今日精选
HOT最新资讯
共 29398 篇If Your AI Agent Has Write Access to Public Repos, Audit It Now — Here's Why
One word broke into a private repository this month. Not a zero-day. Not stolen credentials. Not...
Day 4 of Demolishing my Stack of Unfinished Projects: Secret Chat
Published on Aug 21st, 2025 🚀 Made some progress Welcome back to my "Demolishing My Stack of Unfinished Projects" series! This week, I'm excited to share the story of how I transformed a simple chat idea into a fully-featured, production-ready real-time messaging application called CodeniChat (formerly Secret Chat Bolt). 🎯 The Project That Started It All Secret Chat began as one of those "wouldn't it be cool if..." moments. I had this idea for a secure, real-time chat application that could handle multiple rooms, user invitations, and password resets. You know the drill - you start with enthusiasm, then life happens, and suddenly it's been months with just a README file and some half-baked code. But this week, I decided enough was enough. It was time to demolish this unfinished project and turn it into something I could actually be proud of. I started off with a short prompt into the bolt.new platform 🛠️ The Tech Stack That Made It Possible Frontend Next.js 15 - The latest and greatest React framework React 19 - Cutting-edge React with the new compiler TypeScript - Because type safety is not optional Tailwind CSS - For rapid, beautiful UI development shadcn/ui - Pre-built, accessible components Backend & Database Neon Database - Serverless PostgreSQL that scales with you Drizzle ORM - Type-safe database operations NextAuth.js - Secure authentication system Bcryptjs - Password hashing and security Real-time Features Server-Sent Events - For real-time message updates WebSocket-like functionality - Without the complexity 🚀 The Week-Long Development Sprint Day 1: Foundation & Database I started by setting up the database schema with Drizzle ORM. The beauty of using a modern ORM is that you can define your relationships once and let TypeScript handle the rest. // Core tables for the chat system export const users = pgTable ( " users " , { id : text ( " id " ). primaryKey (), email : text ( " email " ). notNull (). unique (), name : text ( " name " ). notNull (), password
Day 3 of Demolishing my Stack of Unfinished Projects: SmartNotes Project
Published on Aug 18th, 2025 The Setup: When Everything Seems Perfect After successfully implementing a chatbot based on ChatGPT in my portfolio (as detailed in my previous "Redesign Portfolio" post), I was feeling pretty good about myself. The AI integration was working smoothly, users could ask questions about my skills and projects, and I had successfully created content embeddings that made the chatbot intelligent and contextually aware. Little did I know that this "completed" project was about to become the perfect candidate for my "Unfinished Projects" series. The Crisis: When OpenAI Goes Silent It started with a simple error message: "OpenAI API account suspended." At first, I thought it was a simple configuration issue. Maybe I had accidentally exposed my API key or hit some rate limit. But after checking my environment variables and account status, I realized the problem was deeper. My OpenAI account was suspended, and suddenly, my "completed" AI chat functionality was completely broken. Suddenly, my SmartNotes app which also powers the chat functionality went offline. This was supposed to be a finished project. Instead, it had become the latest addition to my stack of unfinished work. The Panic: Scrambling for Solutions The immediate challenge was clear: either abandon the chat functionality entirely or find an alternative solution. Given that I had already invested significant time in building the user interface and database integration, abandoning it wasn't an option. I started researching alternatives: Claude API : Limited availability and different pricing structure Local AI models : Required significant computational resources Hugging Face : Promising, but I had no experience with their inference API The clock was ticking, and my portfolio was broken. The Discovery: Hugging Face to the Rescue After several hours of research and testing, I discovered that Hugging Face offered inference APIs that could potentially replace OpenAI's functionality. The catc
16 Redesigning my Portfolio Website
Published on Aug 18, 2025 A New Era of AI-Powered Coding Begins I have installed Cursor on my laptop this weekend, and I am amazed at how much it speeds up my coding. I have a new debugging buddy!! This week, I have made several updates to the Portfolio website. The Challenge: When OpenAI Falls Short In my previous post, I shared the excitement of implementing a chatbot based on ChatGPT for my portfolio website. The initial experience was promising - I successfully created content embeddings and integrated them with OpenAI's API. However, as many developers know, relying on a single service provider can lead to unexpected roadblocks. When my OpenAI account encountered issues, I faced a critical decision: abandon the chat functionality or find an alternative solution. I chose the latter, embarking on a journey that would transform my portfolio's AI capabilities and teach me valuable lessons about building robust, fallback-ready systems. The Migration: Embracing Open Source AI The transition from OpenAI to Hugging Face wasn't just a simple API swap - it was a complete architectural evolution. Here's what I learned: 1. Model Selection Complexity Finding the right model on Hugging Face proved more challenging than expected. After testing several options: microsoft/DialoGPT-medium - No inference provider available gpt2 and distilgpt2 - Limited conversational capabilities Qwen/Qwen3-4B - Perfect fit with the nebius provider 2. Database Architecture Evolution The migration also prompted a database upgrade from MongoDB to Neon PostgreSQL. This wasn't just about changing providers - it was about building a more scalable, production-ready foundation for my portfolio. Technical Implementation: Building Resilience Streaming Responses for Better UX One of the most significant improvements was implementing streaming text responses. Instead of waiting for complete AI responses, users now see text appear word-by-word, creating a ChatGPT-like experience: // Streaming implementation
Without Exception: How Neander Programs Fail
Neander has no exceptions. No try , no catch , no finally . A call to one of the host application's APIs returns something closer to Rust's Result : either the answer, or the reason there is no answer. In place of a catch block there is one type marker, three operators, and a guarantee that every submission comes back in the same shape no matter what happened. Last time the foundational series closed with isolation. This is the first of two encores, and it takes the subject that came up in nearly every entry without ever being laid out in full: what happens when something goes wrong. There are two answers, because there are two audiences. An error is a value while the program runs, and a verdict once it has stopped. The two are made of the same parts, on purpose. The failable type Every call returns a failable type, written T! . It carries either a value of type T or an error with a code, a message, and the name of the function that produced it. T! is the mirror of the nullable type T? . Same shape, different question: one asks whether a value is there at all, the other asks whether obtaining it worked. The mirroring runs deeper than the notation, because the same three operators serve both types. A failure gets no unwrapping vocabulary of its own. Those three are =? , ?? and is : // narrow, or throw the error out of the enclosing block let order : Order =? call orders .get ( id : 42 ) // or substitute a default let order : Order = call orders .get ( id : 42 ) ?? emptyOrder // or inspect it and decide let result : Order! = call orders .get ( id : 42 ) if result is error { if errorCode ( result ) != 404 { throw result } return emptyOrder } A standalone call statement, one without a let , narrows implicitly: the error is thrown and the success value is discarded. One property does the heavy lifting throughout the rest of this post: T! originates only from a call . No expression picks up a ! along the way, and no widening rule introduces one. The marker means exactly o
1 Startup Series: Connecting my Admin frontend to the backend
Published on Feb 16th, 2023 My solar e nergy startup platform FasoLara has reached a new milestone recently and I decided to start a new blog series about it! The project management platform has been a long journey since I published my first commit to GitHub in October 2020. What started based on a simple idea quickly became a behemoth of a software engineering project for my beginner programmer skills. I have poured thousands of hours into research, tutorials and coding to figure out how to put something like this together. Since then, I have made multiple changes to the FasoLara repository. The platform is currently open source, but I am using a private fork to publish the 3 different components to the Vercel platform. I had a basic demo of the admin dashboard with 6 pages before I removed all the sample data, then upgraded everything to the app directory in NextJS 13 and connected the dashboard to the backend server featuring Apollo GraphQL server v4. Yesterday, February 15th, 2023, I added Next-Auth to handle authentication. Initial testing of the next-auth version seems to work with the appDir in Next.JS 13. It is far from the login experience that I want. It will take more effort to iron out the details because proper documentation is still rare Lots of testing needs to be done Although I have successfully connected the Cypress testing framework to the frontend app, I have yet to do the same on the admin app. I am managing a lot of complexity with lots of new packages. Every mistake under the sun I have lost count of how many times I made breaking changes to the code base trying to implement new features on the main branch only to hard reset the branch after tens of hours of work that I could have done on a new branch instead. I can say that I am moving fast and breaking things per facebook's motto! Mobile app on the backburner I have 3 sample pages that I made on the mobile application. I would have liked to have at least a fully functional landing page on th
The Day My AI Taught Me That Passing Tests Means Nothing
I never set out to build VentureTwin AI as just another chatbot. The idea was much bigger than answering questions. I wanted to build a digital twin that could understand a student's entire journey—their projects, certifications, technical skills, academics, achievements, and career interests—and use all of that to provide meaningful career guidance. Instead of simply recommending jobs based on keywords or certificate counts, I wanted the system to answer a much harder question: What is this student actually good at, and where are they most likely to succeed? To make that possible, I designed the platform as a collection of independent intelligence modules. The Certificate Intelligence module retrieved and verified certifications. Resume Intelligence evaluated technical skills and experience. Project Intelligence analyzed project metadata such as technology stack, complexity, implementation, and impact. Each module produced its own output, which was then passed to a scoring engine that generated a Career Readiness Score. Individually, every module worked exactly as expected. Then I compared two student profiles. The first student had completed more than 20 online certifications but had only a couple of basic projects. The second student had fewer certifications, but had built full-stack applications, worked with AI models, contributed to open-source projects, and actively participated in hackathons and technical competitions. I expected the second profile to receive stronger recommendations. It didn't. Instead, the student with the larger collection of certificates consistently received the higher Career Readiness Score. At first, I assumed something was broken. I traced every stage of the scoring pipeline, inspected API responses from every module, verified the PostgreSQL records, and even recalculated the scores manually. Every value matched. Every API response was correct. The database contained exactly what it should. The scoring engine was behaving exactly as I
Day 1 of Demolishing my Stack of Unfinished Projects
Originally published on 2022-07-04. Published on July 3rd, 2022 We have a ll been there.. We all have that long list of unfinished side projects that we hope to complete some day.. If you're anything like me, that 'some day' is always eluding you and never getting here.. Ripping up the bandaid Today I have decided to finally go ahead and finish one of my long list of unfinished tutorial projects. I recently read a long Twitter thread that gave me a lot of food for thought. To paraphrase my understanding of one tweet, 'success is a combination of all the small wins'. Therefore, by finishing and publishing one unfinished project today, I set myself up to finishing another one tomorrow. Small, consistent gains I just need to make it a habit of finishing what I have started so that they do not get out of hands. After all, my Github account has about 126 repositories, but my portfolio website only has a dozen completed and published projects. Almost Done I have finished up the tutorial project. My next step is to rebuild the project from scratch without the handholding of the tutorial. One of the mental blocks that prevented me from finishing up the project in the first place seems insignificant now. Next time that mental block tries me, I will be better prepared! The project we're talking about! Published Link: https://blockchain.tioye.dev
[Boost]
Our incident-response agent got the root cause wrong 7 times out of 12. It still never made a bad rollback. Aayush Bharadva Aayush Bharadva Aayush Bharadva Follow Jul 25 Our incident-response agent got the root cause wrong 7 times out of 12. It still never made a bad rollback. # opentelemetry # observability # ai # python 1 reaction 5 comments 7 min read
Learning Go the Slow Way: Building Projects Instead of Following Tutorials.
Like a lot of beginners, I started learning Go the usual way: tutorials, courses, and coding along with someone who had already solved every problem. It felt productive. I finished lessons, learned the syntax, and everything seemed to make sense. Then I tried building something on my own.I had no idea where to start. That was the point where I changed my approach. Instead of following tutorials, I started building small, messy, imperfect projects. I still use AI, but not to generate the code for me. I use it as a guide that helps me think through the problem. Why tutorials stopped working for me Tutorials are great for introducing concepts and showing that something works. What they don't teach very well is how to make decisions when you're on your own. When you're following along, someone else has already decided how to organize the project, what to name things, how to structure the packages, and how to solve the tricky parts. You learn what to type, but you don't get much practice deciding why to do it that way. I could finish a tutorial and still struggle to build a simple API from scratch. That was a clear sign that I wasn't actually learning how to solve problems. My new approach: start with a real project Now I begin with a small project I actually want to build. Nothing huge—just something manageable, like: A URL shortener A simple job queue A CLI tool that automates something I find repetitive The goal isn't to build an impressive portfolio piece. It's to build something that's mine, where every design decision is one I have to make myself. The problem, of course, is that starting from a blank page can be overwhelming when you're still learning. That's where AI has become genuinely useful. How I use AI I don't ask AI to build the project. Instead, I ask it to break the project into small, testable milestones. For example: "I want to build a basic URL shortener in Go.Break this project into small steps, where each step is one feature I can build and test befo
I Built Flowstate Because We Somehow Made Productivity More Complicated Than The Actual Work
I Built Flowstate Because We Somehow Made Productivity More Complicated Than The Actual Work Live: https://flowstate.chromitedev.xyz/ GitHub: https://github.com/ChromiteDev/flowstate We have a strange problem. Humans built some of the most advanced technology in history. We created: Computers that fit in our pockets Instant communication across the planet Machines that explore space Software that can do incredible things And somehow... We still struggle with: "What should I actually focus on today?" That is the problem I wanted to solve. So I built Flowstate . The productivity paradox We have never had more productivity tools. Seriously. Think about it. There are apps for: Tasks Notes Calendars Habits Goals Projects Time tracking Team management There is probably an app to help you organize the apps that organize your life. At some point we stopped being productive and started managing productivity. The funniest part? Sometimes creating the perfect productivity system becomes the biggest productivity project. You spend two hours making a beautiful workspace... Then realize: You have done absolutely nothing. A masterpiece of organization. Zero progress. The moment I realized something was wrong I noticed a pattern. People were not struggling because they were lazy. They were struggling because their attention was constantly being divided. Every day we fight: Notifications Endless information Too many choices Too many responsibilities Too many things competing for our attention The internet gave us unlimited access to information. But our attention? That is still limited. The question behind Flowstate I kept coming back to one question: "What actually deserves my attention right now?" Not: "What are all the possible things I could do?" Not: "How can I create the most complicated workflow imaginable?" Not: "Should I reorganize my folders for the fifth time?" (We have all been there.) The goal was simple: Create a tool that helps people find clarity. Introducing Flowsta
Writing a Linux Driver From Scratch to Watch Free TV on a Raspberry Pi
May 2026 There's a touchscreen mounted in my kitchen — I call it the WallScreen. It runs recipes, the chore board, a calendar, the usual smart-home clutter. One day I decided it should also pull in free over-the-air television. No subscription, no streaming app, just the local broadcast towers that have been beaming HD into the air for free this whole time. I had a Raspberry Pi 5, a $30 USB tuner, and what I assumed would be a boring afternoon. It was not a boring afternoon. The tuner that didn't want to work The tuner I grabbed was a MyGica A681 — a tidy little USB TV stick. Plug it into Windows, install the bundled software, done. Plug it into a Raspberry Pi running a current Linux kernel and you get… nothing. The computer notices a device is there and otherwise shrugs. Here's why, in two sentences: Linux has no built-in driver for the chips inside this particular stick. The manufacturer's driver only works on regular PC processors — and even then, only as a sealed, prebuilt file with no source code. A Raspberry Pi uses a different kind of chip entirely, so that driver is a non-starter. That's the whole problem. The hardware is great. It's just that on a Pi, this tuner is a paperweight — and you can't buy or download your way out of it. The only way out was to write the driver myself. What writing the driver actually involved A USB TV tuner isn't one chip — it's a little team of them working together. One chip is the "translator" that lets the computer talk to the device over USB. Another tunes to a channel, like turning a radio dial. A third converts the broadcast signal into video data the computer can use. The good news: for the parts that handle tuning and decoding the signal, I was able to build on existing open-source work from the broader Linux TV community — code other people had already written and shared for the chips inside this stick. (It's all credited in the project.) The missing piece — the part nobody had written — was the translator layer : the co
JWT + OAuth2 + OIDC + PKCE Complete small Guide
The flow will be: Authentication foundation Session vs JWT JWT deep dive JWT security Access/Refresh tokens OAuth2 relationship with JWT End-to-end production flow PKCE Storage strategies summary 1. Authentication Fundamentals Every secure application needs answers to two questions: Authentication "Who are you?" Example: User enters: username password MFA System verifies identity. Result: User is Bhargav Authorization "What are you allowed to do?" Example: User: Bhargav Permissions: READ_ORDERS CREATE_ORDER DELETE_ORDER Authentication happens first. Authorization happens after. Authentication | v Authorization 2. Traditional Session-Based Authentication (Stateful) Before JWT, applications commonly used sessions. Flow User logs in: Browser | | username/password | v Server Server creates: Session ID = abc123 Stores: Database / Memory abc123 | | User: Bhargav Role: ADMIN Browser receives: Cookie: SESSION_ID=abc123 Every Request Browser sends: GET /orders Cookie: SESSION_ID=abc123 Server: Receive Session ID | v Search session storage | v Find user | v Allow request Problems with Sessions 1. Server maintains state The server must remember: Session ID | v User Information 2. Scaling problem Imagine multiple servers: Load Balancer / \ Server A Server B User logs in: Server A Session stored here Next request: Server B No session found Solutions: Sticky sessions Shared session database 3. JWT Authentication (Stateless) JWT solves this by putting information inside the token. JWT: JSON Web Token It is a compact, signed representation of claims between two parties. Example: eyJhbGciOiJIUzI1Ni... JWT vs Session Session Server stores user state: Server Session ID | v User Data JWT Token contains information: JWT Header + Payload + Signature Server does not need to store session information. 4. JWT Structure A JWT has three parts: HEADER.PAYLOAD.SIGNATURE Example: xxxxx.yyyyy.zzzzz Part 1: Header Contains metadata. Example: { "alg" : "RS256" , "typ" : "JWT" } Meaning: JWT uses RS
React 19's useActionState Showed Me Why Disabling My Submit Button Was Never Enough
Every form I ever shipped before React 19 needed the same three pieces of state, and I wired them up...
Show HN: SeaTicket – AI agent that resolve GitHub and Discord issues
https://seaticket.ai/ After maintaining Seafile, open-source file-sync software, since 2012. Somewhere across those fourteen years, "go check if someone already reported this" turned into one of the most common lines in our team chat. Because the same bug tended to show up multiple times. Nothing connected Github and Discord Issues until my team happened to remember seeing "that thing" somewhere else. SeaTicket is what we built to fix that for ourselves before opening it up. It connects GitHub I