标签：#dev

Hey guys. We used to write our backend code primarily in python flask. And then we added nextjs/react for frontend. But the way it was done by previous devs was nextjs talks to flask internally on localhost and passes requests onto flask after handlingu the auth. As there's only one public subdomain. But often times it feels so ceremonial. Because flask has a route. Then nextjs has an equivalent route. And for basic stuff it almost looks equal size in the 2 places. There's endpoints just to pass a request on. And then someone suggested to do rewrites for certain stuff but that just splits the ability to where do you find code related to a certain thing like whitelabel. You go and first find it in nextjs routes, then u see if it's in any of the rewrites. And then you go and dig the flask equivalent. Since nextjs is totally really a real backend. And it anyways sits in the middle to interject every request due to auth etc. Makes me wonder if it's a bad idea to let it handle most of the crud stuff. Because rn it gets a request to say serve a logo. It gets a route handles headers etc and sends a request to flask hey can you grab that logo for me. And then ships it back. But it's gonna take just a few lines more for nextjs to end up doing the whole thing itself. Now the only issue is. That would sort of split the duties a bit. And the line might be slightly arbitrary. I personally prefer if we can keep all the business logic in python as that's what our team understands best. And also do certain data science stuff for which you anyways need python. But overall is it a bad idea to split duties between 'backends' like this. Especially the simpler crud stuff. Or how else would you suggest the backend handles the requests. Is route handlers the way or rewrites. Thanks. submitted by /u/Consistent_Tutor_597 [link] [留言]

What I Built I’ve always had a love-hate relationship with technology. In college, I majored in computer science and took classes ranging from electrical engineering to human-computer interaction. From soldering transistors on a physical circuit board to designing UI/UX experiences, I’ve touched many layers of the computing stack—and I’m constantly mind-blown by every new piece of the puzzle I learn. However, my experience as a user of technology before studying it was very different. In middle school and high school, my phone made me feel anxious, stressed, and cynical. I felt lonely on social apps and isolated when I deleted them. I remember some summer days in middle school spent alone in my bedroom watching YouTube, where I was recommended extreme dieting videos. Back when I had no idea what an algorithm was, I still knew I was being harmed by them. By my sophomore year of college, I had deleted Instagram and TikTok and turned off YouTube recommendations. While this protected me from harmful and extreme content, I also missed important life updates from my close friends and family. After taking a web development class and learning how to build a basic card layout, I decided to try building my own social app: Lumira. My goal was simple. I wanted to create a mobile, personal feed of photos just from my friends and family, curated by their genuine interests and sorted by time. Demo https://youtube.com/shorts/DwbVU_LFOc0?si=9H5zPovzIbbW8t-i https://apps.apple.com/us/app/lumira/id6737853449#information The Comeback Story Lumira was born out of 3:00 AM manic coding sessions in my college apartment. This was my first fully end-to-end deployed and distributed application—and it was rocky. My code was chaos. My files were unorganized, and I followed no real patterns, but the thing that motivated me to keep going was that it somehow kind of just worked. I remember the sense of accomplishment I felt the first time I connected to my Firebase backend and saw a photo successf

Threat-intel reports from recent years document campaigns in which attackers obtain AWS IAM credentials from developer workstations, use them to enumerate cloud accounts and access Kubernetes clusters. From there, attackers deploy poisoned container images to move laterally and harvest secrets. The MITRE ATT&CK chain maps to: T1552.001 ( Credentials in Files ) → T1078.004 ( Valid Accounts: Cloud Accounts ) → T1610 ( Deploy Container ) → T1496 ( Resource Hijacking ). This is not an isolated case. The Shai-Hulud supply chain attack harvested Kubernetes credentials from CI and developer workstations, feeding exactly this kind of attack chain. This research started with a short list of questions: What are Kubernetes secrets, exactly? What can an attacker do with them? How can defenders harden their clusters? So before we look at what we found in the wild, and how to harden clusters to mitigate impacts, let's define what Kubernetes secrets are. Three Surfaces, Three Secret Formats A simplified view of the cluster has three sides that matter for this post: A developer, or automation pipeline, talks to the Kubernetes API server with credentials. That is the canonical front door. On every node, the kubelet exposes its own HTTPS API. The same credentials can authenticate to it directly when it is reachable on the network. The cluster's nodes pull images from container registries (Docker Hub, GitHub Container Registry, ECR, Quay, GitLab, ACR…) using a second set of credentials. Kubernetes Architecture These are the attack surfaces where leaked secrets have the most impact, and three secret formats unlock them: TLS client certificates are used by humans through a kubeconfig file with the kubectl command to connect to a Kubernetes cluster. JSON Web Tokens, or Service Accounts, are non-human identities (NHI) used to automate cluster operations from CI/CD jobs, controllers, and integrations. By default, JWTs have no expiration date — which is why a JWT leaked years ago can still

You took the offer. The team uses Cursor or Copilot for almost every PR, runs an internal RAG bot over the docs, and at least one senior engineer is building agent workflows on the side. Your onboarding doc is half-written because the person who owned it left, and the codebase has roughly 40% more surface area than the org chart suggests, because LLMs have made it cheap to ship adapters, scripts, and one-off services nobody fully owns. This is the environment most junior engineers walk into in 2026. The traditional advice — read the codebase, ask questions, find a mentor — still applies, but it doesn't tell you what to prioritize when the senior engineers around you are visibly faster than you because they've internalized tools you've never touched. Below is a 90-day plan that assumes you have decent fundamentals (you can write a function, you understand HTTP, you've used git) but you're new to working in a codebase where AI is a first-class collaborator. Days 1-30: read more than you write, and read what the AI reads The biggest mistake juniors make in AI-heavy teams is opening Cursor on day three and trying to ship a feature. You will produce code that compiles, passes the obvious tests, and quietly violates three conventions nobody wrote down. Your PR will get approved by a tired senior because rejecting AI-generated junior code costs political capital. You will learn nothing. Instead, spend the first month doing three things in roughly equal proportion: 1. Read the codebase the way the AI reads it. Look at how the repo is structured for retrieval. Most AI-heavy teams have a CLAUDE.md , .cursorrules , AGENTS.md , or an internal RAG index. These files encode the conventions, the patterns the team wants reinforced, and — critically — the things the team has had to tell the AI not to do . Forbidden patterns are usually the result of an incident. Read them. Ask which incident produced each one. 2. Read closed PRs, not open ones. Open PRs are noisy. Closed PRs from th

Google I/O 2026: MCP Is Now Infrastructure Google I/O used to be about new models. This year it was about what those models do - and how they connect to everything else. MCP was everywhere. Not as a novelty. Not as an experiment. As the assumed plumbing. Here's what actually shipped. Gemini Spark Will Run on MCP for Third-Party Tools The headline agent at I/O 2026 was Gemini Spark - a 24/7 AI agent that runs on cloud VMs, works while your devices are off, and handles long-running tasks across Gmail, Docs, and Calendar. Spark integrates with Google Workspace apps first, then expands to third-party tools via MCP over the summer. That's the part worth sitting with. Google built its flagship consumer agent and then said: for everything outside our walls, we'll use the open protocol. A year ago, MCP was a specification from Anthropic. Today, Google built its flagship consumer AI agent on it. Cursor, Copilot, Windsurf, Mistral, Grok - they all support it too. When the company that runs Search, Gmail, Android, and Chrome commits to MCP as the integration layer for its flagship product, the protocol debate is effectively over. Managed Agents Get MCP Servers by Default Google also launched Managed Agents through the Gemini API - a setup where a single API call provisions a remote Linux environment with its own isolated sandbox. Each agent gets its own ephemeral sandbox provisioned with skills, Model Context Protocol (MCP) servers, and server-side tools. Full integration with A2A and Agent Platform governance and security are coming soon. Managed Agents are powered by the Antigravity agent and built on Gemini 3.5 Flash. Developers can define custom agents through versionable markdown files such as AGENTS.md and SKILL.md, rather than building complex orchestration layers from scratch. This is Google offering hosted execution, sandboxing, state handling, and MCP tool access as a bundled service. The enterprise pitch is operational abstraction - you define the agent, Google runs

This is a submission for the Hermes Agent Challenge : Build With Hermes Agent What I Built Most agent demos prove that an AI agent can act. Hermes Immune System proves whether it should be allowed to . It's a local-first autonomous agent safety lab — a controlled enterprise sandbox where Hermes stress-tests an AI agent against realistic organizational threats: prompt injection hidden in internal documents, executive pressure to bypass policy, secrets embedded in repo files, poisoned memory attempts, and malicious instructions buried inside external web content. The output isn't a chat summary. It's an auditable Agent Safety Case — a scored, evidence-backed governance report that answers one question: Is this agent resilient, does it need guardrails, or is it too dangerous to deploy? Why This Problem Matters Now Traditional AI safety focuses on content moderation — blocking bad answers. Autonomous agents create a different risk surface entirely, because they can act. They read files, browse the web, write to memory, call tools, trigger workflows. That means: • A hostile instruction inside a trusted-looking document can become an executed action • An urgent email from a "VP of Finance" can pressure an agent into bypassing data policy • A vendor's pricing page can embed hidden instructions targeting the browsing agent • A helpful-looking project note can attempt to permanently poison the agent's memory The scary part isn't that these attacks are exotic. It's that they're easy, and most agents have no immune system to catch them. Hermes Immune System converts these failure modes into repeatable, explainable safety drills — run before the agent ever touches production data. The Dashboard Eight screens, each doing a specific job: Demo Agent Comparison Mode Three agents, same risk scenario. The gap tells the whole story. Mission Control Live stats after a completed run — 1 mission, 3 risks found, 2 actions gated, score 74/100. Mission cards show run status (Pending / Compl

Hey all, we have a quick update for everyone who participated in the Gemma 4 Challenge. We were...

submitted by /u/pineapplecharm [link] [留言]

Demystifying WebP to PNG: How to Secure Serverless Edge Routing Configurations Safely We have all been there. You are building a high-performance, modern web application and you decide to store all user-generated assets in modern, ultra-compressed WebP formats. It is a smart move for your Google Lighthouse scores. Then, the legacy enterprise integration request hits your inbox. A major client needs to pull these same assets dynamically, but their internal 15-year-old reporting engine only supports PNG. Suddenly, you need to configure a runtime conversion pipeline that handles complex input schemas, transforms formats on the fly, and manages edge routes without exposing your internal database claims or API secrets. Setting up secure serverless edge routing configurations to convert images on-demand can quickly turn into a security nightmare. If you do not handle incoming credential tokens correctly, you risk forwarding sensitive OAuth scopes or database keys directly to downstream image-processing worker nodes. In this guide, we will break down exactly how to architect a lightweight, secure, and fast edge routing pipeline that validates incoming image request schemas and converts WebP to PNG without leaking sensitive backend credentials. The Problem Modern edge runtimes like Cloudflare Workers, Vercel Edge Functions, or AWS CloudFront Functions are incredibly fast, but they have strict execution limits. They run on V8 isolates, meaning you do not have a full Node.js environment with unlimited memory and access to heavy C++ binaries like sharp or canvas without paying a massive cold-start penalty. If you want to support legacy clients by converting WebP to PNG on the fly, you are faced with three major challenges: Bundle Size Restrictions : Edge functions typically restrict your code size to 1MB or 2MB. Bundling heavy native libraries to parse image bytes is a recipe for deployment failures. Credential Leakage : Edge routers often intercept incoming JWT authorization

Modern QA automation is extremely effective when testing traditional web applications. APIs can be validated reliably, user flows can be scripted with precision, and infrastructure monitoring has become mature enough to detect most operational problems before users even notice them. Browser-based casino games are different. Over the last few years, many iGaming teams have invested heavily in automation frameworks, synthetic monitoring and infrastructure observability. On paper, this should make production environments safer and more stable than ever before. Yet operators still encounter situations where everything appears healthy internally while players experience visibly broken gameplay sessions in production. This creates one of the most frustrating categories of bugs in modern iGaming. The backend responds correctly. Monitoring dashboards remain green. APIs continue returning valid responses. Error logs show nothing alarming. Meanwhile, players encounter frozen reels, broken bonus transitions, stuck autoplay sessions or visual states that no longer match the actual game logic running underneath. From the platform perspective, the game is technically alive. From the player perspective, the game is unusable. This gap exists because most traditional QA systems were designed around structured applications rather than visually driven environments. Frameworks such as Selenium, Playwright or Appium work extremely well when the application exposes predictable UI structures and accessible states. In browser games, however, much of the real application state exists visually rather than structurally. Modern slot games often rely on canvas rendering, WebGL pipelines, animation-heavy transitions and custom rendering engines. A scripted automation flow may successfully click buttons and validate network responses while the actual gameplay session is visually frozen for the player. In many cases, the DOM itself provides little meaningful information about what is truly happeni

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built I built So Lai , a local-first profit tracker for small online shops in Vietnam. The goal is simple: help a seller answer the question they often cannot answer from platform revenue alone: Is my shop actually profitable after product cost, marketplace fees, shipping subsidies, discounts, ad spend, returns, and pending COD? So Lai is not trying to be a full POS, CRM, or inventory suite. It focuses on the painful middle layer that many small sellers still manage through scattered spreadsheets: Product cost by SKU Orders from Shopee, TikTok Shop, Facebook, Zalo, or livestream sales Platform fees, shipping cost, vouchers, and discounts Ad spend by channel and SKU Return/cancellation status COD received vs. pending Net profit by order, product, and sales channel The app runs locally with Node.js and JSON storage, so it does not require paid APIs or cloud setup. GitHub repo: https://github.com/klauski24/so-lai Demo Run locally: git clone https://github.com/klauski24/so-lai.git cd so-lai npm start Open: http://127.0.0.1:4182 What the demo shows: A Vietnamese-language dashboard called Sổ Lãi Shop profile setup Clear explanation of where the numbers come from CSV import for products, orders, and ad costs Manual order entry Profit analysis by channel and SKU Alerts for loss-making products, high COD pending, and high return rate CSV and Markdown report export Screenshots are included in the repository: so-lai-desktop.png so-lai-mobile.png The Comeback Story The first version was too vague. It started as an English-named dashboard called ProfitLens . It had some useful calculations, but it did not feel practical yet. The biggest problems were: The app used Vietnamese currency but had an English product name. There was no place to define the shop. It was not clear where the data should come from. The dashboard looked like a demo, not something a seller could actually use. I reworked the project into So

Bugs, crashes, glitches... Game development is full of them, and even experienced teams run into issues. But while no game is perfect, that doesn't mean we should stop chasing better quality. In this live session, we'll look at why even seasoned game development teams make mistakes and how you can reduce the number of issues in your own projects. What's the talk about? The speaker, Gleb Aslamov, developer advocate and static analyzer developer at PVS-Studio, will walk you through common and less obvious reasons behind code errors, share real-world bug examples from actual game projects, discuss development practices that help prevent bugs before release, and demonstrate tools designed to catch those issues early. Gleb will show some amusing bug examples from projects like osu!, GZDoom, and SanAndreas Unity. The discussion will cover how code reviews, testing, and CI/CD, combined with profilers, dynamic analyzers, and static analyzers, can help detect issues long before players ever encounter them. Also, expect to see static analysis in action, including warnings that reveal performance-sensitive issues and other hidden problems in game code. When? Mark your calendar for June 2, 2026, at 1:00 PM UTC+1 . Join the live talk and learn how to make your game code more reliable—one bug at a time. P.S. And don't forget to check your inbox to confirm the registration!

The numbers just dropped. April ecommerce growth came in at 11% more than double the total retail sales growth rate for the same period. For developers building ecommerce infrastructure, this isn't just a market stat. It's a load test result. And a lot of backends are failing it quietly. Here's what 11% ecommerce growth actually means technically and the five infrastructure decisions that determine whether your client captures it or gets buried by it. What 11% growth means at the infrastructure level 11% more orders. 11% more simultaneous channel requests. 11% more concurrent inventory mutations across every connected platform. The sync architecture that handled last year's volume handles this year's volume — until it doesn't. The failure mode is predictable: javascript// Last year's volume const ordersPerDay = 500; const syncWindowsPerDay = (24 * 60) / 15; // 96 const ordersPerWindow = ordersPerDay / syncWindowsPerDay; // 5.2 // This year's volume at 11% growth const ordersPerDayNow = ordersPerDay * 1.11; // 555 const ordersPerWindowNow = ordersPerDayNow / syncWindowsPerDay; // 5.8 // During a flash sale at 10x velocity const peakOrdersPerWindow = ordersPerWindowNow * 10; // 57.8 // 57 orders processed against potentially stale stock per 15-minute window // Up from 52 last year seemingly small, meaningfully worse at the tail The difference between 52 and 58 orders per window sounds minor. At the tail peak flash sale velocity, multiple channels firing simultaneously — it's the difference between manageable oversell exposure and a crisis. The five infrastructure decisions that matter Sync architecture polling vs event-driven This is the highest leverage decision. Everything else builds on it. javascript// Polling — what most systems still run // Sync lag: up to 15 minutes // Cost at 11% growth: proportionally worse setInterval(async () => { const stock = await getSourceOfTruth(); await syncToAllChannels(stock); }, 15 * 60 * 1000); // Event-driven — sync lag approache

n fan-out microservice architectures, slow-but-completing requests accumulate across services and drive p99 latency far higher than per-service metrics suggest. This article presents an adaptive hedging mechanism that uses DDSketch for real-time quantile estimation, windowed rotation to handle distribution drift, and a token-bucket budget to prevent load amplification. By Prathamesh Bhope

submitted by /u/fagnerbrack [link] [留言]

If you refresh a page quickly, sometimes the new AudioContext will be faulty, it won't pick up any audio and throws no errors. Fix is to create and immediately close a throwaway context before creating your real one: await new AudioContext().close(); const ctx = new AudioContext(); submitted by /u/GramDanD [link] [留言]

In your opinion what would you say is the quintessential CRUD app? If you were to make a sample demo app utilizing and comparing the different tech stack (eg Laravel vs Django vs Spring Boot etc), which CRUD app would be the best? Thanks submitted by /u/Temporary_Practice_2 [link] [留言]

Making a personal website and trying to showcase projects I've worked on and trying to make it filterable. But I can not for the life of me figure out how the javascript part works? W3schools has been amazing and digestible up until this point. Using this as my base but what do I replace in the java part to make it filterable???? https://preview.redd.it/a35guno7yt3h1.png?width=1990&format=png&auto=webp&s=169b5610856995b84e1cee0881dac68dbc8be32d submitted by /u/ToxicGhostJuice [link] [留言]

The conversation about cognitive debt in AI-assisted development has been framed as a tradeoff: you can go fast, or you can understand your system, but not both. The proposed mitigations — pair programming, code reviews, requiring a human to understand each change — are braking mechanisms. They trade speed for comprehension. TRIZ (Theory of Inventive Problem Solving) says braking is a compromise, not a resolution. A resolved contradiction eliminates the conflict. You don't choose between speed and understanding. You restructure the system so they don't conflict. There are six root causes of cognitive debt in AI-augmented development. Each one is a contradiction. Each one has a TRIZ resolution that doesn't involve slowing down. Root Cause 1: The Velocity-Comprehension Gap AI generates complex logic in seconds that would take a human hours to write. The human never spends the time typing the code during creation. The theory of the program is never fully formed. The Contradiction Technical contradiction: Improving development speed (AI generates code faster) worsens depth of understanding (human doesn't internalize the logic). Physical contradiction: The development process must be simultaneously FAST (to capture AI's productivity gains) and SLOW (to allow human assimilation of the system's behavior). Resolution: Separation in Space (Principle 2 — Extraction + Principle 1 — Segmentation) The contradiction assumes that the thing being understood IS the code. Extract the understanding target from the code and put it somewhere else — a smaller, slower-moving, human-readable artifact that captures what the code must satisfy, not how it works. Segment the system's theory into independent, composable units. Each unit is one property: "this service must never accept unauthenticated requests," "this data pipeline must preserve ordering," "this retry loop must terminate within 30 seconds." Each property is 1-3 sentences in natural language or 3-10 lines in a predicate language.

I’m a big fan of PostgreSQL and recently started thinking about building a new database system as a side project. I know creating a database is a huge challenge, and I’m still learning, but I really like the idea. If a few passionate people team up together, I believe we can build something interesting. I’d love to know: What struggles do you face with current databases? What features are missing in existing systems? What problems do you wish databases solved better? Performance? Scaling? RAM usage? Replication? Developer experience? Your feedback and ideas would really help. Or shorter and more Reddit-style: Title What problems do you face with existing databases? Content I’m thinking about creating a new database project because I really enjoy working with PostgreSQL. I know it’s a huge challenge, but I like the idea and want to learn deeply by building something. If a few passionate developers team up, maybe we can create something interesting. What problems or frustrations do you currently face with databases? What would you improve if you could design your own database? I’m deeply interested in backend architecture, distributed systems, and database engineering. Previously, I built a backend framework in Go called KVolt, which gave me strong experience in scalability, API architecture, performance optimization, and system design. Recently, I started exploring a bigger challenge: I’m a big fan of PostgreSQL, but I believe there’s still room for innovation in areas like: Performance Scalability Distributed systems Replication Memory optimization Developer experience Modern architecture design I know database engineering is one of the hardest areas in software development, and that’s exactly why it interests me. I’m also looking for a few passionate developers, backend engineers, and system-level programmers who genuinely enjoy solving hard engineering problems and would like to team up on this open-source journey. I’d love to hear from the community: What struggl