标签：#ev

When a chatbot hallucinates, a person reads the answer and catches it. When an agent hallucinates, it may have already run the query, sent the email, or changed the config before anyone looks. That single difference is why agent safety is its own discipline rather than a subsection of application security, and it is why OWASP shipped a dedicated Top 10 for Agentic Applications in December 2025 instead of folding the problem into the existing LLM list. Most teams I talk to are not missing this because they disagree. They are missing it because the safety work never got a line in the plan. The agent shipped, it worked, and the access model that came with it on day one is still the access model on day ninety. Permission Creep Is The Real Attack Surface The incidents that actually happen are boring. An agent gets built to summarize documents. Two sprints later somebody needs it to write a summary file, so it gets write access. Then it needs to post the summary, so it gets an API token. Nobody sat down and approved a document summarizer with filesystem and network write access, but that is what exists now, and the access model was never revisited because nothing broke. Least privilege is easy to agree with and boring to maintain, which is exactly why it fails. The useful version is a rule rather than a principle: every agent starts at zero permissions, and every capability you add triggers a re-read of the whole permission set rather than an append to it. Indirect Prompt Injection Turns Data Into Instructions Prompt injection is still OWASP's number one risk for LLM applications, and it gets meaningfully worse in an agentic context because the payoff is no longer a misleading answer, it is a real action. The direct version, where a user types something that overrides the system prompt, is the one everybody tests for. The version that gets people is indirect: the malicious instruction sits inside a web page, a support ticket, a PDF, or a database row that the agent was to

This is a submission for Frontend Challenge - Comfort Food Edition, CSS Art. ...

This $9 NFC key requires you to physically scan it to unlock distracting apps on your phone.

While struggling to understand channels in go, I would try out many things in my sandbox repository. I encountered deadlock errors and stuff about go routes being asleep. I came to understand that the order of execution played a role and that with unbuffered channels you need a sender and a receiver ready at the same time (kind of). I wrote a short article on my blog site about the experience The Unbuffered Channels In Go Lesson I Think Has Finally Clicked for Me 🤷🏽‍♂️

Welcome back to the React Mastery Series ! In the previous article, we explored React Rendering and Component Lifecycle . We learned: What causes a component to re-render How React reconciliation works The difference between rendering and DOM updates How lifecycle behavior is handled using Hooks Now let's learn how React applications respond to user interactions. Every modern application depends on events: Clicking buttons Typing into forms Selecting options Submitting data Dragging and dropping elements Keyboard shortcuts React provides a powerful event system to handle all these interactions. What is Event Handling? Event handling is the process of responding to user actions in an application. Examples: User Action | ↓ Event Triggered | ↓ Event Handler Executes | ↓ State Updated | ↓ UI Re-renders Example: A user clicks the "Transfer Money" button: Click Button | ↓ Handle Click Event | ↓ Validate Data | ↓ Call API | ↓ Update UI Events in Traditional JavaScript vs React Traditional JavaScript const button = document . getElementById ( " save " ); button . addEventListener ( " click " , saveData ); You manually: Find the DOM element Attach event listeners Manage updates React React attaches events directly inside JSX. < button onClick = { saveData } > Save </ button > React manages the event registration internally. React Event Syntax React events use: camelCase naming JSX expressions Function references HTML: <button onclick= "save()" > Save </button> React: < button onClick = { save } > Save </ button > Notice: onclick ❌ onClick ✅ Handling Click Events Example: function Button () { function handleClick () { console . log ( " Button clicked " ); } return ( < button onClick = { handleClick } > Click Me </ button > ); } When the user clicks: Click | ↓ handleClick() | ↓ Execute Logic Passing Functions vs Calling Functions A very common beginner mistake. Incorrect < button onClick = { handleClick () } > Save </ button > This executes immediately during rendering. Correc

The automaker is gearing up to make some big changes to its EV line in the near future. Here's what to expect.

myjsonstudio.online

I compiled the rules engine of a shipped Android game to the browser. Same Java, two compilers. Then I checked whether the two agreed. They did not — and the test I already had for exactly this had been green the whole time. The same command twice: green against the current engine, then against the committed recording of the broken build. Play it as a terminal session if you want to select the text. The setup The rules live in one module with no Android on its classpath, which is what let me compile them a second time with TeaVM and run the same logic on a canvas in a browser tab. A seeded run should be reproducible. Give the engine seed 42 and a fixed sequence of inputs, and you should get the same game every time — that is what makes a run replayable and two builds comparable. Here is what I actually got, same seed, same inputs: JVM browser first obstacle x, frame 60 405.426 304.426 still alive at frame 360 yes no final score 9 6 Not a rounding difference. A different game. The cause is boring. The test failure is not. GameEngine used java.util.Random . Its algorithm is specified down to the constants — you can read the exact linear congruential generator in the Javadoc. So a seed ought to name exactly one sequence. But my code was not running that algorithm. It was running whichever implementation the runtime supplied , and TeaVM's is not the JVM's. The specification describes what java.util.Random does; it does not force a foreign runtime's reimplementation to match. The fix took ten minutes: write the LCG out longhand so both builds execute the same arithmetic instead of trusting that they will. The interesting part is the test. The test that could not have caught it I had a test called theSameSeedProducesTheSameRun . It ran the engine twice, with the same seed, and asserted the results matched. It passed on every commit, including every commit during which the browser build was playing a different game. It had to pass. It runs the engine twice in the same runt

Christopher Nolan's impressionistic remix of Homer's epic poem finds the man behind the myth.

We've all done it. You spin up an RDS instance to test something on a Friday afternoon. You attach an EBS volume to a t3.micro that you kill three days later — but the volume just... stays. You allocate a static IP for a load test, and the load test ends, but the IP doesn't know that. None of this shows up as an error. Nothing crashes. There's no red banner in the console screaming at you. It just quietly sits there, accruing charges, until you open your AWS bill a month later and go "wait, why are we paying for that ?" I call these zombie resources — infrastructure that's technically alive (and billing you) but functionally dead. It's happened to me enough times on side projects and client work that I've started designing a small tool to stop it: CloudZombie . Heads up: this is early. There's no working product yet — I'm validating the idea and building in the open, starting with a waitlist. If that's not your thing, no hard feelings, but if you've felt this exact pain before, I'd love your take. The problem, more specifically Cloud waste isn't usually one big dramatic mistake. It's death by a thousand cuts: Orphaned EBS volumes — you terminate an EC2 instance, but the attached volume doesn't get deleted with it, so it just sits in an "available" state forever. Idle databases — that staging or QA RDS instance nobody remembers spinning up, quietly running at under 1.5% CPU for weeks. Abandoned static IPs and load balancers — cloud providers actually charge more for an Elastic IP that isn't attached to anything, which feels like a small act of cruelty. Individually, each one is a few dollars a month. Collectively, across a handful of side projects or a growing team's sprawl of staging environments, it adds up to real money leaking out of your runway — with zero warning. What CloudZombie is meant to do The plan is for CloudZombie to connect (read-only) to your AWS account and scan specifically for these patterns: Unattached EBS volumes sitting idle Databases with sust

Welcome back to the React Mastery Series ! In the previous article, we learned about State in React and how state changes make our applications interactive. Today, we will understand one of the most important concepts for every React developer: How does React render components? Many developers know how to write React code, but understanding when and why React renders is what separates a beginner from an advanced React developer. A strong understanding of rendering helps you: Build faster applications Avoid unnecessary re-renders Debug performance issues Use optimization techniques correctly Let's dive in. What is Rendering in React? Rendering is the process where React: Takes your component code Creates a representation of the UI Updates the browser DOM when necessary A simple way to visualize it: Component Code | ↓ React creates Element Tree | ↓ Reconciliation Process | ↓ Browser DOM Update Rendering does not always mean updating the browser DOM . React may render a component, compare the result, and decide that no DOM changes are required. Initial Render When a React application starts, the first rendering process happens. Example: function App () { return ( < h1 > Hello React </ h1 > ); } The flow: index.html | ↓ main.tsx | ↓ <App /> | ↓ React creates UI | ↓ Browser displays content This is called the initial render . What Causes a Re-render? A component re-renders when: 1. State Changes Example: const [ count , setCount ] = useState ( 0 ); setCount ( 1 ); When state changes: State Update | ↓ Component Re-renders | ↓ UI Updates 2. Props Change Example: < User name = "Siva" /> If the parent changes: < User name = "John" /> The child component receives new props and re-renders. 3. Parent Component Re-renders When a parent component renders, React also re-renders its children by default. Example: function Parent () { return ( <> < Child /> </> ); } If Parent updates, Child also gets rendered again. Later, we will learn how React.memo can prevent unnecessary child re

A roundup of recent reviews published by Engadget.

The Mermaid Mask, the next point-and-click game from Tangle Tower developer SFB Games, has everything you could ask for in a great murder mystery. It starts with a compelling setup: The captain of a submarine is found dead in a locked room, his body next to a mysterious cauldron with blood trickling across the floor. […]

After setting up Jenkins and creating my first Declarative Pipeline, the next step was preparing my machine to build Docker images. Since my pipeline will eventually clone code from GitHub, build a Docker image, and push it to a container registry, Jenkins needs access to Docker. Without Docker installed, the docker build stage would fail because Jenkins wouldn't be able to execute Docker commands. Installing Docker On my Ubuntu machine, I installed Docker using: sudo apt update sudo apt install docker.io -y Once the installation completed, I verified it using: docker --version This confirmed that Docker was successfully installed and ready to use. Verifying Docker Installation Installing Docker is only half the job. The next step is to check whether your current user has permission to use Docker. Run: docker ps Expected Output If everything is configured correctly, you should see something similar to: CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES Even if no containers are running, getting an empty table like the one above means Docker is working correctly. What If You Get a Permission Error? If you see an error like: permission denied while trying to connect to the Docker daemon socket it means your current user doesn't have permission to access the Docker daemon. First, check which user you're currently logged in as: whoami Example output: nishant Now add your user to the docker group: sudo usermod -aG docker $USER What does this command do? usermod modifies a user account. -aG means append the user to a supplementary group without removing existing groups. docker is the group that has permission to communicate with the Docker daemon. $USER automatically refers to your currently logged-in username. Apply the Changes The group membership won't take effect immediately. You have two options: Option 1 (Recommended): Log out of your Ubuntu session and log back in. This refreshes your user groups and is the most reliable method. Option 2: Simply restart your ter

It's easy to test a site on office fibre, get a 95+ Lighthouse score, and call performance "done." Then someone in a secondary city mentions the site feels slow on their phone, and the gap between tested performance and real performance becomes obvious. This isn't a Pakistan-specific problem in theory, but it's an unusually common one in practice — a large share of real users here are on congested 3G or throttled 4G, on mid-range Android devices, often outside the main metros where infrastructure is best. If you're building for a Pakistani (or generally emerging-market) audience, "works great in the office" isn't the same as "works great for the actual user." Here's what actually moves the needle, beyond just plugging in a CDN. A CDN helps, but it doesn't fix the last mile A CDN gets your assets physically closer to the user, which helps. But if the connection between someone's phone and the nearest edge node is still a congested 3G link, the CDN's job is basically done — the bottleneck is the last mile, and no amount of edge-caching fixes that. What actually helps is reducing how much has to travel down that last mile in the first place. That reframes the whole problem: less about "getting bytes there faster" and more about "sending fewer bytes." 1. Image weight is usually the biggest offender Images are typically the single largest contributor to page weight, and the fix isn't exotic: // Next.js example — explicit width/height prevents layout shift, // and the Image component serves modern formats automatically import Image from " next/image " ; < Image src = "/hero.jpg" alt = "Product hero shot" width = { 1200 } height = { 630 } priority // only for above-the-fold images /> A few concrete habits that add up: Serve WebP/AVIF instead of raw JPEG/PNG where you can — usually 25-50% smaller at equivalent visual quality Always set explicit width / height (or use a framework component that does it for you) so the browser doesn't shift layout while images load — this als

Welcome back to the React Mastery Series . In Day 1, we introduced the roadmap of this series and discussed what we will cover — from React fundamentals to enterprise-level architecture. Today, we will start with the most important question: What is React, and why was it created? What is React? React is an open-source JavaScript library for building user interfaces , especially single-page applications (SPAs). It was created by engineers at Meta (Facebook) and was initially released in 2013. React focuses on one core idea: Build complex user interfaces by breaking them into small, reusable components. Instead of creating a complete application as one large piece of code, React encourages developers to divide the UI into independent and manageable components. Example: A banking application dashboard can be divided into: Dashboard │ ├── Header │ ├── AccountSummary │ ├── TransactionList │ ├── TransferMoneyForm │ └── Notifications Each part can be developed, tested, and maintained independently. Why Was React Created? Before React, developers commonly used traditional JavaScript and libraries like jQuery to update web pages. For small applications, this approach worked well. But as applications became larger, several challenges appeared. 1. Managing Complex UI Updates Imagine a banking application where: Account balance changes Transactions are updated Notifications appear User profile information changes With traditional DOM manipulation, developers had to manually find elements and update them. Example: document . getElementById ( " balance " ). innerHTML = " $5000 " ; As the application grew, managing thousands of DOM updates became difficult. React introduced a different approach: Describe what the UI should look like, and React manages the updates. The Problem With Direct DOM Manipulation The browser provides the Document Object Model (DOM), which represents the HTML structure. Example: HTML | DOM Tree | Browser Rendering When we update the DOM frequently: Browser

Recently I went looking for a CLI tool to manage my Dev.to articles from the terminal. I write 4-5 articles per month, track analytics obsessively, and wanted a git-backed workflow. I found 9 existing tools. Tried them all. Here's what happened: devto-cli (Node): Last commit 2 years ago. Broke on install. dev-to-git (Node): Only syncs TO local. Can't push back. slinkity : Abandoned. forem-cli : 3 endpoints implemented out of 40+. Every single tool does the same thing: publish an article. That's it. Maybe pull. Maybe validate tags. Meanwhile the Dev.to API has 40+ endpoints including analytics, semantic search, ML-powered content concepts, follower engagement, trend tracking, and reading list management. Nobody uses them. So I built devpub . Table of Contents What devpub does What I discovered in the API The build story Architecture Try it Contributing What devpub does (that nothing else does) # The basics (every tool does this) devpub push -f articles/my-post.md devpub pull # Analytics in your terminal devpub stats # Views: 246.5K | Reactions: 4.4K | Comments: 402 | Followers: 18.9K # Full dashboard with top articles devpub dashboard # AI-powered search (semantic, not keyword) devpub search "building serverless apps" --semantic # What's trending RIGHT NOW devpub trends # Catch problems before publishing devpub validate The difference isn't one feature. It's coverage. Here's the comparison: Capability devpub Everyone else Publish/update articles Yes Yes Pull articles to local Yes Some Analytics (7 endpoints) Yes No Semantic search Yes No Trend discovery Yes No Article validation Yes No Rate limiting (30 req/30s) Yes No Retry logic for failures Yes No Concepts API (ML topics) Yes No What I discovered in the Dev.to API While building devpub, I found several API endpoints that aren't documented anywhere obvious: 1. Semantic Search -- Dev.to has a full embedding-based search system using Gemini embeddings (768-dimensional vectors) with pgvector. You can search articles b

TL;DR — Fitz LiveViews is a real-time UI framework for Fitz , a compiled, gradually-typed language where HTTP, WebSockets, auth, and an ORM are part of the syntax. You write single-file components ( .fitzv ) with state / event / <template> , and the server renders HTML, diffs it, and patches the browser over a WebSocket — no JavaScript build step, no client framework . The same .fitzv can also compile to WebAssembly for offline, zero-round-trip widgets. There's a live component gallery, a course, and a full flagship app (an admin panel with auth + Postgres + Docker) already built with it. Repo : github.com/Thegreekman76/fitz-liveviews · Docs : thegreekman76.github.io/fitz-liveviews This is the first post in the FitzLiveViews series. I'll start with the pitch and the setup; the following posts build things. The problem Building a modern web UI usually means two languages, two type systems, and a build pipeline: a backend (Python / Node / Go) plus a frontend framework (React / Vue / Svelte) plus its toolchain (Vite / Webpack / Babel). You duplicate your types across the wire, you keep two mental models in sync, and node_modules grows a personality of its own. Phoenix LiveView (Elixir) showed there's another way: render on the server, push diffs over a WebSocket, and let the browser stay dumb. No client framework, no API to hand-write, no JSON serialization dance. Fitz LiveViews brings that model to Fitz — and adds a twist: the same component can also compile to WebAssembly when you want purely client-side, offline interactivity. What Fitz LiveViews looks like A component is a single .fitzv file — state, event handlers, and a template, like Vue or Svelte: component Counter { state { count : Int = 0 } event increment () { count = count + 1 } event decrement () { count = count - 1 } event reset () { count = 0 } < template > < div id = " counter-app " > < p > Count : { count } < /p > < button @ click = " increment " >+ 1 < /button > < button @ click = " decrement " >- 1 <

TL;DR — Fitz LiveViews es un framework de UI en tiempo real para Fitz , un lenguaje compilado y de tipado gradual donde HTTP, WebSockets, auth y un ORM son parte de la sintaxis. Escribís componentes de un solo archivo ( .fitzv ) con state / event / <template> , y el servidor renderiza HTML, lo diffea y parchea el browser por WebSocket — sin paso de build de JavaScript, sin framework de cliente . El mismo .fitzv puede además compilar a WebAssembly para widgets offline sin round-trip. Ya hay una galería de componentes en vivo, un curso, y una app flagship completa (un panel de administración con auth + Postgres + Docker) construida con esto. Repo : github.com/Thegreekman76/fitz-liveviews · Docs : thegreekman76.github.io/fitz-liveviews Este es el primer post de la serie FitzLiveViews . Arranco con el pitch y el setup; los siguientes construyen cosas. El problema Armar una UI web moderna normalmente implica dos lenguajes, dos sistemas de tipos, y un pipeline de build: un backend (Python / Node / Go) más un framework de frontend (React / Vue / Svelte) más su toolchain (Vite / Webpack / Babel). Duplicás tus tipos de un lado al otro del cable, mantenés dos modelos mentales en sync, y node_modules desarrolla personalidad propia. Phoenix LiveView (Elixir) mostró que hay otra forma: renderizar en el servidor, empujar diffs por WebSocket, y dejar que el browser quede tonto. Sin framework de cliente, sin API que escribir a mano, sin la danza de serializar JSON. Fitz LiveViews trae ese modelo a Fitz — y suma una vuelta de tuerca: el mismo componente puede además compilar a WebAssembly cuando querés interactividad puramente client-side y offline. Cómo se ve Fitz LiveViews Un componente es un solo archivo .fitzv — state, event handlers y template, como Vue o Svelte: component Counter { state { count : Int = 0 } event increment () { count = count + 1 } event decrement () { count = count - 1 } event reset () { count = 0 } < template > < div id = " counter-app " > < p > Count : { cou

Most agent tooling is still built around a single conversation: one agent, one task, one terminal, one stream to babysit. Fine for small tasks, bad for real engineering work. Herdr is interesting because it treats that as the default shape of the work. The simplest way to describe it is: Herdr is tmux for coding agents. More precisely, it is an agent multiplexer that runs inside your existing terminal. It gives each agent a real PTY, keeps processes alive where the work is happening, shows agent state, and exposes a CLI plus a local socket API. That distinction matters. Herdr is not another desktop agent app. It is a binary you run where the code and terminals live: a server, a Mac Mini, a VM, a dev machine under your desk. Close the laptop, detach, ssh back later, reattach, even from a phone. The work did not die because your terminal window did. The throughput problem Coding agents changed the cost of starting work. I can ask one agent to explore a bug, another to write a failing test, another to draft a migration plan. The bottleneck is supervision. The problem is that normal terminals do not understand supervision. tmux and Zellij give you persistence and panes, but they do not know whether an agent is blocked, working, done, idle, or just sitting there after printing a question three screens ago. Desktop apps often understand the agent state better, but then the workflow is stuck to the machine with the GUI. Worktree orchestrators can coordinate parallel tasks, but they usually want to own the workflow. Herdr sits in a useful middle: terminal model, plus agent awareness. The performance multiplier is not magic. It comes from four practical properties: Multiple agents run in real PTYs, each with its own shell, logs, prompts, and process state. Herdr rolls up semantic state, so you can see which agents are blocked, working, done, or idle. The server owns the panes, so sessions survive client detach, laptop sleep, and terminal death. The CLI and socket API let scr