标签：#ev

Every developer who has written a Playwright test for OTP verification has written this line: const otp = email . body . match ( / \b\d{6}\b / )?.[ 0 ]; It works. Until it doesn't. The email body changes format. The OTP appears inside an HTML table. The sending service wraps it in a <span> . Your regex matches a phone number instead of the code. The test fails intermittently and you spend an hour debugging something that has nothing to do with the feature you're testing. The regex problem OTP extraction via regex is brittle by nature. You're pattern-matching against a string that your email sending service controls — not you. Any time the template changes, your tests break. Here's what a typical OTP test looks like today: import { test , expect } from ' @playwright/test ' ; import { ZeroDrop } from ' zerodrop-client ' ; const mail = new ZeroDrop (); test ( ' user can verify OTP ' , async ({ page }) => { const inbox = mail . generateInbox (); // 1. Trigger OTP send await page . goto ( ' /login ' ); await page . fill ( ' [data-testid="email"] ' , inbox ); await page . click ( ' [data-testid="submit"] ' ); // 2. Wait for email const email = await mail . waitForLatest ( inbox , { timeout : 15000 }); // 3. Extract OTP — the fragile part const otp = email . body . match ( / \b\d{6}\b / )?.[ 0 ]; if ( ! otp ) throw new Error ( ' OTP not found in email body ' ); // 4. Enter OTP await page . fill ( ' [data-testid="otp"] ' , otp ); await page . click ( ' [data-testid="verify"] ' ); await expect ( page ). toHaveURL ( ' /dashboard ' ); }); The test works — but line 14 is carrying all the risk. Change the email template and the test breaks. Add a phone number to the footer and the regex matches the wrong number. Send a 4-digit OTP instead of 6 and you need to update the pattern. OTP extraction at the edge ZeroDrop extracts OTPs before they reach your test. The Cloudflare Worker that catches incoming emails runs a pattern match on the plain-text body and stores the result alongsi

AWS Hero Vadym Kazulkin explains how to overcome Java’s enterprise hurdle on AWS Lambda: cold starts and memory footprints. He shares a technical deep dive into performance tuning, comparing fully managed AWS SnapStart (with pre-snapshot priming hooks) against GraalVM ahead-of-time compilation, while addressing the latest architectural implications of Project Leyden and Java 25. By Vadym Kazulkin

ArrowJS, developed by Justin Schroeder, is a reactive UI library that has reached its 1.0 release after three years in development. It utilizes core web technologies, avoids JSX and compilers. Notable features include an optional WASM sandbox for executing untrusted code. The framework's minimalism is highlighted by its reliance on three main functions: reactive, html, and component. By Daniel Curtis

Most developers have done this at least once. You get a messy API response. You need to inspect a JWT. You have a webhook payload, a log object, or a config file that is hard to read. So you open a JSON formatter, paste the content, and move on. That habit is convenient. But it also deserves a second look. Not every JSON tool behaves the same way. Some tools process your input entirely in the browser. Some send content to a server. Some store snippets for sharing. Some extensions have permissions that are broader than you expect. The problem is not that every online formatter is unsafe. The problem is that you often do not know what happens after you paste. What you should avoid pasting blindly Before using any random online tool, be careful with: production JWTs API responses containing user data logs from real systems config files webhook payloads database URLs cloud keys internal endpoints tenant IDs error traces from production systems A JSON payload does not need to contain an obvious password to be sensitive. Sometimes the risky part is context: user IDs, internal URLs, tokens, customer data, or system structure. A quick DevTools check You can do a basic check with your browser’s DevTools. Open the JSON tool. Open DevTools. Go to the Network tab. Clear existing requests. Paste a harmless test JSON first. Run format, validate, diff, decode, or whatever action the tool provides. Watch the Network tab. Look for POST, PUT, fetch, XHR, or beacon requests after your input. Inspect request payloads if they exist. Check whether your pasted JSON appears in any request. Do this with harmless test data first. If the tool uploads the test JSON, do not paste production content into it. What to look for A few signs deserve attention: POST requests after you paste or click format request bodies containing your JSON share-link features that save snippets server-side validation APIs analytics events that include pasted content extension background requests that are not clearly

Hermes AI Agent handles multi-step workflows well. The planning layer holds up. Memory across sessions works. What kept breaking down was the tool layer. Once a workflow touched three or four external systems, I was spending more time on auth configs, mismatched response formats, and per-tool retry logic than on the workflows themselves. I fixed this by routing all external tool calls through a unified MCP gateway. The agent logic stayed the same. The integration complexity moved into one place I could actually manage. This post walks through how that works, how to set it up, and where it is genuinely useful. How Hermes runs tasks Hermes is an open-source, self-hosted agent runtime from Nous Research, released in February 2026 under the MIT license. It runs persistently on your own infrastructure and executes goals as structured, stateful workflows. Four layers handle execution. The planning layer breaks a goal into sequenced steps and adjusts them as intermediate results come in The execution layer runs each step and fires tool calls when external data or action is needed The memory layer stores task state and session history in SQLite with FTS5, so context carries over across restarts The skills layer captures completed workflows as reusable documents retrieved on future tasks After a task finishes, Hermes writes a skill file with the procedure and known failure points, then stores it for retrieval next time a similar task runs. Tool execution is embedded in the runtime loop. External capabilities come through MCP-based interfaces, which is where the gateway plugs in. What breaks when integrations live inside the agent In a standard MCP setup, each client connects one-to-one with a specific MCP server. That works fine with two or three tools. With ten, it becomes a maintenance problem that grows with every tool you add. A task spanning a web search, a product API, and a SERP scraper means three separate auth setups, three response formats to parse, and three diffe

Modern software delivery pipelines can deploy code dozens or even hundreds of times per day. Traditional penetration testing models, where security teams perform assessments quarterly or before major releases, simply cannot keep pace. Attackers do not wait for the next security review. Every pull request, dependency update, infrastructure change, or container image introduces potential risk. Integrating penetration testing into CI/CD enables organizations to identify vulnerabilities before they reach production. The goal is not replacing human penetration testers. The goal is automating everything that can be automated so security experts can focus on complex attack paths and business logic flaws. Understanding Security Testing Layers in CI/CD Security testing is often misunderstood because multiple categories overlap. Testing Type Purpose SAST Analyze source code SCA Detect vulnerable dependencies DAST Test running applications IAST Runtime security analysis Penetration Testing Simulate attacker behavior Penetration testing combines elements of all these approaches. A mature CI/CD pipeline continuously performs automated penetration testing while reserving manual testing for sophisticated attack scenarios. Designing a Security-First CI/CD Architecture A security-centric pipeline typically looks like: Developer Commit ↓ Pre-Commit Security Checks ↓ Pull Request Validation ↓ Build Stage ↓ Container Security Scan ↓ Infrastructure Validation ↓ Deploy to Staging ↓ Automated Penetration Testing ↓ Security Gate ↓ Production Deployment Each stage eliminates vulnerabilities before they become more expensive to fix. Stage 1: Pre-Commit Security Controls The cheapest vulnerability is the one that never reaches Git. Secret Detection Install TruffleHog or Gitleaks before code reaches the repository. repos : - repo : https://github.com/gitleaks/gitleaks rev : v8.20.0 hooks : - id : gitleaks Developer installation: pip install pre-commit pre-commit install Now every commit is aut

Since the Umbraco 16 release, Umbraco ships only with the TipTap Rich Text Editor. This was unfortunately something that Umbraco was forced to do. TinyMce 7 has a license that is incompatible with the open source license of Umbraco and TinyMce 6 was going out of support. So an alternative had to be found. Umbraco did a pretty good job at abstracting the rich text data. In Umbraco 15 both TinyMCE and TipTap were still present and exchangeable because of this abstraction. And arguably, the way you can set up your toolbars for the TipTap editor is superior to TinyMCE. But still, a new Rich Text Editor is a big change that presents real challenges. These challenges are most obvious when looking at the Umbraco forum's tip-tap tag . Topics vary, but a few come up again and again: Additional HTML tags getting added to the markup, like a <p> tag inside a <li> The inability to add certain tags to TipTap, like <script> tags The inability to add styling to an element, for instance to create a link that looks like a button These are valid challenges, especially if you're upgrading from an existing TinyMCE setup. But this is also a good moment to ask two questions: Why do I want the same behaviour? And was the old behaviour actually any good to begin with? You don't have to migrate everything at once Before getting into that, it's worth knowing that TinyMCE is still available as a community package for Umbraco 16+. If you're in the middle of a project, dealing with a large codebase, or just not ready to rethink your Rich Text Editor setup right now, that's a valid escape hatch. Swap in the package, keep things running, and give yourself time to migrate properly. But "later" should still be on the roadmap. The package is community maintained, not an official Umbraco product, so there are no guarantees around long-term support or compatibility with future Umbraco versions. Relying on it indefinitely carries the same risk as the situation Umbraco just came out of with TinyMCE 6. So

You've heard of Bitcoin. You've maybe heard of the Lightning Network. But what exactly is LND, and why should developers care? Let's break it down — technically, but from the ground up. The Problem: Bitcoin is Superb but Slow Bitcoin's base layer — the blockchain itself — is intentionally slow. Every transaction must be broadcast to thousands of nodes, verified, and bundled into a block that gets mined roughly every 10 minutes . The network handles about 7 transactions per second (TPS). Compare that to Visa's ~24,000 TPS and you quickly see the problem. Bitcoin in its raw form isn't built for buying coffee, splitting a bill, or paying a freelancer in real time. But there's a solution — and it lives on top of Bitcoin. Enter the Lightning Network The Lightning Network is a Layer 2 (L2) payment protocol built on top of Bitcoin. Instead of recording every single payment on the blockchain, it lets two parties open a private payment channel, transact off-chain as many times as they want, and only settle the final balance on-chain when they're done. Think of it like running a tab at a bar: Opening the tab = one blockchain transaction Each round of drinks = instant off-chain payment Closing the tab = one final blockchain transaction The result? Near-instant payments, near-zero fees, and massive throughput — without sacrificing Bitcoin's security. What is LND ? LND stands for Lightning Network Daemon. It's the most widely used implementation of the Lightning Network protocol, built and maintained by Lightning Labs. Key facts for developers: Written in Go 🐹 Exposes a gRPC API (port 10009) and a REST API (port 8080) Controlled via a CLI called lncli Uses macaroons for authentication (think JWT, but for Lightning) Connects to a Bitcoin node (bitcoind or btcd) as its source of truth Other Lightning implementations exist — like Core Lightning (CLN) and Eclair — but LND has the largest developer ecosystem and is the best entry point. How LND Fits Into the Stack Here's the architec

DevOps has always evolved with technology. Cloud changed how teams manage infrastructure. Containers changed how applications are deployed. CI/CD changed how software is released. Observability changed how teams monitor systems. Now AI is starting to change DevOps again. The next stage of DevOps is not only automation. It is intelligence. * DevOps Was Built on Automation * Automation is one of the strongest foundations of DevOps. DevOps teams automate: • Builds • Tests • Deployments • Infrastructure provisioning • Monitoring alerts • Rollbacks • Scaling • Security checks This has helped teams deliver software faster and more reliably. But most automation still works through fixed rules. For example: if CPU crosses a threshold, send an alert. If a build passes, deploy to staging. If a container fails, restart it. This works well for known situations. But modern systems are more complex. Microservices, cloud platforms, Kubernetes, APIs, databases, queues, and third-party dependencies create huge amounts of operational data. When something goes wrong, fixed rules are not always enough. * Why Intelligence Matters * Modern DevOps teams do not just need more automation. They need better understanding. AI can help teams identify patterns, detect unusual behavior, summarize logs, group related alerts, and suggest possible causes during incidents. This is where AIOps becomes important. AIOps means using AI for IT operations. It helps DevOps and SRE teams move from reactive operations to smarter operations. Instead of only asking, “What alert fired?” teams can start asking: • What changed recently? • Which services are aff ected? • Are these alerts connected? • Is this behavior unusual? • Has this happened before? • What is the likely root cause? This does not mean AI will replace DevOps engineers. It means AI can support engineers with faster insights. * What This Means for DevOps Engineers * DevOps engineers should pay attention to AI because their role is evolving. Traditi

On paper, the Honor Magic V6 sounds like a tremendous leap forward for foldable phones: It's the thinnest one yet, with the biggest battery, and the best water-resistance ever. In practice, only the bigger battery feels like a meaningful improvement. The other upgrades are only fractionally superior to what came before. This isn't entirely Honor's […]

Even the aging iPhone 11 will feel a little more responsive soon, thanks to improvements in an unsung iOS feature.

We Built ARK Because Our Customer Support Was Spread Across 4 Apps The Problem A few months ago, our small team was drowning. Not in customers (well, a little) — but in tabs. WhatsApp open in one window. Instagram DMs in another. A live chat widget buried in a third. Email in a fourth. Every time a customer reached out, someone had to figure out: which channel did this come from, has anyone replied already, and what was the context of the last conversation? The result was predictable: slower replies, repeated questions to customers, and a support workflow that didn't scale past a handful of conversations a day. Why Existing Tools Didn't Fit We looked at the usual suspects — Intercom, Zendesk, Front. They're solid products, but they're built for large support teams with big budgets and dedicated admins. We needed something simpler: a single inbox, AI doing the repetitive work, and a setup that doesn't take weeks to configure. What We Built ARK pulls every customer conversation — WhatsApp, Instagram, Messenger, email, live chat — into one inbox. On top of that, AI handles three things: Drafting replies based on conversation history and context Summarizing long threads so anyone on the team can jump in without reading 40 messages Routing conversations to the right person automatically based on topic or channel The goal wasn't to replace human support — it was to remove the busywork so the team can focus on actually helping people. Where We Are Now ARK is live with a 7-day free trial (auto-renews after that). We're still early, and we're shaping the roadmap based on real feedback from teams managing support across multiple channels. If you're dealing with the same multichannel chaos we were, I'd love to hear how you're handling it — and what's still missing from the tools you've tried. 🔗 https://byark.ai/

Do you really need a full framework to handle a few API endpoints or webhooks? Laravel and Symfony are excellent tools — for large applications. But when you're building a focused microservice, a webhook receiver, or a lightweight REST API, bootstrapping a full-stack framework means carrying hundreds of files, a massive autoloader, and a dependency tree you'll never fully use. That's the problem webrium/core was built to solve: a minimalist, zero-dependency PHP micro-framework written entirely from scratch, designed to stay out of your way. Installation composer require webrium/core That's it. No configuration files to publish, no service providers to register. The Entry Point Every webrium application starts with the same three lines: <?php require_once __DIR__ . '/vendor/autoload.php' ; use Webrium\App ; use Webrium\Route ; App :: initialize ( __DIR__ ); // ... your routes here App :: run (); App::initialize() sets the root path and loads the global helper functions. App::run() initializes error handling and dispatches the current request through the router. Routing The router supports all standard HTTP methods. Route handlers can be closures, a Controller@method string, or an [Controller::class, 'method'] array. Basic routes: Route :: get ( '/status' , fn () => [ 'status' => 'alive' ]); Route :: post ( '/items' , fn () => [ 'created' => true ]); Route :: put ( '/items/{id}' , fn ( $id ) => [ 'updated' => $id ]); Route :: patch ( '/items/{id}' , fn ( $id ) => [ 'patched' => $id ]); Route :: delete ( '/items/{id}' , fn ( $id ) => [ 'deleted' => $id ]); Route handlers return an array — the framework automatically encodes it as JSON and sends the correct Content-Type header. Dynamic parameters: Route :: get ( '/users/{id}/posts/{postId}' , function ( $id , $postId ) { return [ 'user_id' => $id , 'post_id' => $postId , ]; }); Named routes: Route :: get ( '/users/{id}' , fn ( $id ) => [ 'id' => $id ]) -> name ( 'users.show' ); // Generate the URL elsewhere: $url = rout

Hey developers! I have been working on a side project to help people discover the best AI tools in one place. It is a curated directory designed to be clean, fast, and user-friendly. You can check it out live here: GetNexusAI Tech Stack Used: Next.js / React Tailwind CSS Vercel for hosting Why I Built This: Finding the right AI tool among thousands of options can be overwhelming. I wanted to create a simple dashboard where users can easily filter and find exactly what they need without the clutter. I Need Your Help! Since I just launched it, I would love to get your honest feedback: How is the loading speed and UI/UX? What features should I add next (e.g., user reviews, bookmarking tools)? If you have built an AI tool, let me know so I can feature it! Check the website here: https://getnexusai.tech

Check this out: i run four monetization channels side by side. Sponsored posts, display ads, YouTube ad revenue, and affiliate links. After eighteen months of tracking every dollar in a spreadsheet I built myself, I can tell you with brutal honesty: affiliate income is the only one that scales without me having to constantly produce more content or chase the next brand deal. But the math only works if you pick the right program. Most affiliates I know are promoting garbage with terrible retention, and they have no idea they're burning their audience's trust for a $9 one-time payout. Let me walk you through how I evaluate affiliate programs, what I've learned from running real funnels, and why the AI API category has quietly become the most lucrative vertical for tech creators in 2026. My Monetization Stack After 18 Months of Testing Here's a snapshot of my monthly revenue from a tech newsletter with around 34,000 subscribers and a YouTube channel sitting at 88,000 subscribers: Sponsored posts: $2,100 per placement, but I can only land maybe 2-3 per month without annoying my list Display ads: $1,800 per month from Mediavine, but this number barely moves regardless of how hard I work YouTube ad revenue: $2,400 per month, capped by watch time and RPMs Affiliate income: $6,800 per month, and it grows every single month even when I publish nothing That last number is what got my attention. Affiliate income compounds. When I published a tutorial in February recommending a tool, that single piece of content still earned me $340 in May because users stayed subscribed. No other channel behaves like that. No other channel lets a piece of content from four months ago keep paying you. But here's the catch that took me a while to figure out: not all affiliate programs are built the same way. And the difference between a good program and a bad one can be 10x in lifetime earnings per referred user. # # How I Score an Affiliate Program (The Growth Hacker Scorecard) Before I promote

Simple Intro Your company gets one big cloud bill. It says $30,000. But which team spent it? Which app? Nobody knows. Kubernetes makes this worse because 100 small apps share the same computers. It’s like 10 families sharing one electricity bill. Let’s fix this in 5 easy steps Step 1: Put Nametags on Everything In Kubernetes, you can add "labels" to your apps. Example: team=sales , app=website , owner=pooja If you don’t add name tags, you can never track who spent what. It’s the most important step. Step 2: Check the Big Cost - Computers 70% of your bill is for CPU and RAM. That’s the “brain” and “memory” your apps use. The problem: Most people book a big computer but only use 20% of it. You pay for 100%, use 20%. You waste 80% money. Easy fix: Every month, check “How much did I book vs How much did I use?” Then book smaller next time. Step 3: Don’t Forget Hidden Costs Two things people forget: Storage: Like a hard disk. You deleted the app but forgot to delete the disk. It still charges you every month. Network: Moving data between countries or zones costs money. Check for old disks and big data transfers once a month Step 4: Share the Common Bill Fairly Some costs are for everyone. Like the main Kubernetes system or empty computers waiting for work. How to split it? Easy. If Team A uses 60% of the total computer power, they pay 60% of the common bill. Fair for everyone. Step 5: Use a Tool, Not Excel Doing all this in Excel will make you cry. It’s too much data. Use a tool that does it automatically. It connects to your Kubernetes, reads all the name tags, and tells each team: “You spent $2,340 this week.” Final Tip You can’t save money if you don’t know where it’s going. First, make the costs clear to everyone. Then the savings happen automatically. FAQ - In Simple Words Q1. Why can’t I just see costs in AWS bill? Because AWS only tells you “EC2 cost $10k”. It doesn’t tell you which of your 50 apps used that EC2. Kubernetes hides the details. Q2. What is the first

If you've ever worked on a live game, you've probably watched this happen: an update ships, something feels off, the forums light up, and within an hour the community manager is in the middle of a fire they didn't start and can't immediately put out. And here's the thing most people get wrong about that person's job. "They just post updates, right?" That's the assumption. A game community manager writes patch notes, posts announcements, answers a few questions on Discord, drops the occasional meme, and keeps the social feeds warm. That's the visible 10%. The other 90% is harder, quieter, and almost invisible when it's done well. A community manager sits at a collision point. On one side: players who are frustrated because something broke, a balance change feels unfair, compensation feels insulting, or an update slipped. On the other side: a dev team that's heads-down debugging, prioritizing, and sometimes wrestling with problems that genuinely can't be fixed fast. The community manager has to talk to both sides at once — without sounding cold, defensive, fake, or corporate. That's not a "soft skill." That's translation under pressure, and it's hard. The real role: a two-way translator Strip away the memes and the role is basically two jobs sharing one desk. Job one is outward. Translate the studio to players: acknowledge the actual pain, explain what's known and unknown, hold boundaries without being defensive, and come back with real updates. Job two is inward. Translate players to the studio: take a pile of angry, contradictory, emotional posts and turn them into categorized, prioritized, actionable feedback the team can build from. Most people only ever see job one. Job two — the research half — is usually what decides whether the game actually improves. We'll get to it. Why players hate "we hear you" Players can smell a script instantly. These phrases aren't wrong , but they're hollow: "We hear you." "We value your feedback." "Please be patient." "We apologize f

TL;DR OOMKill is a reporting artifact, not a root cause. By the time the kernel logs the kill event and your alerting pipeline fires, the service already degraded for every user who hit The Alert You See Is Not the Problem You Have OOMKill is a reporting artifact, not a root cause. By the time the kernel logs the kill event and your alerting pipeline fires, the service already degraded for every user who hit it in the preceding minutes. Operators page on the kill. The latency damage is already done. Aspect What Operators Observe What Actually Happens OOMKill event Alert fires; pod is restarted Kill is the kernel's final action after degradation is already complete Silent pressure window No alert fires; no dashboard turns red p99 latency climbs as allocator contention serializes parallel work Incident attribution Logged as "OOM, increased limit"; latency spike blamed on network or dependency Root cause (limit headroom erosion) goes unaddressed; pattern repeats Limit headroom over time No automated signal warns of erosion Gap between working set and limit shrinks as traffic grows or data shapes shift Recommended alert threshold Triggered at kill event Trigger at 80% headroom consumption before kernel involvement The mechanism works like this. Kubernetes memory limits define a hard ceiling enforced by the Linux kernel's cgroup subsystem. When a container's resident set size approaches that ceiling, the kernel does not wait. It begins refusing new memory allocations. Silent pressure window The application's allocator blocks, retries, or falls back to slower paths. Garbage collectors in JVM and Go runtimes trigger earlier and more aggressively because the heap has no room to grow. Each of these responses adds latency to in-flight requests before a single OOMKill event appears in your logs. The kill is the kernel's final action after the application has already been running degraded. Silent pressure window. The interval between first memory pressure and pod termination is

Introduction It's crazy to me that some GitHub repos, that were just created in the last...

Have you ever felt that browsing the web has become "tiring"? We open a browser, search, close a page, then move to another... a dizzying cycle of distracted navigation between sites, while we are essentially looking for "knowledge," not "links." I asked myself: What if browsing was as fluid as scrolling through Facebook, but with the power and accuracy of search engines like Google? I finally decided to turn this idea into reality through my new project, Arabinum. What does Arabinum do? Turning websites into posts: The browser reformats the web so that content appears as fluid feeds, eliminating visual distraction. Smart categorization: No more getting lost; I have divided content into specialized sections like "Videos" and "Research Papers," so you can find what you need in one place. Browsing as a social activity: I added interactive features (Like, Comment, Repost) to make content consumption a collaborative experience rather than a rigid, individual process. I believe the web needs an interface that restores the user's focus, and this project is my attempt to merge the best of the worlds of "Search" and "Social Media." Notes: This is a beta version I launched just to see your thoughts on the idea. This version might not be compatible with small screens yet. This version includes Google Search, YouTube, and scientific papers from arXiv. I look forward to hearing your opinions. The site is free and ad-free, but I need your support to continue due to API and domain costs. I am sixteen years old and a high school student. Finally, I present to you my browser, Arabinum: https://arabinum.amrzlabs.com