标签：#ev

Most monitoring watches for something bad to appear: a 500, a timeout, an expired certificate, a slow response. A heartbeat monitor does the opposite. It watches for something good to stop appearing . Your cron runs, your backup completes, your embedded device phones home, your queue worker drains — and each of those pings a URL to say "I'm still alive." The monitor's job is to notice when the pings go quiet. That inversion is the entire value. A cron that fails throws an error you can catch. A cron that stops being scheduled — the box got reimaged, the systemd timer got disabled, the container never came back after a deploy, the account got suspended for an unrelated billing issue — throws nothing at all. There is no log line, no exception, no non-zero exit. There is only the absence of the thing that used to happen. You cannot alert on an event that does not fire. You can only alert on the silence. So heartbeat monitoring looks trivial: store a timestamp on every ping, and if now - last_seen > expected_interval , fire an alert. It is about ten lines. And it is exactly those ten lines that will let 43 days of downtime pass without a second word — because the hard part of a dead-man's switch is not detecting the death. It is staying loud after it. I know because it happened to our own. Three states, and why the third one must stay silent Start with the check itself. A naive heartbeat has two states — alive or dead — and both are wrong at the edges. The real answer set has three: alive — a beat arrived within period + grace . Everything is fine. dead — the last beat is older than period + grace . The thing stopped. Page someone. unknown — the monitor exists but has never received a single beat. That third state is where two-state heartbeat monitors self-immolate. A brand-new heartbeat you just created has no last_seen timestamp. If your rule is "alert when last_seen is too old," a null last_seen is infinitely old, so the monitor pages you the instant you create it —

When all tests pass doesn't mean what you think it means. TL;DR: Write the failing test first and ban deletions, or the AI deletes your test, reverts your fix, and calls it done. Common Mistake ❌ You ask the AI to fix a failing test, and it deletes the test instead of touching the defect that made it fail. Problem solved, apparently. You tell the AI every test passes, then change a business rule yourself, and you ask it to implement whatever the new rule requires. It reverts your edit back to the old rule, watches the suite go green again, and cheerfully reports done . It didn't fix anything. It just made the evidence go away. Congratulations, you now have a very well-behaved cheat!. Efficient and completely fraudulent, which is more than you can say for most of your actual employees. Isaac Asimov saw this coming: in Liar! , the robot Herbie lies to every human in the building because the truth would hurt, and the lie is the path of least resistance, no malice involved. At least Herbie felt bad about it afterward. Your AI isn't malicious either. It just doesn't lose any sleep, mostly because it doesn't have any, and reporting done is its path of least resistance too. Problems Addressed 😔 A shrinking test count is invisible unless someone is counting, so the shortcut survives until the defect resurfaces in production, usually on a Friday. A vague make the tests pass hands the model every incentive to satisfy the letter of the request over your actual intent, and it will take you up on that offer. Deleting a failing test hides the defect it was written to catch, and the regression ships in the next release, gift-wrapped as a new feature. Reverting your own business-rule change to make its done claim easier erases work you did outside the session, without telling you. That's a magic trick dressed up as a fix. Trusting a claimed done without reading the diff turns your code review into a rubber stamp, and rubber stamps don't catch fraud. Commenting out a failing asserti

Se você já perdeu tempo com essa sequência: git stash git checkout outra-branch # resolve o problema urgente git checkout branch-original git stash pop ...só pra descobrir depois que esqueceu o que tinha no stash, ou que o venv / node_modules da outra branch estava desatualizado — este artigo é pra você. O problema Um repositório Git tradicional tem uma única pasta de trabalho ligada a uma branch por vez. Trocar de branch significa trocar todo o conteúdo dessa pasta. Isso funciona bem quando você faz uma coisa de cada vez, mas quebra assim que você precisa: Revisar um PR urgente enquanto está no meio de uma feature grande Rodar testes de uma branch enquanto edita outra Manter ambientes de dependências diferentes (versões de libs, .env ) para features distintas sem reinstalar tudo a cada troca A saída mais comum é o stash , mas ele é frágil: some da vista, acumula, e é fácil esquecer o que tinha ali dentro. A solução: git worktree O git worktree permite ter várias pastas de trabalho simultâneas , cada uma vinculada a uma branch diferente, todas compartilhando o mesmo histórico de commits (o .git ). Pense em uma biblioteca central (o histórico do repositório) com várias mesas de leitura (as worktrees), cada uma com um livro diferente aberto. Você não precisa fechar um livro pra abrir outro. O que é compartilhado, o que é separado Compartilhado entre worktrees Separado por worktree Histórico de commits Arquivos da working directory Objetos do Git (blobs, trees) Arquivos não versionados ( .env , venv , node_modules ) Configuração do repositório Saída do git status Um commit feito em uma worktree aparece imediatamente no git log das outras — mas os arquivos físicos de cada pasta continuam independentes. Colocando em prática Criando uma worktree com branch nova git worktree add ../meu-projeto-feature-x -b feature/nome-da-feature Isso cria a pasta ../meu-projeto-feature-x , já com uma branch nova feature/nome-da-feature criada a partir do commit atual. Criando uma worktree

The SPF redirect trap: why -all can make redirect= useless SPF records often look simple until you start combining mechanisms and modifiers. One particularly easy mistake is to write a record like this: v=spf1 include:_spf.google.com -all redirect=_spf.example.com At first glance, it seems reasonable: authorize Google, reject everything else, and use another SPF policy through redirect= . But the redirect= part will never be used. The reason is an important detail of how SPF evaluation works. redirect= is not a fallback after -all An SPF record is evaluated mechanism by mechanism. For example: v=spf1 ip4:192.0.2.10 include:_spf.google.com -all The receiver checks the mechanisms until one matches. The all mechanism is special because it always matches . That means: -all effectively says: If nothing before this matched, return SPF Fail. Now consider this record again: v=spf1 include:_spf.google.com -all redirect=_spf.example.com Once SPF reaches -all , it already has a result. There is no reason to evaluate redirect= . The redirect modifier is only used when none of the mechanisms in the record produce a match. Because all always matches, a record containing all prevents redirect= from being used. What redirect= is actually for The redirect modifier is useful when several domains should share one central SPF policy. Imagine these domains: example.com example.net example.org Instead of maintaining the same SPF configuration independently on every domain, they can redirect to a central policy. For example: example.com TXT "v=spf1 redirect=_spf.example.com" example.net TXT "v=spf1 redirect=_spf.example.com" example.org TXT "v=spf1 redirect=_spf.example.com" And the central record might contain: _spf.example.com TXT "v=spf1 ip4:192.0.2.10 include:_spf.google.com -all" Now the sending policy can be maintained in one place. This is very different from include: . redirect= vs include: These two are easy to confuse. include: Use include: when you want to authorize senders def

Every Four Pillars calculator — saju in Korea, BaZi in China — agrees on the easy 95% of the job. Feed it a birth date and it maps that instant onto a traditional calendar: four pillars, each a heavenly stem paired with an earthly branch. The remaining 5% is boundaries. And at the boundaries, nearly all of them quietly disagree with the printed almanac they claim to reproduce. I maintain a saju reading service, and getting these four cases right was most of the actual engineering. Here they are, with the failing inputs. 1. A solar term is an instant, not a date The year pillar does not turn on January 1, and not on lunar new year either. It turns at 입춘 (ipchun, "start of spring") — one of the 24 solar terms, defined by the sun's apparent longitude. In 2024 that moment was February 4, 16:27 KST . A calculator that applies solar terms at day granularity says "February 4 → new year pillar" and hands the wrong year to everyone born that morning. npx k-saju 2024-02-04 04:00 # year 癸卯 — still the old year pillar, because 04:00 < 16:27 The fix is unglamorous: store term boundaries as instants and compare instants. The subtlety is that this correction applies to the year and month pillars only — the day pillar runs on its own sexagenary count and must not be touched. 2. The 23:00 hour belongs to two days at once Traditional practice starts the day at 23:00, not midnight — the hour of the Rat (자시). So for a birth at 23:31, there are two defensible answers about which day's stem the hour pillar derives from, and schools split on it. The convention this engine declares: the day pillar keeps clock midnight , while the hour stem takes the next day's stem (the 야자시 rule). npx k-saju 2000-05-15 23:31 # day 癸酉, hour 甲子 I am not claiming this is the One True Rule. I am claiming it should be written down. Most tools pick a side in silence, which is how two calculators give one person two charts and neither can explain why. 3. The clock is not the sun Korea keeps time on the 135°E meri

Security researchers are warning that thousands of enterprise servers could be exposed to compromise through vulnerabilities in their Baseboard Management Controllers (BMCs) - specialized processors embedded in server motherboards that provide administrators with remote, out-of-band control. By Craig Risi

Without thinking, I scribbled over what I'd just written. It's what I would have done if I was writing with pen and paper. But I didn't have a pen in my hand; my canvas was an LCD and the letters on my page were just pixels. Score one point to the TCL Note A1. TCL's […]

Nuxt has released version 4.5, featuring updates such as a switch to Vite 8, a new Rspack 2 builder, and experimental SSR streaming. This streaming enhances Time to First Byte by flushing the HTML shell instantly. The release also includes a stable error code system and new composables, alongside important upgrade instructions for developers moving from earlier versions. By Daniel Curtis

The current EV market is flush with variety. I've driven single-motor economy-minded machines, dual-motor EVs with all-wheel drive, tri-motor vehicles that dial up the performance stakes, and even wild quad-motor performance cars, like the Rimac Nevera. But this is the first time I've ever driven a five-motor EV, one with the agility and speed to […]

The Optoma GT2400HDR laser projector is great for setting up a driving range in your living room, but mediocre video quality makes it less appealing for home entertainment.

Originally published on the WeLocale blog . Most SEO work is a matter of degree. You improve a title, you gain a little. hreflang is not like that. It either forms a valid set that search engines act on, or it does nothing at all, and the failure is completely silent. No warning, no penalty, no message in Search Console telling you the tags you carefully added are being discarded. We build a translation widget, which means we generate hreflang tags for other people's sites. This post is what we have learned about why they get ignored, including the parts where our own approach has real limits. The rule that breaks most setups hreflang is not a property of a page. It is a property of a set of pages, and every page in that set has to agree. If your English page says the German version is at /de/ , the German page has to say the English version is at / . If it does not, the declaration is one-way, and one-way declarations get dropped. Google calls these return links and treats their absence as a reason to distrust the whole set. This is why hreflang fails in a way that feels unfair. Every individual page looks correct when you inspect it. The problem only exists in the relationship between pages, which is exactly the thing you cannot see by viewing source on one URL. The corollary catches people too: each page must list itself . A German page whose tags mention English and French but not German is an incomplete set. Incomplete sets get dropped. The other four failure modes en-UK. The language code comes from ISO 639-1 and the region code from ISO 3166-1. In ISO 3166-1 the United Kingdom is GB. There is no UK. The tag is silently invalid, and it is easily the most common hreflang error on the web. Same class of mistake: lowercase regions, uppercase languages, and a region with no language at all. URLs that redirect. hreflang has to point at the final URL. If it points at http and you redirect to https, or it omits a trailing slash your server adds, the target is a redir

“It never crossed my mind that they would be so bold as to sell our private data for AI,” says one former Spirit Airlines flight attendant.

AI coding agent Cursor has launched Origin, a git based code hosting platform embedded inside its AI-powered editor, positioning it as an alternative to GitHub for teams that already work in Cursor. Origin is rolling out in early beta on Pro, Teams and Enterprise plans, and lives inside a new Codebase tab within the Cursor application. By Matt Saunders

Building web applications today often comes with a trade-off between feature velocity and performance. Over-reliance on heavy frameworks or unoptimized third-party plugins can quickly lead to bloated bundle sizes and poor user experience. As an engineer running DevLanka , a small web and app development studio in Sri Lanka, I’ve had the opportunity to build custom web systems and mobile applications. In this article, I want to share a few practical engineering insights on modern web performance, toolchain selection, and practical security. 1. Toolchain & Bundle Size Considerations Moving from legacy build setups to modern toolchains like Vite and React 19 significantly improves development DX (Developer Experience) and build output: Module Bundling: Vite leverages ES modules during development, resulting in faster startup times and optimized production builds. Tree-Shaking: Ensuring modern JavaScript imports are properly tree-shaken prevents unused code from shipping to the client. Rendering Strategy: For public-facing, SEO-critical pages, client-side rendering (CSR) alone may not always be ideal. Combining SSG (Static Site Generation) or SSR (Server-Side Rendering) with lightweight React components ensures proper HTML pre-rendering for search crawlers. 2. When to Use Custom Engineering vs. CMS Platforms There is no single "best" tech stack for every project. Choosing between a traditional CMS (like WordPress/Wix) and custom software engineering depends entirely on project requirements: Use a CMS when: You need rapid deployment, simple content publishing, or a standard marketing site with a limited budget. Use Custom Engineering when: You require tailored business logic, seamless API integrations, custom database schemas, or fine-grained control over execution environments. Note on Security: Custom development reduces dependency on third-party plugin vulnerability exploits, but it is not inherently immune to security risks. Custom code still requires strict adherenc

Building a working tender documentation system for yourself is one project. Turning that same system into a template the rest of the team can pick up and use correctly, without needing to ask you what a particular instruction actually means, is a completely different project wearing the same clothes. The Gap Between Personal Use And Handoff A prompt template that only you use can carry a lot of implicit knowledge safely, because the missing context lives in your head and gets filled in automatically every time you run it. An instruction that says something like ensure the response addresses compliance requirements directly means something very specific to the person who wrote it, shaped by dozens of past examples of what counting as directly actually looks like in practice. That same instruction, handed to someone on the team who was not present for any of those past examples, is just as likely to be interpreted in a way that is defensible on its own terms and still wrong relative to what was actually meant. The template worked perfectly for months before it needed to be handed off, which made the gap invisible until the moment it actually mattered. The first time someone else on the team ran it independently and produced a response that technically followed the instructions but missed the actual intent behind them, the problem was not that the instructions were poorly written in any obvious sense. It was that they had been written for an audience of one, and that audience had context nobody else on the team had access to. What Actually Needs To Be In A Handoff Ready Template Fixing this meant rewriting a significant portion of the template with a different question in mind at every step, not does this instruction produce the right output when I run it, but does this instruction contain enough of the reasoning behind it that someone without my accumulated context could apply it correctly to a new tender they have never seen before. That meant replacing instructions

How to Write a Developer CV That Survives ATS and Still Reads Like a Human Wrote It Most developer CV advice picks a side: optimize hard for the applicant tracking system, or write something a human will actually enjoy reading. You need both, because both readers are real — a bot filters you before a human ever sees the file, and then a human decides whether to actually call you. What the ATS is actually doing It's not "AI" in any sophisticated sense most of the time — it's parsing your document into fields (name, contact, work history, skills) and keyword-matching against the job description. That means: Stick to standard section headers — "Professional Experience," "Education," "Skills." Creative renaming ("My Journey," "What I Bring") can break the parser's assumptions. Avoid tables, text boxes, and multi-column layouts for anything containing content the ATS needs to extract — many parsers read left-to-right, top-to-bottom, and a two-column layout can scramble your work history into nonsense. Match the language of the job posting, not just your own vocabulary. If they say "Node.js" and you only wrote "backend JavaScript," you may not match the keyword filter even though you clearly qualify. Save as .docx or a text-based PDF , not an image-based or heavily designed PDF — if you can't select and copy the text yourself, the parser probably can't either. What makes a human actually want to talk to you Once you're through the filter, the CV needs to do a different job: convince someone you're worth 30 minutes of their day. Quantify impact where you can — "reduced page load time by 40%" beats "improved performance." If you don't have a number, describe the before/after concretely instead. Lead each bullet with what changed, not what you were assigned. "Migrated the checkout flow to a queued job to eliminate timeout errors" tells a much richer story than "responsible for checkout flow." Cut anything that isn't verifiable or specific. Soft-skill bullet lists ("great com

The clinical trial technology stack is undergoing an infrastructure-level shift. As trial complexity grows—driven by decentralized models, multi-site global protocols, and massive data volume expansion—the cost of operational friction has become unsustainable. A Phase III clinical trial burns tens of thousands of dollars in direct costs per day. However, most timeline delays stem not from failing science, but from operational gridlock: site activation bottlenecks, uncoordinated protocol amendments, and fragmented data silos. In their comprehensive breakdown on clinical trial management software development, tech studio GeekyAnts outlined the modern core requirements for building production-ready CTMS platforms. Analyzing their guide through an enterprise architecture and engineering lens reveals critical operational blueprints, structural constraints, and technological shifts defining the current healthcare development landscape. Core Engineering Pillars of Next-Generation CTMS Platforms To replace legacy systems and fragile spreadsheet networks, a modern CTMS must execute core operational workflows with strict regulatory compliance and high system reliability. ,,, +-------------------------------------------------------+ | CTMS Core Architecture | +-------------------------------------------------------+ | +-------------------------+-------------------------+ | | +------------------+ +------------------+ | Operational Hub | | Regulatory Stack | +------------------+ +------------------+ | * Site Tracking | | * Audit Trails | | * Protocol Mgmt | | * eTMF/EDC Sync | | * Financials | | * 21 CFR Part 11 | +------------------+ +------------------+ ,,, Operational Workflow Orchestration A resilient CTMS must maintain real-time synchronization between protocol specifications and site-level execution. Essential capabilities include: ** Protocol Version Control **: Dynamic mapping of amendments across active sites to prevent out-of-date procedure execution. ** Site Activatio

The Remote Job Search Playbook for Developers Outside the US/EU Remote work opened the door for developers outside major tech hubs to compete for roles that used to be geographically gated. It also created a much bigger applicant pool for every posting. If you're searching from outside the US/EU, here's what actually affects your odds — beyond "just apply to more jobs." Timezone overlap is a real filter, not a footnote A lot of "remote, worldwide" postings quietly mean "remote, but we need 4+ hours of overlap with our core team." Before you apply, check what timezone the company or their existing team is in. If you can genuinely offer a workable overlap, say so explicitly in your application — don't make a recruiter guess whether a 7-9 hour time difference is going to be a problem later. Sourcing channels that actually produce interviews Recruiting-as-a-service platforms (Rightfit-style agencies, Toptal, Turing) — they pre-filter for companies actively hiring remote and internationally, which saves you from applying into a black hole on a generic job board. Company engineering blogs and changelogs — companies that write publicly about their engineering tend to also be more remote-mature and less nervous about hiring outside their home country. Referrals inside communities you're already part of — dev.to, Discord servers for your stack, open-source project maintainers. A referral skips the "will this person actually work out remotely" anxiety that a cold application can't answer. Direct outreach to smaller, funded startups — they often can't afford local senior talent and are more open to global hiring than enterprise companies with rigid HR policy. What to lead with in your application Recruiters hiring internationally are quietly screening for risk: will this person disappear, will communication be a problem, will payment/compliance be a headache. Address these before they have to ask: State your availability and overlap hours plainly. Link to async-friendly proof

Breaking Into Full-Stack Development Without a CS Degree: What Actually Worked for Me I didn't go through a computer science program. What I have instead is about seven years of shipping production code, learned almost entirely from official documentation, open-source repos, developer communities, and a lot of trial and error on real client work. If you're on that same path and wondering whether it's enough — here's what actually moved the needle for me, and what turned out to be a waste of time. What worked Building things that had to work, not things that looked good on a syllabus. Tutorial projects teach syntax. Client work teaches you what happens when a payment webhook fires twice, or when your "simple" CRUD app suddenly needs to survive 10x the traffic you designed for. The fastest learning happened on real, slightly terrifying production systems — not curated coursework. Reading source code and official docs before reaching for a course. Anyone can follow a video tutorial. Fewer people will sit with Laravel's own documentation, or actually read through a library's source when the docs run out. That habit compounds — you stop being dependent on someone else pre-chewing the material for you, and you get faster at picking up whatever stack a client happens to be using. Writing about what I learned. Technical writing forced me to actually understand things well enough to explain them, not just well enough to copy-paste them into working code. If you can't write a clear paragraph about why you chose NgRx over plain component state, you probably don't understand it as well as you think. Taking freelance and agency work early, even underpriced. Nobody hands a self-taught developer a senior role on day one. What they will do is pay you to fix their bug, or build their MVP, or maintain their legacy app. That's your CS degree — it's just distributed across a dozen small, real engagements instead of four years in one building. What didn't work (or wasn't worth the time)

Say hello to a revamped collection of perfectly proportioned 38-mm Speedmasters.