标签：#dev

I think it's fair to say that someone who has never done non-AI web development will always be vibe-coding. For, say, an experienced (20+ years) developer, would it still be vibe coding if they craft technically sound prompts (i.e. explicitly mention things to avoid/include, and define methodologies and algorithms as well as goals), and fully test (and have AI fix) the output, but never review the actual code? What if the prompts are loose, but they are fastidious about reviewing all code generated? submitted by /u/lindymad [link] [留言]

I've been with Omnis for years (they were awesome) and they were bought out by JetHost. The transfer took down a bunch of clients. Now I'm arguing with them and they don't offer an online guarantee or a refund. I have to deal with clients whose websites were down. I'm really upset just because I have never had to worry about this. Anybody have cheap reliable registrars? My fave never showed in google, so I figured I'd axe the community if anyone has a good secret one in your pocket submitted by /u/dash-dash-hyphen [link] [留言]

Hi! I'm in the process of teaching myself HTML and CSS for the very first time. I have a general idea of what I want this website to be and how to structure it. For actual secure access, I am making it on Neocities. For general browsing on the other hand, I want to essentially make a snapshot of whatever the current build of it is and put it on an http as well with the intent of being able to see and browse said website on old hardware like a Dreamcast or Win98 machine. Any help is appreciated! submitted by /u/souls_wandering [link] [留言]

A few months ago I was doing a final pre-release review on a client project before handing it...

I built a portfolio site that ended up turning into a collection of interactive experiments rather than a traditional resume. > Main Page > Drawing > Text based game > Capture the flag (CTF) It includes: - a live collaborative pixel canvas where visitors draw together - a hidden terminal with a virtual filesystem - small hidden challenges scattered throughout the site - an AI assistant you can talk to It started as a portfolio, but became more of an interactive playground. submitted by /u/Another_bot_beepboop [link] [留言]

This is a submission for the June Solstice Game Jam When you have a hammer- everything is a nail! This installment brings a Flutter build to Midsommer Madness via Antigravity. A complete Android APK is built with Flutter and some Joystick bugs are fixed! What I Built When it comes to Summar Solstace - the place to be is Sweden. It is one of the highlights of the calendar. This project aimed to recreate some of the mystique around the event- just in time for some fresh surestromming! Now you can get it on the GO! Midsommer Madness now in as an Android APK! Code GitHub repo is here: https://github.com/xbill9/midsommer-flutter xbill9 / midsommer-flutter Midsommer Madness game in Flutter / Web view Midsommer Madness 🇸🇪 Midsommer Madness is a Swedish-themed action retro arcade game inspired by Redneck Rampage and the Swedish Midsummer holiday. Help Sven race against the solar timer to reach the Maypole ( midsommarstång ) before sundown! If you fail, the solstice is lost, you trigger a meltdown, and you are sacrificed to the Wicker Man. 📸 Screen Gallery Title Screen Game Over Screen Victory Screen 🎮 Level Sequence The game features ten distinct thematic levels: IKEA Warehouse: Battle crowded, flatpack-carrying shoppers who throw box projectiles at you. Systembolaget: The state-owned liquor shop crowded with drunk Swedes stumbling and lobbing green beer bottles. Lördagsgodis: Sugar rush Saturday! Dodge hyperactive, strung-out Swedish kids throwing sweet candy projectiles. The Swedish Pub: Sing along with Frank Zappa fans singing "Bobby Brown" (shouting and firing glowing letters B , O , B , B , Y ). Volvo Highway: A survival lane-crossing level where… View on GitHub My Lingonberries are ripening- get to work! Appreciating Procedural Creation Midsommer Madness is a Swedish-themed retro action-arcade game built as a hybrid mobile/web application. The codebase combines a Flutter wrapper (serving as the native shell) with a Vanilla Web App (implementing the core game loop, vis

Το πρόβλημα της ώρας Η ώρα είναι από τα πιο ύπουλα προβλήματα στην ανάπτυξη λογισμικού. Αν ένας χρήστης στην Αθήνα δημιουργήσει μια παραγγελία στις 20:00 και ένας άλλος στη Νέα Υόρκη τη δει στις 13:00, ποια είναι η "σωστή" ώρα; Αν μια εφαρμογή αποθηκεύσει μόνο το 20:00, χωρίς να γνωρίζει τη ζώνη ώρας, τότε η πληροφορία είναι πρακτικά άχρηστη. Αυτός είναι ο λόγος που υπάρχουν έννοιες όπως: Local Time UTC UTC Offset Epoch / Unix Timestamp Δεν δημιουργήθηκαν για να μας μπερδεύουν. Δημιουργήθηκαν για να λύνουν το πρόβλημα της παγκόσμιας διαχείρισης χρόνου. Local Time Το Local Time είναι η ώρα που βλέπει ο χρήστης στη χώρα του. Παραδείγματα: Αθήνα: 2026-06-09 20:00 Λονδίνο: 2026-06-09 18:00 Νέα Υόρκη:2026-06-09 13:00 Όλες οι παραπάνω ώρες μπορεί να αντιστοιχούν στην ίδια ακριβώς χρονική στιγμή. Συνέβει ένα γεγονός μία ενέργεια στον πλανίτη γη ακριβώς αυτή την στιγμή που όμως για διαφορετικές γεωγραφικές περιοχές αντιστοιχεί σε διαφορετικές ώρες. Πότε χρησιμοποιούμε Local Time; Μόνο για εμφάνιση στον χρήστη. Παραδείγματα: Ημερομηνία παραγγελίας Ώρα δημιουργίας post Ημερολόγιο συναντήσεων Reports προς τον χρήστη Πότε ΔΕΝ το αποθηκεύουμε; Σχεδόν ποτέ ως μοναδική πηγή αλήθειας. Αν αποθηκεύσεις: 2026-06-09 20:00 δεν γνωρίζεις: Σε ποια χώρα δημιουργήθηκε Σε ποια ζώνη ώρας ανήκει Αν ίσχυε θερινή ώρα (DST) UTC (Coordinated Universal Time) Το UTC είναι η παγκόσμια αναφορά χρόνου. Όλες οι ζώνες ώρας υπολογίζονται σε σχέση με αυτό. Παράδειγμα: UTC: 2026-06-09 17:00 Την ίδια στιγμή με βάση την UTC ώρα μπορούμε να έχουμε: στην Αθήνα UTC+3 -> 20:00 στο Λονδίνο UTC+1 -> 18:00 στη Νέα Υόρκη UTC-4 -> 13:00 Πότε χρησιμοποιούμε UTC; Σχεδόν πάντα στο backend. Αποθηκεύουμε: 2026-06-09 T 17 : 00 : 00 Z Το Z σημαίνει UTC. Γιατί; Επειδή: Δεν αλλάζει με DST Δεν εξαρτάται από χώρα Είναι παγκόσμιο σημείο αναφοράς Ένας κανόνας που ακολουθούν σχεδόν όλες οι μεγάλες εταιρείες: Store in UTC, display in Local Time. UTC Offset Παραδείγματα: UTC+3 UTC+2 UTC-5 UTC+9 Για την Αθήνα: Χειμώνας -> UTC+2 Καλοκα

The biggest mistake teams make when comparing testing tools is treating the feature list like the decision. A tool can support API tests, visual checks, CI, reporting, and integrations, and still be the wrong choice if nobody adopts it, the runs are flaky, or the billing model turns into a budget surprise. Start with the workflow, not the brochure The first question is not “What does this tool support?” It is “Where will this tool sit in our actual delivery flow?” A tool that looks great in a demo can still fail if it does not fit how your team writes tests, reviews failures, shares results, and ships code. If your team lives in GitHub PRs, Slack, and CI pipelines, then the evaluation should center on how quickly a test result shows up where developers already work. If your team has QA specialists, product owners, and client stakeholders, then reporting and handoff matter as much as assertion syntax. This is why feature checklists can mislead. Two tools may both claim browser automation, API coverage, and dashboards, but one might require a heavy framework rewrite while the other can be adopted incrementally. The latter is usually the better tool, even if it looks less impressive on paper. Checklist item one, can people actually use it next week? Adoption beats capability. If a tool needs a long onboarding program, a specialist only one person on the team understands, or a custom setup that no one wants to own, the tool becomes shelfware fast. Look at who will author tests, who will maintain them, and who will interpret failures. A tool that lets QA write quickly but gives developers a painful review experience can still become a bottleneck. A good evaluation asks for the smallest realistic test case. Take one happy-path flow, one negative case, and one flaky UI interaction, then see how far each tool gets you without custom glue. That is usually more useful than a vendor demo with polished sample scripts. Checklist item two, what happens when the tests get messy? E

If your goal is faster releases with fewer flaky failures, the tool choice matters less than the testing strategy behind it. Teams usually start by asking, “Should we use Playwright, Selenium, Cypress, or a cloud platform?” A better question is, “What do we need to prove, in which browsers, at what cost to maintainability and reliability?” That shift changes the conversation. Browser automation is not only about writing scripts that click through a happy path. It is about building a test system that survives UI changes, covers the browsers your users actually have, and fails for the right reasons. This playbook walks through a practical sequence you can use to compare tools and make those tradeoffs explicit. Start with the outcomes, not the framework Before comparing tools, define the job your browser tests need to do. Most teams have a mix of goals, even if they do not write them down: Catch broken critical flows before merge Verify rendering in real browsers, not just headless simulations Keep test code readable enough that the team can maintain it Reduce flaky failures that waste review time and erode trust Avoid spending more time on infrastructure than on product quality Once you name those goals, tool comparison becomes simpler. A fast local developer feedback loop may point you toward one choice, while broad cross-browser coverage and managed execution may point you toward another. If a tool is fast but makes maintenance painful, that is not a win. If it supports many browsers but creates unstable runs, that is also not a win. Map your browser reality first The second step is to compare your user base with your test environment. Teams often say they support “all major browsers,” but the actual risk is usually narrower. Check which browser and device combinations matter for your product, then decide what needs automated coverage versus manual spot checks. This is where real browser execution becomes important. A headless run can be useful, but it does not repl

After containerizing an application with Docker, the next logical step is deploying it on Kubernetes. Kubernetes helps automate application deployment, scaling, networking, and management of containerized workloads. Instead of manually running containers, Kubernetes ensures your application remains available and can easily scale when needed. In this guide, we'll deploy a Docker image of a Node.js application on Kubernetes using a Deployment and a Service. Prerequisites Before starting, make sure you have: Docker installed Kubernetes cluster running (Docker Desktop Kubernetes, Minikube, Kind, EKS, etc.) kubectl configured A Docker image pushed to Docker Hub In my case, the image was: madhavnaks/node-app:latest Why Kubernetes? Running a container using Docker is straightforward: docker run -p 3000:3000 madhavnaks/node-app:latest However, in production environments we need much more than simply running a container. Kubernetes provides: High availability Self-healing containers Load balancing Service discovery Horizontal scaling Rolling updates This makes it the industry standard for container orchestration. Understanding the Kubernetes Architecture for This Deployment For this deployment, we'll use two Kubernetes resources: Deployment A Deployment is responsible for: Creating Pods Maintaining desired replica count Recreating failed Pods automatically Managing updates and rollbacks Service A Service provides a stable network endpoint for Pods. Since Pod IPs change frequently, Services allow applications and users to communicate reliably with Pods. Deployment and Service Manifest Create a file named: app.yaml Add the following configuration: apiVersion : apps/v1 kind : Deployment metadata : name : node-app spec : replicas : 2 selector : matchLabels : app : node-app template : metadata : labels : app : node-app spec : containers : - name : node-app image : madhavnaks/node-app:latest ports : - containerPort : 3000 --- apiVersion : v1 kind : Service metadata : name : node-a

Claude Fable 5 me permitiu criar um "GTA" em apenas um prompt. Prompt: "Crie um jogo, Tiny GTA 3D." A própria Anthropic afirma que o Fable 5 é seu modelo mais poderoso já lançado ao público, com avanços significativos em engenharia de software, pesquisa científica, visão computacional e execução autônoma de tarefas complexas. Em testes iniciais, empresas relataram que o modelo foi capaz de comprimir meses de trabalho de engenharia em poucos dias. Cidade 3D aberta com 64 quarteirões, prédios, parques e oceano Dirija, roube carros e fuja da polícia Sistema de procurado com 5 estrelas, viaturas e helicóptero te perseguem 42 pedestres vivos que fogem, voam e morrem 16 missões de entrega com histórias de corrupção brasileira Áudio sintetizado: motor, sirene, buzina e cantada de pneu Recorde salvo no navegador Jogue aqui: https://andredarcie.github.io/tiny-gta/

Most developers know Haskell as a language for functional programming, type safety, compilers, parsers, and beautiful mathematical abstractions. But can Haskell also be used to build an interactive engineering simulator? That was the motivation behind my project: Four-Bar Mechanism Haskell Simulator Repository: https://github.com/mohammadijoo/Four-Bar-Mechanism-Haskell This project is a browser-backed desktop-style GUI application written in Haskell. It visualizes, classifies, and animates a planar four-bar linkage mechanism, which is one of the most classical mechanisms in mechanical engineering, kinematics, and machine design. The GUI is built with Threepenny-GUI , so the interface runs in a local browser window, while the mathematical model and mechanism logic remain written in Haskell. For me, the interesting part was not only drawing a moving linkage. It was about connecting mechanism design theory , computational geometry , and functional programming in one small educational simulator. What is a four-bar linkage? A four-bar linkage is a closed-loop mechanical system made from four rigid links connected by four revolute joints. In this project, the four links are: Symbol Name Description g Ground link Fixed distance between pivots A and B a Input link Rotating link from A to moving pivot C b Output link Link from fixed pivot B to moving pivot D f Floating link / coupler Link connecting moving pivots C and D The fixed pivots are placed at: A = ( 0 , 0 ) , B = ( g , 0 ) The input link rotates by angle α . Therefore, point C can be computed directly as: C = ( a cos α ,; a sin α ) Point D is more interesting. It must satisfy two geometric distance constraints: ∣ D − C ∣ = f ∣ D − B ∣ = b So the simulator solves the position of point D using a circle-intersection method. One circle is centered at C with radius f . The other circle is centered at B with radius b . Where those two circles intersect, the mechanism can close. That is the basic geometric heart of the sim

Building a URL shortener with Cursor, ChatGPT, AWS Lambda, API Gateway, and Cloudflare taught me more about shipping software than writing code. Since last year, Cursor has been my go-to development assistant for daily tasks. But at the beginning of this year, just using it to generate snippets didn't feel like enough anymore. Having studied programming since 2011, I knew what modern AI tools could do, but I wanted to test their limits. I decided to build a full project—a URL shortener—without writing a single line of frontend or backend code myself. For the stack, I chose Node.js with TypeScript, React with Vite, and AWS Lambda to handle redirects. While I used ChatGPT to debate architectural trade-offs, Cursor generated the entire codebase. Watching a functional application take shape so quickly was the exact moment a line was crossed for me. It made me realize how fundamentally software development is shifting: our role is evolving from code writers to architectural decision-makers and problem-solvers. But truth be told, this project and this post represent a massive personal milestone. Like many developers, I have a graveyard of half-finished projects on my machine. This is one of the first times I've pushed a personal project all the way to production. Writing this and exposing my work to the community is a huge first step for me. This isn't just a story about code or AI—it's about the challenge of finally shipping something. The Stack Before asking Cursor to write a single line of code, I wanted to map out the architecture. I didn't need a massive enterprise system for a URL shortener, but I did want something flexible enough to support future features and experiments. To validate my ideas, I used ChatGPT to debate the pros and cons of different architectural approaches. We eventually settled on this stack: Backend: Node.js + TypeScript Frontend: React + Vite Database: MongoDB Atlas Redirects: AWS Lambda Entry Point: AWS API Gateway DNS / CDN: Cloudflare Secur

Grab a refreshing slice of cold watermelon (because it’s summer in Tokyo and I love it!), and let me...

I’m building a website that will eventually become a collection of useful browser-based tools, similar to iLovePDF but covering many different categories. The goal is simple: No downloads No accounts Fast and mobile-friendly Free to use I’m researching what people actually need before building more tools. What’s a small utility, calculator, converter, formatter, generator, or productivity tool you use regularly but wish had a better version? Examples: Land measurement calculators PDF tools Text formatting tools Developer utilities SEO tools Study tools I’d love to hear your ideas and pain points. submitted by /u/Nikpa_2163 [link] [留言]

SQL is arguably the most widely used language in software engineering, yet it is often the least carefully written. Most teams enforce strict linting on their application code but leave SQL queries as a free-for-all. This guide covers the formatting rules that separate maintainable, team-friendly SQL from query spaghetti that haunts on-call rotations. Why Poorly Written SQL Is a Real Engineering Problem Unformatted SQL is not just an aesthetic issue - it is a correctness risk. Dense, run-on queries make it nearly impossible to spot accidental Cartesian products, missing GROUP BY clauses, or WHERE conditions that silently bypass indexes. By the time a performance problem surfaces in production, tracing it back to the root cause becomes a painful exercise in reading someone else's stream of consciousness. Rule 1: Keyword Capitalization SQL engines treat select and SELECT identically, but human readers do not. Always uppercase reserved keywords such as SELECT, FROM, WHERE, JOIN, GROUP BY, and ORDER BY. Keep table names, column names, and aliases lowercase. This single habit immediately creates a visual boundary between the logic structure of the query and the underlying data it operates on. Rule 2: Indentation and Clause Alignment Think of SQL clauses as layers in a data pipeline. Each major clause - SELECT, FROM, WHERE, GROUP BY, ORDER BY - should start at the left margin. Columns and filter conditions beneath them should be indented by 4 spaces (or 1 tab, as long as your team is consistent). This structure lets any reviewer skim the query top-to-bottom and understand the data flow at a glance. Rule 3: Trailing vs. Leading Commas This is a genuinely debated topic on data teams. Leading commas (placing the comma at the start of each new line) make version control diffs significantly cleaner when columns are added or removed. Trailing commas look more natural for developers coming from JavaScript or Python. Neither approach is wrong - what is wrong is mixing both styles

When you expose inventory or checkout endpoints to public-facing front-ends or third-party webhooks, safeguarding those APIs from brute-force scripts, scraping bots, and inventory hoarding algorithms becomes a critical requirement. Without defensive rate limiting, a single coordinated script can easily overwhelm your database connections. The Problem with Simple Counter Resets A common mistake when setting up basic API protection is using a rigid "Fixed Window" counter (e.g., allowing 100 requests per minute, resetting exactly at the turn of the clock). This creates a massive flaw where a developer can flood your server with 100 requests at 11:59:59 and another 100 requests at 12:00:01, effectively doubling your acceptable burst traffic and causing severe performance dips. To handle uneven burst traffic safely without crashing your database, the standard approach is implementing a token bucket algorithm. The Token Bucket Pattern The token bucket algorithm maintains a centralized bucket that holds a maximum capacity of tokens. Tokens are added back to the bucket at a constant, predictable rate over time. Each incoming API request consumes exactly one token. If the bucket is completely empty, the request is instantly rejected with a 429 Too Many Requests status code, protecting your core server threads. javascript // Quick Redis-based token bucket rate limiter concept async function isRateLimited(userId) { const key = `rate:${userId}`; const now = Date.now(); // Use a Redis multi-exec transaction to atomically check and update tokens const [tokens, lastRefill] = await redis.hmget(key, 'tokens', 'lastRefill'); // Calculate token replenishment based on time elapsed... // Return true if tokens <= 0, otherwise decrement tokens and update timestamp }

Exactly one year ago, my terminal was a blank slate. I started where almost everyone does , wrestling with HTML, CSS, and JavaScript, trying to understand the web pixel by pixel. What began as curiosity quickly turned into a full obsession. I went from building simple static pages to diving deep into full-stack development. Here’s what that intense first year of constant building, breaking things, and shipping real projects has looked like. The Leap into Modern Frameworks Once vanilla JavaScript started feeling limiting, I jumped into React . Component-based thinking completely changed how I approached interfaces. Then came Next.js — it bridged client-side beauty with server-side power and pushed me into a true full-stack mindset. The Ultimate Test: Lynvista Safaris The biggest challenge was building lynvistasafaris.com , a live travel booking platform for a real client. This project forced me far beyond tutorials and into real engineering problems. I had to implement: Payment infrastructure from scratch with Daraja API (M-Pesa STK pushes) and Paystack for international transactions. A robust database layer using Drizzle ORM + MySQL. Custom business logic , including a multi-currency pricing system with special validation rules for currencies like GBP. It was messy , many late nights debugging webhooks, schema mismatches, and edge cases , but shipping it taught me more than any course ever could. What One Year Taught Me Syntax is just a tool. The real skill is learning how to break down complex problems, debug effectively, and keep iterating even when things break in production. I’m incredibly proud of the progress I’ve made in 365 days (402 contributions later), but I know I’m still at the very beginning. For the next phase, I’m focused on shipping more projects, writing about the crazy bugs I encounter, and deepening my architectural and full-stack skills. If you want to see what I’m building right now, check out my GitHub .

In Q1 2026, OpenAI and Anthropic moved enterprise customers from flat-rate plans to token-based billing. The change looks administrative, but it had a direct consequence for engineering teams: the real cost of AI became visible for the first time. The market's reaction over the following two months was enough to reopen a question many considered settled: does AI actually deliver measurable ROI? What happened when the bill arrived The most documented case is Uber. The company had encouraged all employees to use agentic tools as much as possible and even ranked AI usage internally on leaderboards. The result: the entire annual budget was consumed in four months. The response was a $1,500/month cap per employee per agentic coding tool (Claude Code, Cursor, and similar). At Brex, engineers were limited to $500/week in tokens; employees outside engineering received a $5/week cap. T-Mobile temporarily capped usage at $2,000/month per user with plans to migrate to a tiered system. One unnamed company, according to Ed Zitron in "AI Is Slowing Down" (June 2026), spent $500 million on Anthropic models in a single month due to absent spend controls. These are not isolated cases. A KPMG survey reported by the Wall Street Journal in June 2026 found that only 26% of companies have a comprehensive view of their AI costs; 50% have partial visibility; and 22% only find out what they owe after the bill arrives. Steve Chase, KPMG's global head of AI, told the Journal: "It's a new resource that needs to be managed that didn't exist quite that way, and we're seeing exponential growth." The structural problem behind the spending caps The spending caps are a symptom. The root cause, as Zitron details in the same article, is that the economics of generative AI require numbers that currently seem out of reach. Anthropics has made over $330 billion in compute commitments with Google, Amazon, and Microsoft, plus another $45 billion with CoreWeave and SpaceX. To cover those commitments, it nee

73 cryptographically signed npm packages from Microsoft were compromised last week with advanced credential-stealing malware that fires the moment a developer opens one in an AI coding agent. Claude Code, Gemini CLI, Cursor, VS Code — all trigger it. It's the second supply-chain attack in two months against the same Microsoft account. "The genius of this Miasma worm lies in how it adhered to legitimate workflows. It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem." — Cloudsmith What actually changed 73 official Microsoft npm packages were poisoned with the Miasma worm — a clone of TeamPCP's open-sourced Mini Shai-Hulud toolkit Malware executes automatically when any of the 73 packages are opened inside an AI coding agent The payload (28 KB) harvests credentials from AWS, Azure, GCP, Kubernetes, 90+ dev tool configs, and password managers , then spreads laterally through cloud infrastructure Attack vector: stolen Microsoft publisher credentials → bypasses the build pipeline entirely → malicious build published with valid SLSA provenance attestation Each infection gets a uniquely encrypted payload — meaning hash-based IOCs are useless for detection GitHub initially flagged packages as "terms of service violations" rather than malware; Microsoft only acknowledged possible malicious content 48 hours later The same Microsoft account was compromised in May 2026 (durabletask Python SDK on PyPI, 400k downloads/month) — and apparently wasn't fully remediated Why this one stings The supply-chain attack playbook has levelled up. SLSA provenance — the framework designed to give you cryptographic confidence that a package came from a legitimate build — was used against you here. Attackers stole a legitimate Microsoft OIDC token, published a malicious build with real provenance, and conventional scanners waved it through as a routine trusted update. The AI agent angle makes it worse.