标签：#EV

terraform plan is honest about what it's going to do. The problem is it's also verbose, repetitive, and full of cosmetic changes (like recomputed tags) mixed in with real ones (like a database instance scheduled for -/+ replace ). On a 400-line plan, the dangerous changes hide. This is the kind of task AI is actually good at: skimming structured text, flagging the entries that matter, ignoring the rest. But "paste plan into Claude" is not the workflow. There's a specific shape to this that works. Why people get this wrong The natural instinct is to copy the plan output and paste it into a chat: Terraform will perform the following actions : # aws_instance.web will be updated in-place ~ resource "aws_instance" "web" { id = "i-0abc123def456" ~ instance_type = "t3.small" - > "t3.medium" ... The model will respond with a sentence about each line. You'll scroll. You'll skim. You'll miss the -/+ replace on the database because it's in the middle of 30 routine updates. This is the same failure mode as pasting a wall of logs and asking "is anything wrong?" The model is too polite to skip things. You need to tell it to. The format that actually works: JSON terraform show -json tfplan outputs a structured representation of the plan that's much easier to reason about than the text format. Two reasons: The "actions" field is explicit. Each resource_change has a change.actions array — ["create"] , ["delete"] , ["update"] , or ["delete", "create"] for replace. No ambiguity. You can filter before pasting. With jq , you can extract only the dangerous changes, drop the noise, and feed a 20-line summary into the AI instead of a 400-line plan. Try this: terraform plan -out = tfplan terraform show -json tfplan > plan.json # Get just the dangerous changes jq '[.resource_changes[] | select(.change.actions | contains(["delete"])) | {address, type, actions: .change.actions}]' plan.json That's the AI's input. Compact, unambiguous, and pre-filtered to the changes that need a human decision.

Bolting an LLM onto your pull requests is a weekend project. Building AI code review that your engineers don't disable within two weeks is the actual problem. The failure mode isn't missing bugs — it's crying wolf. Post twenty nitpicks and three hallucinations on someone's PR and they'll mute the bot forever. This is the pipeline we built on Mattrx to earn — and keep — that trust. Mattrx is our multi-tenant marketing-analytics SaaS: ~95k lines of C#, 11 engineers, and enough pull requests that senior-reviewer time was the bottleneck. We tried the naive thing first — pipe the changed file into a model, post the output — and watched the team stop reading it in nine days . TL;DR Dimension Human-only / naive AI (before) AI review pipeline (after) Coverage selective / whole-file dump every PR, diff-focused First-review latency ~6 hours (wait for a human) ~3 minutes (AI first pass) Context none / a naked file diff + call sites + conventions Reviewers one mega-prompt specialized dimensions, in parallel False positives ~35% (so it gets ignored) ~6% (adversarially verified) Merge control human, or nothing severity gate; human always decides Governance none gateway: audit, cost, secret redaction ~90 PRs/week across 11 engineers; the pipeline reviews 100%. First-pass review latency 6h → 3 min. False-positive rate ~35% → ~6% — the single number that decides whether the bot lives or dies. Escaped defects to production down ~40%; senior-reviewer time down ~30%. ~$0.05 per PR (cheap model for style, frontier only for correctness). The one mental shift: AI code review is not about finding issues — models find plenty. It's about not crying wolf . The product is trust, and trust is a false-positive-rate problem. Verify before you comment; let the AI propose and the human dispose. The naive approach — and why it collapses // BEFORE: dump the whole changed file into one prompt, post whatever comes back. foreach ( var file in pr . ChangedFiles ) { var text = await File . ReadAllTextAsyn

Notes from shipping a real-world PWA in Korea: Vite SSG is worth it. SPAs lose Korean SEO because Naver's crawler doesn't fully render JS. Leaflet > Mapbox for cost-sensitive projects. Free OSM tiles + zero cost. Firebase Hosting rewrites let you have deep URLs (/city/suwon) without a backend. KakaoTalk share is non-negotiable in Korea — 70%+ of social traffic. PWA install banner: don't auto-prompt, let the user discover. Project: https://gyeonggi-currency-map.web.app?ref=devto&utm_source=devto&utm_medium=social&utm_campaign=multi-site-bot

OAuth recovery emails look harmless until you test them the lazy way. A team sends password reset links or recovery codes into one shared mailbox, confirms that something arrived, and marks the job done. From a security view, that test is too weak. It can hide token reuse, wrong-user delivery, or log retention that exposes sensitive account events. For non-production checks, I like using a disposable email address that belongs to one test run. Some teams build that inbox layer themselves, some use tempmailso, but the core principle is the same: isolate the recovery event, inspect it quickly, and delete the evidence you no longer need. That is helpful when Authentication and OAuth changes ship together. Why OAuth recovery emails deserve their own threat model Recovery email tests are not just "did the mail send?" checks. They sit on the edge of account takeover risk, so the message itself matters almost as much as the login flow. A decent threat model for these emails should ask: did the message reach only the intended inbox for this run? does the link or code expire when the product says it does? is the message revealing too much user data in subject lines or previews? can an older token still be used after a new recovery request? do logs or test fixtures keep the recovery secret longer than they should? This is where shared inboxes become dangerous in a subtle way. Even if nobody has bad intent, mixed test data makes it harder to prove which token belonged to which request. The same operational confusion shows up in email change confirmation checks , and it gets worse when the email can restore account access. OWASP recommends testing authentication recovery features with the same care as sign-in and session controls, because weak recovery paths are a common bypass route for stronger primary login defenses: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html A safer test flow for recovery links and codes The cleanest pattern is one inbox

The Chevy Silverado EV is a solid first draft of an EV pickup truck. Here's what could make it better.

Book: The Complete Guide to Go Programming Also by me: Hexagonal Architecture in Go — the companion book in the Thinking in Go series My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub You open a pull request in a Go repo you just joined. Ten minutes later there are six comments on it. None of them are about your logic. They point at a capitalized error string, a receiver named this , a context stored on a struct. Each comment links the same page: the Go Code Review Comments wiki. That page is the closest thing Go has to an official style council. It grew out of the comments Go's own maintainers left on CLs for years, and most Go teams treat it as the default rulebook. The problem is that the wiki tells you what but rarely why , so the rules read like arbitrary taste. They aren't. Each one exists because the alternative bit somebody. Here are ten that reviewers cite the most, with the reason behind each. Everything below is idiomatic on Go 1.23+. 1. Error strings are lowercase and unpunctuated The rule: an error string should not be capitalized and should not end with punctuation. // wrong return fmt . Errorf ( "Failed to open config." ) // right return fmt . Errorf ( "failed to open config" ) The reason is wrapping. Go errors get concatenated. Your string is almost never the whole sentence a user reads; it's a fragment in a chain built with %w : return fmt . Errorf ( "load settings: %w" , err ) // -> "load settings: open config: permission denied" Capitalize your fragment and you get load settings: Open config: permission denied in the middle of a line. End it with a period and you get a period in the middle of a longer message. Lowercase, no trailing punctuation, and every fragment composes cleanly no matter where it lands in the chain. The exception is a string that begins with an exported name or acronym, which keeps its own case ( HTTP , TLS ). 2. Receiver types are consistent ac

This is a reprint from my tips blog. You can find the original article here: [ https://tips.ojapp.app/en/ios-android-pwa-goal-difference-3/ ] Android vs. iPhone: Different Goals for PWAs When people talk about PWAs, the explanation often sounds like this: Android supports PWAs. iPhone does not support PWAs very well. If you only look at the PWA specifications, this explanation is easy to understand. Android Chrome supports manifest.json, Service Worker, installation, notifications, shortcuts, and many other PWA features quite strongly. iPhone Safari, on the other hand, does not behave the same way as Android. But after testing PWAs on both iPhone and Android many times, I started to see the difference in another way. More accurately, Android and iPhone have different goals for PWAs. That is the biggest difference I noticed while testing repeatedly. Android tries to turn web pages into apps Android PWAs are clearly designed in the direction of making web pages feel closer to native apps. The idea is to take a website opened in the browser and move it toward a native-app-like experience. This direction is very strong on Android. That is why many PWA-related features are well supported. manifest.json Service Worker Push notifications Install Prompt Shortcuts theme_color background_color maskable icons display modes orientation Of course, it is not perfect. Manifest cache can be stubborn, multiple PWAs on the same domain can become confusing, and real-device testing can still create plenty of traps. Even so, when you build according to the PWA specification, Android usually responds in a fairly straightforward way. For example, if you set display: fullscreen , the app feels much more full-screen. theme_color is often reflected in the toolbar color. orientation also works quite strongly on Android. In other words, for Android, a PWA is an app made from the Web . iPhone starts from the experience of placing web pages on the home screen iPhone is different. Even before the

Use Docker and a disposable mailbox to verify AWS SES delivery in CI before release without touching shared inboxes or leaking test mail. Shipping an app that "sent the email" is not the same as shipping an app that delivered a usable message. In AWS stacks, the miss usually shows up late: a container points at the wrong SES region, a preview environment uses stale credentials, or the message lands with broken links after templating. A disposable email address check is a simple final guardrail, and its easy to automate when your mail sender already runs in Docker. This is the pattern I recommend when teams are searching for temp mail com style testing, but need something cleaner for production-like CI. The goal is not to replace unit tests or the Amazon SES mailbox simulator . The goal is to prove that your real app container, with real environment wiring, can send one controlled message and that the inbox content is worth shipping. Why this check belongs in the release path AWS SES is strict in useful ways. If your account is still in the sandbox, you can only send to verified identities or the mailbox simulator . Even after production access, delivery problems still happen becuase the application layer and the cloud layer drift separately. A practical smoke test catches things that mocks often miss: wrong AWS_REGION or SES endpoint selection missing secrets in the container runtime template variables that render empty in preview builds broken confirmation links caused by bad environment URLs unexpected sender identity changes between staging and release That list looks basic, but it doesnt stay basic when three services, one worker, and a release job all touch outbound email. A small Docker pattern that keeps the test deterministic Keep the sender in the same Docker image you deploy, but trigger a narrow email scenario from CI. For example, seed a temporary user, call the notification path once, then poll a disposable inbox API for the matching subject line. servi

By Vilius Vystartas This is the follow-up to What Actually Changed in Two Weeks . That one was about setting up a project for AI-speed delivery. This one is about something I keep re-learning on every fast delivery. You start shipping faster with AI. The code works, the feature lands, it feels good. Then a few weeks later the feedback comes back, and some of it catches you off guard. Not because anything is broken — but because a few things that seemed obvious to you weren't obvious to the other side. No drama. It happens. Here are five things I'm learning to check earlier. 1. What does "done" look like from their side? To me, done means working software. To someone else it might mean pixel-match with a design. Both are valid. What helps: A quick "what does good enough look like to you?" before the work starts. One sentence can save a lot of back and forth. 2. When will they actually look at it? Sending something doesn't mean it gets reviewed immediately. It lands in a queue like everything else. What helps: Naming a review date alongside the delivery date. "I'll share this Tuesday — could you take a look by Friday?" Turns silence from a mystery into a signal. 3. What needs to be perfect vs what can be improved later? Not everything in the feedback is the same weight. A label change and a broken flow are different things. Without saying so upfront, everything looks like an emergency. What helps: Two buckets agreed early. "Here's what I'll get right before it ships. Here's what I'd revisit in a follow-up." Makes the first feedback session more productive. 4. Could they see something before the full delivery? The first time someone sees your work often sets the tone. Showing one page or one flow halfway through can catch mismatches before they multiply. What helps: A mid-point check-in. "First page is ready — want to see if this matches what you had in mind?" Five minutes that can save a round of revisions. 5. Do they have the full picture? You've been living in this

My father is a stroke patient. Watching him try to speak clearly again — with patience, repetition, and no small amount of courage — is what pushed me to build Voice Revive. It’s a free web app for stroke survivors and people with aphasia: pick a category, hear a word, say it back, get forgiving feedback. No accounts, no scores, no pressure. I vibecoded most of it with AI tools, but the reason behind it is deeply personal. If it helps even one person feel a little more confident speaking again, it was worth it. Let’s work together: Voice Revive is a personal project, and I’m open to: Collaboration — features, accessibility, reaching more people who need it Sponsorships — to keep the app free and accessible Part-time / freelance web development — I’m comfortable building with: What I work with today: Next.js & TypeScript Node.js (Express) Python (FastAPI) Tailwind CSS What I’ve built with before (freelance): Kotlin & Java for Android Development(previous experience - freelance) ESP32 & C++ for IOT Development Try it: https://voicerevive.online/ Connect with me: https://www.linkedin.com/in/aaron-mercado-163b02369/

Built for the WeMakeDevs × Cognee "The Hangover Part AI" hackathon — Cognee Cloud track. ▶ Play it free: vegas-amnesia.vercel.app · ⭐ Code on GitHub The problem with most memory demos When you give a developer a memory API, the demo almost always looks the same: add() some documents, search() over them, print the answer. Two functions. It works, it's fine, and it teaches you almost nothing about why graph-based memory is different from stuffing everything into a context window. Cognee actually has a four-stage lifecycle — remember → recall → memify → forget — and the interesting parts are the two everyone skips. memify consolidates what you know into new inferences. forget lets you delete a belief and watch the graph heal around it. Memory you can reason over and correct . So instead of writing another RAG demo, I asked: what if the memory lifecycle wasn't the plumbing — what if it was the game ? Meet HAL-9001 You play HAL-9001 , a personal AI assistant (yes, HAL 9000's slightly more helpful successor). Your owner Dev had a wild night in Vegas. At 6 AM your memory graph was corrupted. His fiancée Priya lands at noon, there's a suspicious ring on his finger, and you remember nothing . The screen boots to a "MEMORY CORRUPTED" terminal and an empty graph. Your job: reconstruct the night, catch the lies, and answer the final question — what happened, and where's the ring? — before noon. Every location you explore, every clue you examine, every witness you interrogate feeds a live 3D memory graph that you can pop open at any time. That graph isn't a visualization of the game state. It is the game state — it's your Cognee dataset, rendered. The four mechanics = the four lifecycle ops Here's the mapping I'm most proud of. Each Cognee operation is a verb the player performs: You do this in-game Cognee Cloud call What happens 🗂 File It on a clue POST /api/v1/remember The fact is ingested + auto-cognified into graph nodes that pop into view ❓ Ask HAL a question POST /api/v1/r

I have been turning old code projects into sellable source-code products. The hard part is not changing the cover image. It is not renaming the ZIP. It is deciding whether the project deserves to be sold at all. A lot of old apps are useful to the person who built them. Far fewer are useful to a stranger who has never seen the repo, never heard the backstory, and only wants to know one thing: Will this save me time, or will it become another folder I regret buying? Here is the checklist I now use before treating a source-code project as a starter kit. 1. The buyer must understand the workflow "Full-stack dashboard" is not enough. A buyer should immediately understand the workflow the project helps with. For example: a review and scoring portal; a maintenance and work-order dashboard; an email-template governance tool; a runnable technical code lab. The more generic the product sounds, the harder it is to buy. I now try to answer this in one sentence: This kit helps [specific buyer] start from a working foundation for [specific workflow]. If I cannot fill that sentence honestly, the project is not ready. 2. A stranger must be able to run it "It runs on my machine" is not a product standard. A buyer needs a path from download to working state. That usually means: setup instructions; environment notes; seeded demo data; demo accounts or fixtures; expected local startup behavior; known limitations; a simple smoke-test checklist. The goal is not perfection. The goal is that a competent developer should not have to reverse-engineer the project before deciding whether it is useful. 3. The product needs proof, not adjectives Marketing adjectives are cheap: production-ready; powerful; scalable; enterprise-grade; battle-tested. Most of those words create more risk than trust if they are not backed by evidence. Better proof looks boring: screenshots; a short demo video; a verified release ZIP; install notes; architecture notes; included / not-included boundaries; a changelog;

Welcome to My Generative AI Learning Journey Artificial Intelligence is changing the way we work, learn, build software, and solve problems. Every day, new AI tools, models, and technologies are being released, making it difficult to know where to begin. Instead of randomly watching videos or reading articles, I've decided to follow a structured learning path—and I'm inviting you to join me. This blog marks the beginning of a long-term Generative AI learning series. Whether you're a student, software developer, freelancer, entrepreneur, or simply curious about AI, this roadmap will help you understand what we'll learn together over the coming weeks and months. The goal isn't just to understand AI theory. It's to build practical skills that can be used in real-world projects and professional development. Why Learn Generative AI in 2026? Generative AI is no longer a futuristic concept. It is already transforming industries such as: Software Development Healthcare Education Finance Marketing Customer Support E-commerce Human Resources Design and Creativity Companies are actively seeking professionals who can build AI-powered applications, automate workflows, and integrate AI into existing systems. Learning Generative AI today means preparing for the next generation of technology. What You Can Expect from This Series This series is designed for beginners but will gradually move toward advanced concepts. Each article will build upon the previous one, making the learning process simple and structured. We'll focus on: Understanding AI concepts Learning industry terminology Exploring popular AI models Writing effective prompts Building AI applications Working with APIs Using open-source models Creating AI-powered software Deploying AI projects By the end of this journey, you'll have both theoretical knowledge and practical development experience. Complete Learning Roadmap Phase 1: AI Fundamentals We'll begin by building a strong foundation. Topics include: What is Generativ

Bootstrap 5 and Tailwind CSS are the two most popular CSS frameworks in 2026. If you're starting a new project and trying to decide between them, this guide gives you an honest comparison based on real-world usage — not just feature lists. The Core Difference Bootstrap 5 gives you pre-built components. Tailwind CSS gives you utility classes to build your own. That's the fundamental difference and it drives every other comparison. With Bootstrap you get a navbar, modal, card, and dropdown out of the box. With Tailwind you build those yourself using utility classes like flex , px-4 , bg-blue . Neither is wrong. They solve different problems for different teams. When Bootstrap 5 Makes More Sense You Need to Ship Fast Bootstrap's pre-built components mean you spend less time on UI and more time on business logic. For admin dashboards, CRM panels, and internal tools — where UI consistency matters more than pixel-perfect custom design — Bootstrap is the faster choice. Your Team Knows HTML and CSS Bootstrap has a shallow learning curve. Any developer who knows basic HTML and CSS can pick up Bootstrap in a day. Tailwind requires understanding its utility-first philosophy and memorizing class names. You're Building an Admin Dashboard Admin dashboards need data tables, modals, dropdowns, sidebars, and form components — all of which Bootstrap provides out of the box. Building these from scratch with Tailwind takes significantly more time. You Want Predictable Output Bootstrap's components look consistent across browsers and screen sizes without extra configuration. Tailwind output depends heavily on how well your team implements it. When Tailwind CSS Makes More Sense You're Building a Custom Marketing Site If your design is highly custom — unique layouts, non-standard components, pixel-perfect design system — Tailwind gives you more flexibility without fighting Bootstrap's default styles. You Have a Design System Already If your team has a defined design system with specific t

Hardwood, the project Gunnar Morling kick-started handling of Parquet files in Java, reached version 1. Its multi-threaded approach and zero mandatory external dependencies promise a simpler, more efficient alternative to the Apache Parquet Java implementation. For now, the library supports just reading; writing support is expected in the upcoming versions. By Olimpiu Pop

The Cloud Native Computing Foundation (CNCF) has announced the graduation of OpenTelemetry, elevating the project to the foundation's highest level of maturity and formally recognizing it as production-ready for enterprise use. By Craig Risi

Thanks to the AI-driven chip shortage, prices for phones, computers, and consoles are sky-high—and still climbing.

Oracle halved the Always Free Ampere A1 compute allowance from 4 OCPUs and 24 GB RAM to 2 OCPUs and 12 GB RAM with no public announcement. Support agents gave conflicting answers on whether PAYG accounts are affected. Documentation states the new limits apply to "all tenancies" while support emails say only free-tier accounts. By Steef-Jan Wiggers

Introduction As data volumes continue to grow, running aggregation queries directly on raw datasets becomes increasingly expensive. Business dashboards, analytics platforms, and reporting systems often execute the same calculations repeatedly—such as total sales, daily active users, page views, or revenue trends. While ClickHouse® is designed to process analytical workloads at remarkable speed, repeatedly scanning billions of records still consumes valuable CPU, memory, and storage resources. This is where AggregatingMergeTree proves its value. Rather than calculating aggregates every time a query is executed, AggregatingMergeTree stores intermediate aggregation states that are merged automatically in the background. This approach allows analytical queries to read compact, pre-aggregated datasets, resulting in dramatically faster response times and reduced infrastructure costs. In this guide, you'll learn how AggregatingMergeTree works, why aggregate states matter, how to build an automated aggregation pipeline using Materialized Views, and when this engine is the right choice for your ClickHouse® workloads. What is AggregatingMergeTree? AggregatingMergeTree is a specialized ClickHouse® table engine designed to store aggregate function states instead of raw records. Unlike the standard MergeTree engine, which stores every inserted row, AggregatingMergeTree keeps partially aggregated values that ClickHouse combines during background merge operations. This significantly reduces the amount of data that must be processed when generating analytical reports. Because much of the computational work happens during data ingestion, dashboards and reporting applications can retrieve summarized information much more efficiently. Typical scenarios include: Sales reporting Website traffic analytics Financial summaries IoT sensor monitoring Business KPI dashboards Application observability metrics Why Use AggregatingMergeTree? Imagine an online marketplace processing millions of tr

Are you a football fan? Since the FIFA hype is at its absolute peak at this moment, it is hard to...