GitHub热门项目 | Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more | Stars: 35,334 | 26 stars today | 语言: Go
GitHub热门项目 | The agent that grows with you | Stars: 178,806 | 1,736 stars today | 语言: Python
GitHub热门项目 | PDF Parser for AI-ready data. Automate PDF accessibility. Open-source. | Stars: 23,160 | 573 stars today | 语言: Java
GitHub热门项目 | Odoo. Open Source Apps To Grow Your Business. | Stars: 51,871 | 29 stars today | 语言: Python
Some people rarely lose things. Wallets are always exactly where they’re supposed to be, keys never go missing, and remotes never slip between the couch cushions. And then there’s the rest of us — the folks who can’t ever seem to find the thing that was right there a few seconds ago. For us, Bluetooth […]
Hey friends 👋 As the title suggests, we are hiring! If you've been with us for a little while, I'm sure you've seen our uptick in community initiatives since Major League Hacking (MLH) acquired DEV earlier this year. We've been working hard behind the scenes to bring new opportunities to the community and give a fresh spin to previous programs. We're now at a point where we need help optimizing and scaling up everything we do, while ensuring the platform remains a special place. That said, we are looking to hire a full-time, remote Community Program Manager based in the United States that cares deeply about community. Below is a brief overview of the role and skills we're looking for, but here's the full job description and application for anyone that wants to jump right in: Community Program Manager Job Application Job Overview Key Responsibilities You will... Develop and grow our community moderator programs Run DEV Challenges A-Z, plus other fun events Oversee our community support operations And more! Important Skills You are someone who... Effectively communicates with both internal and external stakeholders Can't help but be detailed oriented (sorry, I am pedantic) Uses AI to gain efficiency Knows how to work autonomously and manages up Benefits You'll receive... Competitive salary ($80-110k) Stock options Medical, dental, vision benefits and 401K Unlimited PTO Travel opportunities Questions about the role? Drop them in the comments below!
Most teams don’t have a documentation shortage. They have a context shortage. The average developer spends 20 minutes hunting for context before a one-line change. Their AI pair-programmer spends that same time hallucinating. I’ve been thinking a lot about what documentation actually needs to become in an AI-assisted world. The answer isn’t “more docs.” It’s not even “AI-generated docs.” It’s Atomic Context Documentation : smaller, sharper, verified context that stays near the code and helps both humans and AI work on the system safely. In my new article, I break down: Why traditional docs fail the “second reader” (AI) From context to results 👉 Full Article If you’ve ever watched AI confidently guess wrong about your codebase, this one’s for you.
It seems that Prologue: Go Wayback! will never make it out of early access.
The message looked completely normal. A recruiter, a short pitch, a "take-home challenge" hosted on GitHub. Clone it, run npm install , get the dev server up, build a small feature, send it back. Standard stuff. I have done a dozen of these. This one was trying to steal my wallet keys and browser session data before I ever wrote a line of code. It did not hide the malware in the app. It hid it in the build tooling. That is the whole trick, and it is the reason a lot of experienced developers get caught. You read src/ , it looks fine, so you trust it. Nobody reads the lockfile. Nobody reads the postinstall script. That is exactly where the payload lives. Here is the full teardown: what the lure looks like, the exact red flags, how I investigated it without running it, and the defenses you should adopt today. The setup: Contagious Interview This is a known campaign. Security researchers track it as "Contagious Interview," attributed to North Korea-aligned actors. The pattern is consistent: You get contacted about a job, often blockchain or full-stack, often with a salary that is a little too good. You are given a code repository to clone and run as a "technical assessment." The repo runs malicious code at install or build time, not at runtime. The payload pulls a second-stage downloader, grabs your environment variables, crypto wallet files, browser-stored credentials, and keychain data, then exfiltrates them to a remote host. The genius of it is the framing. A normal developer reflex when running untrusted code is "I will read the code before I trust it." But you read the application code. You do not read what npm install does, because npm install is something you run a hundred times a week without thinking. Red flag 1: a postinstall script that does not belong The first thing I do with any unfamiliar repo is open package.json and read the scripts block. Specifically, I look for lifecycle hooks: preinstall , install , postinstall , prepare . These run automatically w
Four people suing Elon Musk's AI firm under pseudonyms due to the risks of being identified may face a difficult choice: Reveal your real names, or drop the lawsuit.
Books API Structure Create folders app/ app/controllers/ app/core/ app/models/ app/models/DAOs/ app/models/DTOs/ app/models/entities/ app/utils/ config/ public/ api/composer.json Configure Composer and the PSR-4 autoload so that classes with the namespace App\ are searched inside the app/ folder. Key content: { "name": "user/api", "autoload": { "psr-4": { "App\": "app/" } } } After creating it, run this command inside the api folder: composer dump-autoload api/config/config.php Defines the base URL of the project. The router removes it from REQUEST_URI to keep only routes such as /books/get. <?php define('BASE_URL', '/proyect/api/public'); api/config/dbconf.json MySQL DB connection: { "host": "localhost", "user": "root", "password": "", "db_name": "books_db" } api/public/.htaccess Makes Apache send all routes to index.php. RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^ index.php [QSA,L] api/public/index.php This is the entry point. It loads Composer, loads the configuration and calls the router. <?php use App\Core\Router; require_once DIR . '/../vendor/autoload.php'; require_once DIR . '/../config/config.php'; (new Router())->dispatch($_SERVER['REQUEST_URI']); api/app/core/Router.php <?php namespace App\Core; class Router { protected array $routes = [ '/' => 'HomeController@index', '/books' => 'BookController@index', '/books/get' => 'BookController@getAll', '/books/getById' => 'BookController@getById', '/books/create' => 'BookController@create', '/books/update' => 'BookController@update', '/books/delete' => 'BookController@delete', ]; public function add($route, $params): void { $this->routes[$route] = $params; } public function dispatch($uri): void { $uri = parse_url(str_replace(BASE_URL, '', $uri), PHP_URL_PATH); if (!isset($this->routes[$uri])) { $this->sendNotFound(); return; } [$controller, $method] = explode('@', $this->routes[$uri]); $controller = 'App\\Controllers\\' . $controller; if (!class_exists($co
While building a web application using React, TypeScript, C++, Emscripten, and Raylib, I ran into two linker-related issues that took far longer to diagnose than they should have. This is a short article on two problems that I have faced, I am sharing this so that developers who are exploring Web Assembly using Emscripten can easily avoid these issues as I'll also cover the workarounds that solved them for me. I'll start with the major one. Link-Time Optimization and EM_JS The problem appears when Link Time Optimization (-flto) is enabled and an EM_JS(ret, name, params, ...) macro function is invoked in one translation unit but called from another. You'll find that the linker complains that the function symbol you're trying to call is undefined. The EM_JS macro defines a C interface to call the JS function. So if you have your EM_JS macros in a js_layer.cpp source file, then you need to wrap the macro invocation as extern "C" { EM_JS ( void , add , ( int a , int b ), { //your JS code; }); } The same applies to the function declaration in js_layer.hpp file. I'll briefly go through the three workarounds or 'solutions' before bringing up the last quirk. The Three Workarounds If performance isn't of any concern Well the first one is obvious, just don't use -flto in your release builds. The downside is that your binaries (the .data and .wasm compiler outputs in this case) will be larger. Without LTO, the linker has fewer opportunities for whole-program optimization and dead-code elimination, which can increase the size of the generated .wasm and potentially reduce performance. Write a wrapper You can simply have a wrapper function in the same translation unit which calls the C function interfacing with the JS function, add() if you take the above example. The wrapper can simply be: // In js_layer.hpp void add_wrapper ( int , int ); // In js_layer.cpp void add_wrapper ( int a , int b ){ add ( a , b ); } Now you can call add_wrapper() from any source file just by including
I've found the solution to this issue today by changing my approach, but I'm still unclear what the problem was with the original setup so I wanted to ask the hive mind. Take this page for example. <!doctype html> <html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Test Page</title> <style> body { display: grid; grid-template-rows: 75px 1fr 75px; height: 100vh; padding: 0; margin: 0; overflow: hidden; } #slidingMenu { width: 200px; height: 100vh; background-color: #333; position: absolute; top: 0; right: -300px; /* Start hidden */ transition: right 0.3s ease; /* Smooth transition */ } #slidingMenu.open { right: 0; /* Slide in */ } #top { background-color: red; } #middle { background-color: green; } #bottom { background-color: blue; } </style> </head> <body> <div id="top"> <div id="slidingMenu"></div> </div> <div id="middle"> <button id="toggleMenu" onClick='slidingMenu.classList.toggle("open")''>Toggle Menu</button> </div> <div id="bottom"></div> </body> </html> When you view this page on a tablet/mobile screen, the page scrolls beyond the bottom of the <body> element. If you open dev tools and enable device preview mode and then resize the viewport, all hell breaks loose. This only happens when the menu is closed. The moment you open the menu, everything sorts itself out. https://preview.redd.it/lcj5ycfy345h1.png?width=1918&format=png&auto=webp&s=ad3a2ddb0813c4f8f7da28c7b018498be1c5ff26 https://preview.redd.it/xrtiuuro445h1.png?width=1917&format=png&auto=webp&s=f705b27e2c2dc7635e1ff1f783c917dd0c334f28 What am I missing? submitted by /u/Wotsits1984 [link] [留言]
Building a Robust Real-Time Chat System with WebRTC DataChannels and a Sovereign State Channel Building a Robust Real-Time Chat System with WebRTC DataChannels and a Sovereign State Channel In this tutorial, you’ll build a practical, end-to-end real-time chat system that runs in the browser and uses WebRTC DataChannels for peer-to-peer message delivery, complemented by a lightweight sovereign state channel (SSC) to handle presence, typing indicators, and simple message syncing when peers go offline. The goal is to enable low-latency messaging without a centralized server for message routing, while still providing resiliency and a predictable UX through a minimal, well-defined control plane. What you’ll learn How WebRTC DataChannels work and how to negotiate connections between peers. How to implement a lightweight presence and typing indicator system without a traditional server. How to design a simple optimistic UI with local echo and conflict-free merging when peers reconnect. How to wire up signaling using a minimal HTTP-based relay (for initial handshake) and fall back to a local-only mode for true peer-to-peer operation. Practical considerations for security, NAT traversal, and offline resilience. Overview and architecture Peers: Two or more browsers that discover each other and exchange WebRTC offer/answer via a signaling channel. DataChannel: Reliable ordered data channel for chat messages. Sovereign State Channel (SSC): A small, independent state machine that runs in each peer to track presence, typing, last-seen, and a local message log. It syncs state with peers opportunistically when connectivity exists, and retains messages locally if the remote is offline. Signaling: A simple public signaling endpoint (could be a WebSocket or HTTP POST/GET) used only to exchange session descriptions and ICE candidates at first. After a peer-to-peer path is established, signaling traffic should go dormant unless reconnecting. Persistence: LocalStorage or IndexedDB to per
Cursor's Developer Habits Report is one of the clearest signals yet that AI coding has crossed from individual productivity into software-delivery infrastructure. The headline numbers read as a story about speed: more code per week, larger PRs, deeper agent sessions, more changes committing without manual review. The deeper implication is governance -- whether teams can preserve architectural intent while generation, review, automation, and commit flows all accelerate at once. The velocity curve is now measured, not anecdotal. For two years the claim that AI coding is accelerating rested mostly on vibes and vendor decks. Cursor's data turns it into telemetry. And read as an operations document rather than a marketing one, that telemetry describes a structural shift: software delivery is getting harder to govern, not just faster to produce. This is not a critique of Cursor. The report is strong validation. Cursor proves the velocity curve with numbers most of the industry only gestured at. The point of this essay is what sits on the other side of that curve. What the Cursor Developer Habits Report Shows The inaugural Cursor Developer Habits Report (Spring 2026 edition), published by Cursor (Anysphere, Inc.), draws on Cursor usage data rather than survey responses. It captures the transformation across five themes -- developer acceleration, the economics of intelligence, the power user gap, the rise of context, and the shift to automation. The headline figures: 3.6K -> 8.6K lines added per developer per week -- the per-developer code volume rose from 3.6K (Jan 2025) to 8.6K (May 2026), with growth accelerating since the start of 2026. 125.86 -> 345.02 lines per PR at p75 -- lines added per pull request at the 75th percentile rose roughly 2.5x year over year (Jan 2025 to May 2026). Developers are taking on larger units of work in a single PR. 8% -> 13.8% mega PRs -- the share of PRs with at least 1,000 changed lines grew from 8% (Jan 2025) to 13.8% (May 2026). ~30% mor
Microsoft's Agentic Transformation Patterns Playbook is a useful signal because it does not treat AI agents as another productivity tool. It frames agentic AI as an enterprise operating-model shift: agents are moving from assisting humans to executing work across processes, systems, and teams. The implication for software teams is sharper than it looks -- coding agents are on the same trajectory, and architectural governance becomes part of the infrastructure stack the moment agents start executing. Microsoft's playbook describes six transformation patterns and emphasizes that each pattern requires different ownership, governance, and operating discipline. That is the move worth paying attention to. It reframes agentic AI from a model question into an enterprise operating-model question. That shift matters for software teams because coding agents are following the same path. They are moving from autocomplete to execution. Once agents edit files, open PRs, modify infrastructure, or coordinate multi-step changes, architectural governance becomes infrastructure. What is Microsoft's Agentic Transformation Playbook? Microsoft's playbook is a practical guide for choosing, scaling, and operating AI agents across the enterprise. Public summaries describe it as a 52-slide guide covering six transformation patterns, from employee productivity to core business processes and customer-facing agents. The throughline is that agents are not a single category -- they are a family of patterns with different ownership models, different risk surfaces, and different requirements for governance. That framing matters because it cuts against the dominant adoption narrative. Most enterprises are still treating AI as a per-team productivity story: this team gets Copilot, that team gets an internal assistant, another team is piloting an agent for support tickets. Microsoft is arguing that the pattern of deployment determines the operating discipline required, and that ad-hoc deployment does n
Google's Managed Agents announcement is one of the clearest signals yet that the AI industry is moving beyond stateless tool calling toward persistent execution environments and long-running agent systems. That shift expands what models can do. It also expands the governance surface -- from prompt and PR review into the runtime itself. We spent two years building brains in jars For most of the current AI cycle, the system around the model has been thin. Models could reason, propose commands, and orchestrate small tool calls. But they ran in short sessions, against narrow APIs, under human supervision, with ephemeral state. The model was a brain; the body was a few HTTP requests and a JSON tool schema. That assumption is ending. The frontier is not just better reasoning. It is a body for the brain. The brain finally has a body. Now it needs governance. The runtime layer for AI agents is arriving Google Managed Agents (and the parallel motion across the ecosystem -- OpenAI's containerized execution work, Claude Code's persistent sessions, MCP-based tool ecosystems, hosted agent harnesses) formalizes the runtime as a product: Sandboxed execution Persistent state across sessions Orchestration loops Infrastructure-native agents Agent-as-a-service lifecycle Long-running sessions Mid-session tool injection Managed runtime lifecycle This resembles the transition from scripts -> applications -> cloud platforms. Agents are no longer just calling tools. They are beginning to inhabit programmable environments . Why persistent agent systems change governance Once agents can continuously modify filesystems, maintain state across sessions, autonomously remediate, inject tools dynamically, operate against production systems, and coordinate across workflows, governance failures stop being one-off review misses. They compound over time . What that compounding looks like: Architectural drift -- small deviations accumulate across long-running sessions Policy propagation failures -- con