标签：#programming

submitted by /u/der_gopher [link] [留言]

BLUF / Executive Summary: Target: Model Context Protocol (MCP) HTTP/SSE Server endpoints. Discovery: Audit of 5,308 public MCP endpoints revealed 65% lack transport authentication . Solution: Introducing MCPGrade ( mcpgrade-1.4.0 ) , a 39-check rating algorithm. The Model Context Protocol (MCP) is now the standard for connecting AI models to tools and data. But as developers deploy MCP servers, security has lagged. In our audit of 5,308 public MCP servers under SentinelReign research, over 3,450 servers (65%) exposed tool execution capabilities without authentication. MCPGrade ( mcpgrade-1.4.0 ) Matrix Assessment Domain Checks Impact Weight 1. Transport Authentication 10 Checks 35% 2. Tool Scope & Authorization 12 Checks 30% 3. Input Validation & Injection 9 Checks 20% 4. Rate Limiting & Audit Logging 8 Checks 15% Check out the full teardown and live A-F scanner at Andrax Pentester . Written by Syed Zada Abrar — Founder & CEO of SentinelReign ( https://sentinelreign.com ).

Pulled live from leetcode.com/problemset/?difficulty=Hard on 29 Aug 2026 (895 hard problems in the Algorithms list). "First 30" = the 30 lowest problem numbers. Everything below is Python 3 . How to use this Open the problem on LeetCode and make sure the language selector says Python3 . Select all the text in the code editor and delete it. Paste the block below in its place — each block already contains the class Solution signature LeetCode generated for that problem, plus any commented-out ListNode / TreeNode header. Press Submit . Do not add import statements or redefine ListNode / TreeNode — LeetCode injects typing.List , typing.Optional , heapq , math.gcd and the node classes automatically. The blocks are written to rely on exactly that. Verification Every solution was executed locally against an independent brute-force reference on randomised and edge-case inputs ( 4,637 assertions, all passing ), then stress-tested at each problem's documented maximum input size ( 31/31 within budget ). Two real defects were found and fixed during that pass — see the notes on #127 and #149. 4. Median of Two Sorted Arrays https://leetcode.com/problems/median-of-two-sorted-arrays/ Approach. Binary search on the cut position of the shorter array. O(log(min(m,n))) , O(1) space. Constraints (from the problem page). nums1.length == m nums2.length == n 0 <= m <= 1000 0 <= n <= 1000 1 <= m + n <= 2000 -10 6 <= nums1[i], nums2[i] <= 10 6 class Solution : def findMedianSortedArrays ( self , nums1 : List [ int ], nums2 : List [ int ]) -> float : # Binary search on the shorter array's cut position. O(log(min(m, n))). if len ( nums1 ) > len ( nums2 ): nums1 , nums2 = nums2 , nums1 m , n = len ( nums1 ), len ( nums2 ) lo , hi = 0 , m total = ( m + n + 1 ) // 2 while lo <= hi : i = ( lo + hi ) // 2 # take i elements from nums1 j = total - i # take j elements from nums2 l1 = nums1 [ i - 1 ] if i > 0 else float ( ' -inf ' ) r1 = nums1 [ i ] if i < m else float ( ' inf ' ) l2 = nums2 [ j - 1 ]

An API operation can receive input from several places. Path parameters identify the record. Query parameters filter or paginate the result. Headers carry metadata or authentication. The request body contains structured data for create and update operations. An MCP tool should give the AI client one clear input schema. That is the mapping problem: HTTP API inputs path + query + headers + body become MCP tool input one structured schema the AI client can understand This tutorial walks through that mapping with practical examples. The goal is to make the tool easy for an AI client to call without hiding the real API contract. Example API operation Imagine a project-management API with this endpoint: PATCH /workspaces/{workspace_id}/projects/{project_id}/tasks/{task_id} It updates one task. The API accepts: path parameters for workspace_id , project_id , and task_id ; query parameters such as notify_assignee ; a request body with the fields to update; authentication through a Bearer token header; an optional request header such as Idempotency-Key . A shortened OpenAPI-style version might look like this: paths : /workspaces/{workspace_id}/projects/{project_id}/tasks/{task_id} : patch : operationId : updateTask summary : Update a task description : " Update the title, status, assignee, or due date for one task." parameters : - name : workspace_id in : path required : true schema : type : string - name : project_id in : path required : true schema : type : string - name : task_id in : path required : true schema : type : string - name : notify_assignee in : query required : false schema : type : boolean default : false - name : Idempotency-Key in : header required : false schema : type : string requestBody : required : true content : application/json : schema : type : object properties : title : " " type : string status : type : string enum : [ todo , in_progress , blocked , done ] assignee_id : type : string due_date : type : string format : date minProperties : 1 securi

About a month ago, Crystal 's multi-threading moved out of preview. I'm a little late with the blog post, but figured I'd share it here in case someone is interested in the language. To those unfamiliar with Crystal , it's basically an AoT-compiled language with a syntax that's inspired by Ruby but with static type safety. It doesn't have a big org behind it, so Manas Tech still working on the language and shipping enhancements is quite amazing imo. I will add that while it's used by Kagi and Lavinmq , I don't think either company has the same resources to pour into Crystal as Jane Street does with OCaml . I haven't really had the chance to play around with the changes. So, got no clue on what the experience is like. submitted by /u/Bassfaceapollo [link] [留言]

submitted by /u/ngruhn [link] [留言]

When people see a browser extension add translation controls, a side panel, or a sending workflow to WhatsApp Web, a common question is: how does the extension actually interact with the page? The short answer is that a modern Chrome extension is split across several execution environments. No single script should be responsible for the interface, persistent state, task scheduling, and access to the page at the same time. This article explains the architecture at a practical level without depending on private implementation details that may change whenever WhatsApp Web changes. A browser extension does not run as one program The simplest mental model is to divide the extension into four parts: The extension interface A background service worker A content script attached to WhatsApp Web A small bridge running in the page's own JavaScript context Each part has a different job and a different level of access. The extension interface is what the user sees: forms, task history, translation settings, saved scripts, and media selection. It should focus on interaction rather than long-running work. The background service worker coordinates tasks and stores state. It can receive a request from the interface, keep track of progress, and send commands to the correct WhatsApp Web tab. The content script lives alongside the webpage. It can inspect the rendered document, inject controls, and communicate with the extension runtime. Chrome isolates it from the page's own JavaScript environment for security. The page bridge exists because isolation is sometimes a limitation. A content script can see the DOM, but it does not automatically share the same JavaScript objects as WhatsApp Web. When deeper page integration is required, a carefully scoped bridge can exchange explicit messages between the isolated extension world and the page world. Why not put everything in the content script? It is tempting to keep the entire feature in one file because the content script is already attach

The agent harness I work on has an Electron GUI that shares a renderer with a web shell. Last night it broke twice in one evening. The second break was caused by the first fix. Both were silent. The first one I could explain. The second one was the interesting one, because it exposed something the first fix's test suite could not see — and the fix was a guard that checks reality instead of checking the guard's own arithmetic. Failure one: the light-theme regression. The React shell used CSS custom properties for theming, but a chunk of the migration hardcoded dark-palette hexes directly in component CSS. In light mode the UI looked wrong: dark text on light cards, bad contrast, the exact shape of a half-finished theme refactor. The fix was to route everything through theme variables (the release shipped that as v0.2.84). Straightforward. Failure two: the fix had a hole, and the hole was invisible. After the theme-variable fix landed, a second round of breakage showed up: the task-form background rendered transparent, file-tab hover was dead, badge font sizes and radii were wrong. Nothing threw. No console error, no crash, no failing test. The cause: the fix consumed four variables — --fs-small , --radius-sm , --bg-1 , --bg-hover — that did not exist in tokens.css . A bare var(--x) with no fallback is not an error. At computed-value time the declaration becomes invalid at computed-value time , and the property is treated as if it were never specified. The element just falls back to the default — transparent background, no hover style, default font metrics. The failure mode of an undefined CSS variable is silence. This is the part I want to keep: the bug was not a wrong value. It was a value that was never there, consumed as if it were. The tests passed because the tests asserted behavior, and the behavior was "whatever the browser does with an invalid declaration". The guard that checks definedness. The fix was a guard, not just a value: a static test that walks ever

submitted by /u/mmatloka [link] [留言]

AI coding agents are getting very good at writing code. They can build components, create APIs, fix bugs, and implement features from short prompts. But I kept noticing one issue: Working code does not always mean a good product. For example, if you ask an agent: “Add a delete button to every project.” It may technically do exactly that. But will it also think about: confirmation before deletion error handling undo options accessibility clear feedback to the user Those are not just coding problems. They are product judgment problems. That led me to experiment with a reusable instruction layer for AI coding agents at AudranLab. The idea is simple: Instead of only asking an agent, “Can you build this?”, also encourage it to ask, “Is this a good way to build it?” I want agents to consider things like accessibility, failure states, destructive actions, usability, and sensible defaults while they work. This does not magically turn an AI into a product designer. But I think it raises an interesting question: Can explicit product principles consistently improve the quality of software generated by coding agents? That is what I’m currently exploring. My next step is to test the approach across different coding tasks and compare the results with and without the additional product-judgment layer. If you’re interested in AI agents, LLM reliability, developer tools, or applied AI, I’ll be sharing more experiments here. AudranLab: https://www.audrantechlab.online/

Leaving a class open to inheritance is a design decision, not a default you can ignore. The core idea An unsealed class is a promise: every virtual member can be overridden without breaking what the class guarantees. Most classes never meant to make that promise. They're just unsealed by default, because that's what class gives you unless you say otherwise. Common mistake: treating sealed as "I don't want to think about subclassing" rather than "this type's invariants would break if someone could." One override breaks the promise Here's the promise, a BankAccount that refuses to go negative: public class BankAccount { public decimal Balance { get ; protected set ; } public virtual void Withdraw ( decimal amount ) { if ( amount > Balance ) throw new InvalidOperationException (); Balance -= amount ; } } And here's the override that breaks it: public class RiskyAccount : BankAccount { public override void Withdraw ( decimal amount ) { Balance -= amount ; // no check } } Nothing here is exotic. It compiles cleanly, and RiskyAccount is a perfectly legal BankAccount as far as the type system is concerned. Open one with a balance of 100 and withdraw 500: BankAccount account = new RiskyAccount ( 100m ); account . Withdraw ( 500m ); Console . WriteLine ( $"Balance: { account . Balance : F2 } " ); Real dotnet run output: Balance: -400.00 The check on the left never ran. virtual was an open invitation, and RiskyAccount took it. Sealing turns a silent bug into a compile error Without sealed , the code above compiles and produces a wrong answer at runtime; nothing points you at the problem until it's already in production. With sealed , the same mistake becomes something the compiler catches before the code ever runs: public sealed class BankAccount { public decimal Balance { get ; protected set ; } public void Withdraw ( decimal amount ) { if ( amount > Balance ) throw new InvalidOperationException (); Balance -= amount ; } } public class RiskyAccount : BankAccount { } // error

Have you ever thought about how a sandbox tunnels a public URL out to the world when one end of the tunnel is untrusted code owned by the user? Take an example: a localhost:3000 app running in a sandbox inside a VM. The user wants a public link for it. It looks like a reverse proxy. It isn't, because the app behind the link is untrusted code. It feels easy, but for security it's full of hiccups. The naive version, and the holes it leaves. If there's just a public URL, anyone can hit it, and if the user doesn't want it shown to the world, that's not acceptable. If we put a secret token in the URL, it leaks, via browser history, referer headers, and server logs. And either way, the hostile app can steal or forge the visitor's session. A normal reverse proxy forwards traffic to a backend it trusts: your own app. This gateway forwards to a backend it must distrust: the user's code running in the VM. It's still a reverse proxy, it's just one whose backend you can't trust. That single inversion is why every byte crossing it, in both directions, gets inspected. What we actually want: a secure runtime URL, behind a reverse proxy, that can't be exploited, not against the visitor and not against the worker the sandbox stays executable and runnable while the URL is live the user can share it with anyone they choose, but it is not public This is deliberately not a plain browser-link architecture. It works through cookies, and it needs one extra sign-off step before the user gets a usable session. So how do we stop a random person from just landing on a particular sandbox's exposed URL? HMAC. How it actually works, in real time. There is no dumb reverse proxy blindly routing traffic into the sandbox. First, the traffic hits the edge (Caddy, wildcard TLS) and lands on cmd/preview-gateway. Its first job is to parse the host into sandboxID + port. Both are client-supplied through the URL, so the sandboxID is then strictly UUID-validated. Second, it verifies the token against its si

submitted by /u/BrewedDoritos [link] [留言]

Follow-up to my 512 MB Spring Boot experiment: I tried the same application on a 256 MB Alpine VPS. JDK 21 struggled badly at this size, but with JDK 25 and a tuned 80 MB heap, the app plus lightweight monitoring completed a one-hour run without restarts or OOM kills. Still not something I’d recommend for normal production, but the difference was interesting. submitted by /u/fykup [link] [留言]

Nuance is the thing that gets you levelled up, and hedging is the thing that gets you levelled down. They sound almost identical from the outside, and the difference is entirely structural. Ask a junior engineer whether to use SQL or NoSQL and you get an answer. Ask a senior engineer and you often get "well, it depends", which is correct, and delivered badly it costs them the round. The problem is not the nuance. It is the order. Hedging leads with the uncertainty and never arrives at a decision. Judgement leads with the decision and then shows the uncertainty around it. Same knowledge, opposite impression. Why hedging reads badly An interviewer is trying to answer one question: would I trust this person to make a call without me in the room. A candidate who lists options without choosing has actively failed to demonstrate the thing being assessed, no matter how well they understand the options. There is a second, less obvious cost. Refusing to commit removes the interviewer's ability to go deeper. They cannot probe a decision you did not make, so the conversation stays shallow, and shallow conversations produce mid-level scores by default. A candidate who says it depends and stops has told the interviewer nothing except that they know it is complicated. Everyone at this level knows it is complicated. The four-part structure This works for almost any technical choice you will be asked about, and it takes about twenty seconds to deliver. Commit. Name what you would actually ship. One sentence, no preamble. Justify. Give the specific reason, tied to the constraints in the question rather than to general virtue. Cost. Say what you are giving up. Every choice loses something and naming it is the seniority signal. Trigger. State the condition that would change your mind, and ideally what you would watch for it. Notice that all the nuance from "it depends" is present. It is simply arranged behind a decision instead of in place of one. Would you use a relational database o

Hello! I'm a beginner developer with my sights set on backend development and data modeling. Like a lot of people starting out, I didn't come in with a computer science degree or years of professional experience — just curiosity about how applications actually store, organize, and make sense of data behind the scenes. Backend work has always felt like the "engine room" of software to me. While frontend gets the visual credit, it's the data layer that quietly decides whether an application is fast, reliable, and able to grow. That's what pulled me toward backend and database design in the first place. My biggest challenge so far has been learning SQL and data modeling from scratch. It sounds simple on paper — write some queries, design some tables — but in practice it meant rewiring how I think. I had to move from "how do I make this work right now" to "how do I structure this so it still works when the data grows, the requirements change, or someone else has to read my schema six months from now." Concepts like primary keys, foreign keys, relationships between tables, and eventually normalization weren't hard to memorize, but they were hard to internalize — to actually reach for instinctively when designing something from a blank page. A few things clicked for me along the way: A good schema is a form of communication. Table and column names, relationships, and constraints tell a story about the business logic, not just the data. Getting it "perfectly right" on the first try isn't the goal. Iterating on a design after seeing how data actually flows through it taught me more than any tutorial did. SQL rewards precision. Small differences — a missing JOIN condition, the wrong key, an unindexed column — can quietly break correctness or performance, so being deliberate matters. Constraints are a beginner's best friend. Things like NOT NULL, UNIQUE, and foreign key constraints catch mistakes early instead of letting bad data pile up silently. This foundation in SQL and d

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is free and source-available on Github. Star git-lrc to help devs discover the project. Do give it a try and share your feedback. A couple of posts back we spent a while inside XOR distance , then used it to build Kademlia , the DHT algorithm that lets a network find anything without a directory. Kademlia: Algo That Turned XOR Distance Into a Network Athreya aka Maneshwar Athreya aka Maneshwar Athreya aka Maneshwar Follow Aug 26 Kademlia: Algo That Turned XOR Distance Into a Network # webdev # programming # beginners # algorithms 20 reactions Add Comment 6 min read I promised that algorithm shows up "under BitTorrent, IPFS, Ethereum." Today we cash that check. We're taking BitTorrent apart, piece by piece, and Kademlia is going to walk right back in through the side door. Also, fun fact before we start: a suspicious number of people on Reddit think Bram Cohen, the guy who wrote BitTorrent alone in Python in 2001, is secretly Satoshi Nakamoto. I'm not saying it's true. I'm saying that by the end of this post you'll understand why people keep saying it. The number that should not have been possible In 2004, a measurement firm called CacheLogic reported that BitTorrent alone was responsible for roughly 35% of all internet traffic. More than every other peer to peer network combined. More than the entire web. One protocol. Written by one guy. No company. No datacenter. No servers anywhere with "BitTorrent Inc" on the rack. That last part is the whole story. Every "normal" system you've ever worked on scales by throwing money at it: bigger box, more replicas, a CDN in front. BitTorrent had nobody to throw money at anything, so every hard problem, capacity, trust, scheduling, incentives, discovery, had to get solved inside the protocol itself . Problem 1: the client-server ceiling has a name Distributing a file in 2001 meant one server, one uplink, and every download eating

A ideia de um sebo que não perde estoque: No primeiro período, nosso grupo desenvolveu um Sebo Virtual. O objetivo era resolver a dificuldade de sebos tradicionais em conciliar estoque físico e virtual, com pagamento via PIX e envio de recibo por e-mail. Minha responsabilidade foi a engenharia de prompt utilizando o Lovable. Quando a IA não entendia o que eu queria: Os primeiros prompts retornaram resultados incompletos. Ao solicitar "explique o código por trás da aplicação", a resposta foi genérica e não detalhou a integração com o banco de dados. Também houve dificuldade em fazer a ferramenta compreender fluxos específicos, como leilão de itens, validação de cupons e cálculo de frete por CEP. O que mudou quando usei diagrama e contexto: O resultado melhorou quando passei a incluir contexto e artefatos. Três prompts funcionaram bem: para wireframe, enviei o diagrama e solicitei o protótipo das telas; para o leilão, pedi quatro telas com checkout e histórico de transações; para o back-end, solicitei as linguagens utilizadas e o fluxo de integração ao banco preservando as informações da documentação. Com isso, identifiquei a stack gerada: React com TypeScript no frontend e Supabase no backend, com consultas como from('pedidos').select('*').eq('usuario_id', id) . Do sebo para qualquer loja online: As regras implementadas, como cupons LIVRO10 e SEBO20, frete proporcional ao peso e checkout via PIX para o endereço base na Rua dos Livros, 707, João Pessoa, são aplicáveis a qualquer e-commerce de pequeno porte. O método permite transformar uma ideia em protótipo navegável em poucas horas. O que levo disso para a carreira? O projeto mostrou que, além do código, a capacidade de formular perguntas claras e organizar a documentação em fluxograma e diagrama de classes é fundamental. Foi meu primeiro case prático e base para portfólio na área de dados e produto. EN Summary: As a first-semester student, our team built a Virtual Bookstore to manage physical and online inventory w

I’m setting up a local AI development environment on Windows + WSL2 and I’m trying to decide between two architectures. Option 1 — Ollama/Models on Windows WSL2 ┌───────────────────┐ │ Application │ │ ├── Python │ │ ├── .venv │ │ └── Source code │ └───────┬───────────┘ │ HTTP localhost:11434 │ ▼ Windows ┌───────────────┐ │ Ollama │ │ ↓ │ │ Models │ │ ↓ │ │ GPU │ └───────────────┘ Option 2 — Ollama/Models inside WSL2 WSL2 ┌─────────────────────────┐ │ Application │ │ ↓ │ │ Ollama │ │ ↓ │ │ Models │ └────────────┬────────────┘ │ GPU access │ ▼ Windows ┌─────────────────────────┐ │ GPU / Driver │ └─────────────────────────┘ My current setup is Option 1 , and it works: WSL2 can access the Windows Ollama API through localhost:11434. But I’m wondering if Option 2 is a better long-term architecture for local AI/LLM development. I’m especially interested in: 🚀 Performance 🎮 GPU utilization 🧠 Model management 💾 Disk usage 🔧 Setup and maintenance 🐧 Linux/ML tooling 🐳 Docker integration 🌐 Networking 📈 Future scalability If you use Ollama with Windows + WSL2, which architecture would you choose and why? And if you've actually used both setups, I'd especially like to hear about your experience. 👇 Option 1 or Option 2?

The criticism of this is everywhere. Open any Go thread long enough and someone will show up to perform the same ritual: "Go projects become messy. There's no framework to guide you. Nest, Django, Spring, they all tell you exactly where to put things. Go? It just says 'organize it somehow.'" It's a fair criticism. Go is unusually permissive about structure. I just think blaming Go for a messy codebase is like blaming the empty document for the bad essay. I don't think Go encourages bad architecture but rather it exposes it. The Hell Is A Perfect Folder Structure?? Ask a hundred Go developers where to put business logic and you'll get a hundred answers (and 200 opinions). "Should I use internal/ ?" "Is everything supposed to live under pkg/ ?" "Should I follow Clean Architecture?" "What about the cmd/ directory?" We spend so much time debating folder structures as if the arrangement of directories somehow determines code quality. As if renaming utils/ to pkg/shared/ is going to save us. God. folders don't create architecture. Dependencies do. You can meticulously organize your project like this: my-app/ cmd/main.go internal/ handler/ service/ repository/ pkg/domain/ pkg/utils/ And still write tightly coupled garbage. Handlers calling repositories directly. Services importing database drivers. Business logic mixed with HTTP concerns. Everything circular. Beautiful folders, though. Very organized looking on GitHub. There are better projects I've seen with just 5 packages, they just don't screenshot as well. Architecture Is About Dependency Direction The architecture is about making intentional decisions about how code depends on other code. Have a look at this: HTTP Handler ↓ Business Service ↓ Data Repository This isn't sacred because of folder names. It's valuable because of what it represents: The handler only knows how to translate HTTP The service only knows business rules The repository only knows how to fetch data Each layer depends on the layer below, never upw