标签：#EV

Three years ago, I started my journey as a developer with a pretty simple idea: Learn to code, gain experience, become good at it. Three years later, I’ve learned a lot — but I’ve also realized that becoming a developer isn't as straightforward as I imagined. I've worked with JavaScript, React, Laravel, PlayCanvas, WebGL, and other technologies. I've worked on real projects, dealt with bugs I didn't understand at first, learned technologies because a project required them, and worked alongside other people to get things done. I think one of my strengths has always been learning new technologies and adapting to new problems. But there are things I'm not proud of. I've never been particularly good at finishing personal projects by myself. I've started many things, learned from them, experimented with different technologies, but I rarely took them all the way to completion. I also don't have an impressive GitHub contribution graph. I haven't spent the last three years consistently building open-source projects or pushing code every day. And if I'm being completely honest, I don't think I've mastered any particular technology. I'm good enough to build things. I'm good enough to understand code, solve problems, learn what I don't know, and contribute to a team. But I'm not at the level where I'd confidently say: "This is the thing I'm an expert at." And recently, AI has made me think about this even more. I'm not afraid of AI taking over jobs. I actually think the capabilities we're getting are incredible. What concerns me is more personal: If AI can already build many of the things I've spent years learning to build, then what should I be becoming as a developer? For a while, I felt overwhelmed by that question. Should I learn more technologies? Should I specialize? Should I focus on fundamentals? Should I build more projects? Should I contribute to open source? Should I learn AI? I'm realizing that the answer probably isn't to chase everything. My next goal isn't to co

For years, I thought being a good programmer meant knowing your stack really well. I was a Laravel developer, A React developer, A Node.js developer and A Go developer. And there was some truth to that. I spent years working with Laravel, for example, and naturally became faster at solving problems with Laravel. I know the ecosystem, the common mistakes, the packages, the conventions, and probably a few things that weren't even written in the documentation. My stack became part of my identity as a developer. But I think AI is slowly changing that. Not because frameworks and programming languages don't matter anymore. They obviously do. It's because AI has made moving between them much easier. Today, I can open a codebase written in a language or framework I haven't touched in years, or maybe have never used seriously, and get productive much faster than I could before. I can ask AI to explain the project structure. I can ask it to explain a piece of code. I can ask it to translate something I understand in PHP into Go. I can ask it to help me write tests. I can use it while debugging. I can even ask it why a particular approach might be a bad idea. That doesn't suddenly make me an expert in that technology. But it means I don't need to spend weeks just getting comfortable enough to start solving the actual problem. And I think that's a pretty big change. Your Stack Is Becoming Less Important There was a time when knowing a technology itself was a significant advantage. If you knew Laravel, you had to learn Laravel. If you wanted to learn React, you had to spend time understanding React. If you wanted to work with Kubernetes, good luck. You read documentation, watched tutorials, built things, broke things, fixed them, and slowly built up experience. That's still how you become good. But AI has changed the entry point. The first few hours with a new technology are no longer as painful as they used to be. You can have an AI sitting beside you explaining things as you g

Floating labels. Inline validation. Custom checkboxes, radios, and a toggle switch. A gradient button with a press-down micro-interaction. Every bit of it below is CSS — no form library, no useState , no event listener wiring up a class toggle. That's form.fscss — the module in the FSCSS ecosystem. Same philosophy each time: solve the hard visual problem once, ship it as importable mixins, let the browser do the actual work. <script src= "https://cdn.jsdelivr.net/npm/fscss@1.1.24/exec.min.js" defer ></script> <style> @import (( * ) from form ) @ form-root () @ form-group (. form-group ) @ form-input (. form-input ) @ form-label (. form-label ) @ form-float (. form-group , . form-input , . form-label ) @ form-checkbox (. form-checkbox ) @ form-btn (. form-btn ) @ form-btn-primary (. form-btn-primary ) </style> <div class= "form-group" > <input class= "form-input" type= "text" placeholder= " " > <label class= "form-label" > Full name </label> </div> <label class= "form-checkbox" > <input type= "checkbox" checked ><span></span> I agree to the Terms </label> <button class= "form-btn form-btn-primary" > Create account </button> The two tricks doing all the work Forms feel like they need JavaScript because most tutorials reach for it immediately. Two native CSS mechanisms cover almost everything a "modern" form needs. Floating labels run entirely on :placeholder-shown . Give the input placeholder=" " — a literal space, not empty — and the browser now knows, purely in CSS, whether the field is empty and unfocused: .form-input :focus + .form-label , .form-input :not ( :placeholder-shown ) + .form-label { top : -9px ; font-size : 11px ; color : var ( --form-accent ); } No state, no class toggling on keyup. The label just reacts to what the browser already knows about the input. Checkboxes, radios, and the switch all use the classic checkbox-hack: the real <input> stays in the DOM (so it keeps native keyboard support and form submission) but is visually hidden, and a sibling

Learn how containers communicate with each other and how to keep data alive even after containers are removed. Modern applications rarely run as a single container. A typical application might include a web application, a database, a cache layer, and background workers. For these services to work together, containers need a reliable way to communicate and share data. In this article, we'll learn: How Docker networking works How containers discover each other Docker network drivers Persistent storage with Docker volumes Essential networking and volume commands A real-world multi-container example By the end, we'll understand two of the most important concepts in Docker: networking and data persistence . Why Docker Networking Matters Every container runs inside its own isolated network namespace. This isolation improves security and prevents conflicts, but it also creates an important challenge: If containers are isolated, how does a web application connect to a database? Imagine a web application running inside one container and MongoDB running inside another. Without networking, they cannot communicate. Docker solves this problem using Docker Networks . A Docker network allows containers to communicate with each other while remaining isolated from unrelated containers. Web App Container | v Docker Network | v Database Container Without a shared network, containers cannot easily find or communicate with each other. Docker Network Drivers Docker supports several network drivers, but most developers primarily use three. Bridge Network A bridge network creates a private virtual network on the Docker host. Containers connected to the same bridge network can communicate with each other securely. Create a custom bridge network: docker network create my-app-network Benefits of bridge networks: Container-to-container communication Isolation from other applications Built-in DNS resolution Easy management For most Docker projects, a user-defined bridge network is the recommend

The problem Your VPN client shows a green "Connected" toggle. That's a marketing claim, not a proof. A tunnel can be up while DNS leaks, IPv6 bypasses the route, or your "anonymous" egress sits in a datacenter that any service can fingerprint. How ActiveVPN works The scan collects five groups of signals: Network interfaces — checks psutil.net_if_addrs() against patterns like tun, tap, utun, wg, ipsec, tailscale, zerotier. Processes — iterates running processes and matches them against known VPN/Tor binaries using exact/CLI-token matching (this removed a lot of naive-substring false positives, e.g. "vpn" matching random apps). External IP — queries ip-api.com, ipinfo.io, and ipapi.co in a failover chain for IP, ISP, country, hosting, and proxy flags. DNS — calls edns.ip-api.com to find the resolver IP your DNS queries actually go through. IPv4/IPv6 — fetches both via ipify to spot IPv6 leaks around an IPv4-only tunnel. Verdict scoring Each signal has a weight (interface 50, VPN process 40, Tor 35, hosting 25, proxy 30). The sum, capped at 100, maps to: 0-19 CLEAN 20-39 SUSPICIOUS 40-74 LIKELY VPN/PROXY 75-100 VPN DETECTED Extras worth mentioning Kill switch: sudo activevpn --kill / --kill-force. Watch mode: activevpn --watch 30 with on_change callbacks for VPN-drop alerts. History & export: JSON/CSV/TXT from the platform data directory. Exit codes (0/1/2) so you can wire it into CI. Library API: import activevpn; result = activevpn.scan(); result.verdict.label. Docker image + GitHub Pages docs + full pytest suite running on 3 OSes across Python 3.8 and 3.12. Install pip install activevpn activevpn GitHub: https://github.com/rkriad585/ActiveVPN Docs: https://rkriad585.github.io/ActiveVPN

Adding online payments to a web application can make it easier for customers to purchase products, subscribe to services, book appointments, or pay invoices. But payment integration involves more than adding a payment button to a website. A reliable integration needs a payment gateway, backend APIs, secure authentication, payment status handling, webhooks, and proper error management. This guide explains the basic process of integrating a payment gateway into a web application, using Razorpay as an example. 1. Understand How Payment Gateway Integration Works A typical payment flow looks like this: Customer → Web App → Backend → Payment Gateway → Bank/Payment Network The customer starts the payment from your website. Your backend creates the payment order through the gateway. The customer then completes the payment using a supported payment method. After the transaction, your application needs to confirm whether the payment was successful before providing the product or service. A simplified flow is: Customer selects a product or service. Your backend creates an order. The payment gateway generates the required payment details. Checkout opens for the customer. Customer completes the payment. The gateway returns payment information. Your backend verifies the payment. A webhook can update your system about payment events. Your database records the final payment status. The application confirms the order. 2. Choose the Right Payment Gateway Before starting development, compare payment gateways based on factors such as: Supported payment methods Transaction fees API documentation Developer tools Settlement process Refund support International payment support Webhook capabilities Security requirements Customer support For an Indian web application, gateways such as Razorpay can support common payment methods including UPI, cards, net banking, and wallets, depending on the account and applicable availability. The important thing is to choose a gateway that fits your applic

Category: My AI Experiments There's a mental model most people use when working with AI: describe your problem, get a solution. It works well enough, until it doesn't. And when it fails, the failure is invisible — because AI doesn't say "I don't have enough to go on." It gives you a confident, well-reasoned, completely wrong answer. I learned this the hard way during a website security investigation. The AI and I ran a thorough analysis, reached a clear conclusion, and were wrong. Not because the AI was weak — because I gave it the wrong kind of input. When I changed the input, the same AI found the answer in seconds. That gap — between the input that produces a wrong answer and the input that produces a right one — is what I want to talk about. The Investigation That Almost Failed My website was secretly redirecting visitors to a virus site. The attack was sophisticated: it only targeted specific browsers, fired at most once per device per day using a cookie-based cooldown, and left no trace in any file. I asked AI to help investigate. I described the symptoms. We searched through files together — .htaccess , theme functions, plugin code. Everything looked clean. The AI identified the most suspicious external element in scope: a Chinese analytics script called 51.la. I removed it. The redirect stopped. I called it solved. Three weeks later, the identical attack appeared on another site I manage. No 51.la anywhere. This time, instead of describing the symptoms, I gave the AI something different: the actual rendered HTML of an affected page, fetched using the exact browser User-Agent and IP type that triggered the attack. The AI found an 83KB malicious JavaScript payload injected into every page. Inside it: a WeChat browser detector, a link-click hijacker, a cookie-based daily cooldown. The payload was stored in the WordPress database — in plugin configuration data — where no file-level search could ever find it. Same AI. Same type of problem. Completely different ou

On 1 August I opened an issue that was three sentences long. A hundred and one minutes later the feature was merged, and the document that got it there ran to 457 lines . I didn't write those 457 lines. In fact, I didn't have to write any more documentation, and not because I simply allowed Claude to run amok. Here is the issue in full — control-api#265 , 225 characters: control-api#265 — Manifest-backed dashboard feeds For each dashboard, auto create a manifest keyed by dashboard_id. For each sensor the dashboard uses, tag it to be included in the manifest. When a dashboard definition is updated, add / remove tags from sensors accordingly. From that genesis moment, this is the lifecycle of the issue all the way through to landing: Time (UTC) Event 14:25 Issue #265 opened — 225 characters 14:54 FEAT-0007 spec committed — 457 lines 15:35 Spec merged (PR #266) 15:51 Implementation committed 16:06 Implementation merged (PR #267, 15 files), issue closed The interesting part isn't the speed. It's the step at 14:54 that landed a previously non-existent spec document, and what happened in the twenty-nine minutes before it. The issue was never a specification I often write issues like this one...the way most people write shopping lists. Actuator address is not ensured? Baseline the trace correctly. With the pre-rolls, the frame-rate looks out. They're abbreviated to the point of being cryptic to everyone else. I write them this way deliberately: I'm usually mid-something else when I notice a problem, or have an idea for a better route to the solution. The cost of a full write-up right at that moment would be a fractured sense of flow. As most engineers will tell you, the transitions into and out of flow are the most disruptive parts of their working day. This terse form of issue-writing can be all you need, and it's worth being precise about why it works and the trade-offs it includes. It is not because "the issues are good enough". They aren't. When you pick one of these u

I've merged plenty of AI-generated code that was genuinely fine. I've also caught myself almost merging code that looked fine and wasn't, because it read like something a competent person wrote and my brain filled in the rest. Over the last year I've settled into a rough set of questions I run through before approving anything I didn't write line by line myself, generated or not. Here they are, in the order I actually ask them. 1. What problem is this code actually solving? It's easy to review whether code works and skip whether it solves the right thing. AI tends to answer the literal prompt, not the intent behind it. def get_active_users (): return db . query ( " SELECT * FROM users WHERE active = true " ) If "active" was supposed to mean "logged in within 30 days" and not a boolean flag that's rarely updated, this passes every test and still solves the wrong problem. Reviewer tip: Read the original ticket or request before reading the diff. Check the code against the intent, not just the literal ask. 2. Do I actually understand the implementation? Not "does it look reasonable," actually understand it, line by line, well enough to explain it to someone else. Reviewer tip: Try to explain the function out loud in one sentence per major step. If you get stuck anywhere, that's the part you haven't actually reviewed yet, just skimmed. 3. What assumptions is it making? Every implementation bakes in assumptions about the shape of the data, the order things happen in, or what "normal" looks like. function getLatestOrder ( orders ) { return orders [ orders . length - 1 ]; } This assumes orders is sorted chronologically and never empty. Neither assumption is stated anywhere. Reviewer tip: Ask "what does this assume about its inputs that isn't checked anywhere?" Write the answer down, literally, in the PR comment if it matters. 4. What happens with bad input? Bad input isn't an edge case, it's a certainty over a long enough timeline. def parse_age ( value ): return int ( val

High-Speed eBPF/XDP Packet Filtering for Linux Server DDoS Mitigation Executive Summary Executive Summary & Key Security Takeaways ← Back to Articles Linux Kernel • XDP DDoS Defense High-Speed eBPF/XDP Packet Filtering for Linux Server DDoS Mitigation By Zyekh Abdul Qadir Jailani Published: 2026-08-04 15 min read (1750+ Words) Share Download .md Download .pdf eBPF/XDP Driver-Level Packet Ingestion & Ultra Fast Packet Dropping Executive Summary & Key Security Takeaways XDP_DROP Early Decision: Drop malicious UDP/SYN floods before allocating sk_buff memory. Kernel Map Invalidation: Dynamic IP blocklists via eBPF BPF_MAP_TYPE_HASH maps. Zero-Copy Performance: Process 10M+ packets per second on commodity server hardware. Clang/LLVM BPF Compilation: Build C programs directly into BPF bytecode targets. Table of Contents Understanding XDP Architecture vs Traditional Linux SKB Allocation XDP Packet Processing Actions (XDP_DROP vs XDP_PASS) Writing a Production XDP Packet Filter in C Compiling & Loading Bytecode Targets via Clang/LLVM Dynamic Blocklist Management via BPF Maps High-Throughput Packet Benchmark Verification Frequently Asked Questions (FAQ) 1. Understanding XDP Architecture vs Traditional Linux SKB Allocation Standard Linux network processing allocates a complex kernel socket buffer data structure (sk_buff) for every incoming packet before firewall rules (iptables/nftables) can evaluate the packet. Under volumetric DDoS attacks (such as 10 Million Packets Per Second UDP floods), the CPU time spent allocating and freeing sk_buff structures exhausts kernel memory and CPU cache lines, causing severe packet drops and server unresponsiveness. eXpress Data Path (XDP) provides a high-performance bare-metal packet processing framework. XDP programs execute eBPF bytecode directly inside the network driver's RX ring buffer before sk_buff memory allocation occurs. # Inspect network interface driver XDP support ip link show eth0 2. XDP Packet Processing Actions (XDP_DROP vs

One of the most common assumptions in engineering leadership is that a rising number of reported incidents signals declining system reliability. However, a recent article from Great Circle argues that the opposite is often true: an increase in incident counts may actually indicate that an organization's incident management culture is improving. By Craig Risi

Clip earbuds are an exercise in compromise. It's an inherent aspect of their design - and physics. They can be more comfortable for people that don't like something jammed in their ear, but sound response suffers. Ambient awareness is great because you can easily hear the sound around you, which means to hear your own […]

Samsung didn't have to change much this year because its hardware is just that good.

As The Verge's resident handheld reviewer, I have nearly every portable gaming PC on a shelf in my house. The MSI Claw 8 EX AI Plus is now the first one I reach for. Thanks to a next-gen Intel chip and improved MSI design, the Claw EX is the most powerful handheld that truly feels […]

Expedia Group has open-sourced mockql-rs, a Rust CLI that fills @mock-annotated GraphQL fields with LLM-generated data at request time. It follows Airbnb's @generateMock in April and a GraphQL Foundation RFC opened in February. All three solve the same problem with different architectures, and two use the same directive name with incompatible semantics. By Steef-Jan Wiggers

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . The bug When you call @google/genai in streaming mode and the model asks to run a tool, Sentry's JavaScript SDK records that tool call to the span twice. One tool call in, two entries out. The attribute that carries them is gen_ai.response.tool_calls . It should hold one object per call. For a single streamed controlLight call it held two. Worse, the two did not even agree on their shape. Here is a real capture, which I come back to at the end: [ { "id" : "call_2079699" , "args" :{ "colorTemperature" : "warm" , "brightness" : 30 }, "name" : "controlLight" }, { "type" : "function" , "id" : "call_2079699" , "name" : "controlLight" , "arguments" :{ "colorTemperature" : "warm" , "brightness" : 30 }} ] Same id, same call, listed twice. One entry keys the parameters under args , the other under arguments . Anything reading this later sees two tool invocations where the model made one. Following the value The streaming instrumentation lives in packages/server-utils/src/ai/google-genai/streaming.ts . Every chunk of the stream runs through handleCandidateContent . That function wrote tool calls from two places: function handleCandidateContent ( chunk , state , recordOutputs ) { if ( Array . isArray ( chunk . functionCalls )) { state . toolCalls . push (... chunk . functionCalls ); // push #1 } for ( const candidate of chunk . candidates ?? []) { // ...finish reasons... for ( const part of candidate ?. content ?. parts ?? []) { if ( recordOutputs && part . text ) state . responseTexts . push ( part . text ); if ( part . functionCall ) { state . toolCalls . push ({ // push #2 type : ' function ' , id : part . functionCall . id , name : part . functionCall . name , arguments : part . functionCall . args , }); } } } } Push #1 spreads chunk.functionCalls into the accumulator. Push #2 walks candidate.content.parts and pushes every functionCall it finds. They look like two different sources. They

1. Retomando: do Dockerfile mínimo a um Dockerfile de verdade Na segunda parte desta série, um Dockerfile de poucas linhas já foi suficiente para empacotar uma aplicação Python. Isso funciona, mas um Dockerfile escrito sem pensar em camadas e cache de build gera imagens maiores do que precisam ser e builds que demoram muito mais do que deveriam a cada mudança pequena no código. Este artigo aprofunda como o Docker constrói uma imagem por dentro, e como escrever um Dockerfile que tira proveito disso. 2. Como funcionam as camadas (layers) Cada instrução de um Dockerfile ( FROM , RUN , COPY , ADD ) que modifica o sistema de arquivos gera uma camada — um diff read-only armazenado separadamente e empilhado sobre as anteriores. A imagem final é simplesmente a soma de todas essas camadas, e o container em execução adiciona uma camada gravável no topo (union filesystem). Container (camada gravável) ────────────────────────── Camada 4: COPY . . Camada 3: RUN pip install -r requirements.txt Camada 2: COPY requirements.txt . Camada 1: FROM python:3.12-slim Duas consequências práticas importantes: Camadas são reaproveitadas entre imagens. Se duas imagens diferentes compartilham as mesmas primeiras instruções (por exemplo, a mesma FROM e o mesmo RUN apt-get install ), o Docker armazena essa camada uma única vez em disco, mesmo que várias imagens a usem. Camadas são cacheadas entre builds. Ao rodar docker build de novo, o Docker verifica cada instrução, na ordem: se a instrução e seus arquivos de entrada não mudaram desde o último build, ele reaproveita a camada já construída em vez de refazer o trabalho. Isso é a base de todo o próximo tópico. 3. Cache de build: ordenar o Dockerfile por frequência de mudança O cache de build é invalidado a partir do primeiro ponto de mudança : se a instrução N mudou (ou um arquivo que ela copia mudou), toda camada a partir de N é reconstruída — mesmo que as instruções seguintes sejam idênticas ao build anterior. Isso significa que a ordem das ins

It’s amazing how few compromises Dell made to get the new XPS 13 down to $700, but I strongly recommend the $900 model, which comes with 16 GB of RAM.

Ground Truth makes the shared rental bikes harder to pedal through rent-burdened neighborhoods, offering a tangible way for people to experience income inequality.

This week's tooling landscape is defined by two themes: cost compression on capable models and protocol-level standardization across agent runtimes. Gemini 3.7 Flash cuts inference spend while measurably improving first-pass code accuracy, and the AI SDK's ACP harness layer is quietly making multi-agent wiring less of a bespoke nightmare. Here's what's worth your attention. Gemini 3.7 Flash launches with coding performance gains Gemini 3.7 Flash ships at half the cost of 3.6 Flash with benchmark improvements that actually map to real workloads: FrontierCode jumps from 34.4% to 43.6%, and document reasoning on GDP.pdf goes from 22.0% to 34.0%. These aren't marginal deltas—a 9-point gain on code generation means materially fewer retries in agentic pipelines where each failed generation compounds latency and cost. For teams running Flash in production for code generation or document extraction, the math is straightforward: same API surface, half the token cost, better first-pass accuracy. Introductory pricing holds through year-end, so the window to lock in the savings is finite. Verdict: Ship. Drop-in swap via the Gemini API—no config changes required. If you're already on Flash for coding or document processing workloads, migrate now. The performance gains on code generation are large enough to reduce retry loops in multi-step planning tasks, which compounds into real infrastructure savings at scale. GLM 5.2 free for eve agents through August 27 Z.ai's GLM 5.2 is a 1M-token open-weights model now set as the default on eve agents, with free access through Vercel's AI Gateway until August 27. The 1M context window is the practical differentiator here—it's large enough to hold entire codebases in context for generation tasks that would otherwise require chunking or retrieval. The cost is zero during the trial window, and the integration is a one-line config change: set model: "zai/glm-5.2" in agent/agent.ts or run eve set --model zai/glm-5.2 . That's a trivially low bar