标签：#webdev

Building a Resilient Real-Time Chat System with WebRTC, Faye, and WebSockets: A Practical End-to-End Building a Resilient Real-Time Chat System with WebRTC, Faye, and WebSockets: A Practical End-to-End Tutorial In this tutorial you’ll build a small, resilient real-time chat system that works across browsers, mobile devices, and constrained networks. You’ll learn how to architect a client/server model with signaling, leverage WebRTC data channels for peer-to-peer messaging when available, and fall back to a robust WebSocket-based relay when direct peer connections fail. The focus is on practical patterns, testable code, and observability to keep a live chat running under load or flaky networks. Key takeaways Understand when to use WebRTC data channels vs. WebSocket relays for real-time chat Implement a signaling server to establish WebRTC connections safely and efficiently Build a resilient message delivery pipeline with idempotent processing and retry semantics Instrument the system for latency, jitter, and message loss to avoid silent failures Test end-to-end flows with simulated network conditions and automated resilience tests Overview of architecture Clients (web and mobile) connect to a signaling server to negotiate WebRTC peers and/or WebSocket sessions. If a direct WebRTC peer connection is possible, use a data channel for low-latency chat messages. If WebRTC is blocked (firewalls, NAT), route messages through a relay server using WebSockets. The relay can also bridge peers that can’t connect directly. A lightweight message store (in-memory for demo, with an optional Redis-backed queue in production) provides at-least-once delivery guarantees and retry capabilities. Observability: metrics for connection attempts, handshake times, message delivery latency, retry counts, and error rates. Tracing spans help diagnose cross-service flows. Tech stack (example) Frontend: TypeScript, WebRTC DataChannel, WebSocket Backend: Node.js with Express for signaling API, ws or

I got tired of watching coding agents spin up from scratch every single time I sent them a prompt. Cold starts, re-cloning massive monorepos, pasting the previous context into a synthetic prompt block — it worked, but it felt fundamentally wrong for agents that are supposed to think in conversations. So we shipped persistent sessions for the Critique Coding Agent API . Here's what changed, why the harness matters, and why you should never run a coding agent without a review skill. The Problem: Agents That Forget When we first released the Coding Agent API, follow-ups were honest but clunky: every follow-up was a brand-new job. The previous output was replayed as plain text into a fresh sandbox. It was the right MVP. It billed predictably. It never pretended a dead sandbox was alive. But it was the wrong long-term shape. If your internal bot fixes a migration, then wants a follow-up test, then wants a small doc tweak — you don't want three cold starts. You want: One repository checkout One OpenCode session A control plane that understands turns What Changed: Persistent Sessions After the first turn completes, the run now enters idle status. The E2B sandbox and OpenCode server stay up until sessionExpiresAt or until you explicitly POST endSession: true . The next prompt you send is delivered as a real message in that same session — not a synthetic "prior run output" block in a brand-new sandbox. Before (Chained MVP): Turn 1 completes → Sandbox killed → Turn 2 = new job + pasted prior summary Now (Persistent): Turn 1 completes → idle → Sandbox warm → Turn 2 = message into same OpenCode session Same run.id . Same checkout. Same context. Just the next turn. How It Works Under the Hood On the first turn, Critique: Creates an E2B sandbox from the OpenCode template Clones your repository at the requested ref Bootstraps tooling and starts opencode serve on localhost inside the VM Opens an OpenCode session Instead of killing that sandbox after completion, we now store session

A security firm called PromptArmor published a writeup on May 27, 2026 showing that ChatGPT for Google Sheets, an OpenAI extension with more than 185,000 downloads, could be made to steal a user's spreadsheets through a single ordinary-looking request. Four days later, on May 31, OpenAI shipped a fix. The short version is that one benign question, typed by a real user into a sheet that contained hidden instructions, was enough to drain twelve linked workbooks out of that user's account and replace the assistant with a fake phishing chatbot. I want to walk through how this worked, because the mechanism matters far more than the headline, and because the same shape of problem is going to keep showing up everywhere we bolt an AI assistant onto data we did not write ourselves. What happened The attack is a textbook indirect prompt injection. The user does nothing wrong. They import a sheet, or pull in data through a connector, and somewhere in that data sits a block of text the attacker controls. In the PromptArmor demonstration the malicious instructions were written in white text on a white background, invisible to a human skimming the sheet but fully readable to the model parsing the cells. When the user later asks the assistant a normal question, the model reads the whole context, including those hidden instructions, and treats them as if they came from the user. The injected text tells the assistant to fetch and run an external script. That script runs with the permissions the extension already holds, which means it can read the current workbook, find URLs to other workbooks linked inside it, and walk outward from there. PromptArmor reported it exfiltrating twelve workbooks in total from a single trigger, then dropping a fake chat interface on top to harvest whatever the user typed next. The detail that should bother you most is this line from their report: the attack succeeds even when the user has explicitly disabled automatic edits. The human-in-the-loop approva

In our project, each time the user types in the address input, a mapbox request is made, with a debounce time of 400 ms. It's one of those inputs where you type an address, and it suggests addresses in a dropdown. I believe we're doing more requests than we should, what's a good debounce time for a case like that? 500 ms? 600 ms? submitted by /u/leinad41 [link] [留言]

The message looked completely normal. A recruiter, a short pitch, a "take-home challenge" hosted on GitHub. Clone it, run npm install , get the dev server up, build a small feature, send it back. Standard stuff. I have done a dozen of these. This one was trying to steal my wallet keys and browser session data before I ever wrote a line of code. It did not hide the malware in the app. It hid it in the build tooling. That is the whole trick, and it is the reason a lot of experienced developers get caught. You read src/ , it looks fine, so you trust it. Nobody reads the lockfile. Nobody reads the postinstall script. That is exactly where the payload lives. Here is the full teardown: what the lure looks like, the exact red flags, how I investigated it without running it, and the defenses you should adopt today. The setup: Contagious Interview This is a known campaign. Security researchers track it as "Contagious Interview," attributed to North Korea-aligned actors. The pattern is consistent: You get contacted about a job, often blockchain or full-stack, often with a salary that is a little too good. You are given a code repository to clone and run as a "technical assessment." The repo runs malicious code at install or build time, not at runtime. The payload pulls a second-stage downloader, grabs your environment variables, crypto wallet files, browser-stored credentials, and keychain data, then exfiltrates them to a remote host. The genius of it is the framing. A normal developer reflex when running untrusted code is "I will read the code before I trust it." But you read the application code. You do not read what npm install does, because npm install is something you run a hundred times a week without thinking. Red flag 1: a postinstall script that does not belong The first thing I do with any unfamiliar repo is open package.json and read the scripts block. Specifically, I look for lifecycle hooks: preinstall , install , postinstall , prepare . These run automatically w

While building a web application using React, TypeScript, C++, Emscripten, and Raylib, I ran into two linker-related issues that took far longer to diagnose than they should have. This is a short article on two problems that I have faced, I am sharing this so that developers who are exploring Web Assembly using Emscripten can easily avoid these issues as I'll also cover the workarounds that solved them for me. I'll start with the major one. Link-Time Optimization and EM_JS The problem appears when Link Time Optimization (-flto) is enabled and an EM_JS(ret, name, params, ...) macro function is invoked in one translation unit but called from another. You'll find that the linker complains that the function symbol you're trying to call is undefined. The EM_JS macro defines a C interface to call the JS function. So if you have your EM_JS macros in a js_layer.cpp source file, then you need to wrap the macro invocation as extern "C" { EM_JS ( void , add , ( int a , int b ), { //your JS code; }); } The same applies to the function declaration in js_layer.hpp file. I'll briefly go through the three workarounds or 'solutions' before bringing up the last quirk. The Three Workarounds If performance isn't of any concern Well the first one is obvious, just don't use -flto in your release builds. The downside is that your binaries (the .data and .wasm compiler outputs in this case) will be larger. Without LTO, the linker has fewer opportunities for whole-program optimization and dead-code elimination, which can increase the size of the generated .wasm and potentially reduce performance. Write a wrapper You can simply have a wrapper function in the same translation unit which calls the C function interfacing with the JS function, add() if you take the above example. The wrapper can simply be: // In js_layer.hpp void add_wrapper ( int , int ); // In js_layer.cpp void add_wrapper ( int a , int b ){ add ( a , b ); } Now you can call add_wrapper() from any source file just by including

I've found the solution to this issue today by changing my approach, but I'm still unclear what the problem was with the original setup so I wanted to ask the hive mind. Take this page for example. <!doctype html> <html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Test Page</title> <style> body { display: grid; grid-template-rows: 75px 1fr 75px; height: 100vh; padding: 0; margin: 0; overflow: hidden; } #slidingMenu { width: 200px; height: 100vh; background-color: #333; position: absolute; top: 0; right: -300px; /* Start hidden */ transition: right 0.3s ease; /* Smooth transition */ } #slidingMenu.open { right: 0; /* Slide in */ } #top { background-color: red; } #middle { background-color: green; } #bottom { background-color: blue; } </style> </head> <body> <div id="top"> <div id="slidingMenu"></div> </div> <div id="middle"> <button id="toggleMenu" onClick='slidingMenu.classList.toggle("open")''>Toggle Menu</button> </div> <div id="bottom"></div> </body> </html> When you view this page on a tablet/mobile screen, the page scrolls beyond the bottom of the <body> element. If you open dev tools and enable device preview mode and then resize the viewport, all hell breaks loose. This only happens when the menu is closed. The moment you open the menu, everything sorts itself out. https://preview.redd.it/lcj5ycfy345h1.png?width=1918&format=png&auto=webp&s=ad3a2ddb0813c4f8f7da28c7b018498be1c5ff26 https://preview.redd.it/xrtiuuro445h1.png?width=1917&format=png&auto=webp&s=f705b27e2c2dc7635e1ff1f783c917dd0c334f28 What am I missing? submitted by /u/Wotsits1984 [link] [留言]

Building a Robust Real-Time Chat System with WebRTC DataChannels and a Sovereign State Channel Building a Robust Real-Time Chat System with WebRTC DataChannels and a Sovereign State Channel In this tutorial, you’ll build a practical, end-to-end real-time chat system that runs in the browser and uses WebRTC DataChannels for peer-to-peer message delivery, complemented by a lightweight sovereign state channel (SSC) to handle presence, typing indicators, and simple message syncing when peers go offline. The goal is to enable low-latency messaging without a centralized server for message routing, while still providing resiliency and a predictable UX through a minimal, well-defined control plane. What you’ll learn How WebRTC DataChannels work and how to negotiate connections between peers. How to implement a lightweight presence and typing indicator system without a traditional server. How to design a simple optimistic UI with local echo and conflict-free merging when peers reconnect. How to wire up signaling using a minimal HTTP-based relay (for initial handshake) and fall back to a local-only mode for true peer-to-peer operation. Practical considerations for security, NAT traversal, and offline resilience. Overview and architecture Peers: Two or more browsers that discover each other and exchange WebRTC offer/answer via a signaling channel. DataChannel: Reliable ordered data channel for chat messages. Sovereign State Channel (SSC): A small, independent state machine that runs in each peer to track presence, typing, last-seen, and a local message log. It syncs state with peers opportunistically when connectivity exists, and retains messages locally if the remote is offline. Signaling: A simple public signaling endpoint (could be a WebSocket or HTTP POST/GET) used only to exchange session descriptions and ICE candidates at first. After a peer-to-peer path is established, signaling traffic should go dormant unless reconnecting. Persistence: LocalStorage or IndexedDB to per

Here's a thing that happens on every team I've been on. Sprint ends. Someone schedules the retro....

I'm trying to understand the market rate for developing a complete SaaS/web-based ZATCA-compliant e-Invoicing platform for Saudi Arabia and would appreciate estimates from agencies or developers who have experience with similar projects. The scope would include: Core Invoicing Create, edit, delete invoices Tax invoices and simplified tax invoices Credit notes Debit notes Proforma invoices Multi-currency support VAT calculations Invoice templates PDF generation QR code generation ZATCA Phase 1 (Generation) Fully compliant invoice format TLV QR code generation Arabic and English invoice support Required invoice fields and validations Printable invoice formats ZATCA Phase 2 (Integration) Integration with ZATCA APIs Compliance CSID onboarding Production CSID onboarding Invoice cryptographic stamping Invoice hashing Digital signatures XML generation according to ZATCA specifications Clearance invoices workflow Reporting invoices workflow Automatic invoice submission Real-time status tracking Error handling and retry mechanisms Certificate management and renewal Business Management Customer management Supplier management Product/service catalog Categories Units of measure VAT configurations Branch management Company profile management User & Security Multi-user access Role-based permissions Activity logs Audit trails Two-factor authentication API access for third-party integrations Reporting & Analytics Sales reports VAT reports Invoice status reports ZATCA submission reports Export to Excel/PDF Dashboard analytics Additional Features SaaS architecture Multi-tenant support REST API Webhooks Email invoice delivery WhatsApp sharing Backup and recovery Localization (Arabic/English) Responsive web application Cloud deployment Technical Requirements Modern web stack Secure architecture Scalable for thousands of invoices per day Production-ready deployment Documentation For agencies that have built ZATCA solutions before: What would you charge for a project like this? How many

I was thinking, with all the lay offs in tech. Would it be possible to start a company and just sort of catch the talent getting laid off? Obviously you would need an initial investment from something like an investment firm or an angel investor. I was just thinking that their could be an opportunity for some rich people to eat AI's lunch if they started a tech company with the laid of talent from the AI bubble. But also idk, I have never been in the valley, so I don't really know how it works. submitted by /u/LAN_scape [link] [留言]

Hey all, some time ago I had an interview for a Frontend Engineer role at Stripe and had this question for my coding round: Develop OTP component that has 4 inputs: - accepts only digits - when one input is populated => auto-focus to the next - submit on enter - should support backspace - should be accessible I was using React and was trying to make it via 4 separate <input> elements heavily relying on the built-in HTML validation attributes (to save time, interviewer agreed it was ok). I made it work with auto-focus and everything but still got rejected. Now I'm curious how other would approach such challenge. I will attach an image in the comments for a visual reference. submitted by /u/truenapalm [link] [留言]

Recently got an email from "Paratype" that one of my sites was using a font that was unlicensed and we needed to pay a fee. I inherited the site from someone else so had no idea about the font, which was hidden in a Bootstrap library, so the decision was made to remove it completely. I replied to Paratype stating this and they replied, "Well, you were using it in the past, so you should pay us anyway." Obviously I'm going to tell them to piss off, but I was wondering how common this sort of thing is? I doubt they have much of a claim legally, the wording of the email is pretty weak sounding to me. submitted by /u/TConner42 [link] [留言]

Hey everyone, I'm a researcher at Carnegie Mellon University conducting a research study on how developers are actually using spec-driven development (SDD) in practice — things like writing SPEC.md files, PRDs, or structured natural-language specs before working with AI coding agents like Claude Code, Cursor, Kiro, etc. There's a lot of community knowledge about how to do SDD well, but almost no academic research on it. I'm trying to change that. What the study involves: One 45-60 minute semi-structured interview via Zoom Questions about your SDD workflow, what's worked, what hasn't, and how it fits into your SDLC No tasks, no tests — just a conversation about your experience Who I'm looking for: Have at least one year of active experience as a contributor or maintainer of any open-source GitHub project Have used SDD tools/workflows in that project (spec files, structured prompting, plan-mode workflows, etc.) 18 or older, fluent in English What you get: Honestly, nothing monetarily. But your experience will directly shape a taxonomy of SDD workflows and practices that I'll publish openly. Happy to share findings with participants who want them. Ethics/privacy : The interview will only be audio-recorded with your consent. Your responses will be kept confidential and de-identified in any published findings. If you're interested, fill out this short screening survey (5 min): LINK Or DM me / comment below with questions. Also happy to hear if there are other communities I should be posting in. submitted by /u/lost_researcher1 [link] [留言]

OSSurf is a platform for discovering open-source repositories and contribution opportunities. It lets you: Explore trending repositories Track pull requests and issues Browse projects by language and category Discover projects suitable for contributions and GSoC Looking for feedback on the overall experience, usefulness, and UI. https://ossurf.vercel.app/ https://github.com/OSSURF submitted by /u/Direct_Sorbet_1631 [link] [留言]

Syndicated from the FavCRM blog . The old quote was two weeks. With an agent on the UI and a headless backend, it's an afternoon. A client needs a booking site. The old quote was two weeks: a calendar, a database, an availability engine, payments, a customer table. With an AI agent building the frontend and FavCRM as the headless backend , the real work is an afternoon. Here is the whole job, start to finish. The scenario A small clinic. Three services, one practitioner, online booking with deposit. You are the agency; you have an AI agent in your editor and a terminal. The plan: Register the clinic's FavCRM workspace Configure services and availability Wire one server route that talks to FavCRM Let the agent build the booking UI against that route Test a real booking end to end Step 1 — Register the workspace (~5 min) The favcrm CLI registers a workspace and issues an API key. No dashboard. favcrm signup request --email clinic@example.com \ --organisation-name "Bright Smile Clinic" favcrm signup verify --request-id < id > --code <6-digit-code> The verify step prints a fav_mcp_* key. Put it where your build can read it — never in the repo: export FAVCRM_API_KEY = fav_mcp_... Step 2 — Configure services and availability (~30 min) Hand the brief to your agent and let it call the tools. Inspect a schema first: favcrm tool describe create_service Then create each service: favcrm tool call create_service '{ "name": "New Patient Exam", "durationMinutes": 45, "price": "80.00" }' favcrm tool call create_service '{ "name": "Cleaning", "durationMinutes": 30, "price": "60.00" }' Set when the practitioner works, so availability is real: favcrm tool call set_staff_availability '{ "weekday": "mon", "start": "09:00", "end": "17:00" }' Repeat per weekday. At this point the backend is done — services, hours, an availability engine that knows about clashes. You wrote no schema. Step 3 — One server route (~30 min) The browser must never hold the API key. Put it in one server route tha

Syndicated from the FavCRM blog . The number that predicts whether an agent is safe to let loose isn't the tool count. When people compare agentic CRMs, they count tools. The number that actually predicts whether an agent is safe to let loose is a different one: annotation coverage . An MCP tool annotation tells the agent what a tool does to the world — whether it reads or mutates, whether it's safe to retry, whether it reaches an external service. Without annotations, the agent is guessing. This is what they are, and why a catalog's annotation coverage matters more than its tool count. What an MCP annotation is Every MCP tool can carry hints alongside its input and output schemas: readOnlyHint — the tool only reads; it changes nothing. Safe to call freely. destructiveHint — the tool mutates or deletes. The agent should confirm before calling. idempotentHint — calling it twice with the same input has the same effect as once. Safe to retry on a timeout. openWorldHint — the tool reaches an external service (sends an email, charges a card), so its effects leave the system. These are not documentation for humans. They are machine-readable signals the agent reasons over before it acts. Why they prevent the worst failures The dangerous class of agent failure is not "the agent couldn't do something." It's "the agent did the wrong destructive thing because it misread an ambiguous instruction." Delete the customer instead of the tag. Refund the wrong invoice. Cancel every booking instead of one. Annotations let the agent self-gate. A well-annotated catalog means the agent calls list_members without ceremony but pauses to confirm before cancel_booking , because one is marked read-only and the other destructive. Pre-MCP function-calling had no equivalent — every tool looked the same to the model, so safety lived entirely in the prompt. Why coverage matters more than count A 190+ tool catalog with 100% annotation coverage is safer than a 30-tool catalog with none. A tool that l

What are HTML Tags? HTML documents consist of a series of elements, and these elements are defined using HTML tags. HTML tags are essential building blocks that define the structure and content of a webpage. HTML tags are composed of an opening tag, content, and a closing tag. The opening tag marks the beginning of an element, and the closing tag marks the end. The content is the information or structure that falls between the opening and closing tags. For Example: <h1>Hello</h1> HTML Elements HTML elements are the essential components of a webpage and provide structure, organization, and meaning to content. Elements are defined by HTML tags which define how different types of content will appear in a browser window. For Example: <p> This is an element. </p> Block-Level Elements A page’s entire width is occupied by a block-level element. The document always begins with a new line. An HTML page generally has three tags i.e., <html> , <head> , and <body> tag. Example: The following is an unordered list, an example of block-level elements. List item 1 List item 2 Inline Elements A block-level element’s inner content can be formatted with an inline element by adding links and stressed strings. These elements help you to format text without disrupting the content’s flow. Example: The following code creates a hyperlink to a URL. It is an inline element because it is used within paragraphs, headings, or other text content to create hyperlinks. It does not disrupt the flow of the document by forcing new lines before or after its content. <a href="https://www.example.com"> Visit Example </a> CSS Properties CSS properties are used to decorate your web page and assign a unique behavior to your HTML element. CSS properties are the foundation of web design, used to style and control the behaviour of HTML elements. They define how elements look and interact on a webpage. Used to control layout, colors, fonts, spacing, and animations on web pages. It is essential for making web pa

I have found a weird case where I put in a real address (verifiable on google maps) it keeps correcting me to a wrong address (doesn't exist and cannot be found on google maps. What gives? If it's truly a bug, how do I let Google know? See below. https://preview.redd.it/x2b1ws07635h1.png?width=1336&format=png&auto=webp&s=18091e8ec57f96854611fef8578fd9e79e369d8b submitted by /u/flatcoke [link] [留言]

The Hook: The 48-Hour Re-Infection Nightmare It’s a scenario that keeps e-commerce founders and agency directors awake at night: You wake up to a critical alert that your flagship WordPress site is redirecting users to a spam domain. You immediately deploy a premium security plugin, run a deep scan, quarantine three suspicious files, and breathe a sigh of relief. The scanner gives you a green checkmark. You're safe. Then, exactly 48 hours later, the redirects return. What went wrong? The automated scanner checked the surface, but the attacker had already established a foothold deeper in the architecture. They didn't rely on a loose PHP file in your uploads directory; instead, they weaponized an overlooked, unauthenticated WordPress REST API endpoint to re-inject the payload the moment your scanner turned its back. When high-value enterprise sites are compromised, treating the symptoms with standard security plugins is like putting a band-aid on a structural fracture. To truly remediate a persistent infection, you must think like a forensic analyst, hunt down hidden persistence mechanisms, and harden the application perimeter. The Anatomy of Persistence: Where Malware Hides Modern WordPress malware is sophisticated. Attackers know that standard security tools look for modified core files or rogue scripts in the /wp-content/plugins/ directory. To survive cleanups, they embed themselves into the core infrastructure of your site using three primary vectors: 1. wp-config.php Pre-Loading Attackers frequently inject obfuscated code directly into the top of wp-config.php . Because this file executes before the rest of the WordPress core loads, malware can hook into the initialization process, silently recreating deleted malicious files every time a page is requested. 2. Malicious Must-Use (MU) Plugins Files placed in /wp-content/mu-plugins/ are executed automatically by WordPress and cannot be disabled from the admin dashboard . Attackers love this directory. They will ofte