标签：#EV

Hey everyone i'm moving to a decent first world country by the end of this year I got my PR and everything I just still need money I worked for the last 6 months as a contractor for $2400 monthly with an AI startup based in California, they sold it a month ago and I was let go obviously as their product was built and acquired by another company, I'm very confident in my skills its just I literally have no idea about how to land a similar job like that again. if you can help me with some advice please do and please don't' be racist I didn't choose where to be born, I wish everyone can get mega rich in the future and thanks in advance. submitted by /u/In-Hell123 [link] [留言]

We manage retainer clients and every so often a client will email us saying something on their site looks broken. Nine times out of ten it's a WordPress plugin update that shifted a layout, a hero image that stopped loading, etc. We find out from them instead of the other way around, which is an awkward position to be in when you're supposed to be the one watching their site. I've looked at tools like Visualping, ChangeTower, and Distill. They all work the same way. You give them a URL, they alert you when something changes. That’s fine for monitoring a few pages yourself, but they don't really fit an agency workflow. There's no concept of a client, there’s no way to group pages by account, and you can’t actually show a client at the end of the month to prove you're on top of things. The developer tools like Percy and Applitools are a different thing entirely. They plug into CI pipelines and need an engineer to set them up. Not useful for an account manager who just wants to know if a client's homepage looks broken this morning. What I keep thinking about is something simpler. A web app that allows you to organize by client, take screenshots on a schedule, flag visual changes before the client notices, and generates a monthly summary you can send to the client. It would be less about code deployments and more about just knowing your clients' sites are visually intact. Is this something you actually run into, or do you have a system that handles it already? Would something like this be worth paying for, or is it too niche to budget for? Am I missing a tool that already does this well? Any feedback is much appreciated. Thanks. submitted by /u/newintownla [link] [留言]

I interviewed for Walmart SWE3 role 3 days back. Both rounds were held on the same day. Qualified Round 1 and then gave Round 2. Round 2 went well too. But I have not received any update yet. Its been 3 days. Is it normal or should I accept that I am rejected? submitted by /u/Complete-Ad-240 [link] [留言]

Made for those who hate having a TV in the home, Samsung’s Movingstyle monitor-on-wheels brings the entertainment when you need it and hides away in a closet when you don’t.

If you are an open-source maintainer, developer advocate, or builder, you know the cycle: you build an amazing tool, but writing the launch blog post, documentation, or tutorial takes hours. For the Hermes Agent Challenge , I wanted to build something that solves this exact problem. I built devto-blogger , a custom, prompt-driven skill for the brand new Hermes Agent by Nous Research. It autonomously scans any workspace or codebase, analyzes the architecture, and drafts a fully-structured, rich Markdown technical article ready for publication on DEV. 🚀 What is Hermes Agent? Hermes Agent is an open-source agentic system built by Nous Research (the lab behind the famous Hermes LLM models). Unlike basic coding copilots or simple chatbot wrappers, Hermes is: Environment-Aware : It runs sandboxed in Docker, Modal, Daytona, SSH, or locally. Connected : It interfaces with Telegram, Discord, Slack, WhatsApp, and more. Closed Learning Loop : It has persistent memory and creates custom skills on the fly from its own experience. 🔧 The Entry: The devto-blogger Skill In Hermes Agent, a "skill" is defined by a simple, declarative Markdown file ( SKILL.md ) located in the ~/.hermes/skills/ directory. By utilizing a prompt-driven skill structure, we can guide the agent's behavior globally without writing complex Python orchestration scripts. Here is the custom skill I designed and installed for this challenge: --- name : devto-blogger description : " Scan the codebase and generate a comprehensive Dev.to technical blog post draft." version : 1.0.0 author : Hermes Agent Developer license : MIT platforms : [ linux , macos , windows ] metadata : hermes : tags : [ devto , blogging , documentation , markdown , technical-writing ] related_skills : [ plan , design-md ] --- # Dev.to Technical Blogger Skill Use this skill when you need to write an in-depth technical post, review, or tutorial about the active workspace or codebase. ## Core Behavior 1. **Codebase Inspection** : Scan repository

In 2024, Orca Security sued Wiz and demanded their full git version control history. Orca wanted to see "when features and functions were added, modified, or altered, including through engineers' notes and comments." The court recognized git history as relevant evidence in a software IP dispute. It ordered production of commit logs tied to two specific features. That ruling should concern you. Your commits record author name, email, timestamp, and content hash. Git chains them together cryptographically, replicates them across clones, and makes them discoverable in litigation. You are building a legal record whether you intend to or not. You already use git as a development tool. It is also a chain of custody for intellectual property. And you are probably destroying yours. A Cryptographic Chain of Custody Every git commit stores five things: the content of the change, the author's name and email, the author's timestamp, the committer's name and email, and the committer's timestamp. That commit is hashed using SHA-1 (or SHA-256 in newer repositories), and the hash incorporates the hash of the parent commit. Change one byte anywhere in the chain and every subsequent hash changes. This is a Merkle DAG. The same data structure that makes blockchains tamper-evident. Your commit history is a cryptographic proof linking each change to all previous changes. Git records three layers of timestamps. AuthorDate is when the content was written. CommitterDate is when it was finalized into the repository. And the server-side push timestamp, recorded by GitHub or GitLab, marks when the remote received the data. That third timestamp is outside the developer's control. A clone is a full copy of the entire history. Your collaborators, CI runners, and backup systems each hold an independent replica. Forensics researchers call this "evidence proliferation." Tampering with one copy does nothing if fifty others exist unchanged. Under Federal Rules of Evidence 902(14), data verified throu

Meet Halimun Proxy a high-performance, ultra-low latency proxy tunnel system built from the ground up in Rust. Why Rust? By leveraging Rust , Halimun achieves extreme efficiency. Using the Axum web framework and Tokio for non-blocking asynchronous I/O, it manages to maintain a tiny footprint—running on as little as ~15MB of RAM . It’s designed to be fast, memory-safe, and incredibly stable under load. Core Security Features Halimun isn't just a proxy; it’s a security layer. It enforces strict request validation to ensure your internal services are never exposed to malicious actors: AES-256-CBC Encryption: End-to-end payload masking. Even if your traffic is intercepted, the actual API endpoint and data remain indecipherable. HMAC-SHA256 Integrity: Validates that data hasn't been tampered with in transit. Replay Attack Prevention: Uses Nonce and timestamp verification in-memory (via DashMap ) to reject duplicate spoofed requests. SSRF Protection: Built-in mechanisms to prevent attackers from targeting your internal network infrastructure (e.g., 127.0.0.1 ). Camouflage Routing: It hides your actual API structure behind random, dummy URL segments, making traffic profiling by WAFs or human analysts nearly impossible. Quick Start (Docker) Halimun is "Docker-ready," making it easy to drop into any existing infrastructure. 1. Configuration First, generate your encryption keys using the built-in generator: # Generate keys and save to .env docker build -t halimun-proxy . docker run --rm halimun-proxy ./halimun-proxy --keygen --format = env > .env 2. Deployment Configure your config.yaml to map your backend services, then launch your cluster: docker-compose up -d Your production proxy is now live, listening securely on port 80 while your backend services remain completely secluded within a private Docker network. Under the Hood: Request Lifecycle Halimun uses an encrypted tunnel approach. A typical request follows this structure: POST /proxy/1/SEGMENT1/SEGMENT2/SEGMENT3/SEGMEN

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built I built the Atomberg Goal Setting & Tracking Portal — a full-featured, role-based HR performance management system for Atomberg Technologies (a fast-growing Indian consumer electronics brand). The portal manages the complete employee performance lifecycle : 🎯 Goal Setting — Employees create goals with weightage, UoM type, and thrust area alignment. Business rules enforced: max 8 goals, total 100% weightage, minimum 10% per goal ✅ Manager Approval Workflow — Submit → Review → Approve / Return for Rework 📊 Quarterly Check-ins — Q1–Q4 progress logging with 4 UoM types (Numeric Min/Max, Timeline, Zero-is-best) 🚨 Escalation Monitor — Rule-based detection of overdue submissions, missing approvals, and pending manager reviews 📈 Analytics & Reports — QoQ trend charts, department-wise performance, thrust area distribution, CSV exports 🔒 Admin Governance — Cycle phase management, shared goal distribution, full audit logging Tech Stack: React 18 + Vite · Context API · localStorage (zero-backend demo) · Recharts · Lucide Icons · Custom dark glassmorphism CSS Demo 🔗 Live App: https://atomberg-goal-tracker.vercel.app/ 📁 GitHub Repo: https://github.com/anonomous29/atomberg-goal-tracker Quick Login Credentials Role Email Password Admin priya.sharma@atomberg.com admin123 Manager rajesh.kumar@atomberg.com manager123 Employee vikram.singh@atomberg.com emp123 What to try: Login as Admin → Go to Escalation Monitor → see rule-based alerts Go to Reports → QoQ Trends tab → see Q1 performance bar chart Login as Employee → Dashboard shows Q1 score donut + goal-level progress Login as Manager → See team check-in status and review Q1 feedback The Comeback Story This project started as a hackathon requirement — a Business Requirements Document (BRD) from Atomberg asking for a digital goal management system. The initial version had the core structure but was essentially an empty shell: blank dashboards on login, no check

I've been on OpenRouter for a side project for a few months and it's solid for prototyping, but the streaming latency and the pricing markup on models I could call directly started bugging me enough to look around. Curious what other people running real production traffic have settled on. submitted by /u/Quantum_Nest [link] [留言]

Of course the Hitman devs made a great James Bond game.

Hey everyone! I'm currently working on a landing page project with quite a few GSAP animations, some ThreeJS, all built with SvelteKit and hosted on Cloudflare. I'm working on this project with a designer friend who has some development knowledge. He can do HTML/CSS/JS and use GSAP. We often work together — he finds clients, handles project management, UI and UX, while I take care of the development side. Since I don't really have a strong "graphic eye", our usual workflow was: I lay the foundations, handle the animations, and let him come back over everything for easing and fine-tuning. Since AI came along, things have gotten a lot more complicated. Don't get me wrong — I use Claude myself to get oriented, review my code, analyse a project, or generate boilerplate code. But I always review the output. My friend, on the other hand, uses it in full vibe coding mode. I just got the latest version of this landing page where he'd pushed his changes, and I was pretty shocked. The code is massively over-engineered for no good reason, hard to follow, and a genuine nightmare to debug. Claude made everything far more complex than it needed to be. To avoid this kind of situation going forward, we've started putting a few ground rules in place: a mandatory review before any merge, and certain core files that only I touch. Not a perfect solution, but it helps keep things from spiraling. Has anyone else had the same kind of experience with vibe coding ? I mean, it does work, but the output feels bloated. Edit : As some people noticed it, i've used an AI to translate that text into english and re-phrase it, since i'm not really fluent in english (isn't that ironic lol). submitted by /u/frenchy_mustache [link] [留言]

submitted by /u/dreamnyt [link] [留言]

They're more secure than you might think.

Supply chain attacks every other morning Unless you've lived under a rock for the last few months, you probably noticed that software supply chain attacks are getting trendy among threat actor groups. Over the last 12 months, we've seen more of those than ever before, to name only a few of them: tj-actions/changed-files : In March 2025, a popular reusable GitHub application workflow was compromised to dump secrets from CI/CD pipelines. Salesloft Drift : In August 2025, threat actors stole OAuth credentials from the compromised Drift chatbot application. Shai-Hulud : In September and November 2025, a wormed attack propagated through npm packages and collected secrets. The common thread among those incidents is that they all revolved around secrets, one way or another. Some used secrets as an initial access vector, and others were focused on collecting secrets from victim environments. March 2026 did not change the state of things, with two new severe attacks added to our dreadful collection: trivy-action & LiteLLM campaign by Team PCP. The most popular Axios package compromise. Both those attacks followed a now-classical pattern, spreading through compromised open-source dependencies to maximise the impact in the shortest possible time. Your all-time classic, now with added internal threats Open-source supply chain attacks are not new. Ever since we started using centralized open-source package registries, the risk has existed. Threat actors understood this and started exploiting it. What has changed since 2015 is how we have improved software development productivity through automation. And now, this very same automation that lets you test and build your projects without typing a single command is amplifying the supply-chain threat and the velocity of attacks. Let's see how. Keeping your malware up to date A very concerning pattern we've observed in the trivy-action and Axios campaigns is that automation can become the source of your compromise. One thing no develop

The Scenario: "Oops, I Made a Messy Commit History" Imagine you're working on a feature branch called feature/login-page . You’ve made a few commits, but now : One of the commits has a bug . Another commit has a wrong commit message . Your commit history looks like a jumbled mess compared to main . Time to clean it up! But… should you rebase , reset , or revert ? First, Let’s Understand the Core Idea of Each: Command What it Does Safe for Shared Branches? rebase Rewrites commit history to make it linear and clean No , unless used carefully reset Moves the HEAD and branch pointer to a different commit No , dangerous on shared branches revert Creates a new commit that undoes a previous commit Yes , safe to fix public history 1. Git Rebase : "Let’s Rewrite History Neatly" What is it? git rebase allows you to move or "replay" your commits onto another branch or rearrange them to make a clean, linear history. When to Use? You want to clean up messy commit history before merging. You want to squash commits . You want to change commit messages . Example: You have these commits in feature/login-page : A — B — C — D (feature/login-page) ↑ Buggy commit (C) You want to fix commit C and clean up the message in D . Solution: Interactive Rebase git rebase -i HEAD~3 You’ll see something like this: pick abc123 B pick def456 C pick ghi789 D You can now: Change "pick" to "edit" for C to fix the bug. Change "pick" to "reword" for D to fix the commit message. Squash commits if needed. Important: This rewrites commit hashes. If your branch is pushed and shared , rebasing can mess up others' history. Use with care! 2. Git Reset : "Let’s Go Back in Time (Dangerously Powerful)" What is it? git reset moves your branch pointer ( HEAD ) to a previous commit. It can unstage files , remove commits , or even delete code changes . Types of Reset: Command What happens? git reset --soft Keeps your changes staged. git reset --mixed Unstages changes but keeps them in the working directory. git reset

Read Time: ~14 minutes | Building on React fundamentals to master state management at scale Prerequisites : Familiarity with React basics, useState, useEffect (Part 1) 🔗 Series Navigation ← Part 1: Complete Guide from Zero to Production Part 2: Advanced Hooks & State Management ← YOU ARE HERE → Part 3: Performance Optimization (coming next) 📌 What You'll Learn By the end of this guide, you'll understand: ✅ Creating powerful custom hooks ✅ When and how to use useReducer ✅ Managing state globally with Context API ✅ Redux fundamentals and when to use it ✅ Modern alternatives: Zustand and Jotai ✅ Choosing the right pattern for your project ✅ Real-world shopping cart implementation 🎣 Custom Hooks: Reusing Logic Across Components Custom hooks are regular JavaScript functions that let you extract component logic into reusable functions. They're one of the most powerful React patterns. Rule #1: Custom Hooks Must Start with "use" // ✅ Correct - starts with "use" function useFormInput ( initialValue ) { const [ value , setValue ] = useState ( initialValue ); return { value , bind : { value , onChange : e => setValue ( e . target . value ) }, reset : () => setValue ( initialValue ) }; } // ❌ Wrong - doesn't start with "use" function formInput ( initialValue ) { ... } Example #1: useFormInput Hook import { useState } from ' react ' ; function useFormInput ( initialValue = '' ) { const [ value , setValue ] = useState ( initialValue ); return { value , setValue , bind : { value , onChange : e => setValue ( e . target . value ) }, reset : () => setValue ( initialValue ) }; } // Using the custom hook function LoginForm () { const email = useFormInput ( '' ); const password = useFormInput ( '' ); const handleSubmit = ( e ) => { e . preventDefault (); console . log ( email . value , password . value ); email . reset (); password . reset (); }; return ( < form onSubmit = { handleSubmit } > < input {... email . bind } placeholder = " Email " type = " email " /> < input {... password .

If you have ever run a Lighthouse audit on a content-heavy WordPress site, you know the usual verdict: "Serve images in next-gen formats." Translation: your JPEGs and PNGs are too heavy, and WebP would cut them down a lot. The problem is that nobody wants to convert images by hand, and most automated options either run as a bulk job you have to remember to trigger, or push your images to a cloud service with a monthly quota. I wanted something simpler: upload an image, get a WebP, done. So I built a free plugin called Pixellize Image Optimizer , and this post walks through the problem, how the plugin solves it, and how it works under the hood. Why WebP is worth it WebP files are usually 25 to 35 percent smaller than the equivalent JPG or PNG at the same visual quality. On an image-heavy page that is a real difference: Faster Largest Contentful Paint, which is one of the Core Web Vitals Google uses for ranking. Less bandwidth, which matters if you pay for CDN traffic. No visible quality loss at sensible quality settings. Browser support is no longer a concern. Every current browser handles WebP. The approach: convert on your own server, on upload Instead of a cloud API, the plugin converts images locally with the PHP GD or Imagick extension (almost every host has one). There is no account, no API key, and no paid tier. The core flow: You upload an image to the Media Library as usual. The plugin generates a WebP version of the full image and every thumbnail size. Your front end serves the WebP automatically. How it works under the hood For WordPress developers, here is the interesting part. The plugin hooks into the standard upload and rendering pipeline rather than fighting it: On upload, it taps into the attachment metadata generation so it can convert the full image and every registered sub-size, not just the original. That matters because responsive images use srcset , and a half-converted set defeats the purpose. On the front end, it rewrites image URLs to the We

In Part 14 , I finished HMAC webhook signing. The backend was complete — JWT auth, PostgreSQL, Redis caching, rate limiting, circuit breaker, worker pool, webhook delivery, migrations, Docker. All running locally. But "runs on my machine" isn't a portfolio project. It's a homework assignment. Time to ship it. The Stack Being Deployed Go backend — ~15MB Docker image (multi-stage build, CGO_ENABLED=0) PostgreSQL 16 — with golang-migrate running schema migrations on startup Redis — for caching, rate limiting, and refresh token storage Oracle Cloud Free Tier — 1GB RAM, 45GB disk, already provisioned Everything wired together with docker-compose.yml . One command to start the entire stack. Step 1: The VM Was Fine, Actually I was worried about the free tier specs. Turned out the "1GB" in the tier name refers to RAM, not disk. The actual disk is 45GB — plenty. free -h # 954MB RAM, 552MB available df -h # 45GB disk, 41GB free The real constraint: no swap . Go's compiler is memory-hungry. Without swap, building the Docker image on the VM would exhaust RAM and kill the process. More on this in a moment. Step 2: Install Docker curl -fsSL https://get.docker.com | sudo sh sudo usermod -aG docker ubuntu newgrp docker The official install script handles everything — Docker Engine, containerd, Docker Compose plugin. One command, done. Step 3: Clone the Repo The repo is private. Created a fine-grained GitHub personal access token with Contents: Read-only permission. Used it to clone: git clone https://TOKEN@github.com/absep98/Go_learn.git Security note: never paste tokens in chat, email, or anywhere visible. Type them directly into the terminal. Tokens in chat history are compromised tokens. Step 4: Create the .env File The .env from my local machine needed two changes for Docker: # LOCAL (wrong for Docker): DB_HOST = localhost REDIS_HOST = localhost # DOCKER (correct): DB_HOST = postgres # ← service name in docker-compose.yml REDIS_HOST = redis # ← service name in docker-compose.ym

Rivian is sending out invites and planning the first deliveries for its R2 electric SUV for June 9.

The Cloud Native Computing Foundation has highlighted a new AI-assisted migration approach that enabled engineers to migrate 60 ingress-nginx resources to Higress in roughly 30 minutes, demonstrating how artificial intelligence is increasingly being applied to modernize Kubernetes networking and gateway infrastructure. By Craig Risi