标签：#dev

Im a beginner trying to create a website for my luxery home staging business. I tried using templates in canva but hate how generic it looks and find it very limiting Is there a better way ro use canva? What combination of tools would help me create an editorial style website. Would be nice if there were some AI tools i could use in conjunction to make some of the work easier . submitted by /u/Grand_Respect_9176 [link] [留言]

A practical 5-10 minute checklist for vetting npm dependencies before adding them to production. It focuses on provenance attestations, install scripts, CI quality signals, maintainer responsiveness, and security handling. submitted by /u/OtherwisePush6424 [link] [留言]

Hello Dev Community 👋 I recently built my first web project called Namastra — a simple tool to explore the meanings, origins, and insights behind names. 👉 Live Demo: 💡 Why I built this I noticed that many people are curious about: What their name means Where their name comes from What personality or cultural meaning it carries But most websites are: Too slow Full of ads Hard to navigate So I decided to build something simple, fast, and clean. ⚙️ What Namastra does With Namastra, users can: 🔍 Search any name instantly 📖 Get meaning and origin 🌍 Learn cultural background ⚡ Use a clean and fast interface 🛠️ Tech Stack I built this project using: HTML CSS JavaScript GitHub (version control) Netlify (deployment) Hosted here: [Netlify] Code managed via: [GitHub] 🚧 Challenges I faced As a beginner developer, I faced challenges like: Designing a clean UI Making search functionality smooth Deploying with GitHub + Netlify Structuring data properly But I learned a lot through building it step by step. 🎯 What I learned How to build and deploy a full project How important UI simplicity is How real users think differently than developers How deployment pipelines work (GitHub → Netlify) 🚀 Future improvements I plan to add: More name data Better UI design Categories (religion, origin, country) Possibly AI-based name insights 🙌 Feedback welcome This is my first real web project, so I’d really appreciate your feedback and suggestions. Try it here: 👉 Thanks for reading ❤️ Happy coding!

I like to make userScripts and userStyles for myself. I've begrudgingly dealt with Shadow DOM here before, and it's nothing but a pain in the ass. However, now I'm seeing a userStyle that I'm trying to apply being removed immediately as it's applied (using Stylus). What is the mechanism behind this? Other styles from the same style sheet are still being honored. The element still has the same root, and is still be matched by the rules's selector. What might be the way this is achieved? https://youtu.be/YgbOrfel604 (Chromium 124.0.6367.61 (Official Build) (64-bit)) submitted by /u/svArtist [link] [留言]

Most indie hackers I know spend an embarrassing amount of time on the naming part. We argue with ourselves over the perfect .com, eventually settle for some janky combo of words with random consonants ripped out, and ship a domain we secretly don't love. There's a quieter option a lot of builders haven't seriously considered: .Vegas. It's a geographic TLD, but it does NOT require you to be in Las Vegas or build anything Vegas-related. What it does give you is a TLD that sounds bigger than it costs, reads as memorable, and is still wide open in 2026. I went down a small rabbit hole this week looking at side-project ideas that would have an almost unfair head start on .Vegas. Here are five. 1. A weekend trip planner Domain: weekend.vegas or trip.vegas This is the lowest-hanging fruit and I'm honestly surprised nobody's built it yet. A tiny webapp that takes a Friday-to-Sunday window and spits back a fully booked itinerary: flight, hotel, two restaurant reservations, one show, one activity. Three clicks, done. Why it works on .Vegas: the domain is the elevator pitch. Nobody needs to read your tagline. The URL bar tells you what the product does. That's worth more than most landing-page copy will ever earn. 2. A bachelor/bachelorette party coordinator Domain: bach.vegas , party.vegas , last.vegas Group-trip coordination is genuinely awful. Splitwise + a group chat + a shared Notion doc + that one friend who keeps forgetting to Venmo back. There's room for a niche product here that handles the deposit splits, the "who's in for the cabana" upsells, and the inevitable last-minute flight changes. Why it works on .Vegas: the URL doubles as a tagline. You don't have to explain what kind of trip it's for. 3. A booking aggregator for shows and residencies Domain: shows.vegas , tonight.vegas Caesars, MGM, Live Nation, AXS, Vivid Seats, the venue's own ticketing system — finding a good show on a specific Tuesday night is a pain. A scraper-backed booking aggregator that's honest a

In web development, every millisecond on the critical path matters. Typography is part of your visual identity, yet a single self-hosted family can add hundreds of kilobytes before the browser paints the hero line clients actually see. That cost often shows up as slower First Contentful Paint (FCP) and a worse Largest Contentful Paint (LCP) when the LCP element is a headline set in a custom face. Font subsetting is the practical fix: ship only the characters (glyphs) each page or component needs instead of entire typefaces built for every language and symbol you will never render. What font subsetting is A typical desktop font file contains thousands of glyphs: Latin extended, Cyrillic, ligatures, numerals, punctuation, and symbols you may never use on a marketing site. When you @font-face that file or pull it from a CDN, the browser still has to download and parse the whole package unless you split it. Subsetting creates a smaller font file that includes a defined subset of Unicode code points. Examples: A display font used only on one H1 might need fewer than 40 characters. A Latin-only blog body font does not need CJK tables on every article. UI labels in English can omit unused weights and scripts. The browser downloads less data, spends less time decoding, and can apply the face sooner. You keep the look; you drop the dead weight. When font subsetting improves web font performance and LCP Subsetting pays off fastest in these cases: Situation Why subsetting helps Display or hero typography Few unique characters, high visual impact, often on the LCP text node Single-language sites Remove unused scripts and diacritic ranges you do not publish Icon or logo fonts misused as full fonts Replace with SVG where possible; subset if you must keep a font icon set Multiple weights loaded globally Subset per weight, or load weights only on routes that need them It is lower priority when you already use a system font stack for body copy and only load one small variable font w

An account manager forwarded us a Search Console screenshot at 4:47 p.m. on a Friday. LCP on the homepage had been in the red for eleven days. Engineering had not been in the thread because nobody was assigned to watch the numbers until a sponsor noticed. That is reactive performance monitoring in practice: fast tools, slow humans, and a calendar that only opens when someone else raises the alarm. Proactive monitoring is the opposite shape. Scheduled lab tests run whether or not anyone remembered to open PageSpeed Insights. Performance budgets turn history into rules. Alerts fire when those rules break, with enough context to triage and enough restraint that people still read them. The word “smart” in product copy usually means the second part: alerts that match how teams actually work, not a louder siren. This post is for agency leads who already automate some tests but still learn about regressions from client inboxes. We walk through what reactive looks like, what proactive requires, and how to wire alerts so they change behaviour instead of training everyone to mute the integration. What reactive performance monitoring looks like on agency teams Reactive does not mean “no tools.” Most agencies we speak with have PageSpeed Insights bookmarks, a monthly spreadsheet, and a standing item on the retainer review slide. Reactive means the signal arrives after the business event you wanted to prevent. Common patterns: Spot checks after deploy. Someone runs PSI on staging, ships, and assumes production matches until a complaint arrives. Quarterly or monthly report pulls. CrUX and Lighthouse exports go into a deck. Useful for storytelling; too slow to catch a plugin update that moved INP on Tuesday. Client-led discovery. The sponsor pastes a screenshot, asks “is this new?”, and the team scrambles to reproduce on a laptop that may not match the lab conditions you use in production monitoring. Alerting without policy. Webhooks fire on every metric twitch. By week three the

Hermes Agent: Why Open-Source AI Agents Are Changing How We Build Software Introduction Artificial intelligence has moved far beyond simple chatbots. Today, developers are building systems that can reason through problems, use tools, execute tasks, and make decisions across multiple steps. These systems are commonly known as AI agents. Recently, I explored Hermes Agent, an open-source agentic framework designed to run on your own infrastructure while providing advanced capabilities such as planning, tool usage, and multi-step reasoning. After spending time understanding how it works, I came away with a greater appreciation for the role open-source agents may play in the future of software development. In this article, I'll explain what Hermes Agent is, what makes it interesting, and why developers should pay attention to the growing ecosystem of open-source AI agents. What Is Hermes Agent? Hermes Agent is an open-source agent framework designed to perform tasks that require more than a single response from a language model. Instead of simply answering questions, Hermes Agent can: Break down complex objectives into smaller steps Use external tools when necessary Maintain context across multiple actions Perform reasoning before taking action Execute workflows autonomously This approach allows developers to build systems capable of handling real-world tasks that would normally require human intervention. For example, rather than asking an AI to summarize a document, you could instruct an agent to: Find relevant documents. Analyze their contents. Extract key insights. Generate a report. Save the results to a specified location. The agent coordinates each step as part of a larger workflow. Why Open Source Matters One of the most compelling aspects of Hermes Agent is that it is open source. Many powerful AI tools today operate behind closed platforms where developers have limited visibility into how systems work. Open-source alternatives provide several advantages: Transp

Most developers paste production JWTs into online decoders without thinking. Here's a 10-second DevTools check to see if your token is actually leaving your machine. A coworker was debugging an auth bug last month. Standard workflow: copy the JWT from the failing request, paste it into an online decoder, read the payload. I've done it a thousand times. You probably have too. Except the token he pasted belonged to a real customer. And the decoder he used is owned by an identity company that's had its share of security incidents. Nothing bad happened. Probably. But it made me think about something I'd never actually checked: when you paste a JWT into an online decoder, where does that token go? What a JWT actually contains Quick reminder of why this matters. A JWT isn't encrypted — it's just Base64URL-encoded. Anyone who has the token can read everything in it: header.payload.signature The payload routinely contains: User ID, email, and role Session identifiers Token expiry ( exp ) and issue time ( iat ) Sometimes — against best practice — far more And here's the part people forget: a valid, unexpired JWT is a live credential. If it hasn't expired, whoever holds it can often impersonate the user. Pasting it into a random website is functionally similar to pasting a password. The 10-second check Most online JWT decoders claim to be "secure" and "client-side." Some are. Some aren't. You don't have to trust the claim — you can verify it yourself in 10 seconds: Open the decoder in your browser Open DevTools → Network tab Clear the network log Paste a JWT and decode it Watch the Network tab If any request fires when you decode — your token left your machine. A truly client-side decoder fires zero network requests during decoding. The JavaScript does everything locally; nothing is sent anywhere. Try this on whatever decoder you currently use. You might be surprised. Why most "online" tools send data It's usually not malicious. Building decoding logic on the server is someti

I have been receiving pretty good offers for B2B contracts. I've been employed for the 7+ years here and, wasn't fired, had np joining whichever company, always got a raise hoping or within the company. The issue is that in some of those , mgmt and leadership people keep changing in less than 6-12 months. Goals, focus, performance, even structure keep changing out of nowhere, regardless of me being consistent or better in whatever made up metric they have always get some stupid ass feedback of something I should be doing outside my job or expertise. Am I being naive? every f..ing company is like that right? I've been wondering if maybe it is not for me being a full-time employee. Are contractor roles less focused on that? What is your exp from what I said above? don't care about goals, being on call or career paths. Just want to do the job, deliver and move on to the next project. I've been promoted many times, had leader roles, don't recommend, don't like, no added value for me and promotions don't give more money or improved my contract. What about agencies that provide dev services and you get allocated for short times? Also got those positions but no idea how it works and how stable it is. I always have been fulltime employee my entire working life. If you have resource about opening a company for B2B contracts, please link it to me, I would be mostly interested in something around Austria/Hungary area. I am specialized in FE hence posting here. EDIT: clarity on the second paragraph submitted by /u/Raziel_LOK [link] [留言]

I'm hoping to get some info on sizing for the Herman Miller Aerons.. I'm 5'7", 220lbs, and in my mid 40s. I'm built with a fairly long torso and shorter, but more muscular legs, which seems to be the opposite of what a lot of ergo chairs are built for. I've had mild, but consistent back pain for the last 10-15 years, primarily from being a programmer and sitting at a desk with cheap chairs and not the best posture for about 25 of the last 30 years.. My current chair (Office Max mesh back with a padded seat and headrest) was decent at the beginning, but the seat padding is basically gone and the last week or so, anytime I sit in it for longer than about an hour, my lower back pain is significantly worse for the rest of the day, so it's time to replace it. I've seen other reddit threads ([this reddit thread, for example]( https://www.reddit.com/r/hermanmiller/comments/j4y3tl/proper\_herman\_miller\_aeron\_sizing\_chart\_corrected/ ) that seem to indicate that the person won't help me with my height/weight and will make my lower back/thigh pain worse.. Is there anyone with a similar build to me that currently has or has had an Aeron that can give feedback as to whether it has actually helped with back pain or made it worse? Or, if anyone with a similar build to me has any suggestions on other chairs that have been good for them, I'd love that info. My budget tops out at about 600-650, and I don't have a problem with used/refurbished if it comes from a decent place with a reliable warranty or 30-90 day return policy. My back thanks you in advance! (In case it matters, this will probably be cross posted in a few other subs.. hopefully that's not an issue, as I need all the help I can get with this back pain at this point. submitted by /u/melophat [link] [留言]

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. A straightforward engineering question: what happens when you feed a long book to an on-device language model in Chrome and start adjusting the parameters? To explore this, I built a small experiment called Gemini Nano Book Lab : a Chrome extension sidepanel that uses Chrome’s built-in Prompt API to answer questions about Richard Wagner’s My Life , while also exposing some of the underlying mechanics. The response is only part of it. The experiment also captures: Model download behavior Retrieval cost Time to first token Context window pressure Effects of different chunking strategies Places where the API works well, and where its limits become obvious If you’re an engineer interested in systems that have rough edges—and therefore teach you something—this is a useful area to explore. What the Prompt API Is Chrome’s Prompt API is part of the browser’s built-in AI features. Instead of sending prompts to a cloud endpoint, a web app or extension can request an on-device language model session and prompt it locally. Resources: The Prompt API Session management best practices Structured output for the Prompt API Built-in model management in Chrome Debug Gemini Nano Core capabilities: Local inference Streaming results Availability check before session creation Context usage measurement Events like contextoverflow (In some environments) sampling parameters like temperature and top-k This makes it more than a simple text box—it becomes an environment for experimentation. Why a Long Book? Long inputs expose the interesting problems. Short prompts hide a lot; a paragraph‑long demo can make any model look magical. A long corpus forces concrete decisions: What chunk size works well? Should chunks overlap? How many chunks should you retrieve? What latency comes from ret

zero errors on the first try means i am basically a senior principal engineer for the next five minutes until the database connection breaks submitted by /u/Alternative-Tax-6470 [link] [留言]

Hello, I have been working for the last couple of years in the Nuxt/Vue environment, and Laravel before that. Recently, one of our clients asked us to rebuild their website in Wordpress. I have hacked my way through some small wordpress projects before, but it always feels miserable and inefficient. Are there any tools or techniques that you use to make development better? This is mostly a brochure website with limited user functionality on the front-end. Unfortunately, I cannot use headless wordpress given the clients technical requirements. I would love to find a way to introduce reusability for components (heros, CTAs, cards, etc), HMR in dev, or any of the other features I've come to rely on in more modern stacks like Nuxt, while also maintaining the CMS aspects of Wordpress (likely through ACF). Would love to hear your tips + tricks! submitted by /u/dont_trust_lizards [link] [留言]

Hey everyone i'm moving to a decent first world country by the end of this year I got my PR and everything I just still need money I worked for the last 6 months as a contractor for $2400 monthly with an AI startup based in California, they sold it a month ago and I was let go obviously as their product was built and acquired by another company, I'm very confident in my skills its just I literally have no idea about how to land a similar job like that again. if you can help me with some advice please do and please don't' be racist I didn't choose where to be born, I wish everyone can get mega rich in the future and thanks in advance. submitted by /u/In-Hell123 [link] [留言]

We manage retainer clients and every so often a client will email us saying something on their site looks broken. Nine times out of ten it's a WordPress plugin update that shifted a layout, a hero image that stopped loading, etc. We find out from them instead of the other way around, which is an awkward position to be in when you're supposed to be the one watching their site. I've looked at tools like Visualping, ChangeTower, and Distill. They all work the same way. You give them a URL, they alert you when something changes. That’s fine for monitoring a few pages yourself, but they don't really fit an agency workflow. There's no concept of a client, there’s no way to group pages by account, and you can’t actually show a client at the end of the month to prove you're on top of things. The developer tools like Percy and Applitools are a different thing entirely. They plug into CI pipelines and need an engineer to set them up. Not useful for an account manager who just wants to know if a client's homepage looks broken this morning. What I keep thinking about is something simpler. A web app that allows you to organize by client, take screenshots on a schedule, flag visual changes before the client notices, and generates a monthly summary you can send to the client. It would be less about code deployments and more about just knowing your clients' sites are visually intact. Is this something you actually run into, or do you have a system that handles it already? Would something like this be worth paying for, or is it too niche to budget for? Am I missing a tool that already does this well? Any feedback is much appreciated. Thanks. submitted by /u/newintownla [link] [留言]

I interviewed for Walmart SWE3 role 3 days back. Both rounds were held on the same day. Qualified Round 1 and then gave Round 2. Round 2 went well too. But I have not received any update yet. Its been 3 days. Is it normal or should I accept that I am rejected? submitted by /u/Complete-Ad-240 [link] [留言]

If you are an open-source maintainer, developer advocate, or builder, you know the cycle: you build an amazing tool, but writing the launch blog post, documentation, or tutorial takes hours. For the Hermes Agent Challenge , I wanted to build something that solves this exact problem. I built devto-blogger , a custom, prompt-driven skill for the brand new Hermes Agent by Nous Research. It autonomously scans any workspace or codebase, analyzes the architecture, and drafts a fully-structured, rich Markdown technical article ready for publication on DEV. 🚀 What is Hermes Agent? Hermes Agent is an open-source agentic system built by Nous Research (the lab behind the famous Hermes LLM models). Unlike basic coding copilots or simple chatbot wrappers, Hermes is: Environment-Aware : It runs sandboxed in Docker, Modal, Daytona, SSH, or locally. Connected : It interfaces with Telegram, Discord, Slack, WhatsApp, and more. Closed Learning Loop : It has persistent memory and creates custom skills on the fly from its own experience. 🔧 The Entry: The devto-blogger Skill In Hermes Agent, a "skill" is defined by a simple, declarative Markdown file ( SKILL.md ) located in the ~/.hermes/skills/ directory. By utilizing a prompt-driven skill structure, we can guide the agent's behavior globally without writing complex Python orchestration scripts. Here is the custom skill I designed and installed for this challenge: --- name : devto-blogger description : " Scan the codebase and generate a comprehensive Dev.to technical blog post draft." version : 1.0.0 author : Hermes Agent Developer license : MIT platforms : [ linux , macos , windows ] metadata : hermes : tags : [ devto , blogging , documentation , markdown , technical-writing ] related_skills : [ plan , design-md ] --- # Dev.to Technical Blogger Skill Use this skill when you need to write an in-depth technical post, review, or tutorial about the active workspace or codebase. ## Core Behavior 1. **Codebase Inspection** : Scan repository

In 2024, Orca Security sued Wiz and demanded their full git version control history. Orca wanted to see "when features and functions were added, modified, or altered, including through engineers' notes and comments." The court recognized git history as relevant evidence in a software IP dispute. It ordered production of commit logs tied to two specific features. That ruling should concern you. Your commits record author name, email, timestamp, and content hash. Git chains them together cryptographically, replicates them across clones, and makes them discoverable in litigation. You are building a legal record whether you intend to or not. You already use git as a development tool. It is also a chain of custody for intellectual property. And you are probably destroying yours. A Cryptographic Chain of Custody Every git commit stores five things: the content of the change, the author's name and email, the author's timestamp, the committer's name and email, and the committer's timestamp. That commit is hashed using SHA-1 (or SHA-256 in newer repositories), and the hash incorporates the hash of the parent commit. Change one byte anywhere in the chain and every subsequent hash changes. This is a Merkle DAG. The same data structure that makes blockchains tamper-evident. Your commit history is a cryptographic proof linking each change to all previous changes. Git records three layers of timestamps. AuthorDate is when the content was written. CommitterDate is when it was finalized into the repository. And the server-side push timestamp, recorded by GitHub or GitLab, marks when the remote received the data. That third timestamp is outside the developer's control. A clone is a full copy of the entire history. Your collaborators, CI runners, and backup systems each hold an independent replica. Forensics researchers call this "evidence proliferation." Tampering with one copy does nothing if fifty others exist unchanged. Under Federal Rules of Evidence 902(14), data verified throu

Meet Halimun Proxy a high-performance, ultra-low latency proxy tunnel system built from the ground up in Rust. Why Rust? By leveraging Rust , Halimun achieves extreme efficiency. Using the Axum web framework and Tokio for non-blocking asynchronous I/O, it manages to maintain a tiny footprint—running on as little as ~15MB of RAM . It’s designed to be fast, memory-safe, and incredibly stable under load. Core Security Features Halimun isn't just a proxy; it’s a security layer. It enforces strict request validation to ensure your internal services are never exposed to malicious actors: AES-256-CBC Encryption: End-to-end payload masking. Even if your traffic is intercepted, the actual API endpoint and data remain indecipherable. HMAC-SHA256 Integrity: Validates that data hasn't been tampered with in transit. Replay Attack Prevention: Uses Nonce and timestamp verification in-memory (via DashMap ) to reject duplicate spoofed requests. SSRF Protection: Built-in mechanisms to prevent attackers from targeting your internal network infrastructure (e.g., 127.0.0.1 ). Camouflage Routing: It hides your actual API structure behind random, dummy URL segments, making traffic profiling by WAFs or human analysts nearly impossible. Quick Start (Docker) Halimun is "Docker-ready," making it easy to drop into any existing infrastructure. 1. Configuration First, generate your encryption keys using the built-in generator: # Generate keys and save to .env docker build -t halimun-proxy . docker run --rm halimun-proxy ./halimun-proxy --keygen --format = env > .env 2. Deployment Configure your config.yaml to map your backend services, then launch your cluster: docker-compose up -d Your production proxy is now live, listening securely on port 80 while your backend services remain completely secluded within a private Docker network. Under the Hood: Request Lifecycle Halimun uses an encrypted tunnel approach. A typical request follows this structure: POST /proxy/1/SEGMENT1/SEGMENT2/SEGMENT3/SEGMEN