标签：#EV

EVs from GM will soon be able to top up at more kinds of public chargers.

Grab a refreshing slice of cold watermelon (because it’s summer in Tokyo and I love it!), and let me...

I’m building a website that will eventually become a collection of useful browser-based tools, similar to iLovePDF but covering many different categories. The goal is simple: No downloads No accounts Fast and mobile-friendly Free to use I’m researching what people actually need before building more tools. What’s a small utility, calculator, converter, formatter, generator, or productivity tool you use regularly but wish had a better version? Examples: Land measurement calculators PDF tools Text formatting tools Developer utilities SEO tools Study tools I’d love to hear your ideas and pain points. submitted by /u/Nikpa_2163 [link] [留言]

SQL is arguably the most widely used language in software engineering, yet it is often the least carefully written. Most teams enforce strict linting on their application code but leave SQL queries as a free-for-all. This guide covers the formatting rules that separate maintainable, team-friendly SQL from query spaghetti that haunts on-call rotations. Why Poorly Written SQL Is a Real Engineering Problem Unformatted SQL is not just an aesthetic issue - it is a correctness risk. Dense, run-on queries make it nearly impossible to spot accidental Cartesian products, missing GROUP BY clauses, or WHERE conditions that silently bypass indexes. By the time a performance problem surfaces in production, tracing it back to the root cause becomes a painful exercise in reading someone else's stream of consciousness. Rule 1: Keyword Capitalization SQL engines treat select and SELECT identically, but human readers do not. Always uppercase reserved keywords such as SELECT, FROM, WHERE, JOIN, GROUP BY, and ORDER BY. Keep table names, column names, and aliases lowercase. This single habit immediately creates a visual boundary between the logic structure of the query and the underlying data it operates on. Rule 2: Indentation and Clause Alignment Think of SQL clauses as layers in a data pipeline. Each major clause - SELECT, FROM, WHERE, GROUP BY, ORDER BY - should start at the left margin. Columns and filter conditions beneath them should be indented by 4 spaces (or 1 tab, as long as your team is consistent). This structure lets any reviewer skim the query top-to-bottom and understand the data flow at a glance. Rule 3: Trailing vs. Leading Commas This is a genuinely debated topic on data teams. Leading commas (placing the comma at the start of each new line) make version control diffs significantly cleaner when columns are added or removed. Trailing commas look more natural for developers coming from JavaScript or Python. Neither approach is wrong - what is wrong is mixing both styles

When you expose inventory or checkout endpoints to public-facing front-ends or third-party webhooks, safeguarding those APIs from brute-force scripts, scraping bots, and inventory hoarding algorithms becomes a critical requirement. Without defensive rate limiting, a single coordinated script can easily overwhelm your database connections. The Problem with Simple Counter Resets A common mistake when setting up basic API protection is using a rigid "Fixed Window" counter (e.g., allowing 100 requests per minute, resetting exactly at the turn of the clock). This creates a massive flaw where a developer can flood your server with 100 requests at 11:59:59 and another 100 requests at 12:00:01, effectively doubling your acceptable burst traffic and causing severe performance dips. To handle uneven burst traffic safely without crashing your database, the standard approach is implementing a token bucket algorithm. The Token Bucket Pattern The token bucket algorithm maintains a centralized bucket that holds a maximum capacity of tokens. Tokens are added back to the bucket at a constant, predictable rate over time. Each incoming API request consumes exactly one token. If the bucket is completely empty, the request is instantly rejected with a 429 Too Many Requests status code, protecting your core server threads. javascript // Quick Redis-based token bucket rate limiter concept async function isRateLimited(userId) { const key = `rate:${userId}`; const now = Date.now(); // Use a Redis multi-exec transaction to atomically check and update tokens const [tokens, lastRefill] = await redis.hmget(key, 'tokens', 'lastRefill'); // Calculate token replenishment based on time elapsed... // Return true if tokens <= 0, otherwise decrement tokens and update timestamp }

Exactly one year ago, my terminal was a blank slate. I started where almost everyone does , wrestling with HTML, CSS, and JavaScript, trying to understand the web pixel by pixel. What began as curiosity quickly turned into a full obsession. I went from building simple static pages to diving deep into full-stack development. Here’s what that intense first year of constant building, breaking things, and shipping real projects has looked like. The Leap into Modern Frameworks Once vanilla JavaScript started feeling limiting, I jumped into React . Component-based thinking completely changed how I approached interfaces. Then came Next.js — it bridged client-side beauty with server-side power and pushed me into a true full-stack mindset. The Ultimate Test: Lynvista Safaris The biggest challenge was building lynvistasafaris.com , a live travel booking platform for a real client. This project forced me far beyond tutorials and into real engineering problems. I had to implement: Payment infrastructure from scratch with Daraja API (M-Pesa STK pushes) and Paystack for international transactions. A robust database layer using Drizzle ORM + MySQL. Custom business logic , including a multi-currency pricing system with special validation rules for currencies like GBP. It was messy , many late nights debugging webhooks, schema mismatches, and edge cases , but shipping it taught me more than any course ever could. What One Year Taught Me Syntax is just a tool. The real skill is learning how to break down complex problems, debug effectively, and keep iterating even when things break in production. I’m incredibly proud of the progress I’ve made in 365 days (402 contributions later), but I know I’m still at the very beginning. For the next phase, I’m focused on shipping more projects, writing about the crazy bugs I encounter, and deepening my architectural and full-stack skills. If you want to see what I’m building right now, check out my GitHub .

In Q1 2026, OpenAI and Anthropic moved enterprise customers from flat-rate plans to token-based billing. The change looks administrative, but it had a direct consequence for engineering teams: the real cost of AI became visible for the first time. The market's reaction over the following two months was enough to reopen a question many considered settled: does AI actually deliver measurable ROI? What happened when the bill arrived The most documented case is Uber. The company had encouraged all employees to use agentic tools as much as possible and even ranked AI usage internally on leaderboards. The result: the entire annual budget was consumed in four months. The response was a $1,500/month cap per employee per agentic coding tool (Claude Code, Cursor, and similar). At Brex, engineers were limited to $500/week in tokens; employees outside engineering received a $5/week cap. T-Mobile temporarily capped usage at $2,000/month per user with plans to migrate to a tiered system. One unnamed company, according to Ed Zitron in "AI Is Slowing Down" (June 2026), spent $500 million on Anthropic models in a single month due to absent spend controls. These are not isolated cases. A KPMG survey reported by the Wall Street Journal in June 2026 found that only 26% of companies have a comprehensive view of their AI costs; 50% have partial visibility; and 22% only find out what they owe after the bill arrives. Steve Chase, KPMG's global head of AI, told the Journal: "It's a new resource that needs to be managed that didn't exist quite that way, and we're seeing exponential growth." The structural problem behind the spending caps The spending caps are a symptom. The root cause, as Zitron details in the same article, is that the economics of generative AI require numbers that currently seem out of reach. Anthropics has made over $330 billion in compute commitments with Google, Amazon, and Microsoft, plus another $45 billion with CoreWeave and SpaceX. To cover those commitments, it nee

73 cryptographically signed npm packages from Microsoft were compromised last week with advanced credential-stealing malware that fires the moment a developer opens one in an AI coding agent. Claude Code, Gemini CLI, Cursor, VS Code — all trigger it. It's the second supply-chain attack in two months against the same Microsoft account. "The genius of this Miasma worm lies in how it adhered to legitimate workflows. It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem." — Cloudsmith What actually changed 73 official Microsoft npm packages were poisoned with the Miasma worm — a clone of TeamPCP's open-sourced Mini Shai-Hulud toolkit Malware executes automatically when any of the 73 packages are opened inside an AI coding agent The payload (28 KB) harvests credentials from AWS, Azure, GCP, Kubernetes, 90+ dev tool configs, and password managers , then spreads laterally through cloud infrastructure Attack vector: stolen Microsoft publisher credentials → bypasses the build pipeline entirely → malicious build published with valid SLSA provenance attestation Each infection gets a uniquely encrypted payload — meaning hash-based IOCs are useless for detection GitHub initially flagged packages as "terms of service violations" rather than malware; Microsoft only acknowledged possible malicious content 48 hours later The same Microsoft account was compromised in May 2026 (durabletask Python SDK on PyPI, 400k downloads/month) — and apparently wasn't fully remediated Why this one stings The supply-chain attack playbook has levelled up. SLSA provenance — the framework designed to give you cryptographic confidence that a package came from a legitimate build — was used against you here. Attackers stole a legitimate Microsoft OIDC token, published a malicious build with real provenance, and conventional scanners waved it through as a routine trusted update. The AI agent angle makes it worse.

I’ve been working on a unit conversion website and would appreciate feedback from fellow developers. Goals: Fast loading Mobile friendly SEO focused Clean UX Site: https://myunitconverter.app I’d especially love feedback on: Navigation Search experience Performance Features worth adding Happy to return feedback on your projects too. submitted by /u/Nikpa_2163 [link] [留言]

Apple has announced the latest version of macOS. It’s all about the reintroduction of Siri, which is now accessible from anywhere on the Mac desktop.

Apple took the wraps off iOS 27 at its WWDC event, and the iPhone update is chock-full of smart upgrades, with a big focus on improvements to Siri.

submitted by /u/feross [link] [留言]

Founder and CEO RJ Scaringe has called it "maybe the most important thing we've launched to date."

Apple used to question whether generative AI-powered editing features were worth the risk of distorting our perceptions of the world. Now it seems Apple no longer believes that photos should accurately capture reality. At WWDC 2026, the company announced a host of new AI-powered photo editing tools. They give users effortless powers of manipulating images […]

"How do I hide wp-admin" is one of the most-searched WordPress security questions, and most answers give the same advice: install a plugin that renames your login URL. That advice isn't wrong. It's just answering a smaller question than the one being asked. Renaming /wp-login.php to /my-login moves the login form. It does not change what answers at the old path, what your plugin folders advertise, or what your home page tells a scanner about the stack underneath. If your only problem is the password-guessing bot hammering the default form, a renamer solves it. If your problem is "stop my site from being identified and targeted as WordPress," you've solved maybe a third of it. Here are the three leaks a login rename leaves open. Leak 1: the old path still costs a full WordPress boot When a login-URL renamer "blocks" the default path, the request to /wp-login.php still loads WordPress. PHP starts, the plugin stack initializes, and only then does the plugin decide to return a 404 to the logged-out visitor. The visitor sees a 404. Your server still did the work of booting WordPress to produce it. On a quiet site, nobody notices. On a site taking tens of thousands of probes a day, that's tens of thousands of full WordPress boots spent generating 404s. Your security dashboard's "attempts blocked" counter looks great. Your CPU graph disagrees. The architectural alternative is to reject the request at the rewrite layer, before PHP runs: # Apache .htaccess — reject the default login path at the server level < IfModule mod_rewrite.c > RewriteEngine On RewriteCond %{REQUEST_URI} ^/(wp-login\.php|wp-admin) [NC] RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC] RewriteRule .* - [R=404,L] </ IfModule > # nginx — same idea, requires a config reload after change location ~ * ^/(wp-login \ .php|wp-admin) { if ( $http_cookie !~* "wordpress_logged_in") { return 404 ; } } The probe to the old path returns 404 from the server, WordPress never loads, and the request costs almost nothi

Visibility Comes Before Optimization in IT Operations is a practical operating principle, not a slogan. The useful version of analytics, automation, and software operations is usually quieter than the marketing version. It is less about collecting everything or automating everything, and more about making the work easier to understand, review, and improve. The practical problem Teams often try to optimize before they can see the system clearly. That creates confident changes based on partial evidence, especially in infrastructure and telecom-adjacent workflows where signals are distributed. This is where many teams lose clarity. They have tools, charts, workflows, and activity, but the connection between evidence and decision is weak. When that connection is weak, software work becomes harder to evaluate. Teams still make decisions, but they rely more on memory, opinion, or urgency than on a reviewable operating picture. A smaller operating model Start with visibility: what is running, which state changed, where the weak signal appeared, and which workflow was affected. Then connect that signal to a decision or operational review. The important detail is restraint. A useful system does not need to track every possible action or automate every possible step. It needs to preserve the signals that help operators understand the situation and act with more confidence. That usually means naming the workflow, keeping the outcome visible, preserving enough context to explain the signal, and making uncertainty explicit instead of hiding it behind a polished interface. What to review Useful analytics separates normal activity from operational risk. It should make the next investigation smaller, not create another dashboard that requires interpretation from scratch. A reviewable system is easier to trust because it can explain its own state. It shows what happened, what changed, what remains uncertain, and which decision should move next. For WebmasterID, this is the practical

Because a reality wasn't given to us and is not there; but we have to make it ourselves, if we want to be; and it will never be one for ever, but constant and infinitely changeable. Luigi Pirandello, One, No One, and One Hundred Thousand Pirandello wrote this about the human condition. He didn't know he was describing the future of the internet. The web we know is about to disappear Not slowly. Not gradually. The web page, as the default unit of human navigation, is about to disappear: it will strip itself of everything we call "interface" and what remains will be only what it always was underneath — data, structure, instruction. The enticing homepages. The banners. The product carousels engineered by UX teams to capture attention in the first second and a half. The brand colors. The call-to-action buttons optimized for conversion rate. All of this is designed for a human eye that navigates alone. That eye is about to delegate. The agent that browses for you Imagine you want to buy a pair of shoes. Today you open a browser, search, filter, compare, go back, reopen the tab you closed, forget what you were looking for, start again. In a few years — maybe less — you will tell the agent what you want. The agent will already know that you have wide feet, that you prefer leather to synthetic, that you're looking for something for a wedding in June but deep down you want something that works afterward too. It will know that today you're in a practical mood, not an aspirational one. That you've spent a lot this month. The agent won't open a homepage. It will query a data structure. It will receive prices, availability, variants, return policies. It will build for you — and only for you, and only in that moment — a presentation tailored to measure. Colors that belong to you. Texts that speak your language. Images generated for your aesthetic sensibility of that day. The same store. Five billion different versions. One for each person, one for each moment. One, No One, and On

I have a domain with godaddy that I have used for over a decade and it comes with a domain email I have used for my work for the entire time. Their constant price hikes and add-ons have gone a step too far, especially after forcing microsoft email on me and then charging me £100 a year just for email with pathetic storage space...so I want to totally migrate from godaddy. The trouble is I am like a super boomer when it comes to web stuff. I will never understand what a DNS is or does, nor an SSL or SMTP, no matter how many times it's explained. My brain just won't accept any of it. It's a foreign language to me, so all of this is beyond terrifying and daunting. I don't want to lose any emails or domain etc as I use it all for work. From the research I have done, it seems transferring my domain to porkbun sounds like a good idea? But I read that I should use a different provider for email? But if the email is @ domainname then how can it be seperate? I don't understand that bit. And apparently I should transfer email before domain?? Could someone please offer some advice on how best to approach this? the internet is giving me 1000 different answers so I have no idea what is best to do. Will I lose previous emails when I transfer the email elsewhere? My current exact usage is: - domain name currently with godaddy - my website is built with adobe portfolio and comes with ample storage so I just redirect url to that page, so I don't need a new website or storage hosting etc. - my single email that I have used for years is mail@domainname and I always used gmail before (via proxy or whatever it's called?). so I used gmail and it sent from my domain email. Worked fine for years until godaddy forced users to pay for microsoft email and then the gmail proxy thing went all weird so I couldn't use it anymore (people stopped receiving my emails and I stopped receiving some emails and got inundated with quarantine warnings and other things I didn't understand). That's it. I jus

How KlineVision does AI technical analysis with Next.js + Gemini, draws it on the real candles, and verifies every call it makes after the fact — misses included. Most "AI stock analysis" tools confidently tell you a chart looks bullish and then never look back. I wanted the opposite: a tool that records every call it makes and later checks whether the market actually agreed — and publishes the hit rate, misses included. That one constraint — keep yourself honest — ended up shaping most of the interesting engineering. Here's how KlineVision is put together. What it does Type a ticker ( AAPL , 600519.SH , 0700.HK ) — or drop a chart screenshot. You get a structured read : trend, support/resistance, candlestick + chart patterns, and 缠论 (Chan theory) structure — drawn directly onto the real candles , not hand-waved in prose. Works across US, A-shares, and Hong Kong markets. The stack Next.js (App Router) on Vercel Supabase (Postgres + RLS) for data & auth Gemini 3 Flash for the analysis itself EODHD + Yahoo Finance for market data GitHub Actions + Vercel Cron for the background jobs PostHog for product analytics Now the parts that were actually interesting to build. 1. "Never analyze fake data" The market-data layer had a silent fallback: when a provider rate-limited, it returned synthetic candles so the UI never broke. Great for a demo, terrible for a product whose entire value is trust — the model would write a beautiful, confident analysis of a chart that never existed . The fix was to make the data layer fail honestly : Yahoo (primary) → EODHD (fallback) → if only demo data is available → 503, no analysis If we can't get real candles, the user gets "live market data temporarily unavailable" — not a hallucinated read. For a trust tool, a silent fallback to fake data is the worst bug on the board. 2. Make the AI show its work A text blob saying "there's a double bottom" isn't credible. You have to see it on the chart. So the model returns structured overlays keyed to

Mobile Experiences That Keep Your Business Connected Today’s customers expect speed, convenience, and accessibility at their fingertips. Mobile applications have become one of the most important channels for engaging users, delivering services, and building lasting customer relationships. At Code Scrapper, we create mobile applications that help businesses stay connected with their audiences while delivering seamless digital experiences across modern devices. Whether you’re launching a new product, expanding your digital presence, or improving customer engagement, our mobile app development services are focused on creating applications that users enjoy and businesses can confidently scale. Turning Ideas Into Engaging Mobile Products A successful mobile application is more than a collection of features. It must provide a smooth experience, solve real problems, and encourage users to return. Our development approach combines business strategy, user-focused design, and modern engineering practices to create mobile solutions that support long-term success. From startup concepts to enterprise applications, we help organizations transform ideas into reliable mobile products that create meaningful value for users and measurable results for businesses. What We Build Customer-Facing Mobile Applications Applications designed to strengthen customer engagement, improve accessibility, and enhance user satisfaction through intuitive experiences. Business & Enterprise Applications Mobile solutions that help teams collaborate, manage operations, and access critical information from anywhere. Ecommerce Applications Mobile commerce experiences designed to simplify purchasing journeys and increase customer retention. On-Demand Service Applications Platforms that connect businesses and users through real-time interactions, bookings, and service delivery. Membership & Community Platforms Applications that help businesses build stronger communities, improve communication, and increase us