth regularly asking ourselves:

“Am I assuming these premises, or have I already confirmed what I’m basing this on?”

This question can help prevent us from getting trapped in debugging dead ends.

What criteria should trigger this question?

I tend to use a simple one:

“For the next hypothesis I’m about to accept, have I confirmed its foundations, or am I assuming them?”

This simple question can save a significant amount of time and effort.

Application problem

A bit of context:

Two systems communicate through event-based messaging.

The originator system sends events in a specific order. The receiving system applies the event data to its state and updates its UI accordingly.

Problem

Even though the originator system sends events in the expected order, the receiver's UI does not always update in that same order.
These symptoms were already known, although the root cause remained unclear. A race condition in the receiver's event interpreter had become the main suspect.
The fact that multiple events were emitted within the same second appeared to support the race-condition theory.
We were considering changes in the originator system because, after a recent optimization, some events were being produced in roughly half the previous processing time.
When I was asked why the originator needed to change, I could not provide a solid explanation. I was under pressure to deliver a fix quickly, but my reasoning was mostly based on assumptions.
I then learned that the receiver had an event timestamp comparator implemented using Moment.js.
Event A and Event B could arrive within the same second and even share the same first three fractional-second digits.
Event A could take slightly longer to process than Event B because additional business rules were applied to it.
Before updating the UI, the receiver's timestamp comparator would skip an event if its timestamp was older than the timestamp of the event previously applied.
JavaScript's legacy Date object stores time with millisecond precision. This means that fractional seconds beyond three digits are not preserved by Date, and Moment.js inherits that limitation when relying on JavaScript dates.
As a workaround, the comparison was changed to operate on the original timestamp strings so that additional fractional-second digits could be taken into account when two events appeared otherwise equal.

Lesson

Read the documentation.
Get to the root of the problem before proposing a convenient workaround.
Do not mistake an assumption for a confirmed constraint.

Solution

Keep access to the raw timestamp representation.
When two events are equal at millisecond precision, use the additional fractional-second digits from the original timestamp as a tiebreaker.

Another problem

The previous solution improved things, but another issue appeared.

I expected timestamps to compare correctly, yet some reported cases still produced unexpected tiebreaker values.
Simple string slicing turned out to be unreliable because the fractional-second representation was not always identical.
I switched to a regular expression that identified the relevant fractional-second portion more explicitly.
Reliability improved, but some additional reports still came in.
This time, the problem was not the comparison logic itself. Some timestamps contained fewer fractional-second digits than expected.
The affected timestamps corresponded to values whose complete representations would have contained trailing zeroes.
The extraction function behaved correctly when trailing zeroes were present, so the next question became: where were those zeroes disappearing?
A teammate suggested checking the serialization layer.
Testing confirmed that serialization was modifying the timestamp representation.
The application was using Newtonsoft.Json, and its date serialization behavior could omit trailing fractional-second zeroes depending on the configured format.
An IsoDateTimeConverter was configured with an explicit datetime format that preserved the required fractional-second representation.
After that change, the event timestamp comparison became considerably more reliable.

Lesson

If the bug is not in the business layer, inspect the supporting layers as well.
Serialization, parsing, formatting, and transport layers can silently transform data that the business logic assumes to be unchanged.
When working with structured strings, identify the exact format you expect instead of relying on positional assumptions such as arbitrary slicing.

Solution

Use an explicit and validated format when extracting structured values from strings.
Configure serialization behavior deliberately when formatting affects application logic.
Avoid relying on default serializer behavior for data whose exact representation matters.

Looking back

There is another architectural lesson I would add today.

If event ordering is a fundamental property of the system, relying exclusively on timestamps to establish that order can be fragile.

Timestamp precision, serialization behavior, clock synchronization, processing delays, and formatting differences can all affect the result.

When strict ordering is required, an explicit sequence number, event version, or another monotonic ordering mechanism can provide a stronger guarantee than timestamps alone.

That does not invalidate the debugging solution described above—it simply moves the responsibility for ordering closer to the domain itself instead of deriving it indirectly from time.

References

Daniel Kahneman, Thinking, Fast and Slow (2011)
Moment.js issue regarding sub-millisecond precision: https://github.com/moment/moment/issues/3256
Moment.js project status and documentation: https://momentjs.com/docs/
Newtonsoft.Json issue regarding trailing fractional-second zeroes: https://github.com/JamesNK/Newtonsoft.Json/issues/1511

I’ll come back to this series whenever I stumble upon situations that bring up the same question:

Are you assuming or confirming?

I want to keep challenging the reasoning patterns that affect not only how we work, but also how we approach everyday problems.

Rotate AWS IAM Access Keys by script

Gerardo León — Thu, 06 Aug 2026 04:50:33 +0000

Update (2026): This article documents a legacy approach and is preserved for historical and educational purposes. AWS now recommends temporary credentials through IAM Identity Center for human access and local development, and IAM roles for workloads, instead of long-term IAM user access keys whenever possible.

The 12-hour expiration described below applied to temporary credentials or an organization-specific setup; IAM user access keys do not expire automatically. The original script also deletes the oldest key before validating the replacement and overwrites the default profile in .aws/credentials. Do not use it unchanged in a production environment. A safer rotation flow is: create the new key, configure and test it, deactivate the old key, verify that it is no longer used, and only then delete it.

Context

Provided IAM access keys were set to expire in 12 hours. Developing locally constantly resulted in Token expired exceptions.

Solution

Create an IAM user access key on demand through a script, following AWS recommendations to rotate access keys periodically.

Problem

Creating these access keys and adding them to the .aws/credentials file is a very manual process.

Solution

Script the whole process through the AWS CLI.

Required

An IAM user name.
A valid access key for the one-time setup.

Requirements

Given one valid IAM access key for the IAM user, create another access key and configure it under the default profile in .aws/credentials.

Given two valid IAM access keys for the IAM user, delete the oldest one and then create a new one.

Script

# Assuming AWS CLI is installed and you have sufficient permissions
param (
    [Parameter(Mandatory=$true)]
    [string]$IAMUserName
)

# Fetch the access keys for the user
$keys = aws iam list-access-keys --user-name $IAMUserName | ConvertFrom-Json

# If 2 keys exist, delete the oldest one
if ($keys.AccessKeyMetadata.Count -eq 2) {
    # Sorting by CreateDate to find the oldest key
    $oldestKey = $keys.AccessKeyMetadata | Sort-Object CreateDate | Select-Object -First 1

    # Delete the oldest key
    aws iam delete-access-key --user-name $IAMUserName --access-key-id $oldestKey.AccessKeyId
}

# Create a new access key
$newKey = aws iam create-access-key --user-name $IAMUserName | ConvertFrom-Json

# Write to the .aws/credentials file
$credentialsPath = "$env:USERPROFILE\.aws\credentials"
$credentialsContent = @"
[default]
aws_access_key_id = $($newKey.AccessKey.AccessKeyId)
aws_secret_access_key = $($newKey.AccessKey.SecretAccessKey)
"@

# Overwrite the credentials file with the new keys
# You might want to append or edit it if you use multiple profiles
Set-Content -Path $credentialsPath -Value $credentialsContent

Write-Output "Updated .aws/credentials with new access keys."

Usage

.\RotateKeys.ps1 -IAMUserName "YourIAMUserName"

Preconditions

AWS CLI installed.
An AWS IAM user created.
Sufficient IAM permissions to list, create, deactivate, and delete access keys, according to the rotation process you implement.

References

Tinkering with ChatGPT: Gmails to Trello cards

Gerardo León — Thu, 06 Aug 2026 04:19:35 +0000

Update — August 2026

This article documents an experiment originally published in April 2023. The Gmail-to-Trello concept and both APIs remain available, but the linked implementation should now be treated as an unmaintained experimental prototype, not as a production-ready or plug-and-play tool.

The repository targets the unsupported Node.js 16 runtime and uses pkg, which was archived in 2024. It also requires security and reliability fixes, including removing credentials from logs, correcting email deduplication and startup behavior, improving Gmail time-based queries, and adding safer error handling.

Do not run the current repository with real Gmail or Trello credentials without first reviewing and updating the code and its dependencies. If you test it, use non-production accounts, least-privilege credentials, and revoke the tokens afterward.

Photo by Rolf van Root on Unsplash.

Why ChatGPT?

As a manager, my coding duties have reduced drastically. So, looked everywhere to build or automate something that could impact any close one’s work. Found ChatGPT could be a helper to get some inspiration.

Use case

Someone close does some grunt work that constraints it to share a Gmail account with other three people.
Work is distributed by emails, each member has to pick their corresponding emails and address them.
Problem: most of the times, someone opens an email that does not matter to its responsibility, and leaves it marked as read; so confusion as to if that email was addressed takes over the place.

What’s in the market?

My diagnostic is the group is prone to carelessly leave emails read by any reason; so my solution, after speaking with the affected, is to move the emails to a place where their state is visible and it’s easier to distribute tasks to the responsible ones. The most common tool for transparentizing such type of workspace, to me, is Trello or any board-like tool, besides that has a free tier, accessible to many users, and allows to order work in lists.

Did some research prior to get dirty with code, found there’s a Trello add-on for Gmail. However, it ain’t cool enough: asks to open a mail to see the add-on in action, this did not avoid the scenario were oblivious users could skip creating Trello cards for each email read. Besides that did not provide any way to automate card creation. So that was a no-way.

Without further ado, hands on work…

Solution

There, I came up with some requirements:

Tool should create cards automatically based off a emails from an account.
Tool should not prompt user for any input once it’s setup.
Tool should create cards on a time basis.
Tool should integrate with Gmail and Trello.
Tool should be a plug-and-play thingy.
Cards should be concesive enough and avoid to copy-paste all of the email contents.
Cards should not duplicate.

From there, the inputs and outputs define as:

Inputs: Gmail credentials, Trello integration requirements, user preferences on time basis for these cards to create, target Trello list, target Trello board.
Outputs: Trello cards in given Trello list of a Trello board.

Caveats

I already mentioned I don’t code much often, and have got a bit dusty so decided to use ChatGPT for this journey.
Trello has its capricious way to integrate with custom tools, so that adds a bit of overhead to the final solution.

Talk is cheap, show me the code:

Below is the link to the GitHub repo, where I include prompts used with ChatGPT in prompts.txt:

nosavvy33/gmails-to-trello on GitHub

Next steps

See if this can become a Google add-on so that setup overhead reduces.

Final words

Surprised about how good of a work starter ChatGPT can be, no doubt it still needs polishing and human intervention for its proposed solutions to work. Personally, I come from another profession menaced by AI: translator; where there’s a saying “machine translation will replace translators that translate like machines”. I think of ChatGPT the same way, machine-generated software will replace software developers that write software as machines.

Connect your Github repo to NPM for package deployments

Gerardo León — Sat, 01 Aug 2026 21:41:18 +0000

Most important... 🧐

You should have already a library to publish to npm, if not, you can follow my previous tutorial, it will have you ready for this post 😀

The NPM fun: first publish 👨‍💻

Now we are ready for the NPM fun, add these two scripts to your root package.json:

"build-lib": "ng build custom-ui",
"publish-lib": "npm run build-lib && npm login && npm publish ./dist/custom-ui --access public",

Also, make sure to add these lines to the library's package.json:

"name": "@gblp/custom-ui", <--- make sure you include your npm username
...
"repository": {
    "type": "git",
    "url": "git+https://github.com/elparaquecosadeque/npm-test.git"
  },
  "publishConfig": {
    "access": "public"
  }

After doing so, run this in your terminal:

npm run publish-lib

And your terminal should prompt you for login to npm and then publish

There is our package is already published to NPM:

Let's automate through Github Actions 🐙

Create a .github/workflows directory in your root, and then a publish.yml resembling below:

name: Publish npm package

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
          registry-url: https://registry.npmjs.org

      - run: npm ci --ignore-scripts
      - run: npm run build:lib
      - run: npm publish ./dist/custom-ui --access public --provenance

Push it and let's go to npm interface. There click on Settings > in Trusted Publisher, enable GitHub Actions:

This will ask you in the form for some details you are good to fill out:

Finish with Setup connection button and you're done here:

Github side: trigger NPM publish 🚀

In your repo, go to Actions > Under Actions, "Publish npm package" > Run workflow

As we have defined the trigger workflow_dispatch this means the trigger is manual, let's give it the first go by click on "Run workflow"

Beware: Version conflict 🚀

If you followed to the letter, you must have come across the error below:

This is quite expressive: NPM cannot publish over previous versions. Let's quickly fix by adding to our projects/custom-ui/package.json:

  "version": "0.0.2",

With that, let's try again:

And now lovingly crafted 💓, we see it mirrored in your NPM profile:

Achievements 🎉🙌

Created your first NPM package for reusability in your multiple projects
Integrated CI/CD for your repo
Revisit the repo to verify if you missed something: https://github.com/elparaquecosadeque/npm-test

Create your first Angular components library

Gerardo León — Sat, 01 Aug 2026 05:30:58 +0000

Build the local lib 🔨🤓

To create an angular components lib, we add an parameter to the usual "ng new":

ng new npm-test --create-application=false

cd npm-test

ng generate library custom-ui --prefix ui

ng generate component components/button --project=custom-ui

This will get you a simple component called button in projects/custom-ui/src/lib

Optional: Build a tester app 📖*️

We create a test app to see what we built in our library. For so, run the following:

ng generate application library-tester

There, to invoke the library in the library-tester app, do:

1) Export the component in *public-api.ts * by copying the line below:

export * from './lib/components/button.component/button.component';

2) Import the component in the library-tester app:

// app.ts
import { Component, signal } from '@angular/core';
import { RouterOutlet } from '@angular/router';
import {ButtonComponent} from 'custom-ui';

@Component({
selector: 'app-root',
imports: [RouterOutlet, ButtonComponent],
templateUrl: './app.html',
styleUrl: './app.css',
})
export class App {
protected readonly title = signal('library-tester');
}

// app.html
<ui-button></ui-button>

Run these to verify in two different terminals:

ng serve --project=library-tester

ng build custom-ui --watch

Once done, in your localhost you should get something close to this:

Let's make the component configurable 🌶️🔥

Do the following changes:

1) In button.component.html:

    <button class="custom-btn" [style.background-color]="color">
      {{ text }}
    </button>

2) Your button.component.ts should resemble this:

import { Component, Input } from '@angular/core';
import { CommonModule } from '@angular/common';

@Component({
  selector: 'ui-button',
  standalone: true,
  imports: [CommonModule],
  templateUrl: './button.component.html',
  styleUrls: ['./button.component.css']
})
export class ButtonComponent {
  @Input() text: string = 'Click me';
  @Input() color: string = '#f68f3b';
}

2.a) Optional, add some custom css:

.custom-btn {
  background-color: #3b82f6;
  color: white;
  border: none;
  padding: 10px 20px;
  border-radius: 4px;
  cursor: pointer;
}
.custom-btn:hover {
  background-color: #2563eb;
}

3) In the library tester's app.html you can now pass those variables in the DOM definition:

<ui-button text="Hey there!" color="blue"></ui-button>

By doing all these steps, now your component should look like below:

Achievements 🎉🙌

Created your first Angular library for reusability in your multiple projects
Keep style, look-and-feel consistency across your apps
Revisit the repo to verify if you missed something: https://github.com/elparaquecosadeque/npm-test

What's next 🏁🤓

In this next article, we will learn to publish our Angular components library to npmjs (NPM) to make it available thru npm install command

Happy coding! 👨‍💻

DEV Community: Gerardo León

Do you assume or confirm?

Chapter 1: How I learnt to distrust JavaScript Date

Application problem

Problem

Lesson

Solution

Another problem

Lesson

Solution

Looking back

References

Rotate AWS IAM Access Keys by script

Context

Solution

Problem

Solution

Required

Requirements

Script

Usage

Preconditions

References

Tinkering with ChatGPT: Gmails to Trello cards

Why ChatGPT?

Use case

What’s in the market?

Solution

Caveats

Next steps

Final words

Connect your Github repo to NPM for package deployments

Most important... 🧐

The NPM fun: first publish 👨‍💻

Let's automate through Github Actions 🐙

Github side: trigger NPM publish 🚀

Beware: Version conflict 🚀

Achievements 🎉🙌

Create your first Angular components library

Build the local lib 🔨🤓

Optional: Build a tester app 📖*️

Let's make the component configurable 🌶️🔥

Achievements 🎉🙌

What's next 🏁🤓

Chapter 1: How I learnt to distrust JavaScript `Date`