Submission for DEV's Summer Bug Smash — Smash Stories track. There was a file in my repo called run_benchmark_1_22.py . Not 1 to 24, which is what the harness was written to do. Not 1 to 26, which is how many Mersenne exponents the agents know. Twenty-two. A chart in the README — a2a_latency_times_1_22.png — agreed. At some point, past-me had decided the benchmark ends at 22, committed the evidence, and moved on. This summer, hunting for a Bug Smash target, I finally asked: why 22? The setup a2a-benchmark compares A2A agent performance across four languages. Python and Go sit behind Gemini tool-calling (ADK); Node and Rust are bare HTTP handlers. Each computes Mersenne primes with Lucas–Lehmer; a harness sweeps N from 1 to 24 and draws two charts. I ran the full sweep. At N=24, the Python column printed N/A . Every other language returned data. There it was — not a decision, a crash , worked around by shortening the run until it stopped hurting. The 4,300-digit wall The Python agent's response at N=24 wasn't even subtle about it: "Exceeds the limit (4300 digits) for integer string conversion; use sys.set_int_max_str_digits() to increase the limit" CPython 3.11 added a default cap on int→str conversion — 4,300 digits — as a denial-of-service mitigation. My agent stringified every prime it found. The 24th Mersenne prime, 2^19937−1, has 6,002 digits . Here's the part that made me laugh out loud: the stringified list was never returned . The tool reports only its elapsed time. The line that had silently amputated my benchmark at N=23 was decorative. The fix was git rm energy: delete the str() , keep the raw int. Go had the identical dead weight ( val.String() ) inside its timed region — it just happened not to crash. One deleted expression, and a column of data that had never existed came into being: N=24, Python, 2,425.9 ms. It gets worse before it gets better With the agents finally running, I kept pulling the thread. The harness parsed Python's elapsed time out of th

Submission for DEV's Summer Bug Smash — Clear the Lineup track. The codebase a2a-benchmark is my multi-language A2A (Agent-to-Agent) performance suite: four agents — Python and Go behind Gemini tool-calling via ADK, Node.js and Rust as direct handlers — each compute Mersenne primes with the Lucas–Lehmer test, while a harness sweeps N=1–24 and charts calculation time and round-trip time. The committed results stopped at N=22. I never questioned that. I should have. The headline bug: a whole column of data didn't exist CPython 3.11+ limits int→str conversion to 4,300 digits by default (a DoS mitigation). My Python agent stringified each prime it found: mersenne_primes . append ( str (( 1 << p ) - 1 )) The 24th Mersenne exponent is p=19937, and 2^19937−1 has 6,002 digits . So for any request of 24+ primes, the tool raised ValueError — and the A2A response dutifully delivered the stack-trace text instead of a result: "text": "Exceeds the limit (4300 digits) for integer string conversion; use sys.set_int_max_str_digits() to increase the limit" The benchmark's Python column was structurally incapable of producing data at N≥24. The kicker: the stringified list was never used . The tool returns only elapsed_time . The fix is deleting the str() — which also removes formatting work from the timed region that the Node and Rust agents never paid (Go had the same dead val.String() call). Fix: PR #1 — plus a switch from time.time() (wall clock, non-monotonic) to time.perf_counter() , and a regression test at count=24. Before/after, N=24 row: Node.js Rust Go Python before 1633.01 ms 812.57 ms 1451.49 ms N/A (crash) after 1616.13 ms 824.10 ms 1531.10 ms 2425.9 ms The harness was reading its data from LLM prose The Python agent's timing came back in two places: a structured elapsed_time in the tool artifact, and the model's prose. The harness regexed the prose first : m = re . search ( r " It took ([\d\.\-e]+) seconds " , text ) In live runs, Gemini said "Calculating the first 5 Mer

After I published my last article about building a Chrome extension that speaks browser notifications aloud, a commenter asked a question I didn't have a good answer to. He pointed out that a lot of web apps — Slack, Gmail, most modern tools — fire their notifications from a service worker via registration.showNotification() , not from the page's JavaScript context. My MAIN world override of window.Notification would never reach those. He was right. And I told him I'd look into it. I spent a week researching whether there was any way to close that gap. There isn't. But the reason why is more interesting than a simple "no." Two ways a website can show you a notification When a website sends you a browser notification, it can do it in one of two ways. The first is the constructor path. The page's own JavaScript calls new Notification("You have a message") directly. This is common for in-tab alerts, real-time updates when you're actively on the site, or any notification triggered by something you just did. The second is the push path. The browser receives a push event from the website's server, wakes up the website's service worker in the background, and the service worker calls self.registration.showNotification() from inside its own scope. This is what happens when Slack notifies you of a new message while the tab is closed or backgrounded. The page never runs. No page JavaScript ever fires. My extension catches the first path. The MAIN world content script overrides window.Notification before any page code runs. But the service worker never touches the page's window. It has no window . It runs in a completely isolated thread, completely separate from the page, and calls showNotification on itself. The override is never reached. Why can't the extension reach the service worker? This is the part that took me a week to fully accept. Chrome extensions can inject content scripts into web pages. They can run code in the MAIN world or the ISOLATED world of a page. They can

FCC chairman claims power to repeal TV ownership limit set by Congress.

****When working with security tools like "Trivy" and "npm" audit, I realized that their primary goal is to generate detailed reports that can be consumed by automation, CI/CD pipelines, and other security tools. For developers, however, there are times when you simply want a quick visual overview of a report. Questions like: How many critical vulnerabilities are there? Which packages need immediate attention? Which vulnerabilities already have a fix available? What should I investigate first? can require navigating through a large JSON report or terminal output. Of course,Trivy already provides excellent terminal output, and there are powerful enterprise platforms that provide comprehensive security dashboards. I wasn't trying to recreate those tools or copy their ideas. Instead, I wanted to explore a different question: What if viewing a security report was as simple as opening a web page? The Idea My goal was to build a lightweight, browser-only application where developers can simply: Drag & Drop a JSON report Paste a JSON report Click Analyze Report That's it. No installation. No backend. No account. No database. Within seconds, the report is transformed into an interactive dashboard. The focus isn't on replacing existing security platforms—it's on providing a simple, fast, and privacy-friendly way to explore security reports. Why Browser-Only? Security reports often contain sensitive information about a project. Uploading those reports to a remote server just to visualize them isn't always desirable. That's why I decided that every report should be processed locally inside the browser. Nothing is uploaded. Nothing is stored. Your security report never leaves your machine. Supporting Multiple Scanners One thing I learned very quickly is that different security scanners don't speak the same language. For example, Trivy and npm audit both report vulnerabilities, but their JSON structures are completely different. The UI shouldn't need to know which scanner genera

Over the last few months, I’ve been turning small workflow problems I encounter on my Mac into focused utilities. Rather than building one enormous productivity suite, I wanted each app to solve a specific frustration well. I also wanted to build software the way I prefer to use it: local-first, available through a one-time purchase, and usable without creating another account or paying for another subscription. Here are five of the apps I’ve built so far. ScreenShelf My desktop used to become a temporary storage zone for screenshots, folders, documents, links, and files I needed for active projects. Folders helped with long-term storage, but they were not always useful for things I wanted to keep visible and nearby. ScreenShelf creates a customizable visual shelf for: Files and folders Screenshots and images Links Text Applications Frequently used project materials You can organize items across separate pages, customize the appearance of each page, and keep different groups of materials available for different projects. It also includes a Recents area that surfaces recent screenshots, which is helpful when the small screenshot preview disappears before you can interact with it. ScreenShelf is essentially the space between a cluttered desktop and a deeply nested folder system. Learn more about ScreenShelf PopNote Some reminders are too small for a full task-management system. You might need to remember to send a file in twenty minutes, check something after lunch, or complete one small step before ending the day. PopNote is a lightweight menu bar app that creates timed pop-up reminders on your Mac. The reminders appear as small visual bubbles rather than traditional notification banners. You can choose a time, add an icon, and let the note reappear when you need it. It is designed for temporary reminders that should remain noticeable without becoming another project to organize. Learn more about PopNote File Fetch I frequently download, save, rename, copy, and move

Recently I learned: find is a useful command to find files in your directories. find folder1 folder2 folder3 This dumps every file and directory under those folders. It also supports flags such as -name "*.txt" to find files matching a particular pattern. There are also filters for size, permissions, and last modified date. I'm thinking this would be a great tool for sanity-testing code that creates nested directories (like a new Docker container's filesystem). This command will give me a full flat listing of the resulting tree (like a deeply nested ls command`). The downside is of course it can dump a lot of output, but in sanity-testing scenarios, there shouldn't be that many files anyways. Something interesting is that this command will take multiple folders before the flags. I'm used to thinking of programs where the arguments are all positionally ordered, so if you don't pass a flag it just assumes the next thing is a regular argument. In this case, find checks whether an argument looks like a flag (starts with - ) before deciding whether to treat it as a path or as part of the expression. I wonder if this is a common pattern across other Linux commands. (Claude says find is special case, but I need to look more into this.)

The vulnerability in the decades-old game could have allowed hackers to take over victims’ computers with a malicious game invite.

You have a project with 20 dependencies. Half of them are outdated. Running ncu -u or pip install --upgrade upgrades all of them at once — and when something breaks, you have no idea which package caused it. So you don't upgrade. The deps rot. Security patches pile up. loopgrade fixes this. It upgrades one dependency at a time, runs your test suite after each upgrade, commits if it passes, reverts if it fails, and moves on to the next one. When it's done, it gives you a full report of what was upgraded, what failed, and why. GitHub: https://github.com/Sagar-S-R/loopgrade PyPI: https://pypi.org/project/loopgrade/ Open for Contributors #Python #LangGraph #opensource

Bryan, a food broker from Michigan, wasn't sure if he'd be able to make it to urgent care in time. He started feeling off on Thursday, and by Saturday, he was having to use the bathroom every 15 to 30 minutes. "It's no joke about the explosive diarrhea," Bryan, who asked that his last name […]

The actor, who starred in 1993's Jurassic Park , died Monday in Sydney, Australia, at the age of 78.

Intuition Manacher's Algorithm leverages the symmetry of palindromes to avoid redundant comparisons. Instead of treating odd- and even-length palindromes separately, the input string is transformed by inserting a special character (#) between every character and adding sentinel characters (^ and $) at both ends. This allows every palindrome to be treated as an odd-length palindrome. While traversing the transformed string, the algorithm maintains the center and right boundary of the rightmost palindrome found so far. For each position, it uses the palindrome information from its mirror position (with respect to the current center) to initialize the palindrome radius, significantly reducing unnecessary expansions. Only when the palindrome reaches beyond the current right boundary is additional expansion performed. This optimization ensures that every character is expanded at most a constant number of times, resulting in linear time complexity. Approach Handle the edge case by returning an empty string if the input string is empty. Transform the input string by inserting # between every character and adding sentinel characters (^ and $) at both ends to treat odd- and even-length palindromes uniformly. Create a palindrome radius array p, where p[i] stores the radius of the palindrome centered at index i in the transformed string. Initialize the variables center and right to represent the center and right boundary of the current rightmost palindrome. Initialize max_len and center_index to keep track of the longest palindrome found during traversal. Traverse the transformed string from left to right, ignoring the sentinel characters. Compute the mirror index of the current position using the current palindrome's center. If the current index lies within the current right boundary, initialize its palindrome radius using the previously computed mirror information. Expand around the current center while the characters on both sides are equal, increasing the palindrome radius

I gave one model the same 44-node architecture twice. The first time I asked for raw SVG — place every box, route every edge, hand me the coordinates. The second time I asked it to describe the same system as typed JSON and let a layout engine draw it. Same model, same session, same brief. The only thing I changed was the output boundary. The boxes are fine in both. I want to be upfront about that, because the usual version of this pitch is out of date. Models place labeled boxes well now. If you ask a current frontier model for a six-box flowchart as SVG you get a clean six-box flowchart, and if that's what you need, go do that — it's the right tool and I'm not going to pretend otherwise. What broke was the edges. With no routing algorithm the model just drew long diagonals straight through unrelated boxes. Not a few — everywhere the graph got dense. And when I changed one node, the entire hand-placed coordinate layout had to be regenerated, and came back different. That second part is the one that actually annoyed me. It's not a rendering bug you can squint past. The picture is a dead artifact: you can't diff it, you can't edit one box, you can't get the same one twice. Every change is a full regeneration and a fresh roll of the dice. This isn't a "wait for a better model" problem Here's the part I'd push back on if someone else wrote it, so let me make the case. Routing a connector around obstacles across a nested graph is global constraint optimization. It's the specific thing layout engines like ELK exist to solve. A model emitting SVG has to commit to an x/y for every point, in order, with no way to backtrack once it sees the whole picture — it's predicting the next token, not solving a layout. So a better model gives you nicer boxes, not untangled edges . The failure is structural, and I'd expect it to reproduce across models past a couple dozen nodes. If you don't buy that, the honest move is to test it: throw a 40-node architecture at whatever model you tru

pinto lets teams manage Scrum backlogs as plain text. Every backlog change can be inspected with git diff , carried across a branch, merged, and reviewed in a pull request—just like source code. The backlog follows the same lifecycle as the product it describes. pinto is local-first: no server, account, or hosted database is required. It works with AI agents, but never depends on them. And unlike a generic CLI to-do list, its core model is Scrum: Product Backlog Items (PBIs), Sprints, Kanban, and the metrics teams use to inspect and adapt. Why pinto exists Jira, Asana, and Notion are capable products. But as more features accumulate, the process can start serving the tool instead of the other way around: Creating one ticket means navigating required fields and workflow settings. Running a Sprint begins with configuring permissions, automations, or dashboards. Even a small status change feels expensive when the tool is slow to open. Scrum is meant to be a lightweight framework for rapid inspection and adaptation . When maintaining the board becomes work in its own right, the tooling has lost sight of that goal. The name pinto comes from the Japanese word ピント “focus.” That is also the design intent: keep the team's attention on the Product Backlog, the Sprint, and the work flowing across the board. pinto deliberately stays small. It starts quickly, keeps dependencies and vocabulary limited, stores durable data as readable files, and excludes project-suite features such as Gantt charts and CRM. Your backlog belongs in the repository Running pinto init creates a .pinto/ directory beside your code. Each PBI is a Markdown file with TOML frontmatter. Here is a real item from pinto's own backlog: +++ id = "P-2" title = "Investigate and fix Windows CI while retaining Windows support" status = "done" rank = "j" labels = ["ci", "windows"] created = "2026-07-15T06:24:58.731847Z" updated = "2026-07-15T09:34:50.653786Z" +++ # Summary Investigate, verify, and fix the current Windo

Freelancing in software development sounds like the ultimate dream: Work from anywhere 🌴 Choose your own projects 💻 Set your own rates 💰 But for developers in India, the reality often looks like this: A client requests "just one small change" for the 15th time. You deliver the code, and the client suddenly goes ghost. You get your payment but realize 10% was deducted, and you have no idea how to file your taxes. You realize you are charging ₹500/hour but spending half your time on unpaid admin work. I've been there. Most Indian developers start freelancing with great coding skills but zero business systems. Here is a step-by-step guide on how to protect yourself, price your work correctly, and handle Indian taxes (GST/TDS) like a professional. Stop Doing Unpaid Requirements Gathering (Use a Questionnaire) When a client says: "I want an e-commerce website, how much will it cost?" If you jump on a call and spend 2 hours discussing it without any commitment, you are losing money. The Fix: Before scheduling a call, send them a structured Project Intake Questionnaire. Ask about: Business model and target audience. Tech stack preferences & required integrations (Stripe, Twilio, WhatsApp API). Brand assets and Figma designs (Do they have them, or do you need to design too?). Budget range & expected timeline. If a client refuses to fill out a 10-minute form, they aren't serious about hiring you. Eliminate "Scope Creep" with a Scope Document "Scope Creep" is when a client keeps adding features without paying extra. It kills developer profit margins. The Fix: Always draft a Project Scope Document before signing a contract. It must have two clear sections: Included in Scope: Detailed feature list (e.g., "User login via Google, 3 database models, responsive UI"). EXPLICITLY OUT OF SCOPE: Things you will NOT do (e.g., "Logo design, copywriting, free server maintenance post-launch"). Include a Change Request (CR) clause: "Any feature requested outside Section 1 will be billed at

DPDP compliance costs for Indian startups: what to budget before 13 May 2027 Summary. Full compliance with India's Digital Personal Data Protection Act is due on 13 May 2027. That is the date consent, notice, security safeguards, breach intimation and data-principal rights all become enforceable, and it is roughly 10 months away. The DPDP Rules 2025 were notified on 13 November 2025 and land in three phases: the Data Protection Board of India stood up immediately, penalties and Consent Manager registration begin on 13 November 2026, and everything else bites on 13 May 2027. The penalty schedule is not proportionate to your size: up to ₹250 crore for failing reasonable security safeguards, ₹200 crore for failing to notify a breach, and ₹150 crore for missing Significant Data Fiduciary obligations. There is no revenue or headcount exemption. The cost gap is where founders get hurt. Vendors routinely quote ₹15 lakh to ₹2 crore for DPDPA compliance, while a startup under 10,000 users can be substantively compliant for under ₹50,000 a year. India's privacy and data governance market is worth roughly $1 billion to $1.5 billion today, per IDfy founder Ashok Hariharan speaking to Inc42 in April 2026, and a lot of that revenue depends on you not reading the rules yourself. This is a budgeting guide, not a legal opinion. The rules are short. Read them, then price the work. The deadline that actually matters There are three dates, and only one of them is a real deadline for most startups. Phase Date What switches on Does it affect a typical startup? Phase 1 13 November 2025 Data Protection Board of India established, Rules notified No direct obligation, but the Board can already receive complaints Phase 2 13 November 2026 Consent Manager registration opens, penalty framework and enforcement powers begin Only if you intend to register as a Consent Manager Phase 3 13 May 2027 Notice, consent, security safeguards, breach intimation, retention, children's data, data-principal righ