标签：#programming

submitted by /u/finalpatch [link] [留言]

a malicious pull request was submitted in a 57k star github repo Egonex-AI/Understand-Anything and the pr description was also convincing, the test plan was fake and the real payload is hidden behind hundreds of whitespace characters on the last diff line. astro.config.mjs runs as a live nodejs module on every dev or preview. there is no sandbox which basically means it will affect more than a postinstall script. The second stage actually pulled commands from a tron blockchain address which is a public RPC nodes only so IP blocking does nothing. submitted by /u/BattleRemote3157 [link] [留言]

Are you tired of just using frameworks and libraries without truly understanding how they work under the hood? Imagine gaining an unparalleled depth of knowledge and problem-solving skills by building your favorite technologies from scratch. Master Programming by Recreating Your Favorite Technologies From Scratch As developers, we spend a significant portion of our time using tools, frameworks, and libraries built by others. While incredibly efficient, this often creates a knowledge gap. We know how to use a tool, but not why it works the way it does, or what fundamental problems it solves. This is where the "build-your-own-X" (BYOX) philosophy comes in. It's a powerful learning strategy where you recreate simplified versions of existing technologies – be it a web server, a database, a version control system, or even a frontend framework – using only fundamental programming concepts. It's not about replacing established tools; it's about dissecting them, understanding their core principles, and in doing so, mastering the craft of programming itself. Why Bother? The Profound Benefits of Building Your Own Investing time in building your own versions of existing technologies offers a wealth of benefits that accelerate your growth as a developer: Deepened Understanding: No more black boxes

submitted by /u/r_retrohacking_mod2 [link] [留言]

its like i can write code of simple problems but i finds myself not so easy when it comes to the program like terminal games and i feels like i am lagging the "right thinking" before writing any code. well the thing is i completed like 22 projects from the book big book of small python projects and i am still writing codes like this https://paste.pythondiscord.com/HGNA i feels like i know python but lacks in thinking on how to approach a problem and making it run properly. and i feels like if i keep practising like this i wouldn't get any close to writing code more effectively any sooner unless i have someone to tell me the right way or i learns it from a tutor or a course or a book on how to approach and think of a problem, cuz if i were to just practise and do it on my own i would be doing hit and trials and it might take me much longer compared to if i m being taught on how to write it better. so how should i go further on now ? i just want to ask how to think when we were given a problem say we were given to make a terminal program and i always just confuse like yeah i can make it work but i still feels like i need to learn to write it neatly. i can make small programs but i want to learn how to make complicated programs or think/design beforehand on making these programs tldr; asking if it will be good to read some "tips" from somewhere or watch any lectures on thinking properly instead of just practising which i think might take "more" time for e.g. will it be beneficial to read books like "think like a progrmmer" by al sweigart ? instead of just practising and finding the neat ways on my own ? submitted by /u/TreacleFlaky2283 [link] [留言]

Pada series sebelumnya, kita sudah melakukan instalasi nix di VirtualBox dan setup SSH agar dapat diakses diluar VirtualBox. Sebelum kita lanjut untuk melakukan konfigurasi system lagi, kita butuh mengetahui bagaimana syntax dalam menulis program Nix dan di artikel ini kita akan mempelajari dasar syntax-nya. Nix Language Nix adalah purely functional language yang lazy-evaluated , digunakan untuk mengkonfigurasi Nix package manager dan NixOS. Karakteristik utama: Purely functional : sebuah function hanya bisa mengembalikan nilai berdasarkan inputnya, tidak bisa mengubah variabel di luar scope-nya (no side effects), dan tidak ada variabel yang bisa diubah setelah didefinisikan (no mutation). Kalau kamu familiar dengan const di beberapa bahasa pemrograman, semua variabel di Nix berperilaku seperti itu. Lazy evaluation : Nix tidak menghitung nilai suatu ekspresi sampai nilai itu benar-benar dibutuhkan. Ini artinya kamu bisa mendefinisikan ribuan package di nixpkgs tanpa semuanya dievaluasi sekaligus. Hanya yang kamu gunakan saja yang akan diproses. Semua adalah expression : tidak ada statement di Nix, setiap baris kode selalu menghasilkan sebuah nilai. if/else bukan statement seperti di bahasa pemrograman pada umumnya, melainkan expression yang harus mengembalikan nilai dari kedua cabangnya. Tidak ada loops : karena variabel tidak bisa diubah, loop seperti for atau while tidak ada artinya di Nix. Sebagai gantinya, kamu menggunakan fungsi seperti map dan filter , atau rekursi untuk mengolah kumpulan data. 1. Basic Data Type Konsep JavaScript Nix String "hello" "hello" Number 42 , 3.14 42 , 3.14 Boolean true , false true , false Null null null List [1, 2, 3] [ 1 2 3 ] Object { a: 1 } { a = 1; } ⚠️ Perbedaan Penting List di Nix menggunakan spasi sebagai pemisah, bukan koma Attribute set menggunakan = bukan : , dan setiap entry diakhiri dengan ; Nix let name = "Alice" ; age = 30 ; scores = [ 10 20 30 ]; person = { name = "Bob" ; age = 25 ; }; in person Javascript const name

submitted by /u/hiIAmJan [link] [留言]

TL;DR: You'll learn how to replace Postman collections with plain-text Hurl files that live in Git, run in CI, and test your API’s geo behavior from any country. Debugging API issues always boils down to taking the tests you already have, running them from a different network or region, and comparing what your API receives. But I bet most of us can’t actually do that right away because our test infrastructure itself is fragmented. Your CI could be using a different config entirely from the “correct” one on a local dev machine, and half the collections may still point to a staging URL that changed months ago. Postman doesn’t produce diff-friendly artifacts, so even figuring out what changed is a full-on investigation. If any of that sounds familiar, I’d recommend finally taking the big step and replacing your Postman collection with Hurl — a command-line HTTP test runner where tests are plain **.hurl** text files that live in Git. For this tutorial, I’ll also walk you through multi-region testing — how to run those tests using a proxy to get a German egress IP, and see what the API actually returns from there. Everything below is self-contained, you’ll only need a new Git repo, then create the tests (three plaintext files.) The Test Suite at a Glance Create a folder (name it whatever you like — hurl-api-tests works) and these are the files we're going to be creating at its root . That folder is your Git repo root; paths in commands and CI are relative to it. Note how we’re using multiple .env files. If you're new to API testing, you'll find out why in a bit. hurl-api-tests/ ├── tests/ │ ├── health.hurl # smoke test -- Makes sure Hurl works, basic asserts. Skip if you want │ ├── auth-flow.hurl # Tests chaining + jsonpath capture + Bearer header │ └── geo-detail.hurl # Tests two egress profiles, real country/ASN diff (direct or proxied) ├── .env.local.example ├── .env.ci.example ├── .env.proxy-de.example ├── run-tests.mjs # cross-platform runner └── .github/workflows/a

Floating-point addition isn't associative. For a corporate inventory with tens of thousands of rows, naive summation drifts — and the number you disclose depends on row order. Here's why, and the fix. Here's a result that should bother anyone building carbon software. Take a corporate emissions inventory — tens of thousands of line items, each a number in tonnes CO₂e. Sum it. Now sort the same rows differently and sum again. The totals don't match. Not by much — maybe the third or fourth decimal place — but they don't match, and nothing in your code changed except the order. If you've never seen this, open a console: 0.1 + 0.2 === 0.3 // false That's the same bug, scaled up to a reporting deliverable. Why order changes the answer IEEE 754 doubles have 52 bits of mantissa. That's about 15–16 significant decimal digits of precision — generous, until you add numbers of very different magnitudes. When you add a small number to a large running total, the small number gets shifted right to line up the exponents before the addition happens. Bits that fall off the end of the mantissa are gone. Add a 0.0001 tCO₂e line to a running total of 80000.0 and there simply aren't enough mantissa bits to hold both the 80,000 and the 0.0001 — the small value is partially or completely swallowed. Float addition, as a result, isn't associative. (a + b) + c is not guaranteed to equal a + (b + c) . Sum your rows largest-first and the small values vanish early against a big accumulator. Sum smallest-first and they accumulate into something large enough to survive. Same data, different total. Here's the effect, deliberately constructed to be visible: const big = 80000 ; const smalls = Array ( 50000 ). fill ( 0.0001 ); // small values first, then the big one let a = 0 ; for ( const x of [... smalls , big ]) a += x ; // big value first, then the smalls let b = 0 ; for ( const x of [ big , ... smalls ]) b += x ; console . log ( a ); // 80004.99999999... console . log ( b ); // 80004.99999999...

There's a quiet lie rotting at the heart of modern software development, and almost nobody wants to say it out loud: the industry is drowning in people who can ace a LeetCode interview, argue endlessly about architectural patterns, and hold strong opinions about tabs versus spaces — but who have never actually shipped a product that real people use. We've built an entire culture around the performance of engineering rather than the practice of it. Walk into any dev team today and you'll find brilliant people who can recite the SOLID principles from memory, who have strong feelings about hexagonal architecture, and who will spend three weeks bikeshedding a folder structure — but who have never felt the particular anxiety of watching your own code process a real user's real money. Never felt that accountability. Never shipped something and then lived with the consequences. That's a problem! The industry has confused credentials and vocabulary with competence. A computer science degree, a GitHub profile full of tutorial clones, and the ability to reverse a linked list in a whiteboard setting are now routinely mistaken for the ability to build software that matters. They're not the same thing. The people who actually make software work — who ship under pressure, who fix production bugs at 11pm, who make pragmatic calls with incomplete information — often look terrible on paper. They'll choose a boring, proven technology over the shiny new thing. They'll skip the elegant abstraction in favour of something they can debug in a hurry. They understand that a running system that's 80% right beats a perfect system that's still in design. AI has made this worse. Now you can generate plausible-looking code, confidently-written documentation, and technically-accurate architecture diagrams without ever having built a system that stayed up under real load, without ever having migrated a production database at 2am, without ever having owned something from idea to invoice. Knowing ho

submitted by /u/ernesernesto [link] [留言]

submitted by /u/andreiross [link] [留言]

submitted by /u/PlaneSufficient2245 [link] [留言]

The post hit X at some point on June 10, the morning after Anthropic's biggest launch in years. I...

on may 28 anthropic announced a $65 billion series h round at a post-money valuation of about $965 billion, which makes it, on paper, the most valuable ai startup in the world. the round was led by altimeter capital, dragoneer, greenoaks and sequoia, on top of earlier hyperscaler commitments that included around $15 billion with $5 billion of it from amazon. the headline everyone ran with is that anthropic passed openai. that part is true, but the comparison is messier than the headline, and the more interesting story is what is generating the number. i build small dev tools and write comparison content, and a lot of what i ship runs on top of anthropic's models. so when the company that makes the tools i depend on nearly touches a trillion dollars, i do not read it as a sports score. i read it as a question about whether the thing i am betting on is durable, and what i should do differently because of it. here is the honest version of both. the number, with the caveats intact the $965 billion figure is consistent across cnbc, axios, morningstar, al jazeera and euronews, so i trust it. what i would not do is state the gap over openai as a precise fact, because the sources do not agree on openai's number. axios pegged openai's most recent valuation at $730 billion. other outlets put it closer to $850 billion off a record round earlier in the year. either way anthropic is ahead right now, but "ahead by $115 billion" and "ahead by $235 billion" are different sentences, and anyone quoting one as gospel is rounding away the uncertainty. the safe claim is the one i will make: as of late may 2026, anthropic is the most valuably-priced private ai company, and it got there fast. the reporting has it roughly tripling from a $380 billion mark in february. the part that matters more to me is the revenue. anthropic crossed a $47 billion run-rate earlier in may. that is the line that turns a valuation from a vibe into something with a floor under it. you can argue about whether $

A complete solution: expressive range types in your domain layer, full PostgreSQL translation in your data layer - no compromises at either end The Two-Column Trap Almost every developer has written it at least once. An object with two date properties: public class MemberSubscription { public int Id { get ; set ; } public int MemberId { get ; set ; } public DateTime StartDate { get ; set ; } public DateTime EndDate { get ; set ; } } Imagine you need to answer a seemingly simple question in a booking system: "Is this subscription still active, and does it conflict with the proposed new one?" With two bare fields, that code ends up looking something like this: // With two bare DateTime fields — the check you always end up writing public static bool IsActive ( MemberSubscription sub , DateTime at ) => sub . StartDate <= at && ( sub . EndDate == default || sub . EndDate > at ); public static bool ConflictsWith ( MemberSubscription a , MemberSubscription b ) { // Partial overlap: a starts inside b if ( a . StartDate >= b . StartDate && a . StartDate < b . EndDate ) return true ; // Partial overlap: b starts inside a if ( b . StartDate >= a . StartDate && b . StartDate < a . StartDate ) return true ; // b is fully contained by a if ( a . StartDate <= b . StartDate && a . EndDate >= b . EndDate ) return true ; // What about open-ended subscriptions? What about same-day boundaries? // What about inclusive vs exclusive end dates? ... return false ; } It looks perfectly reasonable. But start asking questions — as Steve Smith (Ardalis) does in his essay on making the implicit explicit — and you notice how much invisible knowledge this design requires. Should EndDate ever precede StartDate ? The type system doesn't say. Can a subscription have a null end date meaning it never expires? Nothing in the model communicates that. Is a subscription that ends today still active at 11:59 PM? Ask three developers and get three answers. The EndDate == default sentinel for open-ended subsc

submitted by /u/r_retrohacking_mod2 [link] [留言]

Even with decades of documentation, SQL Code Injection remains a top threat. Train your developers and TPMs! submitted by /u/casaaugusta [link] [留言]

Service binding is a feature which allows apps to get an isolated schema/database on a shared Postgres or MySQL. This post explain how it works. submitted by /u/avkijay [link] [留言]

Author here. We kept writing migrations that were fine as a final schema but unsafe during the rollout itself - old pods still reading a column while new pods have already dropped it. Django solved this ages ago with django-migration-linter, which I leaned on for years on Grafana OnCall. Drizzle has nothing like it, so we wrote one for our CI. It diffs new migrations against the base branch and fails on drops, renames, and required columns added in one step. It’s buried in our monorepo right now. There’s an issue linked in the post if you’d want it published to npm. submitted by /u/joey-archestra [link] [留言]