标签：#ev

From fixing one sentence to designing an algorithm, AI becomes much more useful when you stop treating it as a single-purpose chatbot. Instead, think of it as a collection of specialized working modes . Need to debug? /debug Need to design an algorithm? /algorithm Need to plan research? /researchplan Need to challenge your own argument? /critic Need to turn a large project into manageable work? /roadmap90 The underlying idea is simple: Don't just ask AI for an answer. Give it a mode of thinking. From Prompt → Workflow A normal interaction might look like: User ↓ Question ↓ AI ↓ Answer A structured workflow looks different: Goal ↓ Context ↓ Lens ↓ Analysis ↓ Output ↓ Review ↓ Iteration For example: Project ↓ /researchplan ↓ Research questions ↓ /hypothesis ↓ Testable assumptions ↓ /experiment ↓ Evaluation ↓ /audit ↓ Final findings The shortcut is not magic. It is a task-specific instruction layer . 1. Writing Lenses The first group focuses on transforming existing text. /rewrite /improve /polish /proofread /grammar /copyedit /expand /shorten /paraphrase /simplifytext These commands represent different operations. For example: /rewrite should preserve the original meaning while changing the wording. Whereas: /improve can address: clarity structure flow word choice readability And: /shorten optimizes for concision. This distinction matters because: Editing and rewriting are not the same task. 2. Tone Is a Control Variable The next group controls communication style: /formal /casual /friendly /professional /persuasive /convincing /academic /journalistic The same information can be communicated differently depending on the audience. For example: Technical explanation ↓ ┌──────┼──────┐ ↓ ↓ ↓ Student Developer Executive The underlying facts should remain stable. The presentation changes. That makes tone a communication parameter , not merely decoration. 3. Structured Writing For longer outputs: /story /essay /article /report /whitepaper /casestudy /proposal /sop /playbook

AI agent observability means capturing your agent's reasoning cycles, tool calls, and token usage as...

What makes a form portable? Not JSON alone. Its validation, conditions, collections and submission semantics must survive the trip too. I wrote about the architecture behind Modyra and the trade-offs involved. Your Form Is Not Portable If It Contains Callbacks Most form libraries help us manage forms inside an application. They track values, execute validators, expose errors and eventually produce a submission payload. That works well until the form needs to exist somewhere else. Perhaps its structure comes from a backend. Perhaps a visual builder generates it. Perhaps multiple applications must render it. Perhaps the server must independently validate the same conditional rules used by the browser. At that point, the form is no longer just component state. It is a contract. And most form abstractions cannot cross that boundary. The portability illusion Consider a typical conditional validator: const form = createForm ({ defaultValues : { country : ' IT ' , vatId : '' , }, validators : { onChange : ({ value }) => { if ( value . country === ' IT ' && ! value . vatId ) { return { fields : { vatId : ' VAT ID is required in Italy ' , }, }; } }, }, }); This is perfectly reasonable application code. It is also not portable. The callback cannot travel through an API as JSON. A Java service cannot execute it. A visual editor cannot reliably inspect it. Another runtime cannot reproduce its meaning without receiving executable source code. We can serialize the values around the callback, but not the behavior itself. This leads to an important distinction: A form configuration is not a portable form contract if part of its meaning still lives inside executable callbacks. The obvious shortcuts are dangerous There are several tempting ways to work around this limitation. Serialize the callback as source code { "condition" : "value.country === 'IT'" } The receiving application must now parse or execute an expression encoded as text. That creates immediate problems: the expression

Static Forms in Astro: Handling Submissions Without a Server with onsubmit.dev (form backend) Astro is a great fit for content-heavy sites that ship very little JavaScript, but that creates an interesting problem as soon as you add a contact form: where does the POST request go? With onsubmit.dev (form backend) , an Astro site can submit forms to an external endpoint instead of adding its own API route or server. This is particularly useful for Astro projects deployed as static files to a CDN, GitHub Pages, or another static host. You can keep the site static while still accepting contact requests, feedback, registrations, and similar submissions. Start with the zero-JavaScript pattern The simplest approach is also the most aligned with Astro's philosophy: use the browser's native form submission behavior. You don't need a hydrated component merely to collect a few fields. A regular HTML form can make a POST request directly to a form backend: --- // src/pages/contact.astro --- <form method="POST" action="https://onsubmit.dev/f/YOUR_FORM_ID"> <label> Name <input type="text" name="name" required /> </label> <label> Email <input type="email" name="email" required /> </label> <label> Message <textarea name="message" required></textarea> </label> <button type="submit">Send message</button> </form> Replace YOUR_FORM_ID with the endpoint supplied for your form. There is no client framework involved here. The browser serializes the named fields and sends them directly when the visitor clicks the button. That has several nice properties for an Astro project: No Astro server endpoint is required. No React, Vue, or other client runtime needs to be hydrated. The form still works when JavaScript is unavailable. Your static deployment remains static. It is worth remembering that native HTML already does a lot of work. required , type="email" , labels, and standard browser submission cover many simple forms without additional JavaScript. Where astro-onsubmit fits For Astro-specif

How CAPTCHA evolved from typing distorted text to analyzing behavior, context, and risk When most people hear CAPTCHA, they imagine a small checkbox: ☐ I’m not a robot Or perhaps a challenge asking them to select traffic lights, bicycles, buses, or crosswalks. But modern reCAPTCHA is much more interesting than that. In many cases, you don't actually solve anything. You simply open a webpage, move your mouse, click a button, fill out a form—and somewhere in the background, a risk-analysis system is trying to answer a much harder question: “Does this interaction look like a legitimate human interaction, or automated/abusive traffic?” That is a fundamentally different problem from asking a user to identify a picture. Google describes reCAPTCHA as a service that uses advanced risk-analysis techniques to distinguish humans from bots. Modern versions can return a risk score instead of presenting a visible challenge. 1. The original CAPTCHA problem CAPTCHA originally stood for: Completely Automated Public Turing test to tell Computers and Humans Apart. The basic idea was simple: Humans are good at recognizing distorted characters. Traditional computer programs were not. So the website could display something like: but distort, rotate, or obscure the characters. The user typed: 7hK9P and the website accepted the answer. This created a simple classification: It worked reasonably well. Until machines became better. 2. Then computers learned to read the CAPTCHA This created an interesting security race. CAPTCHA became harder. Then OCR and machine learning became better. So CAPTCHA became even harder. Eventually the system was moving toward: Human intelligence vs machine vision And that created an unfortunate side effect. The better the security became, the worse the experience became for legitimate users. Instead of: «“Are you human?”» the user was suddenly being asked: «“Select every square containing a traffic light.”» And sometimes: «“Select every square containing a traffi

How We Cut AWS Staging Costs by 87% With EventBridge Scheduler No code changes. No Lambda functions. No complex scripts. Just 4 schedulers and a realization that nobody uses staging at 3am. Here's a question every engineering team should ask themselves: "When was the last time someone actually used our staging environment at 2am?" For us? Never. Not once. Yet we were paying for it — EC2 running, ECS Fargate tasks spinning, compute burning money — every single hour of every single day, including weekends, holidays, and the 21 hours per day when nobody on our team was even awake. That's the hidden tax of staging environments. And most teams never fix it because the solution feels complicated. It isn't. This is how we cut our staging compute costs by 87.5% — using AWS EventBridge Scheduler, zero Lambda functions, and zero lines of application code. The Problem: Staging Was Running 24/7 For No Reason Our staging environment had two resources running around the clock: EC2 instance — our staging app server ECS Fargate service — our backend API container Our team actively uses staging for roughly 3 hours a day . That's it. The math was embarrassing: Running: 24 hours/day Used: 3 hours/day Wasted: 21 hours/day = 87.5% of compute going nowhere Monthly cost breakdown: EC2 + ECS Fargate (24x7): ~$19.18/month EC2 + ECS Fargate (3hr/day): ~$2.40/month Monthly saving: $16.78 Yearly saving: $201.35 Reduction: 87.5% $201/year saved on staging compute alone — with 45 minutes of setup and zero application code changes. Multiply that across dev environments, QA clusters, review apps, and load test environments. The savings compound fast. The Solution: AWS EventBridge Scheduler Most engineers reach for Lambda when they need to automate AWS tasks on a schedule. That works — but it means writing code, managing runtimes, setting up CloudWatch Logs, and maintaining a function forever. EventBridge Scheduler is the better tool here. It lets you call any AWS SDK action directly on a cron sche

In one crash, the driver of a 2024 Blazer EV said they had to "deliberately steer the vehicle into a concrete curb" to slow it down and avoid a "catastrophic intersection collision."

Many newer vehicles can be accessed from the owner's phone, if they've set it up. There are some things to consider before adding your key.

Ever logged into an app, closed the tab, come back, and you're still logged in — no password needed? That's almost always JWT doing its job behind the scenes. JWT (JSON Web Token) is one of the most common ways to handle authentication in modern backends. But a lot of developers use it without really understanding what's happening — and that's exactly where security bugs sneak in. Let's fix that. By the end of this post you'll know what a JWT actually is, how to use it in a Node.js + Express app, and the mistakes that quietly break real apps. What is a JWT, really? A JWT is just a string with three parts , separated by dots: xxxxx.yyyyy.zzzzz │ │ │ header payload signature Header — says which algorithm signed the token (e.g. HS256 ). Payload — the actual data (like userId , role , and an expiry time). This is not encrypted — it's just Base64-encoded. Anyone can read it. Signature — a cryptographic stamp created using a secret only your server knows. This is what stops people from faking tokens. Want to see this for yourself? Paste any token into a free JWT decoder and you'll instantly see the header and payload. Notice you can read everything without the secret — that's the key lesson: never put passwords or sensitive data in a JWT payload. Creating a token (login) Install the library: npm install jsonwebtoken When a user logs in successfully, sign a token: import jwt from ' jsonwebtoken ' // On successful login: const token = jwt . sign ( { userId : user . _id , role : user . role }, // payload process . env . JWT_SECRET , // secret (keep it in .env!) { expiresIn : ' 7d ' } // auto-expiry ) res . json ({ token }) Three things to notice: Keep the payload small — just an id and role, not the whole user object. The secret lives in an environment variable, never hardcoded. Always set expiresIn . A token that never expires is a token that can be stolen forever. Verifying a token (protecting routes) Now create a middleware that checks the token on every protected request

More and more developers are using AI assistants to write code. With these tools, teams can move from an idea to implementation much faster than before. Logically, overall delivery should speed up as well — but often not as much as we would expect. A team might reduce implementation time by 30% or even 50%, while the time it takes for a feature to actually reach production changes only slightly. The reason is that other stages of the workflow — waiting for code review, QA, testing, approvals, and release — do not automatically speed up just because coding does. That’s why it’s important to ask: if AI has significantly accelerated coding, why isn’t overall delivery time improving at the same pace? Coding time is only one part of delivery time Let’s imagine a typical workflow in a development team: To Do → Development → Code Review → Awaiting QA → Testing → Ready for Release → Done By breaking down the time in the status in more detail, you can see the following picture: 2 days in Development 2 days waiting for review 3 days waiting for QA 1 day in Testing 2 days waiting for release Development time : 2 days. Total delivery time : 10 days. With AI becoming part of the development process, it’s entirely possible to cut implementation time in half. In our example, that means cutting it from 2 days to 1. That's a 50% improvement in Development. But if everything else stays the same, the total delivery time drops from 10 days to 9, which is only a 10% improvement . The team really did get faster at writing code — the improvement just happened in one part of a much larger delivery system. Faster coding can expose the next constraint Think of the workflow as a sequence of stages, each with its own capacity. When Development becomes faster, more work can reach downstream stages sooner. If Code Review, QA, Testing, or Release have enough capacity to absorb that work, delivery improves. If they don't, some of the productivity gain turns into queue time. The delay hasn't necess

There is a layer in my database called 1 . Somebody created it, presumably by accident, and it sat there for months looking harmless. It was the only layer in the system that never served a single tile, and nobody noticed, because it was empty anyway. That layer turned out to be a symptom of a SQL injection vulnerability. This post is about the design that produced it — which I still think is a good design — and the four things I got wrong inside it. The setup A web GIS with about 2.7 million features: 1.8 million points, 697,000 lines, 172,000 polygons. Users create layers through the UI, upload data into them, edit geometry, and expect to see it on a map. The features do not live in a table per layer. They live in three tables — one for points, one for lines, one for polygons — with a layer_id foreign key and a JSON column for attributes: project_pointfeature 1,820,288 rows project_linefeature 697,009 rows project_polygonfeature 171,830 rows That's a deliberate trade. A table per layer means DDL every time a user clicks "new layer", a migration story that never ends, and a schema that drifts. Three generic tables mean one schema, one set of indexes, and layers that are just rows in a metadata table. The cost lands on the tile server. The pattern Martin serves vector tiles from PostGIS. Point it at a database and it discovers spatial tables and views and publishes each as an MVT endpoint. It can be told to publish views but not tables: postgres : auto_publish : from_schemas : [ public ] publish_tables : false reload_interval : 5s So: give every layer its own view. A Django post_save signal on the Layer model creates it: CREATE OR REPLACE VIEW t19_saobracajni_znakovi AS SELECT f . id , f . feature_attrs , f . geom , f . layer_id , l . name AS layer_name , lg . name AS layer_group_name , p . title AS project_title FROM project_pointfeature f JOIN project_layer l ON f . layer_id = l . id JOIN project_layergroup lg ON l . layer_group_id = lg . id JOIN project_project p

With two cameras and built-in climate sensors, the Birdfy Nest Duo let me watch an entire nesting season unfold.

Andrew Swerdlow shares how Roblox scales autonomous software development from prompt to production. He discusses building robust security sandboxes, extracting institutional knowledge via code review exemplars, updating engineering infrastructure, and redefining productivity metrics around feature velocity and long-running AI turns to achieve trusted, automated deployment at scale. By Andrew Swerdlow

Tethered display glasses are truly practical face computers. They trade bulky spatial computing for simplicity: Plug in, recline, and get a massive screen right in front of your nose.

China's intelligent driving is moving fast from highway Navigate on Autopilot (NOA) into the far harder world of urban NOA. The first leap moved hands-free driving out of the closed expressway and into real city streets. The second leap, the one now underway, is rewriting how the car actually thinks. 1. The Rules Era: An "Exam-Cramming" Trap for City NOA Highway NOA was relatively simple to crack. The road is closed, the geometry is consistent, the actors are mostly cars, and a mature rule-based stack can deliver a comfortable product. Urban NOA is a different beast. The system has to handle traffic lights, unprotected turns, pedestrians, e-bikes, food-delivery scooters running red lights, and a hundred flavors of "I-don't-care-about-the-rules" intersection behavior. The complexity grows exponentially. The earliest urban NOA architectures followed one mantra: cover every possible scenario with hand-written rules . Engineers enumerated traffic situations and wrote thousands of if-then-else statements: when to start moving after a light turns green, how much to slow when cut off, how to plan a trajectory for an unprotected left turn. On the highway this approach can pass a test. In the city it falls apart for a single structural reason. China's urban road users, almost by definition, do not follow the rules. Electric scooters drive the wrong way. Pedestrians cross mid-block. Food-delivery riders weave between cars. Drivers in congested intersections play chicken in the kind of "zipper merge" etiquette nobody teaches. These are the long-tail scenarios that no rule library can fully enumerate. As one early test team admitted about their own city NOA: "It feels like exam cramming — it scores beautifully on the routes we pre-mapped, and the moment it hits an unrecorded scenario, it hesitates, behaves awkwardly, and then asks the driver to take over." That "偏科" (one-trick) experience is precisely why urban NOA penetration in China only reached about 15.1% in 2025 , and rem

Most EF Core bugs I've seen in production aren't from bad code. They're from code that looks right. It compiles, it passes review, it works fine locally against a database with twelve rows in it. Then it hits a table with five thousand rows, or a second replica, or a request that gets cancelled halfway through, and it falls over in a way nobody wrote a test for. None of the mistakes below are exotic. They're the default behavior of EF Core when you don't opt out of it, or the default behavior of a deployment when nobody thought about what "five pods start at the same time" actually means. Here's the setup I use and the list of ways it goes wrong if you skip a step. The entity namespace Sample.Domain.Posts ; public sealed class Post { public Guid Id { get ; private set ; } = Guid . CreateVersion7 (); // sequential → index-friendly public required string Title { get ; set ; } public required string Slug { get ; init ; } public string Body { get ; set ; } = string . Empty ; public DateTimeOffset ? PublishedAt { get ; private set ; } public Guid AuthorId { get ; init ; } public uint RowVersion { get ; set ; } // optimistic concurrency token public void Publish ( TimeProvider clock ) { if ( PublishedAt is not null ) throw new DomainException ( "Post is already published." ); PublishedAt = clock . GetUtcNow (); } } Two things here that are easy to skip and annoying to retrofit later. Timestamps are stored as UTC ( DateTimeOffset ), rendered in the user's timezone only at the edge — I do the same thing on ProcessHub, storing everything UTC and rendering in Asia/Tehran, because "what timezone is this in" is a much worse question to answer after the data already exists in three different formats. Second: the clock comes in as TimeProvider , not a call to DateTime.UtcNow buried inside the method. It's a small thing, but it's the difference between a test that can assert "publishing sets the timestamp to exactly this value" and a test that has to accept "sometime around now."

Disclaimer Este texto foi inicialmente concebido pela IA Generativa em função da transcrição de um vídeo do canal Dev Eficiente, apresentado por Alberto Souza. Se preferir acompanhar por vídeo, é só dar o play. Introdução O vídeo que deu origem a este texto foi gravado há quase três anos. Na época, o que me incomodava era simples de descrever: log é um tema comum no dia a dia, mas resolvido de forma artesanal. Cada pessoa da equipe decide, no momento em que escreve o código, se aquela linha merece registro, se o nível é info ou debug, e quais informações vão junto. A comparação que eu fazia era com testes automatizados. Você juntava dez pessoas para escrever testes sobre o mesmo conjunto de classes e saíam baterias completamente diferentes, com abordagens diferentes, às vezes deixando uma branch de fora. Cada pessoa tinha uma opinião sobre o que era importante, e não havia um modelo de pensamento compartilhado por trás disso. Com log eu sentia algo parecido. Como a resposta não estava clara para mim, passei uns dois dias procurando o que o mercado discutia e o que a pesquisa acadêmica tinha investigado sobre práticas de log. Reuni umas cinco ou seis referências e é isso que este post organiza: o que cada referência contribui e quais práticas dá para extrair delas. Mantive as referências e as conclusões como estavam na época. Acrescentei apenas uma seção sobre algo que mudou bastante desde a gravação e que torna esse assunto mais relevante hoje do que era então: a quantidade de código escrito com apoio de IA e a investigação de problemas feita com apoio de agentes. Por que log bem feito importa mais hoje Nos últimos anos mudou bastante quem escreve o código e, principalmente, quem investiga o problema quando ele aparece. Quando parte relevante do código é gerada com apoio de IA, a familiaridade de quem mantém aquele trecho com cada decisão tomada ali tende a ser menor. Você definiu a intenção, revisou o resultado, aprovou. Mas não construiu, linha a linha, o modelo m

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a PortSwigger lab on multi-step process access control. The setup: an admin panel with a user upgrade flow. You pick a user, hit upgrade, then confirm on a second screen before the change actually goes through. Not counting the admin login and accessing the admin panel, that's two steps. The goal was to login as wiener (my non-admin account) and upgrade it to admin without ever having admin access to begin with. Fig 1. A quick look at the admin interface in action. What I tried that didn't work I followed and wrote out the steps the admin flow actually takes, so I could inspect each step individually. Checked the change-email route for anything reusable. Tried hitting the admin and admin-roles paths directly with different HTTP methods. Added the referrer header with the value I'd seen during the legitimate admin flow. Went through the HTML and JS on every relevant page. Tried looking for where the user list was being fetched from. Tried the user-ID-in-params trick that had worked on an earlier lab. None of this brought any results and just got me more frustrated. The thing is, I was going at this problem with the assumption that in this scenario, I was a hacker with no idea of how the admin system actually worked when upgrading users. And that the lab giving me access to the admin credentials was just to hint towards any probable vulns. Why I slipped into that line of thinking, I have no idea. As I watched the hours tick by on my laptop clock, I grew increasingly aware of the painful fact that some LLM somewhere could probably one-shot this problem. That I could end my suffering by taking a knee before the mighty oracle called Claude. And you as a reader are probably wondering why I didn't submit. Well I was determined to actually learn. I had told myself going into this,

All praise to almighty God, and thanks to Google and the DEV Team, a while back, I won the Google...

In one test clip, the auto subtitles looked almost perfect. Then one auto subtitle showed gp where the speaker had actually said HP . It was one token in a long transcript, and that was exactly the problem: nothing in the editor made it look more dangerous than the clean words around it. Disclosure: AI helped me edit and structure this article. The gp / HP mistake came from my own build, and I checked the technical details against the code and the working editor. I ran into this while building a subtitle editor. The ASR system already returned word-level timing and confidence values, but a polished block of text made every word look equally trustworthy. The model exposed uncertainty; the interface hid it. That led me to a narrower engineering conclusion: Auto subtitles are drafts. An accuracy score describes a model result; it does not define a finished review workflow. Why auto subtitles need more than one accuracy percentage Speech-to-text systems are often evaluated with word error rate , or WER. In its simplest form: WER = (substitutions + deletions + insertions) / reference words That is useful for comparing transcripts against a known reference. For auto subtitles, trouble starts when a model-level metric is turned into a product-level promise. Suppose a 100-word transcript contains one wrong word. Its word accuracy may look excellent. But a single auto subtitle can carry very different consequences: Changing “and” to “an” may be harmless. Changing a person’s name damages trust. Changing 15 to 50 changes the meaning. Changing HP to gp made my test caption look careless. Dropping “not” reverses the sentence. WER counts errors. It does not price their consequences. Good auto subtitles also depend on things that a transcript-only score does not fully describe: whether words appear at the right time; whether cue boundaries follow the sentence; whether a line is readable before it disappears; whether punctuation helps or hurts comprehension; whether the user knows