标签：#dev

The Faros AI Engineering Report 2026 is not a survey of developer sentiment. It is two years of telemetry from 22,000 developers across 4,000 teams, measuring what AI adoption actually produces downstream. The findings have a name: the Acceleration Whiplash. The structural explanation has one too. What the telemetry actually shows The output numbers in the Faros report are real and worth stating plainly. Epics completed per developer are up 66.2%. Task throughput per developer is up 33.7%. PR merge rate per developer is up 16.2%. These represent genuine delivery acceleration, and dismissing them would be dishonest. AI coding tools are producing real productivity gains at the business level. The production quality numbers are also real: Metric Change Incidents per PR under high AI adoption +242.7% Median time in code review +441.5% Code churn (lines deleted to lines added) +861% PRs merged with no review at all 31.3% Source: Faros AI Engineering Report 2026: The Acceleration Whiplash . Telemetry from 22,000 developers across 4,000+ teams. Figures represent metric change from lowest to highest AI adoption periods within each organization. Both sets of numbers are true simultaneously. That is the whiplash. Throughput accelerated. The downstream systems built to validate that throughput did not. Plotted together, generation throughput rises steeply while control capacity stays nearly flat -- and the gap between the two curves is the governance debt. Why the systems did not scale Code review, incident response, and architectural validation were all designed for a world where development velocity was human-paced. A senior engineer could review the meaningful PRs in a sprint. An incident postmortem could trace a failure to a specific change and a specific decision gap. Architectural drift was visible because it moved slowly enough to catch. AI-generated code broke these assumptions quietly. Not because the code was obviously bad, but because it was often superficially conv

I built Xaloia AI , a privacy-first AI platform focused on trust and human interaction. And now, I’m shutting it down. Not because the idea was empty. Not because the tech didn’t work. But because I tried to build it from Romania. The Problem Wasn’t the Product Xaloia was built around things that are becoming increasingly important: privacy secure communication human-centered AI But building something meaningful isn’t enough. It needs the right environment to grow. And that’s where things started to break. What I Ran Into Trying to build in Romania, I kept hitting the same walls: Lack of early adopters willing to pay - People are curious about tech, but not ready to invest in new products. Limited startup ecosystem - Fewer accelerators, fewer investors, fewer people who understand what you’re building. Cultural friction around ambition - If your idea isn’t small or conventional, it’s often questioned instead of supported. Low exposure to global markets - Even if you build something good, getting it in front of the right audience is much harder. None of these stop your project instantly. But together, they slowly drain momentum. Why the US Is Different From everything I’ve seen and experienced, the US offers something fundamentally different: Access to capital — people invest earlier Distribution opportunities — platforms, networks, visibility Cultural support for big ideas — ambition is expected, not questioned Faster feedback loops — you know quickly if something works It’s not that success is guaranteed there. It’s that the conditions for success actually exist. The Real Lesson Talent is everywhere. Ideas are everywhere. But opportunity is not evenly distributed. And trying to ignore that reality cost me time, energy, and a product I genuinely believed in. What’s Next Shutting down Xaloia isn’t the end. It’s a reset—with better clarity. Next time, I won’t just focus on building something good. I’ll focus on building it where it actually has a chance to grow.

Here's a thing that happens on every team I've been on. Sprint ends. Someone schedules the retro....

I'm trying to understand the market rate for developing a complete SaaS/web-based ZATCA-compliant e-Invoicing platform for Saudi Arabia and would appreciate estimates from agencies or developers who have experience with similar projects. The scope would include: Core Invoicing Create, edit, delete invoices Tax invoices and simplified tax invoices Credit notes Debit notes Proforma invoices Multi-currency support VAT calculations Invoice templates PDF generation QR code generation ZATCA Phase 1 (Generation) Fully compliant invoice format TLV QR code generation Arabic and English invoice support Required invoice fields and validations Printable invoice formats ZATCA Phase 2 (Integration) Integration with ZATCA APIs Compliance CSID onboarding Production CSID onboarding Invoice cryptographic stamping Invoice hashing Digital signatures XML generation according to ZATCA specifications Clearance invoices workflow Reporting invoices workflow Automatic invoice submission Real-time status tracking Error handling and retry mechanisms Certificate management and renewal Business Management Customer management Supplier management Product/service catalog Categories Units of measure VAT configurations Branch management Company profile management User & Security Multi-user access Role-based permissions Activity logs Audit trails Two-factor authentication API access for third-party integrations Reporting & Analytics Sales reports VAT reports Invoice status reports ZATCA submission reports Export to Excel/PDF Dashboard analytics Additional Features SaaS architecture Multi-tenant support REST API Webhooks Email invoice delivery WhatsApp sharing Backup and recovery Localization (Arabic/English) Responsive web application Cloud deployment Technical Requirements Modern web stack Secure architecture Scalable for thousands of invoices per day Production-ready deployment Documentation For agencies that have built ZATCA solutions before: What would you charge for a project like this? How many

I was thinking, with all the lay offs in tech. Would it be possible to start a company and just sort of catch the talent getting laid off? Obviously you would need an initial investment from something like an investment firm or an angel investor. I was just thinking that their could be an opportunity for some rich people to eat AI's lunch if they started a tech company with the laid of talent from the AI bubble. But also idk, I have never been in the valley, so I don't really know how it works. submitted by /u/LAN_scape [link] [留言]

Hey all, some time ago I had an interview for a Frontend Engineer role at Stripe and had this question for my coding round: Develop OTP component that has 4 inputs: - accepts only digits - when one input is populated => auto-focus to the next - submit on enter - should support backspace - should be accessible I was using React and was trying to make it via 4 separate <input> elements heavily relying on the built-in HTML validation attributes (to save time, interviewer agreed it was ok). I made it work with auto-focus and everything but still got rejected. Now I'm curious how other would approach such challenge. I will attach an image in the comments for a visual reference. submitted by /u/truenapalm [link] [留言]

Recently got an email from "Paratype" that one of my sites was using a font that was unlicensed and we needed to pay a fee. I inherited the site from someone else so had no idea about the font, which was hidden in a Bootstrap library, so the decision was made to remove it completely. I replied to Paratype stating this and they replied, "Well, you were using it in the past, so you should pay us anyway." Obviously I'm going to tell them to piss off, but I was wondering how common this sort of thing is? I doubt they have much of a claim legally, the wording of the email is pretty weak sounding to me. submitted by /u/TConner42 [link] [留言]

Hey everyone, I'm a researcher at Carnegie Mellon University conducting a research study on how developers are actually using spec-driven development (SDD) in practice — things like writing SPEC.md files, PRDs, or structured natural-language specs before working with AI coding agents like Claude Code, Cursor, Kiro, etc. There's a lot of community knowledge about how to do SDD well, but almost no academic research on it. I'm trying to change that. What the study involves: One 45-60 minute semi-structured interview via Zoom Questions about your SDD workflow, what's worked, what hasn't, and how it fits into your SDLC No tasks, no tests — just a conversation about your experience Who I'm looking for: Have at least one year of active experience as a contributor or maintainer of any open-source GitHub project Have used SDD tools/workflows in that project (spec files, structured prompting, plan-mode workflows, etc.) 18 or older, fluent in English What you get: Honestly, nothing monetarily. But your experience will directly shape a taxonomy of SDD workflows and practices that I'll publish openly. Happy to share findings with participants who want them. Ethics/privacy : The interview will only be audio-recorded with your consent. Your responses will be kept confidential and de-identified in any published findings. If you're interested, fill out this short screening survey (5 min): LINK Or DM me / comment below with questions. Also happy to hear if there are other communities I should be posting in. submitted by /u/lost_researcher1 [link] [留言]

OSSurf is a platform for discovering open-source repositories and contribution opportunities. It lets you: Explore trending repositories Track pull requests and issues Browse projects by language and category Discover projects suitable for contributions and GSoC Looking for feedback on the overall experience, usefulness, and UI. https://ossurf.vercel.app/ https://github.com/OSSURF submitted by /u/Direct_Sorbet_1631 [link] [留言]

Syndicated from the FavCRM blog . The old quote was two weeks. With an agent on the UI and a headless backend, it's an afternoon. A client needs a booking site. The old quote was two weeks: a calendar, a database, an availability engine, payments, a customer table. With an AI agent building the frontend and FavCRM as the headless backend , the real work is an afternoon. Here is the whole job, start to finish. The scenario A small clinic. Three services, one practitioner, online booking with deposit. You are the agency; you have an AI agent in your editor and a terminal. The plan: Register the clinic's FavCRM workspace Configure services and availability Wire one server route that talks to FavCRM Let the agent build the booking UI against that route Test a real booking end to end Step 1 — Register the workspace (~5 min) The favcrm CLI registers a workspace and issues an API key. No dashboard. favcrm signup request --email clinic@example.com \ --organisation-name "Bright Smile Clinic" favcrm signup verify --request-id < id > --code <6-digit-code> The verify step prints a fav_mcp_* key. Put it where your build can read it — never in the repo: export FAVCRM_API_KEY = fav_mcp_... Step 2 — Configure services and availability (~30 min) Hand the brief to your agent and let it call the tools. Inspect a schema first: favcrm tool describe create_service Then create each service: favcrm tool call create_service '{ "name": "New Patient Exam", "durationMinutes": 45, "price": "80.00" }' favcrm tool call create_service '{ "name": "Cleaning", "durationMinutes": 30, "price": "60.00" }' Set when the practitioner works, so availability is real: favcrm tool call set_staff_availability '{ "weekday": "mon", "start": "09:00", "end": "17:00" }' Repeat per weekday. At this point the backend is done — services, hours, an availability engine that knows about clashes. You wrote no schema. Step 3 — One server route (~30 min) The browser must never hold the API key. Put it in one server route tha

Syndicated from the FavCRM blog . The number that predicts whether an agent is safe to let loose isn't the tool count. When people compare agentic CRMs, they count tools. The number that actually predicts whether an agent is safe to let loose is a different one: annotation coverage . An MCP tool annotation tells the agent what a tool does to the world — whether it reads or mutates, whether it's safe to retry, whether it reaches an external service. Without annotations, the agent is guessing. This is what they are, and why a catalog's annotation coverage matters more than its tool count. What an MCP annotation is Every MCP tool can carry hints alongside its input and output schemas: readOnlyHint — the tool only reads; it changes nothing. Safe to call freely. destructiveHint — the tool mutates or deletes. The agent should confirm before calling. idempotentHint — calling it twice with the same input has the same effect as once. Safe to retry on a timeout. openWorldHint — the tool reaches an external service (sends an email, charges a card), so its effects leave the system. These are not documentation for humans. They are machine-readable signals the agent reasons over before it acts. Why they prevent the worst failures The dangerous class of agent failure is not "the agent couldn't do something." It's "the agent did the wrong destructive thing because it misread an ambiguous instruction." Delete the customer instead of the tag. Refund the wrong invoice. Cancel every booking instead of one. Annotations let the agent self-gate. A well-annotated catalog means the agent calls list_members without ceremony but pauses to confirm before cancel_booking , because one is marked read-only and the other destructive. Pre-MCP function-calling had no equivalent — every tool looked the same to the model, so safety lived entirely in the prompt. Why coverage matters more than count A 190+ tool catalog with 100% annotation coverage is safer than a 30-tool catalog with none. A tool that l

What are HTML Tags? HTML documents consist of a series of elements, and these elements are defined using HTML tags. HTML tags are essential building blocks that define the structure and content of a webpage. HTML tags are composed of an opening tag, content, and a closing tag. The opening tag marks the beginning of an element, and the closing tag marks the end. The content is the information or structure that falls between the opening and closing tags. For Example: <h1>Hello</h1> HTML Elements HTML elements are the essential components of a webpage and provide structure, organization, and meaning to content. Elements are defined by HTML tags which define how different types of content will appear in a browser window. For Example: <p> This is an element. </p> Block-Level Elements A page’s entire width is occupied by a block-level element. The document always begins with a new line. An HTML page generally has three tags i.e., <html> , <head> , and <body> tag. Example: The following is an unordered list, an example of block-level elements. List item 1 List item 2 Inline Elements A block-level element’s inner content can be formatted with an inline element by adding links and stressed strings. These elements help you to format text without disrupting the content’s flow. Example: The following code creates a hyperlink to a URL. It is an inline element because it is used within paragraphs, headings, or other text content to create hyperlinks. It does not disrupt the flow of the document by forcing new lines before or after its content. <a href="https://www.example.com"> Visit Example </a> CSS Properties CSS properties are used to decorate your web page and assign a unique behavior to your HTML element. CSS properties are the foundation of web design, used to style and control the behaviour of HTML elements. They define how elements look and interact on a webpage. Used to control layout, colors, fonts, spacing, and animations on web pages. It is essential for making web pa

I have found a weird case where I put in a real address (verifiable on google maps) it keeps correcting me to a wrong address (doesn't exist and cannot be found on google maps. What gives? If it's truly a bug, how do I let Google know? See below. https://preview.redd.it/x2b1ws07635h1.png?width=1336&format=png&auto=webp&s=18091e8ec57f96854611fef8578fd9e79e369d8b submitted by /u/flatcoke [link] [留言]

The Hook: The 48-Hour Re-Infection Nightmare It’s a scenario that keeps e-commerce founders and agency directors awake at night: You wake up to a critical alert that your flagship WordPress site is redirecting users to a spam domain. You immediately deploy a premium security plugin, run a deep scan, quarantine three suspicious files, and breathe a sigh of relief. The scanner gives you a green checkmark. You're safe. Then, exactly 48 hours later, the redirects return. What went wrong? The automated scanner checked the surface, but the attacker had already established a foothold deeper in the architecture. They didn't rely on a loose PHP file in your uploads directory; instead, they weaponized an overlooked, unauthenticated WordPress REST API endpoint to re-inject the payload the moment your scanner turned its back. When high-value enterprise sites are compromised, treating the symptoms with standard security plugins is like putting a band-aid on a structural fracture. To truly remediate a persistent infection, you must think like a forensic analyst, hunt down hidden persistence mechanisms, and harden the application perimeter. The Anatomy of Persistence: Where Malware Hides Modern WordPress malware is sophisticated. Attackers know that standard security tools look for modified core files or rogue scripts in the /wp-content/plugins/ directory. To survive cleanups, they embed themselves into the core infrastructure of your site using three primary vectors: 1. wp-config.php Pre-Loading Attackers frequently inject obfuscated code directly into the top of wp-config.php . Because this file executes before the rest of the WordPress core loads, malware can hook into the initialization process, silently recreating deleted malicious files every time a page is requested. 2. Malicious Must-Use (MU) Plugins Files placed in /wp-content/mu-plugins/ are executed automatically by WordPress and cannot be disabled from the admin dashboard . Attackers love this directory. They will ofte

I’m building Obex, a faith-rooted self-control app for men who want to quit porn and stay consistent with daily discipline. The stack is Expo / React Native, with a web landing page and a desktop blocker companion. Core features: Streak tracking and rank progression Panic Mode for urgent moments Accountability partners Blocker support on desktop Christian-focused language and reminders The goal is to make the product feel practical rather than preachy. People usually respond better to clear feedback loops, a visible streak, and a calm recovery path after setbacks. If you want to see it or give feedback, the site is here: https://obex.so

submitted by /u/creaturefeature16 [link] [留言]

This open-source community project lets you create a StumbleUpon-like experience for recommending your favorite sites.

Hi — I'm E Lion (Eric), Hawaii-based builder at Coral Crown Solutions . I ship production code on my own domains—not tutorials: elionmusic.com — 400+ promo pages, vinyl-style player UX, Vapi phone agent + OpenAI "Shine" chat (one knowledge base, unified CSV log, webhook follow-up emails) prayerauthority.com — faith-tech at scale; WebM flying angels , SOAP journal, oracle tools Digital Zion — Three.js metaverse + native 3D desk fork + localhost bridge APIs Stack: PHP 8, vanilla JS, webhooks, JSON-LD / Search Console, ElevenLabs, Playwright, Electron (Shine assistant), Cursor pair-programming. Looking for: peers who respect hard integration work (SMTP, CORS, cPanel, webhook auth) and clients who need a real AI front desk or artist/ministry platform. Live demos: coralcrownsolutions.com · elionmusic.com Happy to give honest feedback on your builds—drop a link.

The Setup I run a Proxmox 9 homelab (pve-manager/9.0.5, kernel 6.14.8-2-pve) and I needed to run Docker inside an LXC container — not a VM — to test a customer-style "bring-your-own-VPS" deployment path for a PaaS I'm building. The container had to act like a standard Ubuntu cloud VM: Docker, systemd, the works. LXC over a full VM gets me near-bare-metal performance, a fraction of the RAM overhead, and instant boots. The catch: the "Docker on LXC" recipes you'll find on most blog posts and Proxmox forum threads are out of date . They assume kernel 5.x and runc 1.1.x. On a modern Proxmox (kernel 6.14 + runc 1.2+ shipped with Docker 29) those recipes fail in two new and confusing ways before you even reach the workarounds we used to know about. This article walks through exactly what fails, why it fails, and the config that actually works in 2026 — plus an honest look at the security tradeoffs, because spoiler: the working config is privileged , and that matters. The Goal A Proxmox LXC container that can: Run docker run hello-world cleanly Pull and build complex images (multi-stage builds, overlay2 storage driver) Run nested containers with their own systemd Use systemd --user for per-service lingering processes Attempt 1: Unprivileged LXC (the path you "should" take) Conventional wisdom says: use unprivileged LXC. The container's root is mapped to an unprivileged UID on the host (typically 100000 ), so even a full container compromise can't escape to host root. Modern Proxmox makes this the default and recommended mode. I started with an unprivileged Ubuntu 25.04 container, added the now-standard features: pct set <vmid> -features nesting = 1,keyctl = 1,fuse = 1 Then inside the container, installed Docker from the official download.docker.com repo and ran: docker run --rm hello-world Here's what happened: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start

Wer täglich in anspruchsvollen Agenturprojekten arbeitet und zwischen Windows-Host und Linux-Umgebung wechselt, weiß: WSL 2 ist ein Gamechanger. Doch selbst wenn man das perfekte Setup einmal konfiguriert hat, kommt unweigerlich der Moment, in dem eine Distribution hängt, RAM freigegeben werden muss oder man ein Backup ziehen will. Anstatt jedes Mal Stack Overflow zu durchsuchen, habe ich mir angewöhnt, die essenziellen Konsolen-Befehle immer griffbereit zu haben. Hier sind die 5 WSL-Befehle, die ich in meinem Setup am häufigsten brauche: Wer täglich in anspruchsvollen Agenturprojekten arbeitet und zwischen Windows-Host und Linux-Umgebung wechselt, weiß: WSL 2 ist ein Gamechanger. Doch selbst wenn man das perfekte Setup einmal konfiguriert hat, kommt unweigerlich der Moment, in dem eine Distribution hängt, RAM freigegeben werden muss oder man ein Backup ziehen will. Anstatt jedes Mal Stack Overflow zu durchsuchen, habe ich mir angewöhnt, die essenziellen Konsolen-Befehle immer griffbereit zu haben. Hier sind die 5 WSL-Befehle, die ich in meinem Setup am häufigsten brauche: 1. Den Status aller Distributionen prüfen Der absolute Standard-Befehl, um zu sehen, welche Linux-Instanzen laufen und welche WSL-Version sie nutzen. wsl --list --verbose # oder kurz: wsl -l -v 2. Der Notaus-Schalter (RAM freigeben) Wenn Docker oder ein Node-Prozess im Hintergrund den gesamten Arbeitsspeicher blockieren, fährt dieser Befehl alle WSL 2 Instanzen sauber herunter. wsl --shutdown 3. Eine bestimmte Distribution als Standard setzen Wichtig, wenn man beispielsweise neben Ubuntu noch Debian installiert hat und festlegen will, was sich beim reinen Befehl wsl öffnet. wsl --set-default <Distributionsname> 4. Die WSL-Umgebung neustarten Es gibt keinen direkten "Restart"-Befehl. Die sauberste Lösung ist das Beenden (Terminate) der spezifischen Instanz. Beim nächsten Aufruf startet sie frisch. wsl --terminate <Distributionsname> 5. IP-Adresse der WSL-Instanz herausfinden Extrem hilfreich für be