标签：#c

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

Introduction: The Need for Modern Web/AppSec Training The cybersecurity landscape is evolving at a breakneck pace, but the tools we use to train the next generation of defenders are stuck in the past. Most web/appsec learning platforms still focus on basic, textbook vulnerabilities —XSS popups, simple SQL injection, or trivial IDORs. These labs are like teaching someone to swim in a kiddie pool; they might grasp the concept, but they’re ill-prepared for the open ocean of modern web applications . The gap isn’t just in depth—it’s in relevance . Real-world apps today are complex, API-driven, and riddled with subtle, pattern-based vulnerabilities that don’t fit into neat, isolated lessons. Consider this: a developer misconfigures a GraphQL endpoint, exposing an entire database. Or an API leaks sensitive data because of a flawed rate-limiting mechanism. These aren’t edge cases—they’re common mistakes in modern apps. Yet, most training platforms ignore them, leaving learners to either stumble upon these issues in the wild or remain oblivious. The result? A workforce of security professionals who can theoretically exploit a vulnerability but struggle to identify or fix it in a real-world context . The problem isn’t just outdated content—it’s the lack of ethical, hands-on practice environments . Many aspiring security professionals resort to illegal or gray-area practices to gain experience, risking legal consequences and ethical dilemmas. What’s needed is a platform that simulates real-world scenarios without crossing ethical boundaries, one that teaches not just how to exploit but also why vulnerabilities occur and how to fix them . Here’s the core issue: modern apps are systems, not isolated components . A vulnerability in one part—say, a file upload feature—can cascade into a full account takeover if combined with a session management flaw. Most labs fail to teach this interconnectedness , leaving learners with a fragmented understanding. A practical platform must brid

GitHub Actions shows you one run at a time. Green check, red X, green check, green check, red X. You scroll the list, you re-run the flaky one, you move on. Nobody's asking the question that actually matters: is this getting better or worse? "I calculated how much my CI failures actually cost. Curious what your pipeline success rate looks like — has anyone else tracked the actual wasted compute time over time?" That's a real question from someone who did the math by hand and found their failures were burning a real chunk of their compute budget. The replies were the same story you'd expect: heavyweight CI platforms have their own dashboards for this, but nobody had a lightweight, local way to just... track it. So I built citrend : pull your GitHub Actions run history into a local file, get a trend. npx citrend sync --repo owner/name npx citrend report --repo owner/name What it actually shows you $ citrend report --repo acme/widgets acme/widgets — 812 run(s) (2 in progress) success rate: 87.4% (699/800 settled, 12 skipped) wasted runs: 101 (12.6%) total compute: 118h 42m wasted compute: 14h 6m weekly trend (oldest → newest): 2026-06-05 91.2% success, 8 wasted (58m) 2026-06-12 88.0% success, 11 wasted (1h 22m) 2026-06-19 79.4% success, 22 wasted (3h 8m) 2026-06-26 84.1% success, 15 wasted (2h 1m) That weekly column is the entire point. A single gh run list will never show you that week 3 was a cliff — you'd have to notice it got annoying to work in, which is a much slower and much less precise signal than a number going from 91% to 79%. How it works sync pulls your workflow run history from the GitHub REST API and caches it locally (deduped by run id, so you can run it on a schedule without piling up duplicates). report reads that cache — no network call — and computes: Success rate , over settled runs only (still-running runs don't count either way until they conclude, and skipped runs are excluded from the denominator since they're not a pass/fail outcome). "Wasted"

Know what your team actually shipped today Discussion | Link

Google has released A2UI v0.9, a framework-agnostic standard for AI agents to declare user interface intent across multiple platforms without arbitrary code. The update emphasizes alignment with existing design systems. It includes a new SDK for Python, improved error handling, and various transport methods. Migration guidance and evolution specifications are also provided. By Daniel Curtis

leetcode.com Problem Statement Given the root of a binary tree, return its preorder traversal. Preorder Traversal follows: Root ↓ Left ↓ Right Brute Force Intuition In an interview, you can explain it like this: Visit the current node first, then recursively traverse the left subtree followed by the right subtree. Recursion naturally follows the preorder sequence. Complexity Time Complexity: O(N) Space Complexity: O(H) Where: N = Number of Nodes H = Height of Tree Recursive Code class Solution { public List < Integer > preorderTraversal ( TreeNode root ) { List < Integer > ans = new ArrayList <>(); preorder ( root , ans ); return ans ; } private void preorder ( TreeNode root , List < Integer > ans ) { if ( root == null ) return ; ans . add ( root . val ); preorder ( root . left , ans ); preorder ( root . right , ans ); } } Moving Towards the Optimal Iterative Approach Instead of recursion, we can use a stack. Since preorder visits: Root ↓ Left ↓ Right we should process the root immediately. To ensure the left subtree is processed first, push the right child before the left child . Pattern Recognition Whenever you see: Preorder Traversal Simulate Recursion Think: Stack Key Observation Stack follows: LIFO To visit: Left First push: Right First ↓ Left Second so that left is popped first. Optimal Java Solution class Solution { public List < Integer > preorderTraversal ( TreeNode root ) { List < Integer > ans = new ArrayList <>(); if ( root == null ) return ans ; Stack < TreeNode > st = new Stack <>(); st . push ( root ); while (! st . isEmpty ()) { TreeNode node = st . pop (); ans . add ( node . val ); if ( node . right != null ) st . push ( node . right ); if ( node . left != null ) st . push ( node . left ); } return ans ; } } Dry Run 1 / \ 2 3 / \ 4 5 Stack: 1 Visit: 1 Push: 3 2 Visit: 2 Push: 5 4 Traversal: 1 ↓ 2 ↓ 4 ↓ 5 ↓ 3 Answer: [1,2,4,5,3] Why Stack Works? A stack processes the most recently added node first. By pushing: Right Child ↓ Left Child the left child

Over the past year, AI has become part of many developers' daily workflow. It can generate code, explain unfamiliar frameworks, review pull requests, and even suggest architectural patterns. But I've noticed that the biggest impact isn't on writing code faster. It's on how we think about software architecture. With AI handling repetitive implementation tasks, it feels like architects and senior engineers are spending more time on system design, scalability, security, integrations, and long-term maintainability rather than syntax and boilerplate. At the same time, AI-generated code isn't always production-ready. It still requires strong engineering judgment, careful reviews, and a solid understanding of the underlying architecture. I'm curious how other developers are experiencing this shift. Has AI changed the way you design software systems? Do you trust AI when making architectural decisions? Which parts of software architecture do you think should always remain human-led? Have AI tools improved your team's productivity, or introduced new challenges? I'd love to hear real-world experiences, lessons learned, and different perspectives from the community.

I've been trying to learn coding for 35 years, which is my age. I love coding, and love the fantasy of being a coder. I love the whole thing about it. It's not a unhinged passion, but still something I carry very close to my digital heart. I started with VB6, and excel, and then web and I have never been particularly good at anything. If you ever met someone that loves gaming or sports but are bad at them, that's me. I need to have coding in my life, I'm just not good enough, ever. And that's fine. I discovered vibe coding because I follow all tech stuff. I've been trying to build certain things for years. I'm not necessarily desperate to build them but I do want them. Discovering AI allowed me to build personal web apps I always wanted to but was limited. All of the sudden I was able to build all web apps I wanted. I did 8 different projects in weeks. None of these things were for everyone, but very specific, tailored apps that help me at work, and in my personal life. Kinda trivializes the unbelievably fucking hard thing that is to learn evem the most remote thing about coding. Ive quit so many times becase concepts and terms I don't get. I still don't know what the fuck a prototype is in JavaScript even tho I got the certificate from FCC. Yet here I am building things that not even my imagination could put together. Am I enjoying it? Yes. Has it been beneficial? Fuck yes. I have been given the tools to create things my skills can't help me to. At the same time, as a person that have been trying to learn since I'm like 15, I know this isn't something to be trivialized. But at the same time I do have tools that trivializes it and they're available and free and works. Am I a disgusting person for feeling empowered? This is the first time in my journey I'm able to build actual things with the help of thear tools, but I also feel it's so disrespectful because I struggled for ALL MY LIFE trying to learn it. That said, since I stated vibe coding I've learn so many shit

The trust problem nobody scopes correctly When companies talk about trust in AI, they almost always mean trust in the model. Is the output accurate? Is it hallucinating? Can we rely on what it says? Those are valid questions but they're the wrong starting point. The trust that actually determines whether AI gets adopted or quietly abandoned inside an organization isn't about the model. It's about the system surrounding it. The four questions that determine Every team evaluating AI in a production workflow eventually runs into the same four questions. Not about model quality. About operational control. Can we understand the outputs? Not just "does the answer look right" but can someone on the team explain why this output was produced and whether it's appropriate for this specific context. An AI that generates correct-looking code or recommendations that nobody can verify is a system that runs on hope. Hope doesn't survive the first incident. Can we validate the decisions? When the AI recommends an action or generates an output that feeds into a business process, is there a way to check it against the actual requirement? Or does the team just trust the output because questioning it is harder than accepting it? The second one is more common than anyone admits. Can we intervene when needed? When something goes wrong, how fast can a human step in? Is there a kill switch? Is there a fallback path? Or does the AI output flow directly into downstream systems with no circuit breaker? The teams that skip this question are the ones that discover the answer during an incident. Can we trace what happened afterward? When an AI-generated decision produces a bad outcome, can you reconstruct the chain? What input went in, what output came out, what context was available, what wasn't? Without traceability, post-mortems hit a dead end, and the same failure happens again. Why opaque systems don't survive real operations There's a tempting argument that opacity is fine as long as the sy

I'm a bit annoyed by the feeling that we're kind of stuck when it comes to using LLMs for programming. I use Claude Code and Codex, but I haven't been able to enter flow state like I can when I hand write code. This is kind of ironic to me since AI should be a bicycle for the mind, but right now it feels like a bicycle that just brakes abruptly every couple minutes. I stop, wait, review, prompt again. Is there anyone exploring something fundamentally different than the prompt response loop we ha

Todo projeto que envolve autenticação via telefone acaba esbarrando no mesmo problema chato: como testar isso de verdade? Você não pode ficar digitando seu próprio número toda vez que roda um fluxo de cadastro. Definitivamente não deveria pedir para os colegas de equipe cederem o deles. E a maioria dos pipelines de CI não tem uma pessoa sentada ali, pronta para ler uma mensagem de texto e digitar o código num formulário. É uma daquelas coisas que parecem pequenas até você estar três sprints dentro de um projeto com 2FA via SMS e perceber que a cobertura de teste desse fluxo inteiro é "testei uma vez, manualmente, antes do almoço". Por Que a Verificação por Telefone É Complicada de Testar A maioria dos fluxos de autenticação de um stack típico é fácil de automatizar. Verificação por e-mail, dá para interceptar com uma caixa de entrada de teste ou um serviço de captura de e-mails. Tokens de sessão, dá para mockar. Redefinição de senha, você controla o loop inteiro. O SMS quebra esse padrão porque o código precisa sair completamente do seu sistema, ser entregue por uma rede de telecomunicação real e voltar antes que o teste possa continuar. Essa ida e volta introduz vários pontos de falha que não têm nada a ver com o seu código: atrasos de operadora, filtros de spam, peculiaridades de entrega por região, limites de taxa. Se você já viu um pipeline de CI falhar numa etapa de verificação por telefone e depois passar numa nova tentativa sem nenhuma mudança de código, é quase sempre por causa disso. O instinto de muitas equipes é pegar um número público gratuito de um dos vários sites de "receber SMS online" para checagens manuais rápidas. Isso funciona bem para uma verificação pontual. Mas desmorona rápido quando você tenta automatizar, porque esses números são compartilhados potencialmente por milhares de outras pessoas usando o mesmo pool. Códigos podem se perder numa caixa de entrada lotada, o próprio número pode já estar bloqueado pela plataforma que você está testand

A government customer of NSO Group used the company's Pegasus spyware to hack into the phone of a European politician, who at the time was serving on an EU committee tasked with investigating the spyware industry.

“It is a direct attack on the rule of law,” says one European Parliament member of the new findings from Citizen Lab.

Hey HN, I built a tiny zero DOM layout engine for vector graphics and custom renderers to resolves nested rows/cols/grids into exact `{x, y, w, h}` boxes, with text measurement, overflow signals, and collision separation. This is to help make SVG, PDF, Canvas responsive. Feedback welcome from anyone building canvas/SVG diagrams, dashboards, node editors, or diagram tools.

I recently built a free online image processing tool that runs entirely in the browser. No uploads, no servers, no sign-ups. Here's how it works under the hood. https://img.aixiaot.com The Problem Most online image tools require uploading your photos to someone else's server. This raises privacy concerns and limits file sizes. I wanted to build something that processes everything locally. Tech Stack - Next.js for the frontend - TensorFlow.js + Real-ESRGAN for AI upscaling - @imgly/background-removal for AI background removal - Tesseract.js for OCR - Canvas API for compression, resizing, format conversion Features • AI Background Removal - one click, works for portraits, products, animals • Image Compression - reduce file size up to 96% • Format Conversion - JPG, PNG, WebP • ID Photo Maker - passport and visa photos with customizable backgrounds • AI Image Upscaler - 2x to 8x with Real-ESRGAN • OCR - extract text from images, 20+ languages • Image Resizer - enlarge or shrink Architecture All processing happens client-side using WebAssembly and the Canvas API. When you upload an image, it never leaves your device. The AI models (background removal, upscaling) run locally in your browser using TensorFlow.js and ONNX Runtime Web. Open Source The entire project is open source under AGPL v3. You can find it on GitHub: https://github.com/haizeigh/ai-image-tools Try It https://img.aixiaot.com I'd love to hear your feedback! What features would you add?

Seven days of flow. Fixed a peer identity binding issue in py-libp2p, automated my Neovim lockfile merges, and added a massive batch of notes on xv6 and Category Theory. 10 commits and a solid PR in the works. TL;DR I managed to hit a perfect seven-day streak this week, balancing some deep-dive p2p networking work with necessary maintenance on my local environment. The highlight was opening a PR in py-libp2p to tighten up how PeerRecords are handled in the Kademlia DHT. On the side, I spent time automating the annoying parts of my Neovim config and dumping a fresh batch of notes into my knowledge base. 10 commits, 204 lines added, and a much cleaner workflow to show for it. What I Built Neovim Configuration & CI I’m a firm believer that your editor should work for you, not the other way around. My nvim repo saw a lot of action this week—9 commits in total—but most of it was under-the-hood maintenance. I’ve been leaning on Lua to keep things snappy, and this week was about ensuring my plugin ecosystem doesn't rot. I pushed several updates to keep plugins at their latest versions, but the real "quality of life" improvement was adding a chore to auto-resolve lazy-lock.json merge conflicts. If you’ve ever worked on your Neovim config across multiple machines, you know the headache of the lockfile drifting. I set up a flow to prioritize incoming changes, which saves me from manually triaging JSON diffs every time I pull from dev . It’s a small tweak, but it removes a recurring friction point in my daily flow. I also spent time cleaning up the root of the config, with about 37 additions and 33 deletions—refactoring is a constant process when you live in your terminal. The Knowledge Base I also put some serious time into main-notes . I’m currently going deep on a few different subjects, and I use this repo as my "second brain." I added 167 lines of new material across 13 files, covering a pretty diverse range of topics: xv6 (the re-implementation of Unix V6), Category Theo

Spent the week deep-diving into my dev-publish tool, focusing on durability and orchestrator resilience. 21 commits across two repos, with a massive cleanup of the publishing logic and some much-needed architecture documentation. TL;DR There is a specific kind of satisfaction that comes from taking a tool you use every day and finally giving it the "production-grade" treatment it deserves. This week was exactly that. I spent most of my time in the guts of dev-publish , moving past the "it works on my machine" phase and into "it works even if the world is on fire" territory. With 21 commits and over 11,000 lines of code churn, I focused on making the publishing orchestrator resilient and the state durable. What I Built The star of the show this week was dev-publish . If you’ve ever tried to automate cross-platform technical writing, you know that the edge cases are where the real pain lives. I pushed 16 commits here, touching about 45 files. The diff was pretty wild: +6,926 additions and -4,289 deletions. That net positive tells part of the story, but the deletions represent me ripping out brittle logic that just wasn't cutting it. Hardening the Orchestrator The biggest win was a massive fix to make the publish state durable and the orchestrator resilient. In the previous iteration, if a network request to an API (like Dev.to) failed halfway through a multi-platform push, the state was... let's just say "vague." I spent a lot of time in src ensuring that the orchestrator can now pick up where it left off. I also documented the published-flag semantics and re-run resilience in the README. It sounds like a small thing, but knowing that a re-run won't accidentally double-post your article is a huge weight off my mind. I also spent some time on the "boring but important" stuff. I normalized how tags are handled to make them safer across different platforms and implemented a much stricter resolution for cover images. If a local image is required but missing, the tool now