标签：#ev

You published a DMARC record months ago. Every checker says it's valid. No reports have ever arrived, and at some point you stopped thinking about it and quietly concluded nobody's forging your domain. You don't know that. You just can't see. Two causes account for almost all of it, and both leave the DMARC record itself looking perfect. 1. Your reporting address never agreed to receive them This is in the spec and almost nobody knows about it. If your rua= address is on a different organisational domain from the domain publishing the record, RFC 7489 section 7.1 requires the destination to explicitly consent. The reason is obvious once you see it: otherwise anyone could point rua= at your mailbox and use the world's mail infrastructure as a free DDoS. Consent is a DNS record, published by the receiving domain: <your-domain>._report._dmarc.<their-domain>. TXT "v=DMARC1" So if example.com sends reports to dmarc@reports.vendor.com , then vendor.com has to publish: example.com._report._dmarc.reports.vendor.com. TXT "v=DMARC1" Without it, conforming reporters send nothing at all. That includes Google, which is most of your report volume. You can watch this working in production. PayPal sends aggregate reports to a third party, and the authorisation record exists: paypal.com._report._dmarc.rua.agari.com. TXT "v=DMARC1;" The practical consequence: not a Gmail address You cannot put a Gmail address in rua= . Google is not going to publish yourdomain.com._report._dmarc.gmail.com on your behalf, and you can't create records in their zone. Same for Outlook, Yahoo, or any address at a domain you don't control. This is a common first move — publish DMARC, point reports at your personal inbox, wait. Nothing arrives, and nothing is wrong with the record. If you use a commercial DMARC service they normally publish these records during onboarding, often via a wildcard. If reports never start after you sign up, check this before anything else. When it doesn't apply: reporting to you

There's a failure mode in SPF that produces no error anywhere you'd think to look. Your record is syntactically valid. dig returns it. Your DNS provider is happy. Your own test mail arrives fine. And yet some of your mail is failing authentication at the receiver, and nothing in your infrastructure will tell you. The cause is usually that you've gone past ten DNS lookups. Ten is a hard ceiling, not a guideline RFC 7208 section 4.6.4 requires evaluators to cap DNS-querying terms at ten. Go past it and the result is PermError — a permanent failure. The important part: receivers don't degrade gracefully. They don't evaluate the first ten and shrug at the rest. They treat the entire record as unusable. You go from "SPF configured" to "SPF absent" in one step, and the only place that's visible is in DMARC aggregate reports, which most people aren't reading yet. Six terms cost a lookup. Four are free. Costs a lookup Free include: ip4: a ip6: mx all ptr exp= exists: redirect= The count isn't yours to control This is what catches people out. The limit applies to the whole resolution tree, not just your record. You publish four includes. One of those vendors publishes six includes of their own. You're at eleven, and your record lists four things. Nothing changed on your side. A vendor updated their record and broke yours. There is no notification for this, from anyone, ever. Counting it by hand You can walk the tree with dig if you want to see it directly: dig +short TXT example.com | grep spf1 Then for every include: you find, recurse: dig +short TXT _spf.vendor.com | grep spf1 Keep going until you bottom out, counting every include: , a , mx , ptr , exists: and redirect= along the way. It's tedious but instructive — you'll usually find one vendor accounting for half your budget. Three traps that make tools lie to you Doing this by hand or with a naive script, there are three places to go wrong. I've seen all three produce confidently incorrect output. 1. redirect= uses = ,

Every portfolio site has the same problem: it's static. A grid of projects, a bio, a contact form — nothing on the page ever changes, which means nothing on the page proves you can work with live data. Recruiters and reviewers skim past it because there's nothing to skim. The fastest fix isn't building your own API — it's embedding someone else's, and picking one that's actually interesting to look at. Here's how to drop a live, auto-updating tech news feed into any site with a single script tag, using NewTqnia , a bilingual (English/Arabic) tech newsroom with a free embeddable widget. Why this is a good portfolio move, not just decoration A static "About Me" page tells someone you can write HTML. A page with a live-updating feed tells them you can integrate a third-party service, handle async content, and think about internationalization (this one supports English and Arabic out of the box) — all real, hireable skills, for the cost of one script tag. Step 1: Build your embed Go to newtqnia.com/en/widget . It's a live configurator, not a docs page — every option you touch updates a preview instantly: Content: custom heading, number of articles, language (English or Arabic), category filter (Artificial Intelligence, Robotics, Space, Health, and others), and ordering (latest first or most popular) Appearance: card / list / compact layout, horizontal or vertical orientation, light / dark / automatic theme, accent color, and toggles for images and summaries Pick settings that match your site — a compact, dark-themed, "Artificial Intelligence"-filtered list looks noticeably more intentional than the default. Step 2: Copy the generated snippet Once you're happy with the preview, the page generates a ready-to-paste embed code block for you — copy it as-is. It'll look roughly like a single <script> tag referencing your chosen configuration, something like: <script src= "https://newtqnia.com/embed/widget.js" data-lang= "en" data-category= "artificial-intelligence" data-count

Originally published at wostal.eu . TL;DR : I handed a CI re-platform — GitHub Actions → Argo Workflows, GitHub → Codeberg — to an AI agent. The rewrite looked correct and passed lint, but it didn't account for one thing: the runtime environment had changed completely. The old runner was an external VM; the new one is a pod inside the cluster, where Tailscale IPs aren't routable. Nobody ran the pipeline end-to-end, so every difference stayed as a landmine — six of them. The worst part wasn't the AI's mistake. It was that I spent hours blaming the network when the real culprit was a single missing newline in an SSH key. This is the companion to a different incident. While I was migrating my homelab k3s control plane from SQLite to etcd , the pipeline that ran that migration turned out to be broken in ways that taught me more than the migration itself. In this post I'll cover: Where the mess came from — an AI-assisted CI re-platform that nobody validated end-to-end The phantom CNI bug — hours of chasing MTU, Tailscale, firewall, and conntrack The real culprit — a single missing newline in an SSH key Why early failures hide later ones — six latent bugs, surfaced one at a time The lesson about delegating migrations — to a human or an AI Where the mess came from The entire CI had just been migrated from GitHub Actions to Argo Workflows , and from GitHub to Codeberg — and that migration was handed to an AI agent 🙂. The re-platforming rewrote the logic roughly 1:1, but it didn't catch that the runtime environment had changed fundamentally . The old runner (GitHub Actions / ARC) behaved one way; the new one is a pod in the cluster — from which Tailscale IPs aren't routable, but private IPs are. Nobody (human or AI) ran the pipeline end-to-end, so all of those differences stayed as landmines. That's why there were six latent bugs and the hang I'm about to describe — not random faults, but traces of a GHA→Argo translation that was never validated in the new environment. The p

This is a submission for Frontend Challenge - Comfort Food Edition, CSS Art. Inspiration For me comfort food has never really been about the plate. It's about who's sitting around it. I grew up in Pakistan, and the memory that comes back first is everyone crowded around the dastarkhwan over a steaming handi of chicken biryani. Someone always grabs the serving spoon before anyone else. Someone asks for more raita. The jalebis are gone before the meal even properly starts, and there's a glass of chilled lassi at every place. So I didn't want to draw a dish. I wanted to draw that — the small ritual of the first plate being served — using only HTML and CSS. Demo Live Demo : https://waasilaasif.github.io/Dastarkhwan/ Source Code : https://github.com/WaasilaAsif/Dastarkhwan Journey This went well past drawing static shapes. The centerpiece is a brass handi overflowing with biryani, framed by the usual suspects: raita, jalebis, lassi, an empty plate, and the serving spoon resting beside the pot. All of it is HTML and CSS — gradients, layered pseudo-elements, border-radius pushed to its limits, CSS-only shadows, and a fairly stubborn amount of keyframe choreography. The animation was the part I actually cared about. I didn't want things to just move. I wanted a sequence. A hand comes in, picks up the spoon, scoops from the handi, serves onto the plate, adds a spoonful of raita, sets the spoon back down, and the whole table settles into its idle state before the loop starts again. Getting the food recognizable was harder than getting it to look nice. Making a lump of gradients read as "that's a chicken leg" or "that's clearly biryani and not just yellow rice" took a lot more fiddling than the playful final result suggests. Like a lot of people in this challenge, I used AI in the process — I worked with Claude to iterate on the harder animation timing. It's a tool in the workflow, not a shortcut past the thinking. What stuck with me is that CSS can carry a story, not just sty

🚀 Ported Example Benchmark Suite Live on blocsignal.dev ! If you’ve been evaluating BlocSignal —the monorepo package bridging the predictable event-driven BLoC architecture with Rody Davis's reactive signals v7 primitives—we’ve got something big to share. We just launched a dedicated Ported Example Suite containing 16 full-featured, runnable benchmark applications adapted directly from the official felangel/bloc (10 apps) and rodydavis/signals.dart (6 apps) example repositories. 🌐 Explore the Live Benchmark Suite : https://blocsignal.dev/ported-examples 💡 Why Port These Benchmark Apps? State management benchmarks are best understood through real-world applications. By porting these established examples 1-to-1, developers can compare BlocSignal side-by-side with original implementations to see concrete architectural benefits: 1. Synchronous Frame Updates (Better Test DX) In classic BLoC, state updates propagate asynchronously over microtask streams. In BlocSignal , emit() updates state synchronously on the exact same frame . This eliminates microtask queue latency, making widget building feel instant and allowing unit tests to assert expect(bloc.stateValue, ...) without pumpAndSettle or stream delays. 2. Reactive computed() Derivations (Zero Event Plumbing) In complex apps like Todos or Dynamic Forms , classic BLoC often requires dispatching intermediate filter events or wiring up CombineLatestStream . With BlocSignal , you declare late final ReadonlySignal<List<Todo>> filteredTodos = computed(...) right inside the constructor. When state changes, downstream signals derive updated values reactively and lazily. 3. Streamless Event Concurrency Transformers (Lower Overhead) Event concurrency transformers ( sequential() , droppable() , restartable() ) in BlocSignal are implemented as streamless higher-order functions using pure Dart Mutex locks. You get full request-cancellation and debouncing capabilities (e.g. in GitHub Search ) with zero RxStream memory allocations .

A few months ago I got frustrated. I needed to compress a PDF quickly. Found a tool online — it asked me to create an account first. Found another — it had so many ads the actual button was invisible. Found a third — it uploaded my file to their servers and I had no idea what happened to it after. I thought: this shouldn't be this hard. So I built EazyStudio — a suite of 80+ browser-based tools where everything runs 100% in your browser, no signup, no intrusive ads, no files ever leaving your device. What's inside Here's a snapshot of what's available: PDF tools Compress, merge, split, rotate PDFs PDF to Word, Excel, JPG and back Add watermarks, protect with passwords Image tools Background remover (runs locally in browser) Image compressor, resizer, converter AI image upscaler Color palette extractor, color picker Developer utilities JSON formatter/validator Base64 encode/decode URL encoder, HTML entity converter Regex tester JWT decoder API tester (Postman-lite) CSS gradient generator, box shadow generator Finance & math EMI calculator, SIP calculator GST calculator, compound interest, tip splitter Unit converters (length, weight, temperature, data) And more QR code generator Password generator Text tools (word counter, case converter, lorem ipsum) Device preview tool The technical approach: browser-first The biggest design decision was: nothing gets uploaded to a server. For PDF operations I use PDF.js and pdf-lib running in the browser. For image tools it's canvas + WebAssembly (WASM) modules. For background removal I'm using a WASM-based segmentation model that loads client-side. This has three benefits: Speed — no upload round-trip, works on large files instantly Privacy — your files never touch my server Cost — zero storage, zero egress bandwidth The downside: WASM modules add initial load time. I worked around this with lazy-loading — the WASM only loads when you first use that specific tool. What I learned building this 1. People hate signups more than I ex

Most of the engineers consider documentation as an after-thought; a README on a finished system written in the final 20 minutes before a PR gets merged. That's the wrong way to do this relationship. Documentation is not a description of architecture. It is part of the architecture, and marking it as separate is the cause of so many rotting systems, which still pass all tests. The compiler doesn't care, your team does It could be a consistent codebase and yet it be undocumented garbage from the point of view of anybody who didn't write it. Only one sort of correctness is enforced by the compiler (or interpreter): does this code perform the operation that the instructions say it performs. It doesn't weigh in on why a specific table contains a deleted_at column, versus a hard delete, or why a service tries 3 times with exponential back-off, versus 5 times with a fixed interval. Those decisions include constraints that are not apparent in the diff, regulatory, historical, or performance. If these are only in the mind of the programmer who wrote them, the actual architecture is partially undocumented, and these constraints will be breached as soon as someone else messes with the code when it is under a tight deadline. Architecture is not only the shape of your services and schemas, it's the set of decisions and constraints that shape stayed within. Undocumented constraints are like walls that we don't see, or know about. They are walked through without anyone knowing they exist, and one of the assumed conditions is broken at a time. Documentation as a design artifact, not a report Good documentation should be done prior to and/or in the midst of implementation, not after. When writing a design doc that explicitly states the problem, the options you considered, the one you selected, and the tradeoffs you made, you are actually doing real design work, you are making mistakes in your thinking process that would only become apparent during production. There have been more ti

Two people asked a context compressor two completely different questions. It gave them the same answer. Not a similar answer — byte for byte the same 544 characters. Here's what that looked like: query="Fix the IntegrityError on commit" level=L0 -> 159 tok cache_hit=False query="Explain the tax rounding TODO in compute_tax" level=L3 -> 159 tok cache_hit=True identical output: yes (544 chars both) Different question. Different compression level. Same 544 characters, served from cache. Finding it I wasn't looking for this. I was auditing something else entirely — measuring how much meaning a context compressor loses, not how fast it runs. My harness feeds the same corpus through the compressor with different queries and checks which critical substrings survive: file paths, error types, line numbers, identifiers. I noticed two rows in my results table were identical. Same token count, same output. My first assumption was that my own harness had a bug — that I was passing the same query twice and hadn't noticed. So I changed the second query to something with no words in common with the first, and bumped the compression level from L0 to L3, which should change the output dramatically on its own. Same 544 characters. That was the moment it stopped being my bug. The cause One line: sid = content_hash(content) That sid was doing two jobs. It was the shadow ID — the handle used to refer to a stored document. And it was also the cache key. As a shadow ID it's correct: the same content should get the same handle. As a cache key it's wrong, because the output of compress() doesn't depend only on the content. It depends on the content and the query and the compression level. Two of those three inputs were simply not part of the key. So the first caller warmed the cache for a piece of content, and everyone who touched that same content afterwards got the first caller's answer — regardless of what they actually asked for. Why this is worse than a stale cache A stale cache gives y

I hit Ctrl-F more than any other key combination on this machine. It runs a shell function called fts — "find tmux session," which is not a good name but it's four years too late to change it. I press it, a fuzzy finder opens listing every project directory I have, I type a few characters, and I'm sitting in a tmux session for that project with the panes already laid out. If the session already existed, I'm back in it exactly where I left off. If what I typed doesn't exist yet, it offers to create it. Somebody watched me do this over a screen share recently and asked what was going on. So: here's the whole thing, the four tools it's built on, and a breakdown of every part that isn't obvious. What you'll end up with: One keystroke from anywhere to any project Fuzzy search across every repo you own, with a live directory tree preview Type a name that doesn't exist → it offers to scaffold and place it Never accidentally start a second tmux session for a project you already have open The same window/pane layout in every project, every time The problem it solves Before this, starting work looked like: cd ~/repo/work/some-project-i-half-remember-the-name-of tmux new-session -s some-project # split some panes, badly, slightly differently each time Three or four commands, one of which needed me to remember a path. None of it hard. All of it friction at exactly the wrong moment — the moment you've decided to start something, which is the moment you're most likely to get distracted instead. I'd also collected tmux sessions named 0 , 1 , 2 and some-project-2 , because I kept starting new ones instead of attaching to the one already running. So the goal wasn't really speed. It was making the right thing the automatic thing. Prerequisites Four tools plus zsh. All four are worth having on their own, and three of them are things you'll reach for daily once installed. Tool Version I'm on What it does here tmux 3.6a The terminal multiplexer. Holds the sessions, windows and panes. fz

Khi bắt đầu xây dựng một website chuyên về mô hình lắp ráp, mình nghĩ công việc chỉ đơn giản là đăng sản phẩm lên rồi bán. Nhưng sau quá trình thực hiện, mình nhận ra để một website hoạt động hiệu quả cần rất nhiều yếu tố khác. Điều đầu tiên mình tập trung là tối ưu trải nghiệm người dùng. Một website bán hàng không chỉ cần đẹp mà còn phải tải nhanh, dễ tìm kiếm sản phẩm và hiển thị tốt trên điện thoại. Bên cạnh đó, mình cũng chú trọng đến SEO. Thay vì sao chép mô tả từ nhà cung cấp, mình tự viết lại nội dung cho từng sản phẩm, tối ưu tiêu đề, thẻ mô tả, hình ảnh và cấu trúc website để Google dễ hiểu hơn. Trong quá trình phát triển, mình cũng xây dựng nhiều bài viết chia sẻ kinh nghiệm lựa chọn mô hình lắp ráp, cách bảo quản và những gợi ý quà tặng cho các dịp đặc biệt. Nếu bạn muốn tham khảo dự án mình đang phát triển, có thể xem tại: 👉 https://tiemlaprap.com Mình vẫn đang tiếp tục cải thiện tốc độ website, tối ưu SEO và trải nghiệm người dùng mỗi ngày. Nếu bạn cũng đang xây dựng một website bán hàng hoặc có kinh nghiệm về SEO, rất mong nhận được những chia sẻ và góp ý. seo #website #ecommerce #webdev #digitalmarketing

The HP HyperX Omen 15, which I first saw at CES, replaces the HP Victus 15, a longtime bestselling budget gaming laptop. The Victus cost just $800, or less when on sale, and was a good entry point to decent laptop gaming. The Omen 15 has nice little upgrades over the Victus. Its RTX 5050 […]

Static site generation has a branding problem. Say "static site" and people picture a blog with twelve posts and a contact form. So how far can you actually push it before you need a backend? Further than most people assume. This is a walkthrough of a production site that has no database, no API layer, no user accounts and no server-side state, and still ships 232 prerendered pages with per-user results, shareable links and dynamic social cards. The site is a Spanish political test with nine ideological axes, seventeen parties, fifty-four questions. It is in Spanish, but nothing here depends on reading it. Treat it as the reference implementation. The architecture in one sentence Three data files are the source of truth, everything else is derived at build time, and everything user-specific happens in the browser. That is the whole trick. The rest is consequences. 1. Derive pages, don't author them The site has 232 URLs. Almost none of them were written by hand. There are three data modules: the axes, the parties, and the questions. From those, generateStaticParams produces every content route: // app/ejes/[id]/page.tsx export function generateStaticParams () { return AXES . map (( a ) => ({ id : a . id })) } The interesting one is the comparison pages. Seventeen parties means 17 × 16 / 2 = 136 unique pairs, and each pair gets its own page, its own metadata and its own canonical URL: export function allPairs () { const out = [] for ( let i = 0 ; i < PARTIES . length ; i ++ ) for ( let j = i + 1 ; j < PARTIES . length ; j ++ ) out . push ({ a : PARTIES [ i ]. id , b : PARTIES [ j ]. id }) return out } export function generateStaticParams () { return allPairs (). map (( p ) => ({ pair : pairSlug ( p . a , p . b ) })) } 136 pages from twelve lines. And because the page body is computed from the same vectors, recalibrating one party silently rewrites the sixteen pages that involve it . No CMS, no migration, no content drift. The numbers on the page cannot disagree with

I have a small script, reply_comments.py , that keeps me from having to re-scan every DEV.to article for new comments by hand. It has two commands: pending (unanswered comments I haven't drafted a reply to yet) and audit (drafted replies I said I'd paste manually but apparently never did). I've already fixed two bugs in this file — one in needs_reply() (a thread stayed "handled" forever after a single reply, even when the other person followed up again) and one in audit() (it only checked direct children, so a reply nested two levels deep was invisible). Today I found a third, in pending() itself, and it's the kind of bug that hides precisely because the first two fixes made everything else in the file look trustworthy. What pending() actually does Comments on DEV.to come back from the API as trees — each top-level comment has a children list, and replies can nest arbitrarily deep. pending() walks each article's top-level comments and decides, for each one, whether it needs a reply: def pending (): try : drafted_text = open ( DRAFTS , encoding = " utf-8 " ). read () except FileNotFoundError : drafted_text = "" drafted_codes = set ( re . findall ( r " ^## (\S+) " , drafted_text , re . M )) out = [] for a in api ( f " /articles?username= { ME } &per_page=100 " ): if not a [ " comments_count " ]: continue for c in api ( f " /comments?a_id= { a [ ' id ' ] } " ): if not needs_reply ( c ): continue if c [ " id_code " ] in drafted_codes : continue out . append ({ " id_code " : c [ " id_code " ], " author " : c [ " user " ][ " username " ], " article " : a [ " title " ], " comment_url " : f " https://dev.to/ { ME } /comment/ { c [ ' id_code ' ] } " , " body " : strip_html ( c [ " body_html " ]), }) return out needs_reply(c) is the fix from a few weeks ago — it recurses the whole subtree and checks who posted the most recent message, not just whether I've ever replied. That part's correct. The bug is in the two lines right after it: c["id_code"] and c["body_html"] . c here i

Learning CSS can feel like magic, but it can also be incredibly frustrating. One minute your website looks perfect, and the next minute, a single line of code breaks the entire layout.If you are struggling to get your web pages to look exactly how you want, don't worry. Here are 5 of the most common CSS mistakes beginners make and exactly how you can fix them. 1. Forgetting the CSS Box Model (Adding Padding Breaks Width) The Mistake : You set a box's width to 100%, but as soon as you add padding: 20px; or a border, horizontal scrollbars appear and your layout breaks.Why it happens: By default, CSS adds padding and borders on top of the width you specified. So, 100% width + 20px padding left + 20px padding right = wider than the screen!The Fix: Always use box-sizing: border-box; at the top of your CSS file. This forces the browser to include padding and borders inside the specified width. /* Add this to the very top of your CSS file */ { box-sizing: border-box; margin: 0; padding: 0; } 2. Confusing Block vs. Inline Elements The Mistake: You try to add a vertical margin, width, or height to a or an tag, but nothing changes on the screen.Why it happens: Tags like , , and are inline elements. By default, inline elements ignore top/bottom margins, heights, and widths.The Fix: Change the element's display property to inline-block or block. /* Fix: This will now respect your width and margin settings */ a { display: inline-block; width: 150px; margin-top: 20px; } 3. Overusing Absolute Positioning (position: absolute) The Mistake: Using position: absolute; to push elements around the screen until they look "perfect" on your laptop, only to find the layout completely scrambled on a mobile screen.Why it happens: Absolute positioning takes elements out of the normal document flow. It makes your website completely rigid and unresponsive.The Fix: Stop using absolute positioning for general layouts. Instead, learn and use CSS Flexbox or CSS Grid to build flexible layouts. /* Inst

React TypeScript Property Form Validation export interface PropertyForm { propertyTitle : string ; description : string ; amenities : string ; monthlyRent : string ; location : string ; unitsAvailable : string ; applicationDeadline : string ; } export interface PropertyFormErrors { propertyTitle ?: string ; description ?: string ; amenities ?: string ; monthlyRent ?: string ; location ?: string ; unitsAvailable ?: string ; applicationDeadline ?: string ; } export const validatePropertyField = ( name : keyof PropertyForm , value : string ): string => { switch ( name ) { case " propertyTitle " : if ( ! value . trim ()) { return " Property title is required " ; } if ( value . trim (). length < 3 ) { return " Property title must be at least 3 characters " ; } return "" ; case " description " : if ( ! value . trim ()) { return " Description is required " ; } if ( value . trim (). length > 2000 ) { return " Description cannot exceed 2000 characters " ; } return "" ; case " amenities " : if ( ! value . trim ()) { return " Amenities are required " ; } return "" ; case " monthlyRent " : if ( ! value . trim ()) { return " Monthly rent is required " ; } if ( Number ( value ) <= 0 ) { return " Monthly rent must be greater than 0 " ; } return "" ; case " location " : if ( ! value . trim ()) { return " Location is required " ; } return "" ; case " unitsAvailable " : if ( ! value . trim ()) { return " Units available is required " ; } if ( ! Number . isInteger ( Number ( value ))) { return " Units available must be a whole number " ; } if ( Number ( value ) < 1 ) { return " At least 1 unit must be available " ; } return "" ; case " applicationDeadline " : if ( ! value ) { return " Application deadline is required " ; } return "" ; default : return "" ; } }; export const validatePropertyForm = ( formData : PropertyForm ): PropertyFormErrors => { const errors : PropertyFormErrors = {}; Object . entries ( formData ). forEach (([ name , value ]) => { const error = validatePropertyFiel

PDF merge, split, and compress sound like the most boring possible features to build. Take some files, do an operation, return a file. I believed that too, until real user files started hitting the backend and every one of these tools broke in a different, specific way. Here's what actually went wrong, and what fixed it. The PDF that wasn't actually a PDF The first crash report was a "corrupted file" error on a PDF that opened fine in every desktop viewer. Turns out plenty of real-world PDFs are technically malformed, a missing xref table, a truncated stream, an object reference pointing at nothing but viewers like Chrome and Acrobat are extremely forgiving about it. Most Python PDF libraries are not. try : reader = PdfReader ( file_path , strict = False ) except PdfReadError : # strict=False alone doesn't save you from everything — # some files need the xref table rebuilt from scratch reader = PdfReader ( file_path , strict = False ) reader . _override_encryption = True strict=False fixed maybe 70% of the "corrupted" reports. The rest needed a repair pass first — scanning the raw byte stream for object markers and reconstructing a valid cross-reference table before the normal parser ever touches it. Painful to write, but it turned "please fix your PDF" into "it just works," which matters a lot when the whole pitch of the tool is "no signup, just upload and go." Merging PDFs is not free, memory-wise The naive merge implementation loads every input PDF fully into memory, concatenates pages, writes the output. Fine for two 200KB files. Not fine when someone merges fifteen scanned documents at 40MB each, because now you're holding the equivalent of 600MB of parsed PDF objects in memory at once on a backend container that doesn't have unlimited RAM. The fix was switching to incremental writes process one input file at a time, write its pages to the output stream, then explicitly drop the reference before moving to the next file: writer = PdfWriter () for path in input_p

Workday is where large enterprises actually post. NVIDIA has 2,000 open roles there, Salesforce 1,477, Adobe 832. It answers an anonymous POST with no key. It also has two behaviours that are not in any documentation you can read without an account, and both of them fail silently. One of them costs you 98% of the board without raising anything. The number that changes after page one Ask for the first twenty postings and the response carries a total : POST /wday/cxs/nvidia/NVIDIAExternalCareerSite/jobs {"appliedFacets":{}, "limit":20, "offset":0, "searchText":""} 20 jobPostings, total: 2000 Ask for the next twenty and the count is gone: offset 20 -> 20 jobPostings, total: 0 offset 40 -> 20 jobPostings, total: 0 Not null, not absent. Zero. The postings keep coming; only the count collapses. Measured on four enterprise tenants: tenant total at offset 0 at offset 20 at offset 40 NVIDIA 2000 0 0 Salesforce 1477 0 0 Adobe 832 0 0 Sony 94 0 0 Same shape every time, so this is Workday and not one tenant's configuration. Why that costs you 98% of the board Here is the loop everyone writes, and it is not a bad loop: offset , out = 0 , [] while True : page = fetch ( offset ) posts = page [ " jobPostings " ] if not posts : break out += posts offset += len ( posts ) if offset >= page [ " total " ]: # looks obviously right break On page two page["total"] is 0 , and 20 >= 0 is true. The loop exits, reports no error, and hands back what it has. I ran both versions against NVIDIA: declared total on page one 2000 the obvious loop collected 40 2% keeping the first total instead 2000 100% Forty postings out of two thousand, and nothing anywhere says so. No exception, no warning, no partial-result flag. Just a job board that looks very quiet. The fix is one line moved: offset , out , total = 0 , [], None while True : page = fetch ( offset ) posts = page [ " jobPostings " ] if not posts : break out += posts offset += len ( posts ) if total is None : # the first answer is the only honest

On Windows I kept launching background servers from a task runner and watching them die the instant the launching step finished — no error, no log, just gone. The task runner was wrapping everything in a job object, and job-object teardown kills every child process on return. Nothing I did inside the child mattered; its death warrant was signed by how it was born. The workaround was to have the process created by something that outlives the runner — the OS scheduler, a WMI process-create call — instead of spawning it as a doomed descendant. When a process keeps dying without a trace, look at its lineage before its code — some parents kill their children on the way out, and no amount of hardening inside the child fixes how it was spawned.

As more big companies invest in glasses that record audio and video and pack AI on board, privacy concerns are only getting louder.