Tesla has started taking orders for the Model Y Long Wheelbase in the US and Puerto Rico.

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

Introduction: The Need for Modern Web/AppSec Training The cybersecurity landscape is evolving at a breakneck pace, but the tools we use to train the next generation of defenders are stuck in the past. Most web/appsec learning platforms still focus on basic, textbook vulnerabilities —XSS popups, simple SQL injection, or trivial IDORs. These labs are like teaching someone to swim in a kiddie pool; they might grasp the concept, but they’re ill-prepared for the open ocean of modern web applications . The gap isn’t just in depth—it’s in relevance . Real-world apps today are complex, API-driven, and riddled with subtle, pattern-based vulnerabilities that don’t fit into neat, isolated lessons. Consider this: a developer misconfigures a GraphQL endpoint, exposing an entire database. Or an API leaks sensitive data because of a flawed rate-limiting mechanism. These aren’t edge cases—they’re common mistakes in modern apps. Yet, most training platforms ignore them, leaving learners to either stumble upon these issues in the wild or remain oblivious. The result? A workforce of security professionals who can theoretically exploit a vulnerability but struggle to identify or fix it in a real-world context . The problem isn’t just outdated content—it’s the lack of ethical, hands-on practice environments . Many aspiring security professionals resort to illegal or gray-area practices to gain experience, risking legal consequences and ethical dilemmas. What’s needed is a platform that simulates real-world scenarios without crossing ethical boundaries, one that teaches not just how to exploit but also why vulnerabilities occur and how to fix them . Here’s the core issue: modern apps are systems, not isolated components . A vulnerability in one part—say, a file upload feature—can cascade into a full account takeover if combined with a session management flaw. Most labs fail to teach this interconnectedness , leaving learners with a fragmented understanding. A practical platform must brid

submitted by /u/JohnTurturrosSandals [link] [留言]

Originally published on bckinfo.com How to Install VMware ESXi: Step-by-Step Bare-Metal Setup Guide Table of Contents ESXi vs. VMware Workstation: Which One Do You Need Hardware Compatibility Check Downloading the ESXi Installer Creating a Bootable USB Installer BIOS/UEFI Preparation Installing ESXi: Step by Step Configuring the Management Network Accessing the vSphere Host Client Creating Your First Virtual Machine Post-Installation Checklist Common Issues and Quick Fixes Closing Notes If you've read our complete guide to VMware virtualization , you already know ESXi is the bare-metal hypervisor underneath vSphere. This guide is the hands-on counterpart — installing ESXi directly on physical server hardware, from hardware compatibility checks through booting your first virtual machine. ESXi vs. VMware Workstation: Which One Do You Need Before starting, it's worth confirming you actually want ESXi and not VMware Workstation. They solve different problems: VMware Workstation is a Type-2 hypervisor — it installs on top of an existing OS (Windows, Linux, macOS via Fusion). Good for running a VM or two on a laptop or desktop you also use for everything else. If that's your case, our guide on installing VMware Workstation on CentOS Stream 10 is the right starting point instead. ESXi is a Type-1, bare-metal hypervisor — it installs directly on the hardware with no host OS underneath it. This is the right choice for a dedicated server running multiple VMs, a home lab, or anything that needs to scale beyond "a VM running alongside my desktop." The rest of this guide assumes you're installing on dedicated hardware that won't run anything else. Hardware Compatibility Check This is the step most worth not skipping. ESXi has a defined Hardware Compatibility List (HCL), and installing on unlisted hardware is the single biggest source of installation failures and post-install driver issues. Check your exact server model and component list (NIC, storage controller) against VMware'

GitHub Actions shows you one run at a time. Green check, red X, green check, green check, red X. You scroll the list, you re-run the flaky one, you move on. Nobody's asking the question that actually matters: is this getting better or worse? "I calculated how much my CI failures actually cost. Curious what your pipeline success rate looks like — has anyone else tracked the actual wasted compute time over time?" That's a real question from someone who did the math by hand and found their failures were burning a real chunk of their compute budget. The replies were the same story you'd expect: heavyweight CI platforms have their own dashboards for this, but nobody had a lightweight, local way to just... track it. So I built citrend : pull your GitHub Actions run history into a local file, get a trend. npx citrend sync --repo owner/name npx citrend report --repo owner/name What it actually shows you $ citrend report --repo acme/widgets acme/widgets — 812 run(s) (2 in progress) success rate: 87.4% (699/800 settled, 12 skipped) wasted runs: 101 (12.6%) total compute: 118h 42m wasted compute: 14h 6m weekly trend (oldest → newest): 2026-06-05 91.2% success, 8 wasted (58m) 2026-06-12 88.0% success, 11 wasted (1h 22m) 2026-06-19 79.4% success, 22 wasted (3h 8m) 2026-06-26 84.1% success, 15 wasted (2h 1m) That weekly column is the entire point. A single gh run list will never show you that week 3 was a cliff — you'd have to notice it got annoying to work in, which is a much slower and much less precise signal than a number going from 91% to 79%. How it works sync pulls your workflow run history from the GitHub REST API and caches it locally (deduped by run id, so you can run it on a schedule without piling up duplicates). report reads that cache — no network call — and computes: Success rate , over settled runs only (still-running runs don't count either way until they conclude, and skipped runs are excluded from the denominator since they're not a pass/fail outcome). "Wasted"

Know what your team actually shipped today Discussion | Link

Google has released A2UI v0.9, a framework-agnostic standard for AI agents to declare user interface intent across multiple platforms without arbitrary code. The update emphasizes alignment with existing design systems. It includes a new SDK for Python, improved error handling, and various transport methods. Migration guidance and evolution specifications are also provided. By Daniel Curtis

leetcode.com Problem Statement Given the root of a binary tree, return its preorder traversal. Preorder Traversal follows: Root ↓ Left ↓ Right Brute Force Intuition In an interview, you can explain it like this: Visit the current node first, then recursively traverse the left subtree followed by the right subtree. Recursion naturally follows the preorder sequence. Complexity Time Complexity: O(N) Space Complexity: O(H) Where: N = Number of Nodes H = Height of Tree Recursive Code class Solution { public List < Integer > preorderTraversal ( TreeNode root ) { List < Integer > ans = new ArrayList <>(); preorder ( root , ans ); return ans ; } private void preorder ( TreeNode root , List < Integer > ans ) { if ( root == null ) return ; ans . add ( root . val ); preorder ( root . left , ans ); preorder ( root . right , ans ); } } Moving Towards the Optimal Iterative Approach Instead of recursion, we can use a stack. Since preorder visits: Root ↓ Left ↓ Right we should process the root immediately. To ensure the left subtree is processed first, push the right child before the left child . Pattern Recognition Whenever you see: Preorder Traversal Simulate Recursion Think: Stack Key Observation Stack follows: LIFO To visit: Left First push: Right First ↓ Left Second so that left is popped first. Optimal Java Solution class Solution { public List < Integer > preorderTraversal ( TreeNode root ) { List < Integer > ans = new ArrayList <>(); if ( root == null ) return ans ; Stack < TreeNode > st = new Stack <>(); st . push ( root ); while (! st . isEmpty ()) { TreeNode node = st . pop (); ans . add ( node . val ); if ( node . right != null ) st . push ( node . right ); if ( node . left != null ) st . push ( node . left ); } return ans ; } } Dry Run 1 / \ 2 3 / \ 4 5 Stack: 1 Visit: 1 Push: 3 2 Visit: 2 Push: 5 4 Traversal: 1 ↓ 2 ↓ 4 ↓ 5 ↓ 3 Answer: [1,2,4,5,3] Why Stack Works? A stack processes the most recently added node first. By pushing: Right Child ↓ Left Child the left child

Over the past year, AI has become part of many developers' daily workflow. It can generate code, explain unfamiliar frameworks, review pull requests, and even suggest architectural patterns. But I've noticed that the biggest impact isn't on writing code faster. It's on how we think about software architecture. With AI handling repetitive implementation tasks, it feels like architects and senior engineers are spending more time on system design, scalability, security, integrations, and long-term maintainability rather than syntax and boilerplate. At the same time, AI-generated code isn't always production-ready. It still requires strong engineering judgment, careful reviews, and a solid understanding of the underlying architecture. I'm curious how other developers are experiencing this shift. Has AI changed the way you design software systems? Do you trust AI when making architectural decisions? Which parts of software architecture do you think should always remain human-led? Have AI tools improved your team's productivity, or introduced new challenges? I'd love to hear real-world experiences, lessons learned, and different perspectives from the community.

สวัสดีครับเพื่อนๆ! 👋 วันนี้จะมาเล่าเรื่องน่าตื่นเต้นให้ฟังนะเพื่อนๆ สำหรับใครที่เป็นสาย SvelteKit เตรียมตัวอัปเดตความรู้ใหม่กันได้เลย เพราะตอนนี้เขามีของเล่นใหม่ที่กำลังอยู่ในช่วงทดลองใช้งาน แต่บอกเลยว่าว้าวมาก! เราไปดูกันดีกว่าว่ามันคืออะไร... 📡 Remote function คืออะไร เป็น function ตัวใหม่ ✨ (ที่คาดว่าจะเป็น new way to implement สำหรับ Sveltekit 3.0) เอาไว้ใช้สื่อสารพูดคุยกันระหว่างฝั่ง client และ server ของ Sveltekit นั่นเอง 💬 ความเจ๋งคือเราสามารถเรียกใช้มันจากมุมไหนของ Sveltekit ก็ได้ 🌍 ไม่จำเป็นต้องจำกัดแค่ฝั่ง server หรือ client แต่จุดสำคัญคือ การทำงานของมันจะเกิดขึ้นที่ฝั่ง server เสมอ 👍 นั่นหมายความว่ามันสามารถทะลุทะลวงไปดึงข้อมูลหรือโมดูลที่เป็น server-only ได้สบายๆ เช่น ตัวแปร environment ที่เราประกาศไว้ หรือพวกฐานข้อมูลต่างๆ ก็ดึงมาได้ชิลๆ เลย 😎 เวลาจะใช้งาน เราจะต้องใช้ท่าการ await แบบใหม่ของ Sveltekit ⏳ ที่ช่วยให้คุณโหลดหรือดึงข้อมูลแบบ promise มาใช้ใน component ของคุณได้ทันที 🚀 ⚠️ หมายเหตุ: ตอนนี้ทั้ง await และ remote function ยังอยู่ในช่วงทดลองใช้งาน 🧪 (experimental) นั่นแปลว่า syntax บางอย่างอาจจะมีการปรับเปลี่ยนหรือบินหายไปบ้างในอนาคต 🥲 แต่แกนหลัก (core functional) ของมันก็จะยังทำงานได้ตามที่เราคาดหวังแน่นอน ถ้าใครคันไม้คันมืออยากลองของใหม่ตอนนี้ สามารถไปเปิดโหมด experimental ได้ที่ไฟล์ svelte.config.js(.ts) ตามโค้ดด้านล่างนี้เลย 👇 svelte.config.js(.ts) /** @type {import('@sveltejs/kit').Config} */ const config = { kit : { experimental : { remoteFunctions : true } }, compilerOptions : { experimental : { async : true } } }; export default config ; 🏃‍♂️ Let get started!! เราสามารถเริ่มใช้ remote function ได้ง่ายๆ ผ่านการสร้างไฟล์นามสกุล .remote.js หรือ .remote.ts 📝 ซึ่งตอนนี้มี function ให้เราหยิบมาเล่นทั้งหมด 4 ตัวด้วยกันคือ: query (ที่เราจะมาพูดถึงกันในบทความนี้) form command prerender หลักการทำงานเบื้องหลังคือ เวลาที่เรา import ตัว remote function ไปใช้ในฝั่ง client มันจะถูกแอบแปลงร่างเป็นโค้ดที่หุ้มด้วย fetch ในช่วง build time 🏗️ นั่นหมายความว่าระบบจะใจดีสร้างเส้น HTTP endpoint ให้เราแบบอัตโนมัติ ✨ ด้วยเหตุนี้เราเลยเอาไฟล์ .remote.js หรือ .remote.

If you ask what goes on in my head at 3 a.m., this is it. Cristiano is on TV doing his thing. Croatia is getting robbed. And somewhere in there, my brain starts thinking about why I suck at things that I enjoy doing?. Let me take you back a little. I write two kinds of articles. Technical ones, which come naturally to me. And the ones which I call business ones (well, the not-so-technical). I spend most of my time on the business articles. I enjoy writing them. I enjoy reading them back too. And just so you know, I'm not writing all these articles for you. I write to document things. Technical posts are usually just answers to questions people keep asking me. Instead of explaining the same thing again, I write it once and send the link. Someone once told me that the best way to really learn something is to teach it to someone else, or even just say it out loud to a wall (You should be doing the same; trust me, it helps). So this blog is my wall. Turns out my wall has people sitting on it. That's you. Anyway. Back to the real question. The real question is about my own head I think "Why do I enjoy things I'm not great at" is the wrong way to say it. The better question is: why do I think I enjoy things I'm not great at? Because this whole idea lives in my head. And the stats page just proved me wrong. Here's what happened. I looked at the numbers on my published articles. I don't usually do this, because I write for myself, not for the numbers. But numbers don't lie. My technical articles get read a lot more than my business ones. And the business ones are the ones I enjoy writing the most. Maybe it's the people around me. Most of them are technical, so maybe the technical stuff feels more exciting to them. Fair enough. But that only explains the blog. It doesn't explain the rest of my life. It's not just about writing I like playing soccer. I'm honestly the last person you'd want on your team. I'm bad. I won't pretend otherwise. But do I enjoy playing? Yes. A lot. I

I've been trying to learn coding for 35 years, which is my age. I love coding, and love the fantasy of being a coder. I love the whole thing about it. It's not a unhinged passion, but still something I carry very close to my digital heart. I started with VB6, and excel, and then web and I have never been particularly good at anything. If you ever met someone that loves gaming or sports but are bad at them, that's me. I need to have coding in my life, I'm just not good enough, ever. And that's fine. I discovered vibe coding because I follow all tech stuff. I've been trying to build certain things for years. I'm not necessarily desperate to build them but I do want them. Discovering AI allowed me to build personal web apps I always wanted to but was limited. All of the sudden I was able to build all web apps I wanted. I did 8 different projects in weeks. None of these things were for everyone, but very specific, tailored apps that help me at work, and in my personal life. Kinda trivializes the unbelievably fucking hard thing that is to learn evem the most remote thing about coding. Ive quit so many times becase concepts and terms I don't get. I still don't know what the fuck a prototype is in JavaScript even tho I got the certificate from FCC. Yet here I am building things that not even my imagination could put together. Am I enjoying it? Yes. Has it been beneficial? Fuck yes. I have been given the tools to create things my skills can't help me to. At the same time, as a person that have been trying to learn since I'm like 15, I know this isn't something to be trivialized. But at the same time I do have tools that trivializes it and they're available and free and works. Am I a disgusting person for feeling empowered? This is the first time in my journey I'm able to build actual things with the help of thear tools, but I also feel it's so disrespectful because I struggled for ALL MY LIFE trying to learn it. That said, since I stated vibe coding I've learn so many shit

The trust problem nobody scopes correctly When companies talk about trust in AI, they almost always mean trust in the model. Is the output accurate? Is it hallucinating? Can we rely on what it says? Those are valid questions but they're the wrong starting point. The trust that actually determines whether AI gets adopted or quietly abandoned inside an organization isn't about the model. It's about the system surrounding it. The four questions that determine Every team evaluating AI in a production workflow eventually runs into the same four questions. Not about model quality. About operational control. Can we understand the outputs? Not just "does the answer look right" but can someone on the team explain why this output was produced and whether it's appropriate for this specific context. An AI that generates correct-looking code or recommendations that nobody can verify is a system that runs on hope. Hope doesn't survive the first incident. Can we validate the decisions? When the AI recommends an action or generates an output that feeds into a business process, is there a way to check it against the actual requirement? Or does the team just trust the output because questioning it is harder than accepting it? The second one is more common than anyone admits. Can we intervene when needed? When something goes wrong, how fast can a human step in? Is there a kill switch? Is there a fallback path? Or does the AI output flow directly into downstream systems with no circuit breaker? The teams that skip this question are the ones that discover the answer during an incident. Can we trace what happened afterward? When an AI-generated decision produces a bad outcome, can you reconstruct the chain? What input went in, what output came out, what context was available, what wasn't? Without traceability, post-mortems hit a dead end, and the same failure happens again. Why opaque systems don't survive real operations There's a tempting argument that opacity is fine as long as the sy

I'm a bit annoyed by the feeling that we're kind of stuck when it comes to using LLMs for programming. I use Claude Code and Codex, but I haven't been able to enter flow state like I can when I hand write code. This is kind of ironic to me since AI should be a bicycle for the mind, but right now it feels like a bicycle that just brakes abruptly every couple minutes. I stop, wait, review, prompt again. Is there anyone exploring something fundamentally different than the prompt response loop we ha

If you ask any senior backend engineer or database administrator how to instantly make a slow, disk-bound application faster, their first answer is almost always: "Put it in memory." But why is memory so preferred, and how do modern architectures utilize RAM to achieve sub-millisecond latencies? We're seeing a massive revival of RAM disks and in-memory architectures. Let's explore why computer experts are increasingly treating RAM like a hard drive. 1. The Physics of Storage: Why RAM Wins To understand the shift towards in-memory architectures, we have to look at the numbers. Hard Disk Drives (HDDs): Mechanical spinning disks. Seek times are around 2-5 milliseconds . Solid State Drives (SSDs): Flash memory. Seek times are around 0.1 milliseconds (100 microseconds) . RAM (Random Access Memory): Volatile silicon. Access times are around 100 nanoseconds . RAM is roughly 1,000 times faster than an SSD and 10,000 to 50,000 times faster than an HDD. When you have a high-throughput system serving millions of requests per second, waiting for a disk to seek is an eternity. 2. In-Memory Databases: Redis and Memcached The most common implementation of this principle in modern backends is the In-Memory Database . How They Work Instead of writing every transaction to an SSD, systems like Redis and Memcached store the entire dataset directly in RAM. This bypasses the OS file system cache, disk I/O bottlenecks, and complex B-tree traversals required by traditional relational databases like PostgreSQL or MySQL. The Trade-off: Durability RAM is volatile. If the server loses power, all data is gone. So how do in-memory databases survive crashes? Snapshots (RDB in Redis): Periodically dumping the entire memory state to disk. Append-Only Files (AOF in Redis): Logging every write operation to a disk sequentially. Sequential writes to disk are significantly faster than random writes. This hybrid approach gives you the read/write speed of RAM with a "good enough" durability guarantee for

Todo projeto que envolve autenticação via telefone acaba esbarrando no mesmo problema chato: como testar isso de verdade? Você não pode ficar digitando seu próprio número toda vez que roda um fluxo de cadastro. Definitivamente não deveria pedir para os colegas de equipe cederem o deles. E a maioria dos pipelines de CI não tem uma pessoa sentada ali, pronta para ler uma mensagem de texto e digitar o código num formulário. É uma daquelas coisas que parecem pequenas até você estar três sprints dentro de um projeto com 2FA via SMS e perceber que a cobertura de teste desse fluxo inteiro é "testei uma vez, manualmente, antes do almoço". Por Que a Verificação por Telefone É Complicada de Testar A maioria dos fluxos de autenticação de um stack típico é fácil de automatizar. Verificação por e-mail, dá para interceptar com uma caixa de entrada de teste ou um serviço de captura de e-mails. Tokens de sessão, dá para mockar. Redefinição de senha, você controla o loop inteiro. O SMS quebra esse padrão porque o código precisa sair completamente do seu sistema, ser entregue por uma rede de telecomunicação real e voltar antes que o teste possa continuar. Essa ida e volta introduz vários pontos de falha que não têm nada a ver com o seu código: atrasos de operadora, filtros de spam, peculiaridades de entrega por região, limites de taxa. Se você já viu um pipeline de CI falhar numa etapa de verificação por telefone e depois passar numa nova tentativa sem nenhuma mudança de código, é quase sempre por causa disso. O instinto de muitas equipes é pegar um número público gratuito de um dos vários sites de "receber SMS online" para checagens manuais rápidas. Isso funciona bem para uma verificação pontual. Mas desmorona rápido quando você tenta automatizar, porque esses números são compartilhados potencialmente por milhares de outras pessoas usando o mesmo pool. Códigos podem se perder numa caixa de entrada lotada, o próprio número pode já estar bloqueado pela plataforma que você está testand

Laravel middleware can be perfectly written and still behave unexpectedly. You may notice authentication running too late, permission checks failing, tenant initialization not working, logging middleware missing important data, or custom middleware executing in an order you didn't expect. In many cases, the middleware code itself is not the problem. The real issue is middleware execution order. Understanding how Laravel executes middleware is critical when building secure and scalable applications because every request passes through multiple layers before reaching your controller. Common Symptoms You may encounter problems such as: Authenticated users being treated as guests Permission middleware failing unexpectedly Tenant information not being available Request logging missing user details Rate limiting triggering before authentication Redirect loops after login Middleware appearing to be ignored completely These issues are often caused by middleware running in the wrong sequence. How Laravel Processes a Request A typical Laravel request follows this flow: Browser ↓ Global Middleware ↓ Middleware Group (Web/API) ↓ Route Middleware ↓ Controller ↓ Response ↓ Browser Each middleware layer can inspect, modify, allow, or block the request before it reaches your application logic. Because of this, execution order matters. Example Problem #1 Suppose you have two middleware: Authenticate User Log User Activity Your logging middleware expects an authenticated user. $user = auth()->user(); However, the log always shows null. Why? Because the logging middleware executes before authentication. The solution is ensuring authentication middleware runs first so user information is available when logging occurs. Example Problem #2 Multi-tenant applications often initialize tenant information through middleware. TenantMiddleware If another middleware accesses the database before tenant initialization, queries may use the wrong database connection. This can lead to: Incorrect data