A practical 5-10 minute checklist for vetting npm dependencies before adding them to production. It focuses on provenance attestations, install scripts, CI quality signals, maintainer responsiveness, and security handling. submitted by /u/OtherwisePush6424 [link] [留言]

The Acer Nitro Blaze Link might run on Linux, but it's no Steam Deck. Acer says it's a "streaming-first handheld and companion device," like a PlayStation Portal for your PC. Announced ahead of Computex on Friday, it's launching in Q4 2026 with a 7-inch (1920 x 1200) display, Wi-Fi 6, just 1GB of LPDDR4 RAM, […]

Checklist for evaluating third-party npm packages before install submitted by /u/OtherwisePush6424 [link] [留言]

At what point does AI-powered monitoring become incompatible with a free society? At what point does this Wild West of tech advances lead to dystopia? We know we can’t stop AI, it’s already here and growing fast. But we can expect better protections and limits of government and corporate use of these tools for surveillance. The big question on this topic - what rules would we put in place if we could even get Congress to ever take action? We will be sharing some thoughts on that in subsequent posts and would love to see what people think. As a political strategist, I think we may need to work at the state levels first to create an intolerable patchwork of regulations to then force Congress to act. If this is done correctly, big AI companies may well beg DC to create something that is nationally standardized. submitted by /u/amfreedomfoundation [link] [留言]

The rise of AI has brought an avalanche of new terms and slang. Here is a glossary with definitions of some of the most important words and phrases you might encounter.

Bun is fast. The README will tell you 4x on bun install , 3-5x on Bun.serve() , 2x on bun:sqlite . Some of this matters for AI agents. Some of it doesn't. We've been running production agents on Bun for about 3 months — a mix of Hono-on-Bun HTTP agents and standalone Bun scripts called from Claude Code and OpenClaw. This post is what we'd tell ourselves 3 months ago about where Bun actually helps and where it bites. Where Bun's speed actually matters for agents Cold starts on agent scripts Agents are spawned. A lot. Every Claude Code hook, every npx invocation, every cron-fired worker. Node's startup is ~80-120ms cold; Bun's is ~15-25ms. For interactive agent loops where the user is waiting on a hook to populate context, that's a noticeable UX difference. The pre-task hook that takes 250ms to do its retrieval feels totally different when the runtime ate 100ms vs 20ms of that budget. This is the strongest case for Bun in agent workflows. Concrete win. bun install for ephemeral agent containers If you spin up containerized agents (Daytona, E2B, Modal, your own ECS task), each cold container does a package install. npm install on a fresh container is 30-90s; bun install is 5-15s. Over thousands of agent runs per day, that's real money. For Workers / serverless / persistent processes, this doesn't matter — you only install once. bun:sqlite for local agent memory If you're building a per-agent local cache (recent tool calls, recently-seen embeddings, scratchpad state), bun:sqlite is genuinely 2x faster than better-sqlite3 on simple selects. It's also zero-install — no native bindings to compile, no Python build chain, just import { Database } from 'bun:sqlite' . If your agent runs on a Bun runtime AND uses SQLite for state, the math works. If you're on Node, just use better-sqlite3 . Where Bun's "speed" doesn't matter LLM inference latency The agent is going to wait 800-4000ms for the LLM to respond. The 50ms of runtime overhead you saved is round-off. Your bottleneck is

Hello Dev Community 👋 I recently built my first web project called Namastra — a simple tool to explore the meanings, origins, and insights behind names. 👉 Live Demo: 💡 Why I built this I noticed that many people are curious about: What their name means Where their name comes from What personality or cultural meaning it carries But most websites are: Too slow Full of ads Hard to navigate So I decided to build something simple, fast, and clean. ⚙️ What Namastra does With Namastra, users can: 🔍 Search any name instantly 📖 Get meaning and origin 🌍 Learn cultural background ⚡ Use a clean and fast interface 🛠️ Tech Stack I built this project using: HTML CSS JavaScript GitHub (version control) Netlify (deployment) Hosted here: [Netlify] Code managed via: [GitHub] 🚧 Challenges I faced As a beginner developer, I faced challenges like: Designing a clean UI Making search functionality smooth Deploying with GitHub + Netlify Structuring data properly But I learned a lot through building it step by step. 🎯 What I learned How to build and deploy a full project How important UI simplicity is How real users think differently than developers How deployment pipelines work (GitHub → Netlify) 🚀 Future improvements I plan to add: More name data Better UI design Categories (religion, origin, country) Possibly AI-based name insights 🙌 Feedback welcome This is my first real web project, so I’d really appreciate your feedback and suggestions. Try it here: 👉 Thanks for reading ❤️ Happy coding!

fd vs find vs ripgrep: I Created 10,000 Files to Settle This Debate TL;DR: fd is ~2.5x faster than find for filename searches, rg demolishes grep by ~3x for content searches, and find + grep combined lose on every single benchmark I ran. But there's a catch: both fd and rg skip hidden files by default, which can bite you if you're not paying attention. Here are the receipts. Why I Did This Every time someone posts a shell one-liner using find on Reddit, there's always that guy in the comments: "jUsT uSe fD, iT's fAsTeR." Then someone else chimes in with "actually ripgrep can do that too." I got tired of the anecdotes. I wanted numbers. Real ones. On real files. So I fired up WSL, generated 10,900 files across 1,506 directories (~143 MB of mixed content), and ran actual benchmarks with hyperfine . No synthetic microbenchmarks, no "I feel like X is faster" — just cold, hard terminal output. Methodology The Test Bed I created a directory at /tmp/fd-benchmark containing: Category Count Details Plain text files 2,000 file_*.txt — 20 bytes each, contains "test content line N" Binary files 2,000 data_*.bin — 15 bytes each Log files 1,500 match_*.log — contains unique "match_this_test_N" strings Config files 1,000 nested_file_*.cfg Nested dir files 1,000 level1_*/level2/level3/deep_*.txt + level1_*/shallow_*.txt Hidden root files 1,500 .hidden_* + .config_*.yml Hidden dir files 500 .hidden_dir/subdir/deep_hidden_*.txt Git objects 500 .git/objects/obj_* Multi-ext source files 800 src_*.{py,js,ts,rs,go,java,rb,php,cpp,h,css,html,json,xml,yaml,md} (50 each) Large binary files 100 large_*.dat — 1 MB each (random data) Total 10,900 $ du -sh . 143M . $ find . -type f | wc -l 10900 $ find . -type d | wc -l 1506 Tools Tested Tool Version What It Does find (GNU) 4.9.0 The OG. Ships with every Linux distro. fd 10.2.0 Rust-based find alternative. Smarter defaults, colored output. grep (GNU) 3.11 Content search. Also the OG. rg (ripgrep) 15.1.0 Rust-based grep alternative. Respects .gi

The botnet was reportedly tied to a Russia-based residential proxy network.

I like to make userScripts and userStyles for myself. I've begrudgingly dealt with Shadow DOM here before, and it's nothing but a pain in the ass. However, now I'm seeing a userStyle that I'm trying to apply being removed immediately as it's applied (using Stylus). What is the mechanism behind this? Other styles from the same style sheet are still being honored. The element still has the same root, and is still be matched by the rules's selector. What might be the way this is achieved? https://youtu.be/YgbOrfel604 (Chromium 124.0.6367.61 (Official Build) (64-bit)) submitted by /u/svArtist [link] [留言]

Most indie hackers I know spend an embarrassing amount of time on the naming part. We argue with ourselves over the perfect .com, eventually settle for some janky combo of words with random consonants ripped out, and ship a domain we secretly don't love. There's a quieter option a lot of builders haven't seriously considered: .Vegas. It's a geographic TLD, but it does NOT require you to be in Las Vegas or build anything Vegas-related. What it does give you is a TLD that sounds bigger than it costs, reads as memorable, and is still wide open in 2026. I went down a small rabbit hole this week looking at side-project ideas that would have an almost unfair head start on .Vegas. Here are five. 1. A weekend trip planner Domain: weekend.vegas or trip.vegas This is the lowest-hanging fruit and I'm honestly surprised nobody's built it yet. A tiny webapp that takes a Friday-to-Sunday window and spits back a fully booked itinerary: flight, hotel, two restaurant reservations, one show, one activity. Three clicks, done. Why it works on .Vegas: the domain is the elevator pitch. Nobody needs to read your tagline. The URL bar tells you what the product does. That's worth more than most landing-page copy will ever earn. 2. A bachelor/bachelorette party coordinator Domain: bach.vegas , party.vegas , last.vegas Group-trip coordination is genuinely awful. Splitwise + a group chat + a shared Notion doc + that one friend who keeps forgetting to Venmo back. There's room for a niche product here that handles the deposit splits, the "who's in for the cabana" upsells, and the inevitable last-minute flight changes. Why it works on .Vegas: the URL doubles as a tagline. You don't have to explain what kind of trip it's for. 3. A booking aggregator for shows and residencies Domain: shows.vegas , tonight.vegas Caesars, MGM, Live Nation, AXS, Vivid Seats, the venue's own ticketing system — finding a good show on a specific Tuesday night is a pain. A scraper-backed booking aggregator that's honest a

In web development, every millisecond on the critical path matters. Typography is part of your visual identity, yet a single self-hosted family can add hundreds of kilobytes before the browser paints the hero line clients actually see. That cost often shows up as slower First Contentful Paint (FCP) and a worse Largest Contentful Paint (LCP) when the LCP element is a headline set in a custom face. Font subsetting is the practical fix: ship only the characters (glyphs) each page or component needs instead of entire typefaces built for every language and symbol you will never render. What font subsetting is A typical desktop font file contains thousands of glyphs: Latin extended, Cyrillic, ligatures, numerals, punctuation, and symbols you may never use on a marketing site. When you @font-face that file or pull it from a CDN, the browser still has to download and parse the whole package unless you split it. Subsetting creates a smaller font file that includes a defined subset of Unicode code points. Examples: A display font used only on one H1 might need fewer than 40 characters. A Latin-only blog body font does not need CJK tables on every article. UI labels in English can omit unused weights and scripts. The browser downloads less data, spends less time decoding, and can apply the face sooner. You keep the look; you drop the dead weight. When font subsetting improves web font performance and LCP Subsetting pays off fastest in these cases: Situation Why subsetting helps Display or hero typography Few unique characters, high visual impact, often on the LCP text node Single-language sites Remove unused scripts and diacritic ranges you do not publish Icon or logo fonts misused as full fonts Replace with SVG where possible; subset if you must keep a font icon set Multiple weights loaded globally Subset per weight, or load weights only on routes that need them It is lower priority when you already use a system font stack for body copy and only load one small variable font w

An account manager forwarded us a Search Console screenshot at 4:47 p.m. on a Friday. LCP on the homepage had been in the red for eleven days. Engineering had not been in the thread because nobody was assigned to watch the numbers until a sponsor noticed. That is reactive performance monitoring in practice: fast tools, slow humans, and a calendar that only opens when someone else raises the alarm. Proactive monitoring is the opposite shape. Scheduled lab tests run whether or not anyone remembered to open PageSpeed Insights. Performance budgets turn history into rules. Alerts fire when those rules break, with enough context to triage and enough restraint that people still read them. The word “smart” in product copy usually means the second part: alerts that match how teams actually work, not a louder siren. This post is for agency leads who already automate some tests but still learn about regressions from client inboxes. We walk through what reactive looks like, what proactive requires, and how to wire alerts so they change behaviour instead of training everyone to mute the integration. What reactive performance monitoring looks like on agency teams Reactive does not mean “no tools.” Most agencies we speak with have PageSpeed Insights bookmarks, a monthly spreadsheet, and a standing item on the retainer review slide. Reactive means the signal arrives after the business event you wanted to prevent. Common patterns: Spot checks after deploy. Someone runs PSI on staging, ships, and assumes production matches until a complaint arrives. Quarterly or monthly report pulls. CrUX and Lighthouse exports go into a deck. Useful for storytelling; too slow to catch a plugin update that moved INP on Tuesday. Client-led discovery. The sponsor pastes a screenshot, asks “is this new?”, and the team scrambles to reproduce on a laptop that may not match the lab conditions you use in production monitoring. Alerting without policy. Webhooks fire on every metric twitch. By week three the

Hermes Agent: Why Open-Source AI Agents Are Changing How We Build Software Introduction Artificial intelligence has moved far beyond simple chatbots. Today, developers are building systems that can reason through problems, use tools, execute tasks, and make decisions across multiple steps. These systems are commonly known as AI agents. Recently, I explored Hermes Agent, an open-source agentic framework designed to run on your own infrastructure while providing advanced capabilities such as planning, tool usage, and multi-step reasoning. After spending time understanding how it works, I came away with a greater appreciation for the role open-source agents may play in the future of software development. In this article, I'll explain what Hermes Agent is, what makes it interesting, and why developers should pay attention to the growing ecosystem of open-source AI agents. What Is Hermes Agent? Hermes Agent is an open-source agent framework designed to perform tasks that require more than a single response from a language model. Instead of simply answering questions, Hermes Agent can: Break down complex objectives into smaller steps Use external tools when necessary Maintain context across multiple actions Perform reasoning before taking action Execute workflows autonomously This approach allows developers to build systems capable of handling real-world tasks that would normally require human intervention. For example, rather than asking an AI to summarize a document, you could instruct an agent to: Find relevant documents. Analyze their contents. Extract key insights. Generate a report. Save the results to a specified location. The agent coordinates each step as part of a larger workflow. Why Open Source Matters One of the most compelling aspects of Hermes Agent is that it is open source. Many powerful AI tools today operate behind closed platforms where developers have limited visibility into how systems work. Open-source alternatives provide several advantages: Transp

If you have been following the 100 Days of Solana challenges, you have already worked with tokens. You created mints, set up token accounts, transferred SOL, and explored token extensions. But there is a distinction that comes up constantly in web3, and understanding it properly will change how you think about everything you build going forward. Fungible and non-fungible tokens. You have probably heard these terms before, especially NFTs. But what do they actually mean on Solana, and how does the same token system handle two very different concepts? What makes something fungible Fungible just means interchangeable. One unit is identical to another unit. If I have 10 USDC and you have 10 USDC, ours are exactly the same. It does not matter which specific USDC tokens I hold because they are all worth the same and behave the same way. We could swap them and nothing changes. This is how most things you are used to work. A dollar bill is fungible. A liter of petrol is fungible. One unit of SOL is the same as any other unit of SOL. When you built token transfers in the challenges, you were working with fungible tokens. You did not need to care about which specific tokens moved, just how many. Fungible tokens are used for currencies, stablecoins, utility tokens, governance tokens, loyalty points, in-game currencies, and anything where the quantity matters more than the individual unit. What makes something non-fungible Non-fungible means unique. Each token is different from every other token, even if they come from the same collection. If I have NFT #42 from a collection and you have NFT #87, those are not interchangeable. They might have different images, different properties, different rarity, or different utility. Think of it like event tickets. Two tickets to the same concert are not the same if one is front row and the other is in the back. They came from the same event, but each one is distinct. Non-fungible tokens are used for digital art, collectibles, membership pa

By definition an llm is just a manifold in a space with (whatever dimension of a single token)* times (context length) dimensions. human text is naturally going to cluster over certain regions and since neural networks are defined over the entire space this means that there are regions where the LLM is extrapolating into something completely outside any human text it has seen. Now my question, is there any research that investigates this? look at the boundaries of an LLM? or really anything on the topology of an LLM? My guess is that most of it is going to be gibberish input tokens producing a gibberish output token, but there has to be somethings of interest. submitted by /u/CognitioMortis [link] [留言]

Most developers paste production JWTs into online decoders without thinking. Here's a 10-second DevTools check to see if your token is actually leaving your machine. A coworker was debugging an auth bug last month. Standard workflow: copy the JWT from the failing request, paste it into an online decoder, read the payload. I've done it a thousand times. You probably have too. Except the token he pasted belonged to a real customer. And the decoder he used is owned by an identity company that's had its share of security incidents. Nothing bad happened. Probably. But it made me think about something I'd never actually checked: when you paste a JWT into an online decoder, where does that token go? What a JWT actually contains Quick reminder of why this matters. A JWT isn't encrypted — it's just Base64URL-encoded. Anyone who has the token can read everything in it: header.payload.signature The payload routinely contains: User ID, email, and role Session identifiers Token expiry ( exp ) and issue time ( iat ) Sometimes — against best practice — far more And here's the part people forget: a valid, unexpired JWT is a live credential. If it hasn't expired, whoever holds it can often impersonate the user. Pasting it into a random website is functionally similar to pasting a password. The 10-second check Most online JWT decoders claim to be "secure" and "client-side." Some are. Some aren't. You don't have to trust the claim — you can verify it yourself in 10 seconds: Open the decoder in your browser Open DevTools → Network tab Clear the network log Paste a JWT and decode it Watch the Network tab If any request fires when you decode — your token left your machine. A truly client-side decoder fires zero network requests during decoding. The JavaScript does everything locally; nothing is sent anywhere. Try this on whatever decoder you currently use. You might be surprised. Why most "online" tools send data It's usually not malicious. Building decoding logic on the server is someti

I have been receiving pretty good offers for B2B contracts. I've been employed for the 7+ years here and, wasn't fired, had np joining whichever company, always got a raise hoping or within the company. The issue is that in some of those , mgmt and leadership people keep changing in less than 6-12 months. Goals, focus, performance, even structure keep changing out of nowhere, regardless of me being consistent or better in whatever made up metric they have always get some stupid ass feedback of something I should be doing outside my job or expertise. Am I being naive? every f..ing company is like that right? I've been wondering if maybe it is not for me being a full-time employee. Are contractor roles less focused on that? What is your exp from what I said above? don't care about goals, being on call or career paths. Just want to do the job, deliver and move on to the next project. I've been promoted many times, had leader roles, don't recommend, don't like, no added value for me and promotions don't give more money or improved my contract. What about agencies that provide dev services and you get allocated for short times? Also got those positions but no idea how it works and how stable it is. I always have been fulltime employee my entire working life. If you have resource about opening a company for B2B contracts, please link it to me, I would be mostly interested in something around Austria/Hungary area. I am specialized in FE hence posting here. EDIT: clarity on the second paragraph submitted by /u/Raziel_LOK [link] [留言]