标签：#ev

I run 75 scrapers in production. Three of them do any fingerprint spoofing. Maybe five use residential proxies. The rest run on plain datacenter IPs or no proxy at all, and they have been running for months. If you learned scraping from blog posts, that number probably sounds wrong to you. Every tutorial you have read starts the same way: sign up for a residential pool, install a stealth browser, randomize your fingerprint, throttle like a human. Then, on step five, you finally get to look at the actual website. That order is backwards, and it is backwards on purpose. Proxy companies write most of the scraping content on the internet. They were never going to write "you probably do not need us." The scraper with the $80 a month costume Last month my guy sent me his Greenhouse job board scraper to fix. It had everything. Puppeteer with the stealth plugin. Rotating residential proxies. Randomized mouse movements between actions. Human-like typing delays. It still kept dying. So I did the thing nobody had done: opened the page in a normal browser with devtools up. The entire job list was sitting in one XHR request to a public JSON endpoint. No auth. No cookies. A rate limit so loose I never managed to hit it. I deleted basically his entire codebase and replaced it with a fetch call. It has not broken since. He had been paying for proxies for months to hit an endpoint that does not care who you are. This was not a rare lucky case. This is most cases. The 20 minute method What I do on every new target, before writing a single line of code: Open the network tab, filter to XHR/fetch. Reload the page. Click around. Paginate. Search. Find the request that returns the actual data. It is usually JSON and usually obvious. Right click, copy as cURL. Paste it in a terminal and start deleting headers one at a time. Rerun after each delete. Whatever survives step five is your scraper. Most of the time the answer is a user agent header and nothing else. Sometimes a referer. Occasion

Here's the problem. Every AI coding agent (Cursor, Codex, Claude Code, whatever) is trained on millions of websites. Most of those websites are average. So when you prompt "build me a landing page," the model gives you the average of everything it's seen: a centered hero, a purple gradient, three equal feature cards, Inter font, ease-in-out , done. It's not broken. It's just mediocre by default. I'm 17 and I got tired of fighting this in every conversation. So I built VibeCurb : a collection of strict constraint skill files, that force AI agents to actually think about design before they touch code. How it works Every skill follows the same four-phase pipeline: Design Read - The agent reads your reference image, existing codebase, or brief and extracts design signals: typography, palette, layout, focal element, spacing. No code is written here. Quality Gate - The extraction has to pass before the agent is allowed to generate anything. It must prove it understands the design direction, not just spit out defaults. Precise Build - Code generation happens against the extraction, not against the model's built-in idea of what a "website" looks like. Each skill has its own build sequence. Visual Diff - The output is checked against the reference using PASS/FAIL tables across composition, typography, color, motion, and responsiveness. If it drifts, it gets caught. There's also an inline drift rejection layer. It catches known AI defaults (CSS keyword easings like ease-in-out , AI-purple #7c3aed gradients, generic glassmorphic cards, placeholder Lorem ipsum content) and flags them before they make it into the output. The skills Each skill constrains a specific problem space: awwwards-hero - Hero sections only. Six documented architectures (Cinematic Center, Editorial Split, etc.) with implementation blueprints. The agent picks one and commits. awwwards-sections - Pricing tables, bento grids, feature highlights, footers. Same pipeline, different element constraints. awwwards-

A VPN might compromise your Android Auto experience at first, but there are some easy workarounds.

An AI coding agent isn't autocomplete. It runs shell commands, reads your files, installs packages, and opens things you never pointed it at. That's the whole reason to have one. It's also why I don't start projects the way I used to. Nothing dramatic happened to me, by the way. I'm not writing this from the wreckage of a dropped production table. I'm writing it because I spent an afternoon going through what could plausibly go wrong, expecting a long list of hard problems, and instead found that most of it is handled by about ten minutes of config nobody mentions on day one. So here's the ten minutes. Prose isn't protection This is the bit that took me embarrassingly long to get. You can tell an agent things two ways. A rule is prose it reads and weighs - good for judgement calls like naming, style, when to stop and ask. A ban is a config entry that makes something impossible. The trap is using the first for the second job. Writing "never force-push" into a CLAUDE.md feels like a control. It isn't. It's a request sitting in a context window next to a few thousand other tokens, competing with whatever you actually asked for. It'll usually win. Usually is fine for naming conventions. It's not fine for git push --force . 1. The deny list .claude/settings.json : { "permissions" : { "deny" : [ "Bash(rm -rf:*)" , "Bash(git push --force:*)" , "Bash(git push -f:*)" , "Bash(git reset --hard:*)" , "Bash(psql*production*)" , "Bash(*DROP DATABASE*)" , "Bash(*DROP TABLE*)" , "Bash(*TRUNCATE*)" , "Read(./.env)" , "Read(./.env.local)" , "Read(./.env.*.local)" ] } } These don't run. Not "the agent is discouraged" - they don't run, including in the scenario the list exists for, which is you at midnight approving a plan you skimmed. Two things to know before you test it. It takes effect from the next session, not immediately. So you write the file, try the blocked command in the same session, watch it go through, and conclude the whole feature is broken. Restart first. Keep the .env

TL;DR: Grafana Agent reached End-of-Life on November 1, 2025 and has been replaced by Grafana Alloy. Alloy consolidates Agent's Static mode, Flow mode, and Kubernetes Operator into a single collector built on the OpenTelemetry Collector while maintaining native support for Prometheus and Loki. If you're using Flow mode, migration is relatively straightforward. If you're using Static mode, the migration process will involve reviewing and testing the converted configuration. Before switching over, verify relabeling rules, recheck resource usage, and confirm that Prometheus and Loki are receiving the same data and labels as before. If you're still running Promtail, it's worth migrating both to Alloy at the same time since Promtail is also End-of-Life. If you deployed Grafana Agent a couple of years ago, there's a good chance you haven't thought about it since. It quietly collects metrics, ships logs, and generally stays out of the way. What you may not realize is that Grafana Agent reached End-of-Life on November 1, 2025. That includes Static mode, Flow mode, and the Kubernetes Operator. Grafana Labs has stopped creating bug fixes, security patches, and official support. If you're still running it, your collection layer is probably still performing normally, but is now unsupported. That doesn't necessarily mean it will stop working tomorrow, plenty of unsupported software continues running for years. It does mean you're taking on the risk yourself, especially as the rest of your monitoring stack continues to evolve. This article covers why Grafana Labs replaced Agent with Alloy, what actually changes during the migration, and where people tend to run into problems. Why Grafana Agent was deprecated One of the biggest issues with Grafana Agent is that it was essentially three agents, not one product: Static mode, which used YAML and looked similar to Prometheus. Flow mode, which introduced a component-based configuration using River. The Kubernetes Operator, which manage

If you've ever needed to let a third-party service talk to your local dev environment, you've probably reached for ngrok. I've been moving some of that over to Tailscale Funnel instead — here's what works, what broke, and how it stacks up against Cloudflare Tunnel. Key takeaways Tailscale Funnel exposes a local dev server to the public internet, similar to ngrok or Cloudflare Tunnel — useful for testing webhooks, payment callbacks, or anything a third party needs to reach on your machine. It's free for solo/small use, with no device limit on the Personal plan (up to 6 users). tailscale serve is tailnet-private; tailscale funnel is what actually makes something public — easy to mix up. Getting it working behind Caddy + Symfony in Docker means fixing two separate redirect loops (one from Symfony, one from Caddy's own auto-HTTPS) and explicitly telling Symfony to trust the proxy. The one real trade-off versus Cloudflare Tunnel: no custom domain with a valid cert — you're stuck with the ts.net hostname unless you accept a browser cert warning. This isn't a "ngrok / local tunnel / Cloudflare tunnel is bad" post. It's a "here's another tool that does the same job, and here's exactly what broke when I set it up" post. Why bother? A few reasons I looked at Tailscale instead of just defaulting to ngrok again: Stable hostname. ngrok's free tier gives you a random URL that changes every time you restart it. Tailscale Funnel gives you a fixed hostname tied to your machine ( your-machine.your-tailnet.ts.net ) that doesn't change. Genuinely free for solo/small use. Tailscale's free Personal plan covers up to 6 users with no device limit at all — plenty for a solo dev juggling a laptop, a desktop, and a couple of test machines. No "3 device" ceiling to bump into. Already in my toolchain. I use Tailscale for other things, so there's no new account, no new pricing tier to think about. Automatic HTTPS. Tailscale handles certificate provisioning for you — no separate cert step. The tr

TL;DR MCP servers are powerful, but they can provide access to production systems if...

Hey all, as part of our expanding challenge program we want to update and clarify some challenge...

This affordable, portable projector doesn’t try to be a cinematic marvel, but it’s fun to use.

Wiremodal is a framework-agnostic modal package for Laravel, which allows to handle modals, so you don't have co configure them in all your projects. It ships a few Livewire-side helpers that make exactly this pleasant. This post is the Livewire integration end to end: opening and closing from PHP, delivering a payload on open, the one trap to avoid, and the optional form panel for when a modal happens to be a form. How to install Pull the package in and get the assets onto the page. composer require edulazaro/wiremodal php artisan vendor:publish --tag = wiremodal-assets The service provider auto-registers and there is no config file. Point your layout at the published files: <link rel="stylesheet" href="{{ asset('vendor/wiremodal/css/wiremodal.css') }}"> <script src="{{ asset('vendor/wiremodal/js/wiremodal.js') }}" defer></script> If you bundle with Vite, skip the publish and import straight from the vendor directory instead, so a package update flows through without re-publishing anything: /* resources/css/app.css */ @import "../../vendor/edulazaro/wiremodal/resources/css/wiremodal.css" ; // resources/js/app.js import ' ../../vendor/edulazaro/wiremodal/resources/js/wiremodal.js ' ; Opening and closing from Livewire Define the modal once with the <x-wiremodal> component, give it a name , and fill the body and footer slots. Here is a delete confirmation: <x-wiremodal name="confirm-delete" title="Delete record?" size="sm"> <x-slot:body> <p>This action cannot be undone.</p> </x-slot:body> <x-slot:footer> <button type="button" data-wm-dismiss>Cancel</button> <button type="button" wire:click="destroy">Delete</button> </x-slot:footer> </x-wiremodal> The Cancel button carries data-wm-dismiss , and any element with that attribute closes the modal it sits in, so you never write a cancel handler. To open and close from the component itself, use the macros the package registers on every Livewire component: public function confirmDelete (): void { $this -> openModal ( 'confirm

A visitor lands on a website and immediately sees prices in the wrong currency, content written for another region, and shipping information that does not apply to them. Nothing is technically broken, yet the experience feels poorly designed. For international websites, location can be a useful personalization signal. Instead of asking every visitor to manually select a country before displaying relevant information, developers can use IP based geographic data as an initial indication of where a request originates. That is where ip geolocation for content personalisation can become useful. The objective is not to identify a person. It is to make an otherwise anonymous visit more contextually relevant. How can location improve content personalisation? Location can influence many small decisions that collectively affect the user experience. An ecommerce website may display a local currency. A news publisher may surface regional stories. A software company may show country specific documentation or availability information. The process is relatively simple. A visitor sends a request to a website. The server obtains the request's public IP address. That IP is sent to a geolocation service. The response provides geographic information. The application then selects content according to predefined rules. The crucial part is the final step. Geolocation provides data, but business logic determines what the visitor actually sees. Which approaches can websites use? One approach is manual location selection. The user chooses their country or region from a menu. This is transparent and usually accurate because the user explicitly provides the information. However, it adds friction and may be forgotten during future visits. Browser based location is another option. It can provide more precise positioning, but it normally requires permission and is not always appropriate for simple content personalization. IP based geolocation sits between these approaches. It requires no location

Sites that start from a stock theme tend to look like it. This one did too — until recently it was the default PaperMod screen. The editorial homepage and unified article styling you're looking at came out of a single day of customization. This guide is that work written down, with the code. One principle drove all of it: never fork the theme. The theme stays a submodule and keeps receiving updates; you win with site-level files only. Hugo resolves same-path site files ahead of theme files, which makes this possible. The entire customization of this site is a handful of files: layouts/index.html ← full homepage replacement data/home/ko.yaml, en.yaml ← homepage copy (per language) assets/css/extended/home.css ← homepage styles assets/css/extended/custom.css ← unifying every other page The starting point is a Hugo site with PaperMod as a submodule, deployed to GitHub Pages. Basic installation is well covered by the PaperMod wiki , so I'll skip it. 1. Replace the homepage wholesale Create a single layouts/index.html and the homepage is yours. The theme's home template stays untouched. The key move: don't hardcode copy into the markup — pull it from data files. On a bilingual site, one template then serves both languages: {{- $copy := index .Site.Data.home .Site.Language.Lang -}} {{- $posts := first 4 (where .Site.RegularPages.ByDate.Reverse "Section" "blog") -}} <section class= "editorial-hero" > <p class= "editorial-eyebrow" > {{ $copy.hero.eyebrow }} </p> <h1> {{ range $i, $line := $copy.hero.titleLines }}{{ if $i }} <br> {{ end }}{{ $line }}{{ end }} </h1> <p class= "editorial-intro" > {{ $copy.hero.intro }} </p> </section> data/home/en.yaml holds nothing but words: hero : eyebrow : " IDEAS · PRODUCTS · OPPORTUNITIES" titleLines : - " Where ideas become products," - " and products become new opportunities." Copy edits stop requiring template changes, and adding a language is one more yaml file. Latest posts are pulled dynamically as above — handle the {{ else }} emp

A demo Andrej Karpathy posted over the weekend stuck with me. He gave Opus 5 a million-token context and the first paragraph of The Lord of the Rings, and asked for a procedural 3D rendering of the scene in Three.js. The model worked alone for about two hours, wrote 5,500 lines, and coordinated polygon placement, camera paths, and animation on its own. Total cost: about $10. The result is faster to watch than to describe. Most reactions read it as the next step past "draw a pelican SVG" benchmarks. Something else looked bigger to me. What changed isn't the model's artistry. It's the unit of delegation. The unit of delegation changed Until now, the work we handed agents came in prompt-sized pieces. One function, one bug, one file. Anything bigger, we decomposed ourselves. The reason was simple: with a small context, the early parts of a long job slide out of view, and coherence goes with them. A million tokens erases that premise. Everything the model wrote and tried across a two-hour session stays in view. When the desk is big enough, there is no reason to hand work over in slices. Delegation moves from the task to the session. That is the difference between a function call and a work session. The first, we decompose and supervise. The second, we hand over material and intent, and receive a result. Karpathy's entire contribution was picking the paragraph and watching the output two hours later. Where the builder's work moves When execution costs $10 and two hours, execution is no longer the bottleneck. Two things remain. On the way in: the brief. What goes into the context. Karpathy's input was one paragraph, but choosing it was the design act. Translated to our work, it becomes choosing which spec, brand guide, reference, or codebase goes in whole — and what stays out. On the way out: judgment. By what standard do you accept the result? Reviewing 5,500 lines one by one doesn't match session-sized delegation. Instead, you define "done" before the run, then judge the

Graphical tools are great, but most of my daily development now happens in the terminal. A good CLI tool saves time, integrates with automation, and keeps my workflow consistent across local development and CI/CD. Here are the 10 CLI tools I use the most. Apidog CLI If you're working with APIs, this is the tool I've found myself using the most. I use it to run API test scenarios, manage environments, and reuse the same tests in GitHub Actions instead of maintaining separate GUI workflows. Git Still the foundation of every development workflow. Docker CLI The fastest way to spin up local services and reproduce production environments. GitHub CLI Creating pull requests, reviewing issues, and managing repositories without leaving the terminal is a huge productivity boost. HTTPie Perfect for quick API requests when debugging or exploring endpoints. jq If you work with JSON every day, jq is almost indispensable. ripgrep (rg) Lightning-fast code searching. Once you start using it, it's hard to go back. fd A simpler and faster replacement for the traditional find command. kubectl Essential for anyone deploying applications to Kubernetes. just A lightweight task runner that helps automate repetitive development commands. Final Thoughts The biggest improvement to my workflow has been moving repetitive tasks into the terminal. API testing, deployments, version control, and automation all become easier when everything is scriptable. Among these tools, Apidog CLI has had the biggest impact because it lets me keep API testing in the same terminal-first workflow that I already use for development and CI/CD. What CLI tool couldn't you live without?

Introduction In June 2026, the IETF published RFC 10008 - the first new general-purpose HTTP method since PATCH was introduced in 2010. The method is called QUERY . In simple terms: QUERY = Safety of GET + Body of POST You can now send complex search/filter queries in the request body, while the server knows the operation is safe and idempotent . This means caching, automatic retries, and CDNs can all work properly. This single change can finally end the long-standing practice of using POST for search. The Problem We Had 1. Limitations of GET With GET, query parameters go in the URL: GET /products?category=electronics&price_min=1000&price_max=50000&brand=samsung,apple&sort=-rating&page=1&limit=20 When filters become complex (JSON filters, nested conditions, many tags), the URL easily exceeds 8,000 characters. Many servers, proxies, and browsers struggle with this. URLs also get logged, bookmarked, and shared — which is often undesirable. 2. Problems with POST So many developers started using POST for search: POST /products/search Content-Type: application/json { "filters": { "category": "electronics", "price": { "min": 1000, "max": 50000 }, "brands": ["samsung", "apple"] }, "sort": "-rating", "page": 1, "limit": 20 } But POST is not safe and not idempotent . That means: Caches and CDNs cannot safely cache the response Automatic retries after network failures are risky The server may treat it as a state-changing operation We have been pretending that a read operation is a write operation for years. What is the QUERY Method? According to RFC 10008: A QUERY requests that the request target process the enclosed content in a safe and idempotent manner and then respond with the result of that processing. In plain English: You send the query in the request body (like POST) The server processes it and returns the result It does not change any server state (like GET) Sending the same request multiple times produces the same result (idempotent) Comparison Table Property GET Q

Microsoft and Uno Platform have released the first stable versions in the SkiaSharp 4 series, beginning with SkiaSharp 4.148.0 and followed shortly afterward by 4.150.0. A 4.151.0 prerelease line is also available, demonstrating the project’s new approach of aligning package versions and release cadence with upstream Skia milestones. By Edin Kapić

Wispr Flow, a popular dictation tool, has released a live notetaker that transcribes and summarizes meetings. It joins a growing wave of AI notetakers for the workplace.

Do you ever get that feeling when you’re working on a task, hit a wall with some problem, and something inside you whispers that there has to be a solution? When it seems like all is lost, like you’ve run into a fundamental limit of reality, but your refusal to accept it keeps driving you deeper into spec docs, 10-year-old GitHub threads, and articles from giants who’ve already blazed this trail and shared their findings? And then, after hours of intense brain-grinding, you add that final line of code, refresh the page, and there it is — the exact result you wanted, staring back at you from the screen? That rush of success is probably familiar to every engineer in some form or another. In those moments, I always want to share the win with my colleagues and, if it could help others, write an article about it. In this post, I’ve collected 3 such cases from our work where we came up with solutions that, as far as I know, are pretty unique and haven’t been fully documented before. I invite you to share in the joy of discovering a solution that seemed impossible! Fixed inside a Scroll Container For a warm-up, let’s take an easier task. One of my most popular CodePens is an example of a fixed block inside a scrolling container. People find it via Stack Overflow answers, so it’s an in-demand problem, so it might come in handy for you too. I’ve been working on an Angular component library called Taiga UI for many years. Everything I’ll talk about in this article comes from there, but that’s just the backstory. We won’t need Angular or any of its specifics here. We’re talking pure CSS. Our library uses a custom scrollbar. While modern browsers let you tweak its appearance a bit , for full control over behavior and visuals, we need to place our own elements inside the container to act as the scrollbar. But how do you do that when absolutely positioned elements fly to the top on scroll, and fixed-position ones are pinned to the viewport? Experienced devs will immediately think

Last month I watched a teammate paste a stack trace into a hosted AI assistant. The trace contained an internal hostname, a database connection string, and a customer email. None of it was secret enough to trip a DLP rule, but all of it left our network through an endpoint nobody had audited. The failure wasn't the tool — it was that we had never written down which data classes are allowed to reach which inference endpoint , and we had no test that would fail when the boundary was crossed. This article builds that boundary as a reproducible fixture: a data-classification decision matrix, a canary-leak test you can run against any hosted or self-hosted model endpoint, and a prevent/detect/recover table. The fixture works whether your endpoint is a cloud API, a free hosted tier, or a GPU box under your desk. The invariant I1: A prompt containing data of classification level L may only egress to an endpoint whose trust level is explicitly approved for L . Everything below exists to make I1 testable in CI rather than aspirational in a wiki. Step 1: Write the decision matrix before touching any tool Data class Examples Free hosted model tier Self-hosted / VPC endpoint C0 – Public OSS code, docs, public CVEs ✅ Allowed ✅ Allowed C1 – Internal-generic Boilerplate, config shapes, anonymized traces ✅ Allowed with review ✅ Allowed C2 – Internal-sensitive Real hostnames, schemas, ticket content ❌ Not without a signed DPA + retention terms you've actually read ✅ Preferred C3 – Regulated/secrets Credentials, PII, customer data, keys ❌ Never ⚠️ Only with controls (see below) Two rules make this matrix enforceable: Default deny. If a data class isn't in the matrix, it's C3 until someone argues it down in writing. The matrix is code. Keep it as a YAML file in the repo so the fixture in Step 2 can assert against it. Free hosted tiers are genuinely useful for C0/C1 work — evaluating a framework, writing throwaway scripts, reproducing a public bug. That is where something like MonkeyCo

The GPT-6 news is doing the rounds and the framing is everywhere: prompt engineering is dead, the future is hierarchical memory and autonomous agent swarms. I mostly agree with the framing, but almost every take I've seen treats it as an AI story. It's not. For anyone who actually runs infrastructure, it's an operations story, and it's a slightly alarming one. Let me explain what changes on the ground, because the interesting part isn't the model, it's what a swarm of these things does to your cloud account. The part everyone got right: prompt engineering was always a workaround Prompt engineering was never a discipline. It was a coping mechanism for models that forgot everything between turns and couldn't reliably use tools. We wrote elaborate prompts because we had to hand-carry all the context in, every single time. Calling it "engineering" flattered it. So "the era of prompt engineering is over" is true, but for an unglamorous reason: the crutch is being removed. Hierarchical memory means the model retains structured state across sessions, it remembers your environment instead of being re-briefed on it hourly. When the model holds the context, the prompt shrinks to intent. That shift is real and it's been coming all year; every major cloud shipped managed agent memory in 2026. GPT-6 is a milestone on that curve, not a lightning bolt. The skill that replaces prompt engineering isn't a better prompt. It's context engineering , deciding what goes into that hierarchical memory, what's authoritative, what's stale, who's allowed to write to it. That's a data-governance problem wearing an AI hat, and infra teams are better positioned for it than prompt tinkerers ever were. The part that should worry you: swarms multiply your blast radius Here's where the ops reality diverges hard from the AI hype. "Autonomous agent swarms" sounds like a productivity feature. From an infrastructure-safety standpoint, it's a blast-radius multiplier , and I don't think that's priced into