标签：#EV

Here is why this article is worth your time: you cannot tell what a generated setup script does by reading the diff. A diff shows you the words that will run, not the files that will be touched, the network connections that will be opened, or the directories that will be wiped at execution time. For a small patch, manual review may be enough. For a server initialization or cleanup script produced by a free model, the danger is in the side effects you never see in the source. This guide turns that problem around. Instead of trying to predict behavior from generated code, you run the code inside a fake root filesystem and record the operating system calls it makes. The technique uses honeypot files, a minimal chroot, and strace to produce a syscall journal. It works especially well when you can generate the script with a free model and run it on a free Linux box that you are allowed to throw away afterward. Disclosure: This article was prepared as part of MonkeyCode's product outreach. If you have MonkeyCode's free model access and free server option available, you can use that server as the throwaway Linux box described in the examples below. The commands assume a Linux host where you can install strace and have root privileges, which is common for a disposable cloud instance or a small virtual machine you control. Build a fake root before you run anything Create a directory that will act as a minimal root filesystem. You do not need a full distribution; you only need enough structure for the script to attempt its operations and for you to watch what it touches. mkdir -p fake_root/bin fake_root/tmp fake_root/var/log fake_root/home/user fake_root/.ssh Inside this fake root, place simple executable stubs so that commands like ls , cat , and rm do not fail immediately. Use /bin/sh from the host in the chroot command later, or copy a static shell into the fake root if available. The important part is not completeness; it is observability. Create executable placeholders f

This is a submission for Frontend Challenge - Comfort Food Edition Perfect Landing. What I...

Building Pure Dart Web Apps Without Compromise When developers evaluate Dart for the web, they typically face a stark tradeoff: Flutter Web : Exceptional for canvas-driven applications, design systems, and cross-platform desktop/mobile parity—but heavy for content-first landing pages, docs, and fast-loading SEO sites. Jaspr Web : A lightweight, component-driven framework that compiles pure Dart to HTML and CSS with instant first paint and full search engine indexing. When we built the official documentation and showcase site for BlocSignal , we knew Jaspr was the perfect foundation. But like many engineers diving into a new UI paradigm, our initial implementation took a shortcut: we used raw StatefulComponent lifecycles and manual .subscribe() callbacks to wire up our state machines. It worked—but it wasn't idiomatic. In this behind-the-scenes case study, we walk through the process of dogfooding bloc_signals_jaspr across blocsignal.dev , replacing manual subscription glue with declarative consumer components, achieving 100,000 operations/sec in compiled JavaScript , and exploring the sheer developer ergonomics of Dart 3.13 primary constructors . The "Manual Subscription Trap": Why Raw .subscribe() Fails at Scale In classic Flutter or Jaspr development, when you create a state machine without framework-level consumer widgets, you might be tempted to subscribe inside initState() : // ❌ THE ANTI-PATTERN: Manual subscription glue in StatefulComponent class LiveVisualizerState extends State < LiveVisualizer > { late final LiveCounterBloc _bloc ; @override void initState () { super . initState (); _bloc = LiveCounterBloc (); // ⚠️ Flaw 1: Every state change triggers a full component setState _bloc . state . subscribe (( _ ) { if ( mounted ) setState (() {}); }); } @override void dispose () { // ⚠️ Flaw 2: Manual dispose tracking _bloc . close (); super . dispose (); } } While this appears harmless in a simple counter demo, it introduces three severe architectural flaws:

There is no manual for TronSoft. No API reference, no schema diagram, no forum thread explaining why a comanda refuses to close. If you want to understand it, you open the database and start pulling threads until something makes sense. That's exactly what I did — for months, on top of my actual job. The problem nobody wrote down I'm the Operations Manager at a restaurant in Itaúna, a mid-sized town in Minas Gerais, Brazil. I'm also the only person there who writes software. Not because I was hired to — because the restaurant runs on a Brazilian ERP called TronSoft, built on a Firebird database, and Firebird doesn't come with the kind of ecosystem you get around Postgres or MySQL. No Stack Overflow flood of answers. No official docs beyond a thin operator manual. Vendor support exists, but it's slow, and it doesn't scale to "I want to automate this specific internal workflow at 11pm on a Tuesday." So when I needed to automate payment reconciliation, close out comandas without touching the vendor's fragile UI, and trigger fiscal document emission (NFC-e) reliably, I didn't have a spec to follow. I had a live production database and a lot of curiosity. Learning a system by watching it think I started the way you'd expect: opening tables, guessing at relationships, breaking things in a test environment until I understood why they broke. Over time that turned into something more systematic — I ended up documenting 390 tables and 514 foreign keys across roughly 40 functional modules, entirely from observation. No vendor documentation, no source code access. Just structure, inference, and a lot of trial and error. Some of what I learned only reveals itself under pressure: Firebird's SQL dialect has its own quirks — FIRST 1 instead of LIMIT , for one. Small thing, but it breaks every query you copy-paste from a Postgres tutorial. Primary keys aren't auto-incrementing in the way you'd assume. They're driven by generators ( GEN_ID ), and if you write a record without syncing

Why Environment Variables Matter Every app has secrets: API keys, database URLs, admin passwords. Hardcoding them in source code is a one-way ticket to leaks. Even if your repo is private, you never know who forks it or what CI logs expose. Environment variables are the standard way to keep configuration out of code. But using them safely requires a few habits that go beyond just process.env . The Basics: Loading and Accessing In Node.js, you read env vars with process.env . But you should not access them raw everywhere. Create a central config module that validates and exposes them. // config.js const required = [ ' DB_URL ' , ' API_KEY ' , ' PORT ' ]; for ( const key of required ) { if ( ! process . env [ key ]) { throw new Error ( `Missing required env var: ${ key } ` ); } } module . exports = { dbUrl : process . env . DB_URL , apiKey : process . env . API_KEY , port : parseInt ( process . env . PORT , 10 ), }; Fail fast at startup. If a required variable is missing, crash immediately rather than failing later in a confusing way. Never Commit .env Files Tools like dotenv load variables from a .env file for local development. That file must stay out of version control. Add .env to your .gitignore immediately. Also add .env.local , .env.production , etc. if you use them. Instead of committing the actual values, commit a .env.example with placeholder or fake values. This documents what is needed without exposing anything. # .env.example DB_URL = postgres :// user : password @ localhost : 5432 / mydb API_KEY = your - api - key - here PORT = 3000 Use a Validation Library Manual checks are fine for small projects, but for anything serious use a schema validator like envalid or joi . They give you type coercion, defaults, and clear error messages. // with envalid const { cleanEnv , str , num } = require ( ' envalid ' ); const env = cleanEnv ( process . env , { DB_URL : str (), API_KEY : str (), PORT : num ({ default : 3000 }), }); module . exports = env ; This catches m

It happened during a quiet Friday sermon at the local masjid. The room was dense with silence, the kind that feels heavy and intentional. Suddenly, a jarring ringtone shattered the atmosphere—someone’s phone, vibrating against the hardwood floor. It wasn't my phone, but the collective wince of the entire room was visceral. A hundred people stopped mid-thought, turning their heads toward the source of the noise. I sat there, my own phone tucked in my pocket, realizing that I had almost been that person just a week prior. It was a moment of pure, avoidable human friction. We live in an age where our devices are supposed to be smart, yet they consistently fail at the most basic context-awareness. I found myself manually toggling my sound profile before every meeting, lecture, or appointment. It is a recurring cognitive tax. If I remembered, great. If I forgot, I risked social embarrassment. Even worse, once the meeting ended, I would inevitably leave my phone on silent for the rest of the day, missing important calls from family or clients. Existing solutions often felt like overkill—they required account creation, constant background sync to a cloud server, or permissions that felt invasive for a task as simple as changing a volume setting. I wanted something that lived entirely on the device, functioning as a silent, invisible utility that didn't need to 'phone home' to function. When I started building Muffle, I decided early on that the entire architecture would be zero-cloud. This wasn't just a philosophical choice; it was a technical constraint I imposed to ensure the app remained performant and trustworthy. By forcing myself to avoid backend dependencies, I had to rely heavily on Android’s AlarmManager and ForegroundService patterns. The biggest challenge was the 'Prayer Time' trigger. Most developers would reach for a Firebase Cloud Function to calculate these times based on the user's location. Instead, I integrated the Adhan library locally. I had to handle c

The company will also be able to expand its fleet across more of the San Francisco Bay Area and Los Angeles.

A user reports that they keep getting logged out. Not immediately — after a while, randomly, always...

85 containers. 24 PostgreSQL databases. 67 domains. 232 cron jobs. One developer. 120 EUR/month in Hetzner bills. This is not a startup fantasy pitch. This is my production infrastructure for a SaaS ecosystem serving German golf clubs, a golf school management platform, a community platform, a CRM, and an auth service. Every customer gets their own database. Physical tenant isolation, not software filters. People tell me this cannot work. The containers disagree. The Stack Next.js for all frontends. Single-tenant PostgreSQL per customer (Supabase stacks). Docker on bare metal. Coolify for deployment orchestration. Traefik as the reverse proxy handling 67 domains. Two Hetzner servers in Germany. Total infrastructure cost: 120 EUR/month. The single-tenant architecture is a deliberate trade-off. Multi-tenant saves infrastructure cost, but one RLS bug exposes every customer's data. One compromised tenant enables lateral movement to all others. GDPR Article 17 deletion in multi-tenant requires complex cross-tenant queries. In single-tenant, deletion is DROP DATABASE . No residual risk. The cost is more operational complexity. Which is exactly why automation is not optional. 176 Guard Rules: The Immune System My AI agents (Claude Code with custom hooks) execute roughly 80% of daily development and operations work. That is dangerous without constraints. So I built a guard system: 176 shell scripts that fire on every command, every file edit, every session end. The architecture is simple. Four dispatchers route to context-specific guards: #!/bin/bash # Pre-Bash-Dispatcher: Loads guards based on command profile. # Not all 176 guards fire on every command. Profiling classifies # each command (git, docker, npm, database, deploy, comms) and # loads only relevant guards. set -uo pipefail GUARDS_DIR = " $( dirname " $0 " ) /guards" INPUT = $( cat ) CMD = $( echo " $INPUT " | jq -r '.tool_input.command // ""' ) # 8 security gates fire ALWAYS, non-negotiable: # tabu-gate, pii-gate,

This is a submission for Frontend Challenge - Comfort Food Edition, Perfect Landing What I...

Google has launched Gemini 3.7 Flash, providing significant updates for coding, automation, and the development of autonomous agents. The company reduced production pricing to help businesses deploy these tools more affordably. This release comes only three weeks after the previous version, signaling a faster pace for developer-focused updates. Accelerated development cycles and cost reduction strategies The introduction of Gemini 3.7 Flash highlights a shift in how technology providers manage their product lineups. Google is prioritizing rapid iteration for its Flash series, which serves as a high-speed tool for developers. This latest version arrived less than a month after its predecessor, showing the company responds quickly to user feedback. Engineers designed this model to handle software engineering tasks and complex, multi-step workflows with higher precision. Pricing for the new model sits at $0.75 per million input tokens and $3.75 per million output tokens. This represents a reduction of approximately fifty percent compared to the prior version. By lowering the financial barrier, Google aims to make large-scale production deployments more sustainable for businesses. The company describes this version as a reliable workhorse capable of following instructions with greater accuracy than previous iterations. While the Flash series moves quickly, the more advanced Pro models follow a different path. These high-end models, designed for the most difficult reasoning tasks, see less frequent updates. During recent financial discussions, leadership at the company did not provide a specific timeline for the next Pro release. This indicates a growing gap between fast, cost-effective models and the slower development of premium intelligence tiers. Industry trends in model tiering Other companies in the industry are following similar patterns by separating their offerings into distinct categories. For example, some competitors have launched high-end variants alongside

That makes it the cheapest EV in Kia's lineup.

Pocket users have until October 8, 2025, to export their saved articles and other items, including lists, archives, favorites, notes, and highlights.

مرتين خلال أسابيع صار موقعنا يبدو سليمًا تمامًا ولا يستجيب للضغط. الصفحة تُحمَّل، والتصميم في مكانه، والكونسول نظيف، والزوار لا يستطيعون فتح أي رابط. في المرتين لم يكن السبب خطأً برمجيًا بالمعنى المعتاد. كان سلوكًا موثّقًا في المتصفح يعمل كما صُمّم تمامًا، لكنه انطبق على نطاق أوسع مما توقّعنا. والأخطر أن اختباراتنا الآلية مرّت بنجاح في الحالتين. الحادثة الأولى: إعداد واحد عطّل سبعين عنصرًا أضفنا ويدجت مساعد ذكي للموقع، وفيه إعداد يفتح نافذة المحادثة تلقائيًا عند دخول الزائر. فعّلناه. بعدها صارت الصفحة ميتة. الروابط لا تُفتح، والأزرار لا تستجيب، وحقول البحث لا تستقبل كتابة. السبب أن الويدجت يعتمد نمطًا شائعًا في نوافذ الحوار: عند فتح النافذة، يضع السمة inert على كل ما عداها حتى لا يتشتت التركيز ولا يهرب مؤشر لوحة المفاتيح خارجها. سلوك صحيح ومطلوب في الحوارات. المشكلة أن الفتح التلقائي يجعل هذه الحالة هي حالة الصفحة الافتراضية عند كل زيارة . سبعون عنصرًا في الصفحة ورثوا inert ، وبقوا كذلك حتى يغلق الزائر نافذة لم يطلب فتحها أصلًا. // ما يفعله الويدجت عند الفتح document . querySelectorAll ( ' body > *:not(.assistant-root) ' ) . forEach (( el ) => el . setAttribute ( ' inert ' , '' )); و inert ليست سمة تجميلية. الفحص السريع يوضح مداها: const el = document . querySelector ( ' a.main-cta ' ); el . offsetParent !== null ; // true — العنصر مرئي getComputedStyle ( el ). pointerEvents ; // 'auto' — لا شيء يمنع المؤشر el . getBoundingClientRect (). width ; // 180 — له مساحة حقيقية el . matches ( ' :disabled ' ); // false — ليس معطّلًا el . closest ( ' [inert] ' ) !== null ; // true ← هنا الجواب كل فحص اعتدنا عليه يقول إن العنصر سليم. inert تعمل في طبقة أخرى: تُخرج العنصر وكل أبنائه من شجرة الوصول، وتلغي استقباله لأحداث المؤشر والتركيز، بلا أي أثر في الأنماط المحسوبة . لماذا مرّت الاختبارات اختباراتنا كانت تسأل الأسئلة المعتادة: هل العنصر موجود في الـDOM؟ هل هو مرئي؟ هل نصّه صحيح؟ الإجابات كلها نعم. ما كشف العطل كان لقطة شاشة نظر إليها إنسان ، ثم محاولة ضغط واحدة. الفحوص البرمجية كانت تصف صفحة سليمة بينما الزائر يرى صفحة جامدة. إن كنت تستخدم أي مكوّن يطبّق inert ، أضف هذا التأك

This is a submission for Weekend Challenge: Dog Days Edition What I Built Three months after adopting my rescue, I noticed he was sleeping more and eating slower. I thought he was "settling in." Six months later, the vet told me he had Stage 3 arthritis. Completely treatable if caught early. I'm not alone. 60% of serious health issues in dogs are discovered after symptoms become severe. Owners spend $653 on average at emergency vets for things that were either totally normal or should have been caught weeks earlier. And 59% of dogs in the US are overweight without their owners realizing. PawWise is an AI vet friend that gives dog owners what they actually need: instant clarity. Upload a photo of your dog and get: Health Check : Body condition score, coat health, posture analysis, breed-specific risks Behavior Decoder : "Why is my dog doing this?" with breed context and training steps Emergency Triage : Is this an emergency? Green/Yellow/Orange/Red urgency with first aid Dog Court (fun mode): Your healthy dog committed a crime? AI generates a voice-acted courtroom drama The serious modes solve real problems. The fun mode gives you something to share when everything is fine. Demo simplynadaf.github.io Try it live: simplynadaf.github.io/dog-court Upload any photo of your dog. The AI will analyze it and give you a full health report with actionable next steps, spoken aloud in a calm voice. In Dog Court mode, upload evidence of your dog's "crime" (chewed shoes, stolen food, destroyed pillows) and listen to a full multi-voice courtroom drama where your dog gets legal representation. Code simplynadaf / dog-court 🏛️ Your dog committed a crime. AI gives them a fair trial. Built with Google Gemini + ElevenLabs for DEV Weekend Challenge: Dog Days Edition 🐾 PawWise AI That Actually Understands Your Dog 59% of dogs are obese and their owners don't know. 60% of serious health issues are caught too late. I built an AI that catches it in a photo. Live Site → • Watch Demo → • Read A

Over the last 10 days, I built FinSaathi, a voice-first AI assistant for the Financial Services track of the VoiceForBharat challenge. The goal was simple: build an assistant that can talk naturally with users, understand financial and government-scheme related queries, remember relevant information, use tools, and know when a human or specialist should take over. What started as a basic voice agent gradually became a complete system with memory, tools, outbound calling, human escalation, call analytics, and specialist-agent handoffs. 💡 The Problem Financial and government-scheme processes can involve eligibility requirements, documents, deadlines, and complicated terminology. For users who are more comfortable speaking than typing, voice can make these interactions much more natural. For example, a user can simply ask: "PMJJBY ke liye main eligible hoon?" Instead of navigating through multiple forms, FinSaathi can understand the request, collect the required information, perform an eligibility check, and explain the result conversationally. The goal is not to replace banks or human support, but to provide a conversational first layer of assistance and escalate situations when human help is required. 🏗️ Architecture USER │ ▼ LiveKit │ ▼ Speech-to-Text │ ▼ LLM / Agent │ ┌────────────┼────────────┐ ▼ ▼ ▼ Memory Tools Escalation │ │ │ └────────────┼────────────┘ ▼ SQLite DB │ ┌──────┴──────┐ ▼ ▼ Human Support Analytics Dashboard Dashboard │ ▼ Murf Falcon │ ▼ USER Technology Stack Component Technology Frontend Next.js / React AI Agent LiveKit Agents Real-time Transport LiveKit Text-to-Speech Murf Falcon Backend Python API FastAPI Database SQLite Calling SIP / LiveKit 🎙️ Key Features Indian Voice & Natural Conversations FinSaathi uses Murf Falcon for text-to-speech and supports natural Hindi/Hinglish conversations. The goal was to make the interaction feel more like talking to an assistant rather than interacting with a traditional chatbot. Safety Guardrails Financial co

Dash cam laws vary from one state to the next. Check the laws of states you'll be driving through.

La Abuela — Comfort Food from Madrid 🍲 A cozy, fully accessible landing page for an imaginary family restaurant in Madrid, built from scratch with vanilla HTML, CSS and JavaScript for the DEV Frontend Challenge: Comfort Food Edition. 🔗 Live demo: https://laabuela.bmops.tech 💻 Interactive pen (CodePen): The story La Abuela ("the grandmother") is a tiny four-table restaurant in Lavapiés, Madrid. In 1987, Abuela Carmen opened it with one rule: if it wouldn't be served at her Sunday table, it wouldn't be served here. Forty years later, the menu still has three dishes — caldo, croquetas, lentejas — and the pot still simmers for three hours. The page tells that story through a warm terracotta-and-cream palette and five illustrations drawn entirely in pure CSS — no images, no SVG, no canvas. What I built Hero — a clay pot in pure CSS: gradient body with layered inset shadows for volume, decorative band, handles, a two-tongued fire with a glowing core, a wooden table with grain, a light sweep across the heading, and animated organic steam Our story — a bowl of caldo with a wooden spoon and a terracotta heart, all divs and box-shadows The menu — three dish cards, each with its own pure-CSS illustration: a steaming bowl of caldo, three golden croquetas with crispy texture and a pool of salsa, and a dark bowl of lentils with nine individual grains The recipe — an accessible accordion unlocking Abuela's caldo, step by step Quotes — from regulars (including one from Osaka who cried into the caldo) Booking form — with inline validation, clear labels and a friendly confirmation Footer — hours, address, and a wink to Carmen The art is pure CSS — no images, no SVG Every illustration is built the way : nested absolutely-positioned divs, layered box-shadow (inset shadows give the clay its volume and the croquettes their crust), organic border-radius , and radial gradients for light. The pot alone uses four shadow layers to feel round instead of flat. The steam is animated with pure CS

A gift card image is not an ordinary profile photo. It can contain a redeemable code, a PIN, a receipt, an email address, an order number, and location metadata from the camera. A single authorization bug can therefore expose both personal data and something that behaves like a bearer secret. This article designs the upload path as a security boundary. The examples are implementation-neutral TypeScript so the controls can be mapped to your framework, image decoder, object store, and queue. The goal is not “secure file upload” in the abstract. It is a narrower property: Collect only the evidence needed for a decision, keep the original out of normal review paths, and make every retained copy private, attributable, and short-lived. Start with staged disclosure Do not begin by asking for the entire card and receipt. Most first-pass routing decisions need only structured facts: brand and issuing country currency and face value physical card or e-code proof type available whether the redeemable area is still covered Only request an image after those fields show that visual proof is necessary. For the first image, instruct the user to keep the code or PIN covered and exclude unrelated receipt lines. If a later step genuinely needs a live code, collect it through a separate, purpose-built secret field—not as another image in a support chat. That separation changes the failure mode. A bug in the ordinary proof viewer should not automatically reveal a spendable credential. The FTC explains why the distinction matters: someone who has the gift card number and PIN may be able to take the funds even without holding the physical card. Treat those values as secrets, not harmless text printed in a photo. Threat-model the whole path An upload control on the browser is useful feedback, but it is not a trust boundary. Model at least these failures: Threat Example Required control Secret exposure A full PIN appears in a proof image or log Staged disclosure, detection, restricted escal

How I Bypassed NVIDIA's Phone Verification to Access 70+ Free AI Models from Bangladesh No VPN. No fake number. Just a browser console and an API call. If you are a developer in Bangladesh, you have probably hit the same wall I did. You go to build.nvidia.com , excited to try out the latest models on the NVIDIA NGC API. You click Generate API Key . And then — a phone verification gate appears. You look for your country code. Bangladesh is not on the list. NVIDIA says: "If your location isn't listed, please check again soon." I checked. It has been that way for a while. I am a student and independent builder from Dhaka, Bangladesh . I experiment with AI products and developer tools under the Alaminnna brand. I needed access to these models for a side project, not for enterprise production. Waiting for official support was not an option, so I looked for a legitimate workaround. Here is what I found. Table of Contents The Two Verification Gates Step 1: Create an Organization Account Step 2: Generate the API Key via Console Why This Works What You Actually Get Quick Test Final Thoughts The Two Verification Gates NVIDIA has two separate phone verification checkpoints: Account creation on the NVIDIA Build portal. API key generation inside the NGC dashboard. Both ask for a phone number. Both block Bangladesh. But here is the critical insight: the UI and the API are not the same system. The web interface enforces phone checks. The API itself does not. That gap is what makes this workaround possible. Step 1: Create an Organization Account (No Phone Needed) Personal NVIDIA accounts trigger phone verification immediately. Organization accounts, however, do not — at least not during the initial signup flow. Here is what I did: Go to build.nvidia.com/minimaxai/minimax-m3 . Click Generate API Key . Enter your email and create a password. Complete the hCaptcha verification. Check your email for a 6-digit verification code and enter it. On the "Almost Done" page, click Submit . You