标签：#ev

SJY’s Zeph are brilliant wired headphones, using flippable earcups for two different takes on your favorite music.

Idempotency, vendor failure, monitoring that catches the invisible outages, and the tradeoffs nobody warns you about, lessons from scaling payments infrastructure. Most software fails quietly. A page renders slowly, a recommendation is a little off, a report is stale by an hour. Users shrug and move on. Payments doesn't work like that. When payments break, someone's money is in a place neither of you can account for, and the clock starts ticking on their patience. There's no graceful degradation. Either the money moved, or it didn't, and someone needs to know which. I've spent a good chunk of my career building and scaling payments infrastructure, and it has quietly rewired how I think about engineering in general. Here's what stuck. 📋 The short version # Lesson One-line summary 1 Idempotency You will receive the same request twice. Design for it. 2 Vendor failure Gateways are vendors. Ask "when," not "if." 3 Monitoring Never learn about an outage from a customer. 4 The unglamorous stuff Ledgers, reconciliation, state machines, refunds. 5 Tradeoffs Every lesson above fights at least one other. 1. 🔁 Idempotency isn't a feature. It's a foundation. The first hard lesson: you will receive the same request twice. Not "might." Will. A client times out waiting for your response and retries. A user double-taps a button on a bad connection. A queue consumer crashes after processing but before acknowledging. A gateway sends the same webhook four times because it never got a 200 back. None of these are exotic failure modes, they're Tuesday. If your system treats every incoming call as a new instruction, every one of those scenarios becomes a double charge. And a double charge isn't a bug you fix quietly in the next release. It's a support ticket, a refund, a reconciliation entry, and a customer who now checks their statement every time they use you. The fix is conceptually simple and operationally demanding: every operation that moves money must be uniquely identifiable and sa

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . The most expensive bug I fixed this year was not in the code. It was in the documentation, and it had been shaping what everyone believed the code did. The setup HydraDNS is an open-source DNS security gateway I build in Go. Router points at it, it filters every DNS query on the network against a 92k-domain blocklist, blocks the bad ones, forwards the rest. Before putting it on anyone else's network I wanted a real number for what one box could take, so I sat down with dnspyre and a rule I had written for myself: every number becomes a sales claim or a fix ticket. No number, no claim. Our feature sheet said the blocklist was backed by a Bloom filter, sub-millisecond lookups. Here is the uncomfortable part: at every load this system had ever run, that claim was indistinguishable from the truth. Normal-traffic latency sat at one or two milliseconds. There was nothing to doubt, because nothing observable disagreed. The first ceiling The redline test capped at about 500 queries per second. Odd, but fine, until I noticed the cap would not move. Blocked queries capped at ~500. Cached queries that never touch upstream also capped at ~500. Two paths doing completely different work, same wall, CPU sitting under 30% on a 22-core dev machine. That combination is worth memorizing: when two very different code paths hit the same ceiling and the CPU is bored, the bottleneck is not in either path. It is in something they share. Ours was the blocklist check. IsBlocked ran a SQL COUNT against the 92k-row table on every single query, because the check sits in front of the cache, so even cache hits paid for it. Every one of those reads was serialized through a single SQLite connection, MaxOpenConns=1 , which was also absorbing the async write traffic from query logging. Engine self-latency under load: p50 of 50ms, p99 of five full seconds. For DNS. And the Bloom filter? I went looking for it so I could

TL;DR Hello everyone! It's been a while since I've posted a list of interesting projects,...

The NHTSA has given Amazon's Zoox permission to charge for rides. It's the first AV with no manual controls to get it.

A leaderboard looks like a one-command problem: ZADD weekly 100 alice ZADD weekly 100 bob ZREVRANGE weekly 0 -1 WITHSCORES While building Podium , an open-source Redis-backed leaderboard service, we discovered that the difficult part begins when two players have the same score. We are sharing the design because this edge case can silently turn player IDs into ranking rules. TeneficGames / podium High-performance, Redis-backed leaderboards for games and competitive applications. Podium High-performance, Redis-backed leaderboards for games and competitive applications. Podium provides ready-to-run HTTP and gRPC APIs for scores, ranks, seasons, and player-relative views. It is designed for backend teams operating large fleets of independent leaderboards without provisioning each leaderboard in advance. Fair, deterministic ordering when scores are equal. Single and bulk score updates, including multi-leaderboard fan-out. Standalone Redis and real Redis Cluster integration coverage. Deploy one multi-architecture OCI image with Docker, containerd, Kubernetes or another OCI-compatible runtime. Quickstart · Performance · API · Documentation · Helm chart · Docker Hub · GHCR Quickstart Start Redis 8.2 and the latest stable Podium image: docker network create podium docker run --detach --name podium-redis --network podium redis:8.2-alpine docker run --detach --rm --name podium \ --network podium \ --publish 8880:8880 \ --publish 8881:8881 \ --env PODIUM_REDIS_HOST=podium-redis \ --env PODIUM_REDIS_PORT=6379 \ trungdlp/podium:latest start Verify the service: curl http://localhost:8880/healthcheck WORKING Submit two equal scores: curl --request … View on GitHub Both players have 100 points. Alice arrived first, so most game designers would expect: 1. alice: 100 2. bob: 100 But that is not what the data model says. Redis sorted sets order members with equal scores lexicographically. With a reverse range, that secondary ordering is reversed too. Your "fair" tie may therefore be de

Quick share of a feature we built into Telechat (self-hosted Claude AI bot) that's been surprisingly useful for devops workflows: Desktop Bridge with mobile approvals . The problem You're running Claude Code (or any Claude-powered agent) on your workstation. It's refactoring a module, running tests, deploying to staging. You step away for coffee, a meeting, or just to stretch. Claude hits a tool call that needs human approval: rm -rf build/ (wants to clean the build directory) git push --force (rebase gone wrong) kubectl delete pod (scaling decision) Without you at the keyboard, it just... waits. For however long you're gone. The solution Telechat's Desktop Bridge connects your Claude Code session to your phone via Telegram, WhatsApp, or Slack. When Claude needs approval: You get a push notification with exactly what Claude wants to execute You see the full command and context You tap Approve or Deny Claude continues (or backs off) All from your phone. No VPN, no SSH, no laptop. Why this matters for devops Unattended CI/CD with a human gate. Run Claude as part of your pipeline for code review, test generation, or deployment prep. Gate the destructive steps on mobile approval instead of blocking the pipeline until someone checks Slack. Overnight tasks. Kick off a large refactoring or migration analysis before bed. If Claude needs a decision at 2 AM, you'll see it in the morning and approve from your phone. It doesn't lose context while waiting. Pair programming while mobile. Reviewing Claude's work from your phone between meetings. Approve the good stuff, deny the risky stuff, add context via chat. How it works Telechat runs on your workstation alongside Claude Code. It acts as a bridge between Claude's approval prompts and your messaging app. When Claude's tool-use loop hits a human-approval checkpoint, Telechat intercepts it, formats the request, and sends it to your Telegram/WhatsApp/Slack. Your response flows back and unblocks the agent. No cloud relay — the brid

This is a submission for Frontend Challenge - Comfort Food Edition, CSS Art. Inspiration Comfort...

When configuring Claude Code (or Claude-driven AI coding assistants) in your projects, structuring your instructions efficiently is key to getting accurate code generation while keeping token consumption low. Understanding when to use a single CLAUDE.md versus modular .claude/rules/ files will help keep your AI assistant sharp, focused, and predictable. The Core Hierarchy & Scope Claude Code looks for configurations across multiple levels: ├── ~/.claude/ # User / Global level (applies to all your projects) └── project-root/ ├── CLAUDE.md # Global project level (loaded into every session) ├── .claude/rules/ # Modular & scoped rules (loaded selectively) └── sub-app/ └── CLAUDE.md # Sub-directory / Monorepo scope CLAUDE.md (The Global Cheat Sheet)Think of CLAUDE.md as the main ReadMe for the AI. It provides high-level context and essential project memory. When to use CLAUDE.md:Common CLI Commands: Build, test, lint, and run scripts (npm test, docker compose up). Core Architecture: Tech stack summary, overall folder structure, and design principles. Global Rules: Non-negotiable guidelines that apply project-wide (e.g., "Strict TypeScript, no any"). Project Context: E-Commerce Web App Build & Test Commands Build: npm run build Test single file: npx jest src/components/Button.test.tsx Lint: npm run lint High-Level Guidelines All UI components must use React 19 functional syntax. Never hardcode secrets or environment variables. .claude/rules/ (Modular & Path-Scoped Rules)As projects grow, packing every guideline into CLAUDE.md bloats the prompt context and reduces overall compliance. The .claude/rules/ directory lets you create modular, topic-specific, or path-scoped rules (in .yml or .md). When to use .claude/rules/:Path-Specific Rules (globs): Guidelines that apply only to certain files (e.g., API routes vs. React components). Domain Separation: Splitting rules into dedicated files (testing.yml, security.yml, db-migrations.yml). Token Optimization: Prevent loading backen

JavaScript vs React: Understanding How They Work Together If you're starting web development, you've probably heard about JavaScript and React. Many beginners think they are competitors, but they actually work together. Let's understand them in simple terms. What is JavaScript? JavaScript is a programming language used to make websites interactive. Without JavaScript, a website would mostly be static. JavaScript allows you to: Handle button clicks Validate forms Create animations Fetch data from APIs Update content without refreshing the page Example: document . getElementById ( " btn " ). addEventListener ( " click " , () => { alert ( " Hello World! " ); }); JavaScript is the foundation of modern web development. What is React? React is a JavaScript library created by Meta Platforms for building user interfaces. Instead of manipulating the webpage manually, React helps developers create reusable UI components. Example: function Welcome () { return < h1 > Hello World! </ h1 >; } React uses JavaScript to create dynamic and interactive user interfaces more efficiently. Simple Analogy Think of building a house: JavaScript = The tools and materials (bricks, cement, wood) React = A construction framework that helps you build the house faster and more efficiently You need JavaScript to use React. Key Differences Feature JavaScript React Type Programming Language JavaScript Library Purpose Adds logic and interactivity Builds UI components Learning Curve Easier to start Requires JavaScript knowledge Usage Works everywhere Used mainly for frontend applications Created By Netscape Meta (Facebook) DOM Updates Manual Virtual DOM for optimized updates Why React Became Popular As applications grew larger, managing UI with plain JavaScript became difficult. React solves this by providing: Component-based architecture Reusable code Better state management Faster UI updates with Virtual DOM Large ecosystem and community support This makes React ideal for building modern applications

Disclosure: BrowserAct sponsored this piece. The BrowserAct links below are affiliate-tracked — I get...

I recently discovered you can build a fully working Flexmonster pivot table right inside a Claude...

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . A payment webhook sounds simple until a successful payment doesn't actually result in the service the customer paid for. That was one of the more interesting bugs I encountered while building The Listening Ear, an appointment and online consultation platform. The requirement was straightforward: A customer pays for a session → the application confirms the payment → the customer's appointment is booked → a Zoom meeting is created. The reality was much more complicated. Project Overview The Listening Ear connects online payments with appointment scheduling and Zoom-based consultations. The application was built with technologies including Next.js 14, TypeScript, Supabase, Prisma, PostgreSQL, Zoom, and payment-provider APIs. The payment workflow was particularly important because payment confirmation was effectively the gatekeeper for the rest of the booking experience. The intended flow looked like this: Customer │ ▼ Payment Provider │ │ webhook ▼ Next.js Webhook │ ├── Verify / interpret payment │ ├── Create Zoom meeting │ └── Create appointment record │ ▼ Customer receives access to their scheduled session The problem was that the webhook sat directly in the middle of all of these operations. Bug Fix or Performance Improvement The bug appeared when I was implementing the payment webhook that would unlock the Zoom scheduling workflow. My initial implementation listened for the payment event and checked whether the event was: if (event === 'charge.success') { Once that condition was met, the webhook immediately continued into the booking workflow. That workflow included: Reading appointment metadata from the payment event. Handling special emergency appointments. Building the Zoom meeting payload. Calling the Zoom meeting API. Creating the appointment record in the database. Returning a successful response to the payment provider. The problem was that all of these operations were effecti

When I first started contributing to open source, GitHub Actions felt like a black box. Seeing a failed workflow on my pull requests was intimidating because I didn't really understand what was happening behind the scenes. Well, this month, I decided to change that. What I Worked On I implemented GitHub Actions across three of my project repos. My main focus was: Adding Markdownlint for Markdown quality Adding Pylint for Python linting. Updating documentation while integrating CI. What I Learned The biggest lesson wasn't technical — it was changing my mindset. A failed workflow isn't something to fear. It's simple feedback. Whether it's markdownlint warning or a pylint error, each failure helps improve the project. Looking Ahead Most of this month was spent improving my own projects, so I didn't contribute much to external repositories. Next month, I want to build on this foundation by contributing to more open source projects and applying what I've learned. Sometimes, learning the tools behind open source is just as valuable as making another pull request. I'm curious What part of GitHub Actions or CI/CD was the most challenging when you first started? Or If you are just getting started, what's the biggest thing that's still a mystery to you? I'd love to hear your experience and tips in the comments. Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

Most enterprise teams know the CISA Known Exploited Vulnerabilities catalog the same way they know the weather: a headline scrolls past ("CISA adds three vulnerabilities to KEV catalog"), someone forwards it, and everyone nods. That is a waste of the single most operationally useful list in vulnerability management. The KEV is small, machine-readable, updated near-daily, and every entry on it has one property your scanner output cannot give you: a real attacker has already used it against a real network. This is a guide to the catalog itself: what it promises, what it doesn't, how the feeds are structured, how to map entries to your own estate without fooling yourself, and how to combine it with EPSS and vendor advisories into a defensible patch-ordering rule. Everything here is verified against the live feed and CISA's own pages as of late July 2026. What the KEV is, and what it is not CISA describes the KEV as the authoritative source of vulnerabilities that have been exploited in the wild . Entry is gated by three criteria , all of which must hold: The vulnerability has an assigned CVE ID. There is reliable evidence of active exploitation in the wild. There is a clear remediation action, such as a vendor-provided update. Read those criteria as exclusions and the catalog's real shape appears. No CVE assigned yet? Not in the KEV, even if exploitation is rampant. Exploitation reported but CISA's evidence bar not met? Not in the KEV. Actively exploited but no fix or mitigation exists? Not in the KEV. The catalog is a curated floor, not a census. As of the 2026.07.29 release the feed contains 1,656 entries, against an ecosystem publishing tens of thousands of CVEs per year. Absence from the KEV is not evidence of safety; presence is close to proof of danger. That asymmetry is the whole point, and it is why the correct reading of the list is "everything on here is urgent" rather than "everything urgent is on here." The distribution is also worth knowing before you buil

Autonomous agents don't just fail loudly—they fail expensively. A single misconfigured retry loop between an agent and an LLM can generate thousands of redundant tool calls and API requests before anyone notices, turning a minor logic bug into a five-figure cloud bill. PolicyAware is built to be the operational safety net that catches this class of failure before it reaches your finance team's dashboard. 1. The Recursive Agent Crisis Every SRE and platform engineer who has run agentic workloads in production has a version of this story. An agent is wired to call an LLM, interpret the response, and take an action—often invoking another tool, which produces output that gets fed straight back into the same LLM. Under normal conditions this loop terminates in a few steps. Under a bad prompt, a malformed tool response, or a subtle logic error, it doesn't. The agent gets stuck reasoning in circles: it calls a tool, receives an ambiguous or malformed result, decides the task is incomplete, and calls the LLM again to "retry." Each retry consumes tokens, each tool call hits a downstream API, and there is no natural circuit breaker unless one has been explicitly engineered. Within minutes, a single stuck session can produce: Thousands of duplicate or contradictory API calls to internal and third-party services. Sustained LLM token consumption that dwarfs normal daily usage. Cascading load on downstream systems that were never designed for machine-speed request volume. By the time monitoring dashboards catch the anomaly—if they catch it at all—the damage is already done: a runaway bill, a rate-limited API partner, or a compromised production database from thousands of unchecked write attempts. Traditional APM tools tell you a service is under load; they don't tell you an autonomous agent is the one generating that load, or why. This is why the recursive agent crisis is fundamentally a governance problem, not just a monitoring problem. Rate limits and cost alerts fire after the

Delete a Telegram bot and https://t.me/your_deleted_bot keeps returning HTTP 200 with a page that looks completely normal. Every link checker I know of — CI actions, directory scripts, monitoring cron jobs — reports it as healthy forever. If you maintain anything that lists Telegram bots, some fraction of your list is already dead and your checks are telling you it is fine. Reproducing it Pick a username that has never existed: curl -s -o /dev/null -w "%{http_code} \n " https://t.me/nonexistent_test_bot_77712 # 200 Two hundred. No redirect, no 404, no soft-404 marker in the body that a status check would catch. Where the truth is The status code is useless here, but the Open Graph title is not. I measured four usernames — two live bots, two that do not exist: URL og:title t.me/BookClassBot (live) BookClass t.me/instanavy_bot (live) StoryViewer - anonymous instagram story viewer tool t.me/nonexistent_test_bot_77712 Telegram: Contact @nonexistent_test_bot_77712 t.me/zzz_definitely_not_a_real_bot_9182 Telegram – a new era of messaging A live bot puts its own display name in og:title . A dead one gets one of two Telegram placeholders: Telegram: Contact @<username> , or — if the username is not even syntactically valid — the generic Telegram – a new era of messaging . That is the whole signal. curl -s https://t.me/some_bot | grep -o '<meta property="og:title" content="[^"]*"' The check Standard library only, no dependencies: import re import urllib.request UA = " Mozilla/5.0 (compatible; linkcheck/1.0) " DEAD_EXACT = { " Telegram – a new era of messaging " , " Telegram " } DEAD_PREFIX = " Telegram: Contact @ " def telegram_bot_exists ( url : str ) -> bool : """ True if the bot behind a t.me URL still exists. HTTP status is not usable here: Telegram serves 200 with a placeholder page for usernames that were deleted or never existed. The Open Graph title is what actually differs. """ req = urllib . request . Request ( url , headers = { " User-Agent " : UA }) with urllib .

The former OpenAI researcher’s fund was forced to unwind public equities after leveraged public bets plummeted. But he still has cards to play.

A new restriction on foreign-made mobile robots affects robotic vacuums, pool cleaners, and lawn mowers. Here’s what it means for the bots already in your home—and the ones you may never get to buy.

There is a number going around that roughly half of all remote MCP servers are dead. I had repeated it myself, in the README of a tool I published. I could not find where it came from, so I measured it. The answer is that about one in ten is actually broken. The "half" figure appears to come from counting servers that require an API key as if they were down. Here is the method and the full breakdown. What I measured On 29 July 2026 I pulled every entry from the official MCP registry — 1,200 servers. Of those, 297 had status: active and advertised a remote endpoint URL (the rest are stdio/local packages with nothing to probe over the network). Each got one anonymous JSON-RPC initialize over streamable HTTP, with a 10 second timeout: { "jsonrpc" : "2.0" , "id" : 1 , "method" : "initialize" , "params" : { "protocolVersion" : "2025-06-18" , "capabilities" : {}, "clientInfo" : { "name" : "mcp-uptime" , "version" : "0.1.0" } } } Then I classified the response: a valid result containing protocolVersion or serverInfo is up, 401/403 is auth-gated, and everything else got bucketed by its actual failure. Results (n = 297) Result Count Share Completed an MCP handshake 133 44.8% Auth-gated (401/403) 134 45.1% DNS failure 8 2.7% Server error (5xx) 6 2.0% Not found (404/410) 5 1.7% Redirect (307/308) 4 1.3% Timeout 2 0.7% Non-MCP response 2 0.7% Other (400, 405, connection) 3 1.0% Reachable: 267 (89.9%). Genuinely broken: 30 (10.1%). Where "half are dead" comes from Look at the first two rows. 55.2% of these endpoints will not complete an anonymous handshake — and that is suspiciously close to the number people quote. But 134 of those 164 are returning a clean 401 or 403. They are running. They are answering. They want an API key, which is a completely reasonable thing for a hosted service to want. Counting those as dead inflates the failure rate by roughly five times. This matters beyond pedantry: if you believe half the ecosystem is rubble, you build defensively against the wron