标签：#dev

Does anyone know a cheaper way to track trending TikToks, Instagram Reels, and YouTube Shorts? I’ve already looked at Apify and Virlo, but they seem too expensive for what I need right now. I’m mainly trying to find viral formats, hashtags, sounds, creators, and short-form trends without spending a lot on scraping tools. Are there any cheaper tools, APIs, open-source projects, or manual/automated workflows people recommend? submitted by /u/InternalGrab3189 [link] [留言]

Are there any languages we don't usually associate with webdev, but where they have great libraries that deserve more attention? So I'm not asking about the language itself. I'm asking about the tooling people have built for webdev in the language. submitted by /u/returned_loom [link] [留言]

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

VSCode extensions were how Github were breached earlier this year. What are people doing around VSCode security best practices around extensions. Approved Extensions Only Disable Auto update Is there anything else like minimum age or settings like that can be done? submitted by /u/ruddet [link] [留言]

This is a super dumb question (considering I've been working for like 5-6 years in this field) but I just want to get to the bottom of this so I can finally stop worrying that by searching "frontend developer" isn't reducing my future prospects LOL. submitted by /u/WitnessConfident2451 [link] [留言]

I currently have a website which heavily relies on the Google Places Photo API. Users can scroll through a bunch of POIs for planning trips, as well as various other things. This can mean that each user could 50+ unique photos. I understand that it’s against ToS to cache these photos and reuse them. The API costs are too high to maintain a scalable solution, but no real competitors come close to the quality of Google. At this current rate I’ll probably have to cap my users on the amount the amount of requests they can make. Is there some work around that I’m missing? Thanks submitted by /u/TWJ32 [link] [留言]

If you have never written a line of game code and you are trying to choose between Unity, Godot, and Unreal, the internet will give you fifty contradictory answers in your first hour of searching. This article is the answer we give to people who ask us in person. We are a Unity-specialist studio. I have spent 12 years building games, including a tenure as Mobile Team on RuneScape Mobile at Jagex. Over that time I have mentored a steady stream of new developers entering the industry. We picked Unity for our commercial work, deliberately, and we will say upfront where that lens does and does not serve you. The advice below is what I would tell a friend's teenager who asked which engine to learn first, not the version where I am trying to win you as a client. Three things drive whether a beginner finishes their first game or quietly abandons it: the engine's first-week friction, the quality of the free learning material, and whether the language and tools punish you or reward you when you make a mistake. Comparison articles obsess over feature lists. Beginners obsess over whether they can get something on screen by Saturday. We are going to talk about Saturday. The 30-Second Answer If you skim nothing else, take this: Pick Godot if you want the gentlest first week. The editor is small, the language reads like Python, and you can ship a 2D game to the web in a single afternoon. Best chance of you actually finishing a project. Pick Unity if you want a future career in the games industry. Largest tutorial library, biggest job market, most transferable skills. C# is harder than GDScript but every hour you spend on it pays back in the long run. Pick Unreal if you have always wanted to make games specifically because of the visuals. Blueprints let you avoid C++ at the start, the rendering looks beautiful from day one, and the long learning curve has the highest payoff if you commit. For the rest of the article, we will explain why each of those is true, where the engines gen

I Read Your AI Agent Logs So You Don't Have To: A $149 Service That Beats Another Dashboard What if the cheapest fix for your broken AI agent is a stranger reading 40 hours of traces for $149? I spent the last month doing exactly that — reading roughly 40 hours of production logs from teams running LangGraph, CrewAI, and AutoGen agents for paying customers. Not building observability dashboards. Not comparing LangSmith vs Langfuse. Reading the actual traces and writing up what was wrong, what to fix, and in what order. Three observations from those 40 hours: The dashboard was never the problem. Every team already had LangSmith or Helicone or a homegrown equivalent logging every LLM call. None of them were reading the logs. The "fix" was almost always one of seven patterns. I kept seeing the same shapes — stuck retry loops, idempotency gaps, tool-call argument drift, etc. — dressed up in different framework jargon. The teams that asked for "another tool" were the ones least likely to use it. They had 14 tools. The teams that paid for an hour of my time were the ones who said "I don't have time to look at this myself." That second group is who I'm now building a $149 service for. Here's why I think it works, what the deliverable looks like, and where the limits are. Why a $149 fixed-fee reading and not an hourly rate I tested three pricing models against the same deliverable: a written diagnostic of an agent's last 7 days of traces, prioritized fixes with code-level examples, and a 30-minute async follow-up. Model Conversion Avg revenue / inquiry Notes $200/hr (estimated 3hr) 2/40 inquiries $15 (lost 38 to sticker shock) Freelance default, fails on cold traffic $1,500 flat project 0/40 inquiries $0 Above the "I'll just keep it broken" threshold for most small teams $149 fixed diagnostic 11/40 inquiries $41 Below "another contractor" threshold, above "free advice" The $149 number is the inversion point — low enough that a stressed eng lead can expense it without a meet

From what I hear, the client IDs are randomly assigned, and people claim that the birthday paradox prevents endless piles of new client IDs piling up in the state vector, but I don't understand how this is possible. The design seems like it would either guarantee a collision eventually, for someone in the world, if the number of random bits is small, or it would indefinitely bloat the state vector up to billions of entries (If it's large). If you have 32 bits of state, and a billion entries, more than half of new random client IDs should be unused, right? Would they not then add another entry to the state vector? Is there some undocumented cleanup method that actually can remove old client IDs? Do they just rely on most applications recreating the whole thing periodically? submitted by /u/EternityForest [link] [留言]

You just merged an AI-assisted feature branch, the code review looks clean, and the app works in your local smoke test. Now comes the real question: do you add another traditional browser test, let an AI tool generate the coverage, or spend the time improving the observability around the existing suite? That decision is where a lot of teams get stuck. AI-assisted development changes more than coding speed. It changes the shape of bugs, the pace of UI churn, the expectations for review, and the amount of test maintenance you can tolerate. If you treat AI testing as a magic replacement for your current process, you will probably add noise. If you ignore it entirely, you miss a chance to reduce repetitive work and catch gaps earlier. The real choice is not AI vs non-AI The useful decision is usually this, should AI help create and maintain tests, should it assist human review, or should it stay out of the critical path and only support investigation? That splits into three practical modes: 1. AI assists development, but humans own test strategy This is the safest default. AI can help draft test cases, suggest assertions, summarize failing traces, or propose missing edge cases, but the team still decides what belongs in the suite. If your product has regulated flows, complex permissions, or revenue-critical paths, that ownership matters more than any automation shortcut. 2. AI generates or heals tests inside a human-defined framework This is useful when the team already knows what it wants to cover, but not every selector, fixture, or assertion has to be hand-written. AI can reduce repetitive maintenance, especially for UI-heavy apps that change often. The hidden cost is that you still need a way to judge whether the generated test reflects product intent or just mirrors the current page state. 3. AI becomes part of the evaluation and triage loop Here the value is not test creation, it is speed of diagnosis. AI can summarize logs, cluster failures, or explain a flaky pa

Microsoft published two Defender vulnerabilities on May 19, 2026 that are being actively exploited in the wild, and CISA has already pushed both into the Known Exploited Vulnerabilities catalog. If you run Windows endpoints, this is a same-week update item, not a "schedule it for the next maintenance window" item. The patches exist, the abuse is happening, and the BOD 22-01 deadline for federal civilian agencies is June 3, 2026. what follows: what happened, who needs to act, and what to do today before someone else makes the decision for you. What's being exploited CVE-2026-41091 is an Elevation of Privilege bug in Microsoft Defender's scanning logic, rated Important. The root cause is improper link resolution before file access. An authenticated local attacker plants symbolic links or NTFS junctions that point at attacker-controlled paths, then triggers Defender to follow them. Defender operates with SYSTEM privileges during scan operations, so the file actions Defender performs on those crafted targets execute as SYSTEM. Net result: a non-admin local user gets full SYSTEM on the host. The attacker needs an authenticated session already. That sounds like a high bar until you remember that initial-access malware lands at user-level, then chains a local privilege escalation to get persistence and lateral-movement capability. CVE-2026-41091 is the second-stage tool intrusion sets are looking for. The Hacker News and BleepingComputer both confirm the in-the-wild abuse is happening. CVE-2026-45498 is a Denial of Service in the Microsoft Defender Antimalware Platform itself. Attackers can trigger a platform-level crash that takes Defender's protection capabilities offline. The exploitation pattern here is the obvious one: kill the EDR/AV before deploying the actual payload, get a clean window for follow-on actions, restore Defender or leave it broken depending on how careful the operator is. CISA's KEV listing tells you this is being chained operationally, not a theoreti

Hello everyone! It has been a busy week, but I've made some exciting progress on my machine learning journey. Here is what I've been up to: Kaggle Orbit Wars & AWS I completed the baseline implementation for the Kaggle Orbit Wars competition and initially hit a score of around 1030. My score has dipped slightly over the past few days, so I am currently brainstorming ways to improve it. This week also marked my very first time using AWS! I used it to extract data for reinforcement learning. Transparency check: I spent exactly $7.58 USD on AWS resources during the process. Paper Reading & RL Insights I spent a lot of time reading research papers this week. AlphaZero: I was initially excited about using the self-play mechanism from AlphaZero. However, because this specific game has rock-paper-scissors dynamics, standard self-play might not work effectively. AlphaStar: This led me to the AlphaStar paper, which uses self-play combined with League Training . The engineering behind AlphaStar is incredible. Two specific concepts really stood out to me: Pointer Networks and V-trace off-policy correction . I was also impressed by their use of an LSTM core to handle long-term memory. Next Steps Moving forward, I plan to leverage Kaggle, AWS, and GCP credits to train different components of my model. I am giving myself total freedom to experiment, imagine, and test unconventional solutions. Random life update to close out the week: I used to have long hair because I was insecure about my forehead, but I finally decided to shave it all off at home by myself. It honestly feels really weird right now, but it's a fresh start!

Yesterday I was looking at the caniuse page for invokers and had something like 83% coverage...I thought: I wonder what other feature has the same coverage and maybe I'm already using it. So I built it: https://ifyouuse.com submitted by /u/pablopang [link] [留言]

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. What if you could change how an AI thinks without retraining it? Not by rewriting prompts. Not by fine-tuning billions of parameters. Not by collecting another mountain of training data. Instead, imagine finding a direction inside the model's internal representation space and nudging the model a little in that direction. A small push. A different behavior. This idea sits at the heart of one of the most fascinating areas of modern AI interpretability: steering vectors . Steering vectors suggest that many behaviors we care about—careful reasoning, honesty, coding style, security awareness, verbosity, and more—may already exist inside a model. The challenge is learning how to activate them. Let's explore what steering vectors are, how they're created, and why they might become one of the most practical tools for controlling AI systems. 1. What Exactly Is a Steering Vector? Large language models process information through layers of high-dimensional activations. At any point during generation, the model's internal state can be represented as a vector containing thousands of numbers. Researchers discovered something surprising: Different behaviors often correspond to different regions of this activation space. For example: Writing Python code Solving math problems Speaking French Explaining concepts carefully Producing insecure code Each tends to produce distinctive activation patterns. A steering vector is essentially the difference between two activation patterns. Suppose we gather examples where the model is: Careful Methodical Thorough and compare them to examples where it is: Rushed Superficial Incomplete The average difference between these internal states becomes a steering vector. At inference time, we can add that vector back into the model's activatio

A few weeks ago I was on a call sharing my screen, walking a teammate through a prompt I'd been iterating on in ChatGPT. Mid-sentence I scrolled up — and there, three messages back, was a chunk of a customer's data I'd pasted in earlier to debug something. Real email, real account info, sitting right there on a shared screen. Nobody said anything. Maybe nobody noticed. But I noticed, and I spent the rest of the call only half-present, trying to remember everything else still in that thread. If you live in ChatGPT all day, you already know the problem. The thread is your scratchpad. You paste logs, keys, customer rows, half-finished internal docs — things you'd never put in a doc you planned to share. And then someone says "can you share your screen real quick" and suddenly your scratchpad is a presentation. Why the usual advice doesn't work The standard answers are all some version of "be careful": Open a clean tab before sharing. Scroll to the top. Use a separate "demo" account. These fail for the same reason all manual checklists fail under pressure: the moment you actually need them is the moment you're distracted, talking, and not thinking about hygiene. You remember after . The fix has to happen before the screen goes live, and it has to require zero discipline in the moment. What I wanted instead I wanted something that just sat there and blurred sensitive parts of a page automatically, so that even if I forgot, the leak couldn't happen. A few requirements: Local only. Whatever it does, it never sends page content anywhere. A privacy tool that phones home is a contradiction. Before, not after. It blurs while the page renders, not after I've already exposed it. Per-element, not whole-screen. A full black box is useless for a demo. I still need to show the working parts. The interesting technical bit The naive approach is to listen for some "I'm sharing now" signal and react. That's too late — there's a visible frame where the data is exposed before the blur kic

Sliding Your Way Out of Panic: The Mental Trick That Speeds Up Coding Under Fire Quick context (why you're writing this) I still remember the sweat on my palms during a technical interview a couple of years back. The interviewer tossed out the classic “longest substring without repeating characters” problem, gave me five minutes, and watched me stare at the whiteboard like I’d never seen a string before. I started with a brute‑force double loop, felt the clock ticking, and ended up writing a mess that was O(n²) and full of off‑by‑one errors. I walked out feeling like I’d choked, even though I knew the solution deep down. Later, after I’d spent way too many hours replaying that moment in my head, I realized the problem wasn’t my knowledge—it was the way I was framing the question while under pressure. I’d been trying to solve the whole thing at once instead of focusing on the tiny piece that actually mattered. When I finally isolated that piece, the answer clicked in seconds. That’s the mental framework I now teach anyone who’s about to face a ticking clock: identify the invariant you must keep true, and let everything else revolve around it . The Insight When the pressure’s on, your brain wants to grab the biggest chunk it can see and start hacking. That’s a recipe for wasted time and bugs. Top coders do the opposite: they strip away everything that isn’t a constant rule the solution must obey, then build the smallest possible state machine that enforces that rule. For the substring problem the invariant is simple: the current window must contain only unique characters . If you can guarantee that, the answer is just the biggest size that window ever reaches. All the fiddly details—where to move the left pointer, how to know when a duplicate appears—fall out of tracking the last index you saw each character. So the mental steps are: State the invariant (what must always be true). Find the minimal data you need to enforce it (usually a map or a set). Update that data

Enlace a post en Español Click If you are developing games in Godot and using AI to help you code, you are probably tired of constantly switching tabs between your editor and the browser. Copying code, pasting it, explaining your scene context over and over again... it is a massive workflow killer. To solve this, I built Golem-AI (named after the Godot Engine logo because let's face it, it looks like a tiny, friendly mechanical golem). It is a "Cursor-style" AI assistant extension integrated directly into a dock right inside your Godot 4.2+ editor. Today, I am opening the repository to the community as a completely open-source project. It is currently in Beta and has some bugs, but it is fully functional, and I want to share it so we can improve it together. / ____/___ / /__ ____ ___ / | / _/ / / __/ __ \/ / _ \/ __ `__ \______/ /| | / / / /_/ / /_/ / / __/ / / / / /_____/ ___ |_/ / \____/\____/_/\___/_/ /_/ /_/ /_/ |_/___/ 🎮 How it Looks Inside the Editor Here is a glimpse of the integrated dock interface, its session history, and the context autocomplete system in action: 🔥 Key Features 🦙 Local & Cloud Providers: Connect it to Ollama or LM Studio for a 100% free, offline local workflow, or hook it up to OpenAI, Anthropic, Gemini, or Cursor proxies. 🧠 Cursor-Style UX & Context (@ Mentions): Type @ in the chat composer to automatically attach open scenes, specific project files, or custom skills directly into the prompt. 🛠️ Editor Tool Calling: It features an optional multi-step verification loop. The AI can actually interact with native Godot editor tools to help you iterate and fix things faster. 📚 Markdown Skills System: Feed the assistant specific workflows, style guides, or documentation using standard markdown files (/skill or @skill :id). 💬 Advanced Chat UI: Built-in "thinking blocks", agent step progress tracking, searchable history sessions, and a native bilingual UI (English / Spanish). 🛠️ The Current State: "It works, but..." (Looking for Beta Testers!) L

Excited to share SkillMap AI, a platform designed to help organizations make faster and more accurate staffing decisions. The idea is simple: project requirements and candidate profiles often live in separate documents, making team allocation slow and inconsistent. SkillMap AI bridges that gap by converting project requirements into structured skill demand and matching them against candidate capabilities. ✨ Key Features • Requirement Intelligence – Transform project briefs into normalized skill requirements • Candidate Matching – Compare resumes against actual project needs, not just keywords • Skill Gap Analysis – Identify missing capabilities before project execution • Staffing Decision Support – Recommend validation, interviews, and upskilling paths 📊 Outcomes ✓ Faster staffing shortlists ✓ Reduced manual resume screening ✓ Better project-team alignment ✓ Evidence-based skill gap identification ✓ Improved workforce planning 🌐 Live Demo: https://skill-map-ai-delta.vercel.app Would love to hear your thoughts and feedback!

When using the Postman extension in vsCode I was wondering where all the Collections credentials and tokens are stored. Are they secure and what is best practice for its use? Should I switch to curl? And can I use environment variables like curl? The postman documentation just talks about using the postman vault but doesn't say where they are stored and how securely if you aren't using it. submitted by /u/ElectricYFronts [link] [留言]

TLDR: I’ve built a single player browser game which is static assets and 0 cost, I plan to release multiplayer which will cost me - would you split into 2 different URLs eg “multi.myurl.gg” vs “myurl.gg” etc (placeholder URLs) Hey reddit, I’ve built a browser game in my spare time and have a question about potentially hosting on 2 different URLs. My specific issue is - right now the game is single player only + bots, and cost wise most of the game is free for me to host at any scale due to the way I’ve architected single player. This includes sharing features and things like watching replays, I could effectively have a billion users and still pay the same as when I have 1 user. This is great! But, once I introduce multiplayer, I have to pay for Cloudflare workers, storage, egress fees potentially etc for those same sharing and replay features. I’ve estimated these costs to be quite low even at scale, but I’m extremely frugal and want to always keep the single player experience alive. The multiplayer experience is more dependant on how well it performs with the public. So I was thinking of hosting single player at something like “myurl.gg” and multiplayer at something like “multi.myurl.gg” for a clean separation of concerns. Am I over-engineering here?? @mods this is not self promotion, I’ve used placeholder URLs etc submitted by /u/ComfortablePeace8859 [link] [留言]