标签：#ev

Disclosure: I work on the team behind SynapEditor. 🧩 TL;DR: Moving from CKEditor 5 to SynapEditor is a one-to-one swap in three steps: installation, toolbar config, and content/event APIs. The main reason to consider it is Office document fidelity (Word, PowerPoint, Excel import/export). Full runnable example at the end. Switching rich text editors sounds like a big job, but most of the work is a straightforward, one-to-one swap. This guide walks through moving an existing CKEditor 5 integration over to SynapEditor: loading the library, wiring up the toolbar and content APIs, and a complete working example you can copy and run. ⚖️ Which is better: CKEditor or SynapEditor? Both CKEditor and SynapEditor are mature, capable editors. If you already have CKEditor running, it clearly does a lot right. So the question isn't really "which is better" in the abstract, it's which one fits where your product is heading. Two things tend to drive the decision: 📜 Licensing and support. CKEditor 4 reached end of life in 2023, and security fixes now sit behind a paid Extended Support agreement. If you're revisiting the integration anyway, it's a natural moment to reconsider the editor itself. 📄 Office documents. This is where SynapEditor differs most. It imports a broad range of office formats: MS Word (.doc, .docx), PowerPoint (.ppt, .pptx), Excel (.xls, .xlsx, ODT, and HTML, and exports back to Word (.docx) with formatting preserved. If your users upload real documents and expect the layout to survive, that's worth weighing. CKEditor 5 SynapEditor Core editing ✅ ✅ CKEditor 4 still supported Paid ESM only n/a Word / PPT / Excel import-export Limited ✅ Native With that out of the way, let's migrate. 📋 What you'll need [ ] An existing CKEditor 5 integration [ ] A SynapEditor license and API key (free at Get Started ) [ ] About 15 minutes for a basic swap ⚙️ 1. Installation CKEditor 5 loads from a single script. SynapEditor loads from a script and a stylesheet: the UI is styled by tha

Every developer has done it — copy-pasted a JWT, a private key, or a JSON blob with sensitive data into some random website and held their breath. Wondering if it was being logged, tracked, or worse. Every developer has done it — copy-pasted a JWT, a private key, or a JSON blob with sensitive data into some random website and held their breath. Wondering if it was being logged, tracked, or worse. I built KRUMB.DEV because I wanted tools that didn't make me feel dirty after using them. What Is It? 46 developer tools, all in one place. No signup. No uploads. No tracking. Open source. The terminal-inspired interface isn't just aesthetic — it's a constraint. Every tool fits in a single column, zero sidebar, zero popups. Just you and the tool. What's Inside Formatters — JSON, SQL (17 dialects), HTML, JavaScript, CSS Encoders — Base64, URL, JWT decoder, YAML↔JSON, JSON↔CSV Generators — Passwords, UUIDs (v1/v3/v4/v5), hashes (MD5/SHA/HMAC), QR codes, Lorem Ipsum, color palettes, CSS gradients/shadows/grids, meta tags, robots.txt, .gitignore Testing & Debugging — Regex tester, diff checker, webhook tester, cURL→code, HTTP status reference, cron expression builder Converters — Unix timestamps, hex↔RGB, binary, SVG→JSX, JSON→TypeScript, HTML playground, markdown editor Network — DNS lookup, SSL checker, IP lookup, QR code decoder, IBAN validator Why I Built It This Way Most "free" dev tools follow the same pattern: create an account, hit a rate limit, and wonder if your data is being stored somewhere. KRUMB.DEV flips that: Everything runs in your browser — JSON, JWT, source code, passwords never touch a network request Zero accounts — open the page, use the tool, leave. No signup wall between you and the output Clean interface — ⌘K opens a command palette to jump to any tool in seconds Open source — MIT license, deploy your own if you want The Tech Next.js, TypeScript, and Tailwind. Static-first, client-side execution for all core tools. Server routes exist only for DNS/SSL l

TanStack Table V9 is a beta release of a headless UI library for creating tables in various JavaScript frameworks. It features improved state management, memory usage, and extensibility. The notable change is an opt-in feature model, allowing developers to load only necessary components. Migration is gradual, with tools provided for legacy support. The library remains free and developer-focused. By Daniel Curtis

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

The Hidden Vulnerability in Multi-Agent Chains The biggest architectural risk in enterprise AI today isn’t prompt injection—it’s Delegation Escalation . When a human user triggers an AI Agent Orchestrator, which then delegates tasks to sub-agents and tool execution gateways via MCP or internal APIs, traditional static service accounts break down. If you pass broad bearer tokens or static user API keys down the execution chain, you create a massive Confused Deputy vulnerability. To deploy autonomous multi-agent chains safely at enterprise scale, platform architects must enforce OAuth 2.1 RFC 8693 Token Exchange with explicit actor claims. The Non-Human Authorization (NHA) Flow Human User Authorization: A user authenticates and grants a specific, bounded scope (e.g., read:finance ) to the primary Agent Orchestrator. Token Exchange: The Orchestrator leverages OAuth 2.1 Token Exchange (RFC 8693) via the enterprise identity gateway rather than passing raw user credentials downstream. Actor-Claim Scoped Call: The sub-agent or tool execution layer receives a short-lived token containing a nested actor claim ( act ) identifying both the human subject and the orchestrator, ensuring execution authority is strictly bounded by the intersection of their permissions. 3 Non-Negotiable Rules for Agentic Identity Governance Delegation Over Impersonation (RFC 8693): Never allow an agent to blindly impersonate a user. Enforce OAuth 2.1 Token Exchange so every issued JWT token contains a nested actor claim: Human Subject -> Agent Orchestrator -> Sub-Agent . Every downstream API must verify both who authorized the action and which agent executed it. Intersection of Privileges (User ∩ Agent): An agent’s runtime authority must be the strict mathematical intersection of the user’s IAM permissions and the agent’s registered tool scope. An agent should never acquire more system access than the human user who invoked it. Ephemeral Tokens & DPoP Binding: Eliminate static configuration API keys

I run a small script called reply_comments.py that scans my DEV.to articles for comments I haven't replied to yet, and hands me a JSON list so I can draft responses. It's been running twice a day for over a week. This morning, while re-reading it for something unrelated, I noticed the function that decides whether a thread still needs my attention was answering the wrong question — and had been since the day it was written. Here's the function, unchanged until today: def replied_by_me ( comment ): return any ( c [ " user " ][ " username " ] == ME or replied_by_me ( c ) for c in comment [ " children " ]) It walks a comment's entire reply tree and returns True the moment it finds any message from me, anywhere in the subtree. Then pending() uses it as the skip condition: for c in api ( f " /comments?a_id= { a [ ' id ' ] } " ): if c [ " user " ][ " username " ] == ME or replied_by_me ( c ): continue ... out . append ({...}) The logic reads fine in isolation: "did I already reply to this thread? Skip it." The bug is in what "already replied" is being asked to mean. replied_by_me doesn't check whether the latest message in the thread is mine — it checks whether a message from me exists at all, ever, at any depth. Those are the same question exactly once: the first time someone comments and I reply. They stop being the same question the moment the other person replies again. Proving it I wrote a small repro against the real function rather than trusting my read of it: from reply_comments import replied_by_me thread = { " id_code " : " 3c00h " , " user " : { " username " : " alexshev " }, " created_at " : " 2026-07-24T08:00:00Z " , " children " : [ { " user " : { " username " : " enjoy_kumawat " }, " created_at " : " 2026-07-25T10:00:00Z " , " children " : []}, { " user " : { " username " : " alexshev " }, " created_at " : " 2026-07-26T09:00:00Z " , " children " : []}, ], } print ( replied_by_me ( thread )) # True That's True even though the second child — posted a full day

Previously, I wrote about How I Processed 666K Pages Of Flattened PDFs into a Full Text Search Engine called the Apario writer . Upon on the conclusion of the last segment, I was able to optimize the compilation time of the original collection of data by rewriting the sidekiq Ruby pipeline script into a dedicated Go Application. Regardless of what compiling the PDF assets would look like, I still needed to serve those assets - and that's where the writer did little to nothing to actually address the OPEX of the project from 2020. Given the size of the data set, the 666K pages ended up compiling into a directory of ~1.13TB in size. This was held in storage that was distributed across several high volume storage dedicated servers on OVH behind MinIO . This provided an S3 compatible API directly. What I Know About OPEX OPEX or Op erational Ex pense is how you describe a spending of money that is used explicitly for the operations of the business versus a capital expense. Hardware was considered a CAPEX or Cap ital Ex pense. So when Bit Fry Game Studios needed their DevOps pipeline upgraded for the 9 hour game builds into a 30 minute private enterprise cloud build, it required a CAPEX investment of $69K plus trust in me in order to achieve a -$15K/month OPEX savings. Annualized over a hardware lifecycle, over $472K can be recovered from OPEX by making a small CAPEX expense up front. One of the first projects that I ever worked on was in PHP and MySQL on Ubuntu 8.04 . It was to balance the budget of a department that had ACME Bucks so to speak. It required me to write a finance module, fully tested, that managed Blue , Green and Black dollars. Blue dollars were for OPEX. Green dollars were for CAPEX. Black dollars were for external vendors where money left the company (versus moving between departments). Black depreciated instantly - meaning 100% of it was paid immediately. Blue dollars were borrowed over a 12 month pay-back period. Green dollars were borrowed over a 36

We had a gitflow pipeline that looked clean on paper: develop feeds a release branch, the same build artifact promotes through dev, qa, sit, uat, and prod, and once prod is green we tag the commit on main. Textbook. Then a production bug showed up on a Tuesday afternoon, and the diagram stopped mattering. The standard gitflow answer is to branch a hotfix off the tag, PR it back into release, run it through the pipeline, and once it's proven in UAT, merge to main and cherry-pick the same commit back into develop. We built exactly that. It works. Until you ask the question nobody wants to answer out loud: release still has whatever was mid-flight when you cut the last tag. Untested code. Feature work three sprints deep in QA, sitting on the same branch you're now supposed to route your hotfix through. So the real question we ended up arguing about wasn't "how do we release a hotfix." It was "do we trust the release branch enough to put a hotfix through it." Most of the time, the honest answer is no. The gate everyone obsesses over is the wrong one Five environments, five sign-offs, a change ticket for each one: that's the smell people point at first when a pipeline feels slow. It's real. It's just not the dangerous one. A slow gate costs you time. A gate you route around because you didn't trust your own process costs you an incident. Here's what we landed on after the argument: release the hotfix directly from the hotfix branch, not through release. On Azure, that means deploying to the UAT slot, smoke-testing against production data shape, then toggling the slot. Same infrastructure, same config, none of release's baggage riding along. Once it's live, cherry-pick the commit into both develop and main, retag, and let the normal pipeline catch up on its own schedule whenever it gets there. That's a smaller number of gates (one real test in the slot, one human sign-off) that actually mean something, instead of five theatrical ones inherited from a process built for pla

I shipped GoGBA (Android + iOS) to both stores in late December 2025. Six months in: MAU peaked at 8.3k, currently steady around 7.4k. No paid advertising, ever. This is a write-up of what the six months actually involved. I'll be specific about the technical work, and equally specific about the mistake that cost me RetroAchievements hardcore certification — because that part is the most useful thing here for anyone building in this space. Why GBA only I grew up on a GBA — Super Robot Wars, Fire Emblem, Pokémon, Castlevania, Zelda. Later NDS/3DS/PSP/Vita/Switch arrived and the GBA did its job and retired. On PC the emulator I remember is VisualBoyAdvance. I've used GBA, NDS and PSP emulators on phones. I kept coming back to GBA, for four reasons that are all practical rather than nostalgic: Pixel art holds up. Personal taste, no defense offered. Battery. A GBA game survives a long-haul flight. Single screen. The remaining screen space is exactly where virtual buttons want to go. NDS dual-screen on a phone is always a compromise. ROM hacks. The GBA hack scene is the richest of any handheld. Point 3 is the one that made me build something: GBA is the only handheld whose form factor natively fits a phone. That's a product observation, not sentiment. What existing emulators get wrong (for me) I used the main ones on both platforms: Delta and Linkboy on iOS; Pizzaboy, Linkboy and Lemuroid on Android. Lemuroid is open source and a lot of shipped emulators are built on it. They're all good. Every one of them had small things that annoyed me. The only genuinely cross-platform one is Linkboy (formerly MyBoy), but its configuration surface is extremely deep — second only to RetroArch in complexity. That's the gap. Everyone was solving "can it run" and "can it be tuned perfectly." Nobody was solving "pick it up and play." The methodology was just dogfooding I'm a Flutter GDE and tech lead for a 40-person cross-platform team; GoGBA was a solo test of that experience. The only r

React useDeepCompareEffect: Fix useEffect Object Dependencies (2026) You wire up a fetch. The endpoint takes a query object, so you pass it in the dependency array. The effect fires, sets state, the component re-renders, the query object is rebuilt — a brand-new object with identical contents — and the effect fires again. You have written an infinite loop, and React thinks it did exactly what you asked. function Results ({ term , page }: Props ) { const [ rows , setRows ] = useState ([]); const query = { term , page , sort : ' desc ' }; // new object, every render useEffect (() => { fetchRows ( query ). then ( setRows ); // setRows → re-render → new query → 🔁 }, [ query ]); } useDeepCompareEffect from @reactuses/core is a drop-in replacement for useEffect that compares dependencies by value instead of by reference. Same signature, same cleanup semantics — the effect just stops firing when nothing actually changed. Everything below is the real implementation, TypeScript-first, including the parts that cost you something. Why useEffect Can't See It React compares dependency arrays with Object.is , element by element. For primitives that's exactly what you want: 5 is 5 , 'desc' is 'desc' . For anything with an identity — objects, arrays, Date s, Map s, functions — it compares the reference , and a literal written inside a component body produces a fresh reference on every single render: Object . is ({ term : ' react ' }, { term : ' react ' }); // false — different objects So the dependency "changed" on every render, by React's definition. This isn't a bug in useEffect ; reference equality is the only comparison that's O(1), and React runs it on every render of every component. The cost of value comparison is real, and React declines to pay it on your behalf. Which leaves you paying it — one way or another. The Usual Workarounds, and Where They Fray Memoize the object. Correct, and the right answer when there's one dependency: const query = useMemo (() => ({ term , page

In CSS, the term "box model" is used when talking about web design and layout.The CSS box model is essentially a box that wraps around every HTML element. Every box consists of four parts: content, padding, borders and margins. EXPLANATION Content - The content of the box, where text and images appear Padding - Clears an area around the content. The padding is transparent Border- A border that goes around the padding and content Margin - Clears an area outside the border. The margin is transparent div { width : 400px ; border : 12px solid green ; padding : 50px ; margin : 20px ; }

Gemini Prompt for Google AI Studio Image Generation Prompt (paste into Gemini image generator): A futuristic cityscape at sunset with a swirling vortex of neon lights and flying cars; multiple translucent tetrahedron bubbles forming a luminous word-and-light matrix suspended above a skyline of glass spires; warm magenta and orange sunset on the horizon blending into electric cyan and violet neon; reflective wet streets below mirroring the tetrahedra; dynamic motion blur on flying vehicles; volumetric fog and light shafts; high-detail, cinematic wide-angle, ultra-detailed textures, rim lighting on edges, subtle lens flares, 8k, photorealistic + stylized neon cyberpunk aesthetic. Suggested Generation Settings: Model: Gemini multimodal image model Aspect Ratio: 16:9 (wide cinematic) Quality / Resolution: High / 8k or max available Style: Cyberpunk photoreal + neon stylized Guidance / Creativity: Medium-high (to keep structure but allow creative tetrahedron arrangements) Seed: Leave blank for variety or set a fixed seed for reproducible results Safety / Content Filters: Default on Image Variations to Request Close-up: Single tetrahedron bubble with internal micro-lights forming a single glowing word fragment. Aerial: Bird’s-eye view of the vortex and traffic lanes of flying cars. Night variant: Same scene fully after dark with intensified neon contrast. Motion study: Long-exposure streaks from flying cars and rotating tetrahedra. Export & Integration Notes Export images as PNG for transparency-friendly assets and MP4 or animated WebP for short looping demos. Generate a short 10–15s video loop from Gemini if available to show the vortex animation for your demo. Use the image as background and the video loop as a hero demo in your CodePen prototype. DEV Submission (Ready-to-publish Markdown) Title Multiple Tetrahedron Bubble Word and Light Matrix — A Neon Vortex Cityscape What I Built What I built: a generative visual piece that layers geometric tetrahedron bubbles into a

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. The...

I've built dozens of dashboards. Most have been ignored. A few have been used constantly. The difference isn't the graphs. It's the design. The 3-second test A useful dashboard answers 'is everything OK?' in 3 seconds. Not 'let me scroll through 40 graphs to find out.' Big colored header at the top: green = healthy, yellow = watching, red = broken. That's the 3-second answer. Everything else is drill-down. The hierarchy rule Three layers, no more: Overview — one line per service, status color, key SLI Service detail — one dashboard per service, 6-12 graphs max Deep dive — triggered from service detail, domain-specific Anything beyond 3 layers is 'please get lost in my dashboard tree.' The on-call test Imagine you're on-call at 3 AM. You get paged for 'service X is slow.' Can you, in 30 seconds, use this dashboard to tell if the problem is the service itself, its database, its upstream dependency, or its downstream consumers? If yes, the dashboard works. If no, redesign. What to cut Graphs with no baseline (flat line or spiky forever — how do you know if it's bad?) Metrics you've never used in an actual incident Vanity metrics (total requests ever) Graphs where the y-axis is in units nobody understands The hidden metric The real measure of a dashboard's value: does the on-call engineer open it before or after the paging tool? If they open it first — it's their compass. If they open it only after being paged — it's a reference, not a dashboard. Aim for the first. Written by Dr. Samson Tanimawo BSc · MSc · MBA · PhD Founder & CEO, Nova AI Ops. https://novaaiops.com

A few months ago, I submitted a talk proposal to WordCamp US without really knowing what to expect. Today, I'm happy to say that it was accepted, and I'll be speaking at one of the largest WordPress conferences in the world. WordCamp US has always been one of the events I've looked up to in the WordPress ecosystem. As someone who has spent over a decade building content platforms with WordPress, contributing to open source, and working with teams across different countries, having the opportunity to share my experience on that stage is something I don't take for granted. My session is: Stop Blaming WordPress: Building a Real Editorial Workflow Without Leaving the Ecosystem Throughout my time working with WordPress, I've noticed a recurring pattern. When editorial teams struggle to publish content efficiently, WordPress often gets the blame. But after working with organizations of different sizes, I've learned that the CMS is rarely the real problem. The real challenges are usually: disconnected editorial processes; unclear content ownership; missing approval workflows; inconsistent governance; too much reliance on manual work. In this session, I'll share practical strategies for building scalable editorial workflows while keeping WordPress at the center of the ecosystem. The goal isn't to introduce another platform, it's to make the existing one work better. Speaking at WordCamp US is especially meaningful because I've been part of the WordPress ecosystem for many years. Being able to give something back to this community is an opportunity I'm genuinely grateful for. If you'll be at WordCamp US 2026 in Phoenix, I'd love to connect. 🎟️ Get your ticket: https://us.wordcamp.org/2026/tickets/ 💸 Use my speaker discount: speaker-friend20 during checkout for a discount on your ticket. See you at WCUS! 🚀

Lightsail is a good home for a single small container: flat pricing, bandwidth included, and none of the VPC/security-group ceremony of EC2. The one rough edge is pulling a private image from Amazon ECR , because a standard Lightsail instance can't authenticate to ECR the way EC2 can. This post walks the whole path. The pipeline we're building: docker build ──push──> ECR (private repo) ──pull──> Lightsail instance ──run──> container What you'll need An AWS account and the AWS CLI installed locally. Docker installed locally (to build) and on the Lightsail box (to run). A Dockerfile that produces a runnable image. If you're deploying a Next.js app, a standalone output image works well. 1. Create the ECR repository ECR is a private Docker registry. Create one repository per image: aws ecr create-repository \ --repository-name project-name \ --region us-east-1 Note the repositoryUri in the output — it looks like: <account-id>.dkr.ecr.us-east-1.amazonaws.com/project-name You'll use that URI everywhere below. Export it to save typing: export ECR_URI = <account-id>.dkr.ecr.us-east-1.amazonaws.com/project-name export AWS_REGION = us-east-1 2. Build the image locally First, the Dockerfile . This is a multi-stage build for a Next.js app using output: "standalone" — the first stage installs dependencies and builds, the second copies only the traced runtime files into a slim image that runs as a non-root user: FROM node:24-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci COPY . . RUN npm run build FROM node:24-alpine WORKDIR /app ENV NODE_ENV=production ENV PORT=3000 ENV HOSTNAME=0.0.0.0 # Standalone output ships only the traced files needed to run the server. # public and .next/static are not included by default and must be copied in. # --chown makes the files writable by the non-root user so Next.js can write # its runtime cache to /app/.next/cache. COPY --from=builder --chown=node:node /app/public ./public COPY --from=builder --chown=node:node /app/.next/stand

AI design tools have gone from generating blurry wireframe suggestions to shipping functional,...

There's something about a movie like The Room, Troll 2, or Fateful Findings that I find irresistible. These sorts of "so bad they're good" films are marvelous curiosities where ambition far outstrips resources, ability, and self-awareness to become something much greater than the sum of their parts. Champagne and Bullets (also released as GetEven and […]

A smart contract can't tell whether a submitted score came from a valid game or was simply made up. Dario Dash handles that by proving the run itself. I have been building Dario Dash , a small endless runner on Dusk. The game runs in the browser and does not require a wallet to play. After a ranked run, the browser can generate a Groth16 proof locally and submit the score to a smart contract. The contract does not trust the submitted score. It accepts it only after verifying the proof, binding it to the transaction sender and checking that the run seed has not already been used. The source is available on GitHub . What actually needs to be proven? A score by itself says almost nothing. A client could simply submit any number it wants. For Dario Dash, a valid run includes much more than the final score: the player movement and jump timing the seed-derived obstacle schedule obstacle clearance and collision windows item pickups damage and game-over conditions fireball kills transitions between Regular, Super, Fire and Cape forms the number of ticks played the resulting score The proof must establish that these rules were followed from the initial state until the claimed final state. It also needs to bind the run to the account submitting it, otherwise somebody could copy another player's proof. The architecture The repository is split into a few layers: dash_zk contains the deterministic game simulation used by the browser proving path. dash_core contains a separate 60 Hz simulation used by the RISC Zero path. dash_web exposes the Rust simulation to the browser through WebAssembly. zk_browser contains the Circom circuit and the JavaScript proof conversion code. contract verifies the proof and maintains the leaderboard on Dusk. web contains the playable Vite application. The important boundary is that the game logic is deterministic and integer-only. Floating point physics would be a mess to reproduce consistently across JavaScript, WebAssembly, the proof circuit and th

When good cameras got cheap, everyone predicted the death of professional photography. The prediction landed wrong. The low end died outright: stock libraries, cheap portraits, mass-event coverage went to anyone with a phone and a free editing app. The high end did better than ever — editorial work, photojournalism with access nobody else had, an aesthetic you could not reproduce by buying the same gear. The damage landed in the middle. Small weddings, corporate headshots, real estate listings, the steady unglamorous bulk of the market: not extinction, compression. Prices fell, volume moved to cheaper substitutes, and the survivors climbed up or specialized out. That compression is the cleanest map I know for what AI-assisted coding is doing to software work. And this half I know from inside: two decades leading dev teams, and now building AI tooling for them. The comfortable half of the argument The reassuring version of this is everywhere right now: you were never paid to type, you were paid to think, so AI just frees you to do the valuable part. It's not wrong. It's just the half that's easy to hear. The other half is about the market, not about you. Judgment, architecture, knowing what breaks in maintenance, deciding what not to build — a model that writes plausible code on command doesn't commoditize any of that. I have watched weeks of confusion land on people who could not read what a capable model generated; the gap was never the tool, and better AI autocomplete does not close that gap. But "judgment beats typing" answers only a question about skill and dodges the question about market structure. AI doesn't replace developers as a class; it commoditizes a segment. The segment it hits first is the same one the camera hit: the middle. The junior-to-mid tier that lived on CRUD apps, simple integrations, brochure sites, the standard internal tool with a form and a table behind it. That work was always implementation against a known spec, and implementation again