标签：#beginners

Bitcoin can look simple from the outside: paste an address, choose an amount, send. Under that simple interface are several concepts that are useful for developers and technical beginners to understand. This post is not trading advice and does not discuss price. It is a practical mental model for what is happening when someone sends Bitcoin. 1. A wallet does not "hold coins" the way an app balance does Many beginners imagine a wallet as a container full of coins. That is close enough for casual conversation, but it can be misleading. A Bitcoin wallet manages keys and helps create transactions. The Bitcoin network tracks spendable outputs on the ledger. When you send BTC, the wallet constructs a transaction that spends previous outputs and creates new outputs. You do not need to master every detail on day one, but the high-level idea matters: control of keys controls the ability to spend. 2. An address is a destination, not an identity A Bitcoin address is where funds can be sent. It is not a username and it is not automatically tied to a person in the way a social profile is. Before sending, beginners should check the address carefully. A small copy-paste mistake can be permanent. Malware can also replace clipboard contents, so visually checking the beginning and ending characters is a useful habit. For larger transfers, a tiny test transaction can reduce risk. 3. Fees are about block space Bitcoin transactions compete for limited block space. A fee is not a tip to a company. It is part of the transaction economics that helps miners decide which transactions to include. When the network is busy, low-fee transactions may wait longer. When the network is quieter, confirmations may happen faster. The beginner lesson is simple: do not assume "sent" means "fully settled." Check confirmations and understand that fee choice can affect waiting time. 4. The mempool is a waiting area Before a transaction is confirmed in a block, it may sit in the mempool, which is a pool of u

Web Security: OWASP Top 10 and How to Fix Them (2026) Security isn't a feature you add later — it's built into every layer. Here's how the top 10 vulnerabilities work and how to prevent them. #1 Broken Access Control // ❌ Vulnerable: User can access anyone's data app . get ( ' /api/users/:id ' , ( req , res ) => { const user = await db . users . findById ( req . params . id ); res . json ( user ); // No check if requester owns this data! }); // ✅ Secure: Always verify ownership app . get ( ' /api/users/:id ' , async ( req , res ) => { // Check: Is the logged-in user requesting their OWN data? if ( req . params . id !== req . user . id && req . user . role !== ' admin ' ) { return res . status ( 403 ). json ({ error : ' Access denied ' }); } const user = await db . users . findById ( req . params . id ); res . json ( user ); }); // ✅ Better: Use middleware for all protected routes const requireOwnership = ( resourceType ) => async ( req , res , next ) => { const resource = await db [ resourceType ]. findById ( req . params . id ); if ( ! resource ) return res . status ( 404 ). json ({ error : ' Not found ' }); if ( resource . userId !== req . user . id && req . user . role !== ' admin ' ) { return res . status ( 403 ). json ({ error : ' Access denied ' }); } req . resource = resource ; // Attach for route handler next (); }; app . get ( ' /api/posts/:id ' , auth , requireOwnership ( ' posts ' ), ( req , res ) => { res . json ( req . resource ); }); #2 Cryptographic Failures // ❌ Storing passwords in plain text or weak hashing const password = " password123 " ; db . users . insert ({ email , password }); // NEVER DO THIS! // ✅ Proper password hashing with bcrypt const bcrypt = require ( ' bcrypt ' ); const SALT_ROUNDS = 12 ; // Higher = slower = more secure (12 is good balance) async function hashPassword ( password ) { return bcrypt . hash ( password , SALT_ROUNDS ); } async function comparePassword ( password , hash ) { return bcrypt . compare ( password , hash ); /

Hello everyone! It has been a busy week, but I've made some exciting progress on my machine learning journey. Here is what I've been up to: Kaggle Orbit Wars & AWS I completed the baseline implementation for the Kaggle Orbit Wars competition and initially hit a score of around 1030. My score has dipped slightly over the past few days, so I am currently brainstorming ways to improve it. This week also marked my very first time using AWS! I used it to extract data for reinforcement learning. Transparency check: I spent exactly $7.58 USD on AWS resources during the process. Paper Reading & RL Insights I spent a lot of time reading research papers this week. AlphaZero: I was initially excited about using the self-play mechanism from AlphaZero. However, because this specific game has rock-paper-scissors dynamics, standard self-play might not work effectively. AlphaStar: This led me to the AlphaStar paper, which uses self-play combined with League Training . The engineering behind AlphaStar is incredible. Two specific concepts really stood out to me: Pointer Networks and V-trace off-policy correction . I was also impressed by their use of an LSTM core to handle long-term memory. Next Steps Moving forward, I plan to leverage Kaggle, AWS, and GCP credits to train different components of my model. I am giving myself total freedom to experiment, imagine, and test unconventional solutions. Random life update to close out the week: I used to have long hair because I was insecure about my forehead, but I finally decided to shave it all off at home by myself. It honestly feels really weird right now, but it's a fresh start!

For years I saw "open source contributions" on job descriptions and just... nodded along. Typed it into Google once, got overwhelmed, closed the tab. It always seemed like something other people did. People who actually knew what they were doing. People who weren't me. Then I started looking into it properly. And honestly? It still seemed big. Like I'd need to understand an entire codebase, find a complex bug, write some genius fix that the maintainers would applaud. Turns out that's not it at all. I found some resources that changed how I saw it completely. The bar to start is embarrassingly low, and that's intentional. The open source community built it that way on purpose. So I did it. Was it a few lines of code? Yes. Did I do it directly in the browser like a person who has no idea what they're doing? Also yes. Do I care? Absolutely not. Where to actually start: goodfirstissue.dev — filters repos by good first issue label up-for-grabs.net — same idea, different interface Docs you already use — if you read something and think "that's oddly worded," you're already there GitHub search — label:"good first issue" is:open and filter by language Here's the thing though, this isn't just about open source. Everything seems big and intimidating at first. So you start small. One tiny contribution. Not because it's impressive but because it's real, and it's yours, and it builds something. Confidence mostly. Then you do a slightly bigger thing. Then a bigger thing after that. You don't level up by waiting until you're ready. You level up by starting small and not stopping. My first contribution exists now. That's enough for today.

My Journey Towards AI and Software Development Hello everyone, My name is Kunal Tiwari, and I am a student who is passionate about technology, artificial intelligence, and software development. Technology has always fascinated me because it allows people to transform ideas into real-world solutions. Over time, I developed a strong interest in understanding how software is built and how AI can help solve everyday problems. I started exploring programming and software development with curiosity and a desire to learn. Although I am still at the beginning of my journey, I believe that consistent learning and practical projects are the best ways to grow as a developer. My current interests include: Artificial Intelligence (AI) Android App Development Software Engineering Problem Solving Building useful applications Through this blog, I plan to share my learning experiences, projects, challenges, and lessons that I discover along the way. My goal is not only to improve my technical skills but also to document my progress and connect with other learners and developers. I know the journey ahead will require patience, dedication, and continuous learning. However, I am excited about the opportunities that technology offers and look forward to building meaningful projects in the future. Thank you for reading my first post. I hope to share valuable insights and experiences as I continue my journey towards AI and software development. Best regards, Kunal Tiwari

Hey Folks! 👋 Good Day... This blog is a summary of the concepts covered during the last two classes at my institute. One of the reasons I enjoy writing these blogs is that they serve as my personal knowledge journal. Whenever I need a quick refresher on a concept, I can simply revisit my blog instead of searching through notes or recordings. It helps me reinforce what I've learned while also documenting my learning journey. Over the past two days, we explored several important Java concepts, including constructors, the this keyword, inheritance, constructor chaining. In this blog, I'll share what I learned in the simplest way possible, using real-world analogies, practical examples, and the thought process that helped me understand these concepts more clearly. If you're a beginner learning Java, I hope this walkthrough makes these topics a little easier to grasp and a lot more memorable. What Is a Constructor? According to Oracle Java Documentation: A constructor is a special method that is used to initialize objects. The constructor is called when an object of a class is created. In simple terms: Imagine you order a new smartphone. Before the phone reaches your hands, the factory installs the operating system, configures the hardware, and prepares everything for use. A constructor does exactly the same thing for an object. Before you use an object, Java uses the constructor to prepare it. My First Confusing Example I wrote the following code: public class SuperMarket { String name = "python" ; int price ; public SuperMarket ( String name , int price ) { System . out . println ( "Are you constructor?" ); name = name ; price = price ; } public static void main ( String [] args ) { SuperMarket product1 = new SuperMarket ( "abc" , 20 ); System . out . println ( product1 . name ); } } I expected the output to be: abc But Java printed: python And honestly... I was completely confused. After all, I passed "abc" into the constructor. Why was Java ignoring it? The Hotel Roo

Create a storage account and configure high availability. Create a storage account for the internal private company documents. In the portal, search for and select Storage accounts . Select + Create . Select the Resource group created in the previous lab. Set the Storage account name to private . Add an identifier to the name to ensure the name is unique. Select Review , and then Create the storage account. Wait for the storage account to deploy, and then select Go to resource . This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy . Explanation A storage account is like a digital locker in the cloud. Resource group is a folder that organizes related services. High availability means your files stay safe even if one region (data center area) has problems Configure Redundancy In the storage account, in the Data management section, select the Redundancy blade . Ensure Geo-redundant storage (GRS) is selected. **Refresh **the page. Review the primary and secondary location information. Save your changes. Explanation : Redundancy means keeping copies of your files in multiple places. GRS ensures your files are copied to another region for safety. Create a storage container, upload a file, and restrict access to the file. Create a private storage container for the corporate data. In the storage account, in the Data storage section, select the Containers blade. Select + Container . Ensure the Name of the container is private . Ensure the Public access level is Private (no anonymous access). As you have time, review the Advanced settings, but take the defaults. It means: don’t change anything in the Advanced settings unless the lab specifically tells you to. Azure already chooses safe, recommended defaults for you. Select Create . Explanation : A container is like a folder inside your storage account. Setting Public access level to Private means nobody can see

📌 This article was originally published on Sherdil E-Learning . I'm republishing it here so the dev.to community can benefit too. The Kubernetes vs Docker question is one of the most common sources of confusion for developers entering DevOps. People hear both names constantly, see them used together in job listings, and assume they must be competitors. They are not. Docker and Kubernetes do different jobs, and most modern infrastructure uses both. This guide explains what each tool actually does, how they fit together in a real deployment, the practical difference between Docker Compose and Kubernetes, and which one you should learn first. Docker: the container creator Docker is a tool for building, running, and managing containers . A container is a lightweight, portable package that contains an application together with its dependencies, runtime, system libraries, environment variables, and configuration files. The same container runs the same way on a laptop, a CI runner, a production server, or a cloud platform. In a typical Docker workflow you: Write a Dockerfile that describes how to build the image Run docker build to produce the image Run docker run to launch a container from it For multiple containers (a web app plus a database, for example), you use Docker Compose to define the whole set in a docker-compose.yml file and start them with one command. Docker is excellent for individual containers and small multi-container applications. The limitation is scale. What happens when you need a hundred containers across a dozen servers? When one container crashes at 3 a.m.? When you need to roll out a new version without downtime? Docker alone does not solve those problems. For the official reference, see docs.docker.com . Kubernetes: the orchestration layer above Docker Kubernetes (often shortened to K8s ) is an open-source platform that runs containers across many machines as a single coordinated system . It was originally built at Google, based on their internal

I built 24 browser-based tools. Here is the complete technical guide for building your own and selling PRO licenses on Gumroad. Architecture: One HTML File + GitHub Pages + Gumroad No frameworks, no backend, no monthly costs. One HTML file on GitHub Pages. Gumroad handles payments. The PRO Flow User hits free limit → PRO modal Buy button → Gumroad popup ( window.open , NOT target=_blank ) Payment → Gumroad postMessage with license key message listener catches key Key verified via Gumroad API ( /v2/licenses/verify ) localStorage saves PRO (in try-catch!) Gotchas From 24 Tools postMessage security: Check d.success && d.purchase , never just d.license_key . I had this bug in 17 files. localStorage: Wrap in try-catch . Uncaught throws crash the whole page. CDN scripts: Always <script defer> . Without it, slow CDN blocks rendering. Gumroad publish: curl returns false every time. Use PowerShell. Buy button: Popup connects the page to Gumroad. Redirect breaks postMessage . Packed 5 templates with everything pre-configured: Browser Tools Starter Kit ($19)

MD5 Is Broken — Stop Using It for Passwords (Use SHA256 Instead) MD5 was invented in 1991. It's 2026, yet I still see developers using MD5 for password hashing in production systems. Let’s break down why this is dangerous and what you should use instead. What Is a Hash Function? A hash function takes any input and produces a fixed-length output called a digest or hash . It is a one-way function , meaning you cannot reverse it to get the original input. Example: ```text id="hash1" Input: "password123" MD5: 482c811da5d5b4bc6d497ffa98491e38 SHA256: ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f Even a small input change completely changes the output. --- # Why MD5 Is Broken MD5 generates a **128-bit hash**, which was considered secure decades ago. Today, it's extremely weak. Modern GPUs can compute **billions of MD5 hashes per second**, making brute-force attacks trivial. --- ## The Rainbow Table Problem Attackers use precomputed databases called **rainbow tables**. These tables map common passwords → their hash values. So if you hash: ```text "password123" → MD5 → known value An attacker can instantly look it up. Collision Vulnerabilities Researchers have demonstrated that two different inputs can produce the same MD5 hash . This breaks the core security guarantee of hash functions. SHA256 — The Better Choice SHA256 produces a 256-bit hash and is part of the SHA-2 family. It is currently considered cryptographically secure. Example: ```text id="sha1" "hello" → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 Even tiny changes completely change the output: ```text "hello" → 2cf24dba... "Hello" → 185f8db3... But Wait — Don’t Use SHA256 for Passwords Either This is where many developers make a mistake. SHA256 is not suitable for password hashing . Why? Because it is too fast . Fast hashing allows attackers to brute-force passwords quickly using GPUs. What You Should Use Instead For password storage, use: bcrypt scrypt Argon2 (recommended

A visual, beginner-friendly Java 25 experiment that explains virtual threads, blocking work, carrier threads, and the production rules that matter.

Leetcode 27: Remove Element Leetcode 27 asks us to remove a specific value from an array. The value to be removed is passed in as a parameter to the function along with the array. Just as we did in Day 1, we will cover a naive approach and an optimized approach and discuss the trade-offs between them. I think in the end there's a pretty clear winner. Let's get started. For both approaches we will use the following values: nums = [1, 3, 3, 2, 4] val = 3 Approach 1: Naive (For Loop + Splice) This approach uses a for loop and leverages .splice() for removals. Solution: var removeElement = function ( nums , val ) { let k = 0 ; for ( let i = 0 ; i < nums . length ; i ++ ) { if ( nums [ i ] === val ) { nums . splice ( i , 1 ); i -- ; } else { k ++ ; } } return k ; }; We begin by initializing a variable k to 0. We then enter the for loop. The condition is standard: create a variable i initialized to 0, continue looping while i is less than nums.length to avoid going past the end of the array, and increment by 1 each time through. Each iteration checks one condition: whether nums[i] is equal to val . If true, we call .splice() on the array. The arguments we pass to splice are i and 1 . i is the index at which we want to start removing, and 1 tells splice to remove only that one element. We then decrement i . The reason for this took me some time to wrap my brain around, so I have included a visual below to make it concrete. The core issue is this: when splice removes an element, every element to the right shifts one index to the left. Without i-- , the loop would increment i on the next iteration and skip right over the element that just shifted in. i-- counteracts that by stepping i back, so after the loop increments it, i lands exactly where the shifted element now sits. If nums[i] !== val , we skip the splice and increment k instead. At the end we return k , which holds the count of elements remaining after all occurrences of val have been removed. Time complexity: O(n²)

I built Xaloia AI , a privacy-first AI platform focused on trust and human interaction. And now, I’m shutting it down. Not because the idea was empty. Not because the tech didn’t work. But because I tried to build it from Romania. The Problem Wasn’t the Product Xaloia was built around things that are becoming increasingly important: privacy secure communication human-centered AI But building something meaningful isn’t enough. It needs the right environment to grow. And that’s where things started to break. What I Ran Into Trying to build in Romania, I kept hitting the same walls: Lack of early adopters willing to pay - People are curious about tech, but not ready to invest in new products. Limited startup ecosystem - Fewer accelerators, fewer investors, fewer people who understand what you’re building. Cultural friction around ambition - If your idea isn’t small or conventional, it’s often questioned instead of supported. Low exposure to global markets - Even if you build something good, getting it in front of the right audience is much harder. None of these stop your project instantly. But together, they slowly drain momentum. Why the US Is Different From everything I’ve seen and experienced, the US offers something fundamentally different: Access to capital — people invest earlier Distribution opportunities — platforms, networks, visibility Cultural support for big ideas — ambition is expected, not questioned Faster feedback loops — you know quickly if something works It’s not that success is guaranteed there. It’s that the conditions for success actually exist. The Real Lesson Talent is everywhere. Ideas are everywhere. But opportunity is not evenly distributed. And trying to ignore that reality cost me time, energy, and a product I genuinely believed in. What’s Next Shutting down Xaloia isn’t the end. It’s a reset—with better clarity. Next time, I won’t just focus on building something good. I’ll focus on building it where it actually has a chance to grow.

Hello Dev Community! 👋 It is officially Day 12 of my journey to master the MERN stack! Today, I wrapped up Lecture 3 of Apna College's JavaScript playlist with Shradha Didi, focusing on a fundamental data type we use every day: Strings . Before today, I thought strings were just plain text wrapped in quotes. Today, I learned how much power JavaScript gives us to manipulate, slice, and dynamically format text. 🧠 Key Learnings From JS Lecture 3 (Strings) I explored how JavaScript handles text strings and the built-in properties and methods that make text manipulation effortless: 1. Template Literals (The Ultimate Game Changer) Shradha Didi introduced Template Literals , which use backticks ( ` ) instead of standard quotes. This allows us to perform String Interpolation —embedding variables directly inside a string using ${variable} . It makes code look clean and professional: javascript let obj = { item: "pen", price: 10 }; // Old way: console.log("The cost of", obj.item, "is", obj.price, "rupees."); // Modern way: console.log(`The cost of ${obj.item} is ${obj.price} rupees.`);

I just joined DEV to explore the community and get into the habit of writing about what I'm learning. I also set up a blog on Hashnode — figuring out how the two fit together. Here's a quick code block to test formatting: ​ function greet ( name ) { console . log ( `Hello, ${ name } !` ); } greet ( " DEV " ); ​ ``` More to come as I find my way around 👋

I Built My First Token on Solana — Here's What Actually Surprised Me This week I went from zero tokens to minting, transferring, charging fees, and locking tokens so they can never move. Here's what stuck with me. Tokens don't live in your wallet Coming from Web2, I assumed tokens would just... show up in your account. Nope. On Solana, every wallet needs a separate token account for each token it holds. One mint, one folder. It felt weird at first. Now it makes sense. You can charge fees without writing a single backend The Token Extensions Program has a built-in transfer fee. One flag at mint creation time: spl-token create-token \ --program-id TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb \ --transfer-fee-basis-points 100 That's a 1% fee on every transfer, enforced by the blockchain. No middleware. No payment processor. No way to bypass it. You can make a token that literally cannot be transferred spl-token create-token \ --program-id TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb \ --enable-non-transferable I minted 10, tried to send 5, and watched the transaction get rejected. Not by my code — by the program itself. Perfect for credentials, badges, or certificates that should belong to one person forever. The biggest shift from Web2: these rules are set at creation and are permanent. You can't add a transfer fee to an existing token. You can't make a transferable token non-transferable later. It forces you to think about token design upfront, which is honestly a good constraint. solana #blockchain #webdev #beginners #100DaysOfSolana

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Most AI tutorials start with a setup checklist. Pick a model provider. Create an account. Wire up a...

I recently built Letras Diferentes , a free Unicode text-styling tool for people who want creative copy-paste fonts for bios, nicknames, social posts and gaming profiles. The idea is simple: Type normal text Preview different Unicode styles Copy the result in one click Use it on Instagram, WhatsApp, TikTok, Free Fire, Discord or social posts The project is especially focused on Portuguese-speaking users, but the tool works with general Latin text too. Main project: One thing I’m learning while building it is that Unicode text tools are not just about “fonts”. They are about UX, compatibility, mobile performance, copy buttons, favorites, categories and making the result easy to use on real platforms. I’m still improving the interface, categories and mobile experience. Feedback is welcome.

Web Security Basics Every Developer Must Know (2026) Security isn't just for security teams. Every developer needs these fundamentals to protect their applications and users. The Threat Landscape in 2026 Most common attacks targeting web apps: 1. SQL Injection — Still #1, still devastating 2. XSS (Cross-Site Scripting) — Steals sessions, defaces sites 3. CSRF (Cross-Site Request Forgery) — Actions on behalf of users 4. Authentication bypass — Weak passwords, session fixation 5. Sensitive data exposure — API keys in code, unencrypted data 6. IDOR (Broken Access Control) — Accessing others' data 7. SSRF (Server-Side Request Forgery) — Internal network probing 8. Dependency vulnerabilities — Compromised npm/pip packages Key principle: Defense in depth → Don't rely on one security layer → Multiple independent controls → If one fails, others catch it #1 SQL Injection Prevention // ❌ VULNERABLE: String concatenation const query = `SELECT * FROM users WHERE email = ' ${ email } '` ; // Attacker inputs: ' OR '1'='1' -- // Result: Returns ALL users! // ✅ Parameterized queries (always!) const user = db . prepare ( ' SELECT * FROM users WHERE email = ? ' ). get ( email ); // The database treats the input as DATA, not code. // With ORM (Sequelize/TypeORM/Prisma): User . findOne ({ where : { email } }); // Safe by default // Even with parameterized queries, validate input first: function isValidEmail ( email ) { return /^ [^\s @ ] +@ [^\s @ ] + \.[^\s @ ] +$/ . test ( email ); } if ( ! isValidEmail ( email )) return res . status ( 400 ). json ({ error : ' Invalid email ' }); // ⚠️ Dangerous: Dynamic table/column names can't be parameterized! const allowedTables = [ ' users ' , ' products ' , ' orders ' ]; if ( ! allowedTables . includes ( table )) throw new Error ( ' Invalid table ' ); #2 XSS (Cross-Site Scripting) Defense // Types of XSS: // 1. Stored XSS: Malicious script saved in DB, shown to all viewers // → Comment sections, profiles, product reviews // 2. Reflected XSS: Sc