标签：#ui

Extending the Login Session to 1 Year for Kiosk‑Mode TV Screens (Next.js API Route) TL;DR: I changed the maxAge of the auth cookie from 30 days to 365 days in src/app/api/login/route.ts . The tweak lets a TV kiosk stay logged in without a daily refresh, while keeping the same security flags. The Problem Our kiosk‑mode deployment runs on large‑format TVs that display a live dashboard. The UI is protected by the same JWT‑based authentication we use for the web app. After a user logs in, the server sets a Set-Cookie header with the token: cookie : serialize ( " token " , jwt , { httpOnly : true , secure : true , sameSite : " lax " , path : " / " , maxAge : 60 * 60 * 24 * 30 , // 30 days }); In practice, the TVs are turned on once a week and are expected to stay signed in for months. After 30 days the cookie expires, the dashboard silently redirects to the login page, and a technician has to manually re‑authenticate the device. The symptom was a 401 Unauthorized error after exactly 30 days, logged as: Error: No valid session cookie found (maxAge expired) The root cause: the maxAge value was hard‑coded to 30 days, which is fine for browsers but not for unattended kiosks. What I Tried First My initial thought was to keep the 30‑day limit and simply refresh the token on every API call . I added a middleware that called the login endpoint silently if a request lacked a valid token. The flow looked like this: // pseudo‑middleware if ( ! req . cookies . token ) { await fetch ( " /api/login " , { method : " POST " , body : storedCredentials }); } What went wrong? Rate limiting – The middleware hit the login endpoint on every request that missed a token, quickly exhausting the auth provider's rate limit. State leakage – Storing credentials on the client (even in a server‑side environment) introduced a security surface. Complexity – The extra round‑trip added latency and made the code harder to debug. After a few failed attempts (and a stack trace full of 429 Too Many Requests )

The lawsuit alleges that Oura rings are unable to measure any of the physiological signals needed to assess sleep quality or determine sleep stages.

The private equity giant confirms a breach, weeks after Google researchers said hackers were targeting financial companies.

After two years of testing, these are the electric toothbrushes that impressed WIRED staffers the most.

Two numbers off my Search Console this morning, same 28 day window, same site. The free landing page roast tool: 42 impressions, average position 38.0. The blog post I wrote to support that tool: 11 impressions, average position 21.1. Six weeks earlier it was the other way round. On July 4 the tool sat at position 7.5 on 18 impressions and the article was at 17.8 on 38. So the tool has more than doubled its reach since then, and its average position has gotten roughly five times worse over the same stretch. Both of those things are true at once, and working out why changed how I plan the next tool. The tool favors.dev/roast takes a URL and gives back a conversion score out of 100. It screenshots your full public page, then grades the copy and the design together across six categories: clarity, value proposition, trust, CTA, visual design and SEO. You get back the specific issues hurting signups with a fix for each, the things the page already does well, and a one line verdict. No signup, no credit card, no email field. Paste a URL, press "Roast it", read the result. It is deliberately small, and the scoping is most of why it shipped. The cut list was: accounts and password resets, saved history, dashboards, billing and usage limits, settings and themes, support for every edge case, and an admin panel for myself. Every one of those is how a weekend build turns into a month. If a free tool needs a billing system, you have started building a second product by accident. What those numbers actually say Here is the honest read, because "my free tool beat 29 of my 32 blog posts" is technically true and a bit misleading. Reading Tool impressions Tool position Article impressions Article position Jul 4 18 7.5 38 17.8 Jul 11 20 7.1 42 16.9 Jul 19 22 10.4 39 19.1 Aug 15 42 38.0 11 21.1 Impressions climbed because the tool started matching a much wider spread of queries. Average position fell for exactly the same reason. It is not ranking better. It is ranking on more things, m

Investors want founders who understand the financial reality of their business. Messy data, misunderstood metrics, or waiting until you’re nearly out of cash to start fundraising can cost founders leverage, valuation, and even a term sheet. In this episode of Build Mode, host Isabelle Johannessen sits down with Sasha Orloff, founder and CEO of Puzzle […]

Build-in-public note, no fireworks. Why bother Search Console in mid-August was blunt: 6 of 1,098 pages indexed, the rest stuck at "Discovered – currently not indexed", and the Links report empty. Zero external backlinks. The site has a thousand free session pages that nobody can find because nothing points at them. Directories are the cheapest way to get the first handful of pointers, and they are also the corpora that AI assistants read when someone asks "what tools show SPX gamma exposure". So the goal was never traffic. It was (a) backlinks and (b) third-party mentions. What went in The same card everywhere: SPX dealer positioning rebuilt from the 0DTE tape; zero-gamma flip, call/put walls, hold band; every finished session free; a backtest Lab; an MCP server; no buy/sell signals. Logo from the favicon, three screenshots (terminal, the measured book, the Lab), category Finance / Investing wherever the menu allowed it. Done and live: Capterra, AlternativeTo, the official MCP registry (and glama.ai, which pulls from it), TradersList, Firsto, TinyLaunch, Startup Fame, Indie Hackers. Submitted and waiting on a human: StartupStash. Product Hunt is scheduled, one shot only. What we skipped, and why — this is the useful part Anything that wants a badge on our homepage for the free tier (Huzzler, Startup Fame's final step). The card is filled and sits unpublished. A measurement terminal with "featured on" stickers on it is a different product. AI-tool directories (Futurepedia, There's An AI For That). $300–$500 for a listing in front of an audience that wants image generators. The MCP server technically qualifies; the economics do not. Hashnode. Published a 1,300-word engineering write-up; AutoMod archived it within the hour as "this type of content" on a free subdomain, with an upsell to Pro. The Markdown is saved; it will go out on dev.to instead. Reddit. Not a channel for this product. Decided, not deferred. Paid "we submit you to 140 directories" packages. Every one

I put top-rated USB car chargers to the test for fast charging, value, heat, and safety. These are the best I found.

You’ve got a product idea, a deadline creeping closer, and a blank canvas staring back at you, so...

LighthouseReckoning LighthouseReckoning is a lightweight LoRa mesh networking library for Arduino-compatible microcontrollers, currently tested on ESP32 and RP2040 with SX126x LoRa radios. What is LighthouseReckoning? The goal is simple: Sensor → Relay → Relay → Home One node acts as the Home node . Other nodes automatically determine a path toward it. A node does not need to know the entire network topology. Instead, nodes exchange information about their distance to Home and select a suitable neighboring node as their next hop. For example: Sensor | v Sensor → Relay → Relay → Home ^ | Sensor This allows nodes to communicate over multiple hops without manually configuring routes. How does routing work? Each node keeps track of information about its neighbors and their distance to Home. For example: Node Distance Home 0 hops Relay A 1 hop Relay B 2 hops Sensor C 3 hops Sensor C can therefore forward its data toward Relay B, which forwards it toward Home. When the network changes, nodes can update their routing information and select a different path. Hop-by-hop reliability LighthouseReckoning uses hop-by-hop confirmation instead of requiring one end-to-end acknowledgment. Sensor C → Relay A → Relay B → Home Sensor C only needs confirmation that Relay A received its packet. Relay A then handles the next hop independently. This allows each node to deal with retries locally instead of requiring Home to maintain the state of every route in the network. Using the library A basic node can be initialized with: #include <RadioLib.h> #include <LighthouseReckoning.h> LighthouseReckoning lhr ; void setup () { // Initialize your LoRa radio here lhr . beginAsNode ( & radio , 0xA1B2C3D4 ); } void loop () { lhr . update (); uint8_t payload [] = { 0x01 , 0x02 , 0x03 }; // Send application data when needed lhr . sendData ( payload , sizeof ( payload )); } The Home node uses beginAsHome() and can receive application data through the library's callback mechanism. The library is design

If you have ever tried to win a domain at auction, you probably assumed the game works like eBay: watch the clock, wait for the last eight seconds, fire your bid, walk away with the name. On Namecheap, that does not work. Not "works badly". Does not work. Namecheap's expiring and marketplace auctions close in a daily batch at 11:00 AM ET. Every auction ending that day ends at roughly the same moment, which means there is no quiet corner of the day where you and one other bidder are paying attention. And if a bid lands in the closing window, the auction extends. So the buzzer-beater you were planning gets absorbed and the clock keeps running. The winner is not the fastest click. The winner is whoever set the smartest proxy maximum, on a name they found before anyone else was looking at it. I have been building PounceDomains around that one fact for months, and it is the reason the product looks the way it does. The edge moved from timing to discovery If speed is not the lever, the levers left are: find the good names earlier, and know what they are actually worth before you commit a number. So the engine scans the Namecheap aftermarket around the clock rather than at the bell. You describe the domains you want in plain English, something like "pronounceable 5-letter .com brandables under $50, no numbers or hyphens", and it builds a tuned config you can edit. If your config is too broad, it tells you and tightens it. There are seven scoring lenses you can stack: pronounceable, brandable, exact-match keyword, short premium, dictionary word, two-word combo, and free-text custom criteria. Fast programmatic filters run first, then AI scores what survives, and only domains that clear your threshold become matches. It has graded over 340,000 domains so far. The second lever is the one I care about more. Every match arrives with its receipts The failure mode in domain investing is not missing a name. It is paying $400 for something worth $80 because a free appraisal tool pri

What tok/s really measures, how concurrency changes it, and why a single-user benchmark is not the whole story for local LLM performance. A Few Moments Later… How Fast Is "Fast"? Every interface in the world of local AI eventually shows you that dreaded spinner, and on the wrong setup it sits there long enough that your brain supplies the meme: "A few moments later…" That pause is a number wearing a disguise. Somewhere inside your machine, the model is grinding out tokens — fragments of words — and the only question that matters is how many of them it produces per second. Tokens per second (tok/s) is the universal speedometer of local LLMs, quoted in every benchmark and every GPU review. But it is also one of the most misleading numbers in the field, because the same model can measure 45 tok/s or 793 tok/s depending on how you test it. This guide explains what the number actually means, why it moves so dramatically, and how to read a benchmark without fooling yourself. What a Token Actually Is Before speed makes sense, the unit has to. Models do not read words; they read tokens, which are chunks of text roughly three-quarters of a character on average in English. The word "calculator" might be one token or three, depending on the tokenizer, and this is not idle trivia — it is the reason the same prompt can cost a different amount across providers, as the Token Counter Calculator shows in practice. Because tokens are the unit of both billing and speed, "tokens per second" is the single number that connects all three corners of the local AI decision: how fast the model answers (tok/s), how big the model is (parameters), and what it costs to run (hardware amortized over time). A model doing 50 tok/s reads roughly 100-150 words per second — comfortably faster than you can read. A model stuck at 5 tok/s feels like a slow internet connection in 1998. The Single-User Number Is Not the Whole Story Here is the trap: most consumer benchmarks report tok/s at one user, one requ

Automating Daily Bluesky Posts with a JSON‑Driven Content Pipeline TL;DR: I added a set of JSON files and a lightweight loader to the content‑automation repo so our CI can generate and publish daily Bluesky posts automatically. The change centralizes multilingual copy, makes the publishing script data‑driven, and removes the manual copy‑paste step that was breaking our release flow. The Problem Our weekly release process includes a short status update on Bluesky. The copy lives in a markdown file that we edit manually, then copy‑paste into the Bluesky CLI. Two issues kept surfacing: Human error – a typo or missing line would cause the post to be rejected by the API ( Error: Invalid payload: missing "text" ). No versioning – we had no way to track which text was used for a given date, making it impossible to audit or rollback a post. The symptom was a failed CI job that stopped the whole pipeline with the error above, and we were forced to roll back the entire release just to fix a missing word. What I Tried First My first attempt was to add a tiny shell script that reads a bluesky.md file and pipes it into the CLI: cat content/2026/08/16/bluesky.md | npx bluesky-cli post That worked locally, but the script crashed in CI because the file path was hard‑coded and the runner didn’t have the bluesky-cli binary installed. I also quickly realized that the same script would need to support English and Spanish versions, so the hard‑coded approach would explode as we added more languages. The Implementation 1. Data‑driven content files Instead of markdown, I switched to a JSON structure that can hold multiple languages and post types (progress, announcement, etc.). Each day gets its own folder under content/YYYY/MM/DD/VS/ . For the 2026‑08‑16 release we added: content/2026/08/16/VS/bluesky_en.json content/2026/08/16/VS/bluesky_es.json content/2026/08/16/VS/metadata.json Example bluesky_en.json [ { "type" : "progress" , "text" : "Finally pushed a real change: coverage for the

Merino is one of the best fabrics you can wear. We explain the different blends, what “GSM” means, and how to care for your clothes.

Microsoft has released .NET 11 Preview 7 with a substantial set of .NET MAUI updates, including cross-platform passkey authentication, a new incremental XAML Hot Reload implementation, Shell route templates, and additional AOT-safe bindings. The release also continues MAUI’s migration from legacy renderers to handlers and improves development workflows on Android and Apple platforms. By Edin Kapić

Most designers don't lose time in the design phase; they lose it in the tool-switching phase. You...

Sonic Fire Protection raised its new funding to help get its sound-powered fire protection system into everything from commercial kitchens to apartment buildings.

The Day I Realized I Wasn't Building Apps For years, I thought I was building apps. That's what I called them anyway. A scheduler. A job bot. A healthcare platform. An AI project. A content tool. A browser automation system. Looking at my GitHub, they seem completely unrelated. Honestly, that's something I've worried about before. I have over a hundred repositories. If someone spends thirty seconds scrolling through them, I can imagine them thinking: "Wow. This person is all over the place." The funny thing is that I eventually realized the opposite was true. My GitHub is here: https://github.com/ashb4 The Scheduler That Wasn't A Scheduler One of my projects started life as a simple scheduler. That was the goal. I hated posting content manually. Open platform. Paste content. Upload image. Repeat. Again. And again. And again. It felt repetitive. It felt annoying. Most of all, it felt like something a computer should be doing instead of me. So I built a scheduler. At least, that's what I thought I was building. Then Things Got Weird The scheduler worked. But now I needed content. Then I needed analytics. Then I needed to know what content was working. Then I needed a way to track winners. Then I needed a way to reuse content. Then I needed platform-specific strategies. At some point I looked up and realized I wasn't building a scheduler anymore. I was building a system. A system for discovering, creating, publishing, measuring, and improving content. The scheduler was just one piece. Then I Started Looking At Everything Else That's when I noticed the same thing happening in almost every project I'd ever built. My job application tools weren't really job application tools. They were systems designed to reduce repetitive effort. My automation projects weren't really automation projects. They were systems designed to reduce repetitive effort. Even my AI projects weren't really about AI. They were systems designed to reduce repetitive effort. Different technologies. Diffe

Lea's pushing back on light/dark mode implementations that display three state options for visitors: light, dark, and system. Dark mode toggles: two states are enough originally handwritten and published with love on CSS-Tricks . You should really get the newsletter as well.

From surprisingly good $300 Chromebooks to excellent $650 Windows notebooks and more, these are the best budget laptops I’ve tested.