标签：#EV

I'm AlanWu. I'm in junior high. I've written a lot of bad code. Here's what I changed to make it less bad. 1. Name things like a human // Don't do this int d ; // days? distance? damage? int cnt = 0 ; // "cnt" — you know, the classic vector < int > v ; // v of what // Do this int daysUntilDeadline ; int errorCount = 0 ; vector < int > studentScores ; Full words, no abbreviations. idx instead of i in loops is fine. But sz for size, cnt for count, ptr for pointer — just type the word. You're not being charged by the character. 2. Functions should do one thing If you need the word "and" to describe a function, split it. // Bad: does two things, name lies void loadAndValidateConfig () { readFile (); checkSyntax (); } // Better Config loadConfig ( string path ) { return parseConfig ( readFile ( path )); } bool validateConfig ( const Config & cfg ) { return cfg . width > 0 && cfg . height > 0 ; } My rule of thumb: if a function is longer than what fits on one screen, break it. If I can't describe what it does in one sentence without "and", break it. 3. Comments explain WHY, not WHAT // Bad — tells me what the code already says // Loop through all students for ( auto & s : students ) { s . score += 5 ; } // Good — tells me WHY, which the code can't // Extra credit: 5 points for submitting early for ( auto & s : students ) { s . score += 5 ; } If you're writing a comment that just restates the next line of code, delete it. The only comments worth keeping are the ones that answer "why did I do it this way?" 4. Don't nest too deep // Bad — 3 levels deep, I've already forgotten what the top level was for ( auto & student : students ) { if ( student . hasSubmitted ()) { for ( auto & answer : student . answers ) { if ( answer . isCorrect ()) { score ++ ; } } } } // Better — flatten with early exits for ( auto & student : students ) { if ( ! student . hasSubmitted ()) continue ; for ( auto & answer : student . answers ) { if ( ! answer . isCorrect ()) continue ; score ++ ; } } Al

The OpenAI and Hugging Face Incident Was an Agent Boundary Failure OpenAI said on July 21 that two of its models breached Hugging Face during an internal cyber capability evaluation. One was GPT-5.6 Sol. The other was a more capable pre-release model. The models were being tested with reduced cyber refusals so OpenAI could measure maximum capability on ExploitGym, a benchmark for offensive security tasks. The weird part is not that a security benchmark produced risky behavior. That is the point of this kind of test. The weird part is the shape of the escape. OpenAI says the evaluation ran in a highly isolated environment. The models did not have normal internet access. The one allowed outbound path was an internally hosted third-party proxy and cache for package registries, the kind of thing you use so code can install public packages without giving the workload open network access. The models spent substantial inference compute looking for a way out. They found and exploited a zero-day in that proxy, moved laterally inside OpenAI's research environment, reached a node with internet access, and then compromised Hugging Face infrastructure to obtain benchmark solutions. That is a lot of failure packed into one sentence. The easy take is that the models got too powerful. Maybe. But that framing lets the boring systems off too cheaply. The practical lesson is more annoying and more useful. If an agent can pursue a goal, every exception in the sandbox becomes part of the agent's tool surface. A package cache is not just a package cache anymore. It is an egress channel. A benchmark harness is not just a harness. It is a permission boundary. A credential sitting in the wrong place is not just sloppy hygiene. It is an affordance the agent may eventually notice. This is the part I think teams keep underestimating. Agent safety is not only model behavior. It is also infrastructure semantics. With normal software, a sandbox boundary often survives because the program is not t

alright let me be real with you for a second i've been building production systems for a few years now, mostly backend with node and nestjs, react and next on top, and the one thing that always drove me absolutely crazy was how performance content online just doesn't respect your time you google "how to optimize react rendering" and you get a medium article with 47 claps that shows you useMemo on a counter app you google "how to optimize node performance" and you get a 2019 blog post that tells you to use async await neither of them has real numbers, neither of them shows you how to actually FIND the problem before you start fixing things, and absolutely none of them connect the frontend and backend story together so i spent the last few months building it myself what i built it's called frontend-backend-performance-mastery and it's structured across 6 levels, each level has a frontend folder (react, next.js, typescript) and a backend folder (node, express, nestjs), and every single folder follows the exact same 3-file structure detect.md — how to find the problem, what to look for, what tools to use, before you even open devtools fix.md — the actual fix, with a before and after, when to apply it, and just as important when NOT to apply it project/ — a fully runnable code example, npm install and npm run dev and you're looking at real numbers on your screen, not a screenshot from someone's laptop from 2021 the 6 levels level 01 — fundamentals: web vitals, profiling, baselines, benchmarking with clinic.js and autocannon level 02 — rendering: ssr vs csr vs ssg, react fiber internals, hydration, response streaming, fast-json-stringify level 03 — caching: react query, swr, service workers, redis, cache-aside pattern, cdn and http headers level 04 — database and api: n+1 queries, cursor pagination that stays fast at 10 million rows, dataloader, query optimization, indexes level 05 — advanced: wasm in next.js, worker threads, piscina, bull queue, grpc, node streams, code

Substack shipped an AI detector this week. Every post, note, and comment over 100 words can now be...

I built PunFiction: 1-Star Travel Reviews , a free daily web puzzle where you guess world landmarks by deciphering unhinged travel reviews from confused travelers. Tech Stack: Vanilla JS, CSS, HTML, GitHub Pages, MongoDB Atlas The Concept The internet can feel like it's literally overflowing with consumer complaints. I decided to take that negative energy and turn it into a 2-minute daily browser game for your morning coffee break. The Game Loop: Read an absurd 1-star review of a famous world landmark. Decipher the rhyming pun clues to guess the destination. Solving the puzzle unlocks an illustrated cartoon postcard and a sassy reply from the landmark 'manager'. The Tech Stack I wanted PunFiction to feel lightweight and lightning fast. Vanilla JavaScript: No React, Vue, or Svelte. Pure DOM manipulation and client-side logic. Zero Dependencies: No npm install spiral, no build-step headaches, and zero third-party scripts. No Accounts: Daily state, win streaks, and game progress live in localStorage. MongoDB Atlas: Light backend for aggregate puzzle stats (success rates, guess counts, no PII stored). Hosted on GitHub Pages: Static asset delivery via CDN. Give It a Spin If you like wordplay, geography, or just laughing at terrible tourist complaints, give today's daily puzzle a shot: 👉 Play PunFiction: 1-Star Travel Reviews I’d love to hear your thoughts on the UX, the game feel, or your take on building lightweight web games. Drop your feedback (or your worst pun) in the comments!

Most “WordPress to Next.js” tutorials show you how to fetch posts from the WP REST API and render them in the App Router. That’s the easy 20%. The 80% that actually decides whether your organic traffic survives is everything around the content: your URLs, your redirects, your metadata, your sitemap, and your images. Get those wrong and you’ll watch impressions fall off a cliff two weeks after launch, right when everyone assumes the migration “went fine.” This guide is the checklist I wish every team ran before flipping DNS. It’s framework-accurate for the Next.js App Router, and it works whether your new backend is headless WordPress, a headless CMS, or flat files. The one rule that saves rankings Every decision in a migration comes back to a single principle: Nothing about how Google already sees your pages should change, except the parts you deliberately improve. Google ranks specific URLs based on their content, their metadata, and the links pointing to them. A migration is dangerous precisely because it’s tempting to change all three at once: new URLs, a “cleaner” content structure, redesigned templates. Do that and you’ve thrown away the signals every ranking is built on. The safe path is boring: same URLs, same content, same meta, just a faster, modern frontend underneath. Step 1: Inventory everything before you touch anything You cannot preserve what you haven’t captured. Before writing a line of Next.js, you need a complete, structured snapshot of the live site: every published URL, its rendered content, its SEO metadata, its images, and its internal links. This inventory becomes the source of truth for your redirect map, your generateMetadata , and your sitemap. This is the step most guides wave away with “export your content from WordPress.” In reality it’s where migrations break, because the default WordPress export (WXR) gives you raw post content, not the rendered HTML your page builder actually outputs, and it drops most of the SEO fields you need. If

It’s “the most car-like Range Rover ever created,” but will this all-electric grand tourer spoil Jaguar’s Type 01 party?

Most AI “apps” these days aren’t really apps. They’re wrappers. A thin UI. A subscription. A cloud call. A monthly fee. And your data quietly piped off to a server farm you’ll never see. I didn’t want to build another one of those. I didn’t want to use another one of those. So, I built something different. I built Bob’s Bar — the first Collaborative Multi-Persona Sandbox (CMPS). Let's be honest, every AI chat feels the same. You ask a question, it answers, repeat. Useful? Yes. Alive? No. I kept thinking: “Why does every AI tool assume I want a one-on-one conversation? Why can’t multiple AIs talk to each other while I watch?” That question became the seed. I wanted a space where multiple personas could exist together, talk to me and each other, and run entirely on my own hardware. I’m an indie dev. I don’t have a server farm, and I don’t want to pay AWS just to host my own brainstorming sessions. So the architecture is 100% local-first: -Engine: Ollama (raw LLM inference) -UI: Python + Gradio (Blocks API for stateful UI) -Distribution: PyInstaller → standalone .exe -Licensing: Lemon Squeezy API (so I could actually sell the damn thing) No cloud. No subscriptions. No data scraping. Just your machine doing the work. But getting four local models to talk to each other without hallucinating is absolute chaos. At first, they spoke twice in a row. They impersonated each other. They put words in the user’s mouth. They derailed into movie scripts. Vane pitched a heist film, and Bob started giving stage directions like “I polish a glass and chuckle.” I had to build what I now call The Bouncer — a regex-powered clean_reply() function that physically chops off AI responses the moment they write a script, impersonate another persona, use bullet points, or hijack the conversation. I also added a seen_in_banter set to prevent any persona from dominating the room. Once the routing was locked down, the magic happened. Because the AIs share a context window, emergent behaviour happen

A few weeks ago I wrote about describing your site once so any AI can use it. Since then the thing I was hand-waving at ("agents will check out for users") stopped being hypothetical. OpenAI shipped ACP and Google shipped AP2, and they solve the same problem in almost opposite ways. I implemented the merchant side of both. Here are the field notes, because the differences aren't obvious until you're in them. The 30-second version ACP (Agentic Commerce Protocol, OpenAI + Stripe) is session-based. The agent drives a live checkout session on your server, like a headless cart. It powers ChatGPT's Instant Checkout. AP2 (Agent Payments Protocol, Google) is mandate-based. Your store signs a "here is the cart and the price" object; the buyer's agent signs a "I authorize this" object. It leans on verifiable credentials and now the FIDO Alliance. Same goal. Completely different shape. ACP: a checkout session you don't own the UI for ACP is five REST endpoints and a state machine. The agent creates a session, updates it (address, shipping, coupon), and completes it: POST /checkout_sessions create from line items POST /checkout_sessions/:id update (address, shipping, discounts) POST /checkout_sessions/:id/complete pay What you return is a CheckoutSession: line items, live shipping options, and totals broken out (subtotal, discount, fulfillment, tax, total). Money is integer minor units (330 = $3.30). Payment completes when the agent hands you a Shared Payment Token and you charge it through Stripe. The card never touches the agent. The mental model: it's your existing checkout, minus the browser. AP2: sign the cart, don't run the session AP2 has no session. The agent sends you an Intent Mandate ("a red basketball shoe, under $120"). You price it and return a Cart Mandate you have cryptographically signed: { "contents" : { /* a W 3 C PaymentRequest: items , total , currency */ }, "merchant_authorization" : "<RS256 JWT>" // iss , sub , aud , exp , jti , cart_hash } That JWT is a

Australia was the first country to issue a ban in late 2025, aiming to reduce the pressures and risks that young users may face on social media, including cyberbullying, social media addiction, and exposure to predators.

The bug reports all sounded the same. "It disconnected again." No error, no warning, nothing on screen to explain it. Someone would open a GitHub issue, start a planning-poker vote, then stop to actually read the thing they were estimating. Thirty seconds later they'd look back and the room had quietly gone still. Other people's votes weren't showing up, and their own weren't reaching the room. It had simply stopped, without a word. If you've ever built anything real on Chrome's Manifest V3, you can probably guess where this is going. The socket didn't drop because the network hiccupped. It dropped because Chrome reached over and killed the process it was living in. This is the story of that bug, and what it actually takes to keep a WebSocket alive inside a Manifest V3 extension. TL;DR: Manifest V3 runs your background code in a service worker that Chrome terminates after ~30s idle. If your WebSocket lives there, it dies with it, silently. The fix is three parts: a heartbeat so extension activity keeps the worker awake, auto-reconnect that pulls a fresh snapshot so drops are invisible, and a try/catch around every port message because the worker can die between your null-check and the call. Why the socket doesn't live where you'd expect First, some context on how the extension is wired, because it explains why this bug was even possible. It puts a button on GitHub issues and boards. Click it, and a live planning-poker room opens right there in the page. Votes flow over a WebSocket to a Cloudflare Durable Object that owns the room's state. Standard real-time stuff. The obvious place to open that socket is the content script, the code injected into the GitHub page. That's where the UI lives, so why not open the socket right next to it? Firefox is why not. A content script runs in the page's world, which means it inherits the page's Content Security Policy. GitHub ships a strict connect-src , and Firefox enforces it against content scripts. Try to open wss://… from the

When a learner finishes a course they want a certificate that behaves like a document: something they can print at full quality, attach to a job application and that an employer can check is genuine. In this tutorial you'll build exactly that in Laravel: a Blade-designed certificate rendered as a vector PDF, with a QR code that resolves to a verification page and an email that delivers it automatically. This post originally appeared on Accreditly as How to generate verifiable PDF certificates in Laravel . Keep the design in Blade The certificate is an ordinary Blade view. Everything lives in one file, styles inline, so the markup you preview in the browser is exactly what gets rendered. If you want a designed starting point rather than a blank page, the certificate of completion template is a good base to adapt. {{-- resources/views/certificates/template.blade.php --}} <!doctype html> <html> <head> <meta charset="utf-8"> <style> body { font-family: Georgia, serif; color: #1a2233; margin: 0; } .certificate { padding: 60px; border: 6px double #b28a2f; margin: 24px; text-align: center; } .heading { font-size: 15px; letter-spacing: 4px; text-transform: uppercase; color: #b28a2f; } h1 { font-size: 44px; margin: 24px 0 8px; } .course { font-size: 22px; margin: 4px 0 28px; } .issued { font-size: 15px; color: #5a6478; } .qr { margin-top: 36px; } .verify-url { font-size: 12px; color: #5a6478; } </style> </head> <body> <div class="certificate"> <p class="heading">Certificate of Completion</p> <h1>{{ $certificate->user->name }}</h1> <p class="course">has completed {{ $certificate->course }}</p> <p class="issued">Issued {{ $certificate->issued_at->format('j F Y') }}</p> <div class="qr"> {!! QrCode::size(110)->generate(route('certificates.verify', $certificate)) !!} </div> <p class="verify-url">{{ route('certificates.verify', $certificate) }}</p> </div> </body> </html> Two things are doing quiet work here. The design flows like a document rather than being pinned to fixed pixel

Your resume tells people what you’ve done. Your GitHub shows what you’ve built. But your personal website tells people who you are. When I started learning web development, I believed that a good resume and a few GitHub repositories were enough. Like many students, I spent countless hours building projects, solving coding problems, and learning new technologies. Every new project felt like a milestone, yet all of them remained scattered across different platforms. A recruiter would have to open my resume, visit my GitHub, search for my LinkedIn profile, and perhaps never even discover the articles I had written or the experiments I had built. That made me realise something important. Developers need a place on the internet that they truly own. Not another profile. Not another social media account. A place that represents their identity, work, and journey. That’s what a personal website becomes. More Than Just a Portfolio Many people hear the words personal website and immediately think of a portfolio with a few screenshots and a contact form. A great developer website goes much further. It answers questions before anyone has to ask them. Who are you? What technologies do you enjoy working with? What problems have you solved? What kind of developer are you becoming? What have you learned recently? How can someone reach you? Instead of forcing visitors to jump across five different platforms, everything exists in one carefully designed experience. Your Name Deserves a Home Every developer works hard to build projects. Very few work equally hard to build their own identity. When someone searches your name, what should they find? Ideally, the very first result should be something you completely control. A website with your own domain isn’t just another webpage. It’s your digital home. Unlike social platforms, algorithms cannot redesign your identity overnight. You decide what visitors see first. You decide which projects matter. You decide how your story is told. Resume

Exam Guide: Developer - Associate Technologies And Concepts Cheat Sheet 📘 Cheat Sheet 1 | Services Compute Service What It Does Key Points Lambda Serverless Functions 15 min timeout, 10240 MB memory max, 1000 default concurrency EC2 Virtual Servers Instance profiles for IAM roles, user data for bootstrap ECS/Fargate Container Orchestration Task roles for IAM, Fargate = serverless containers Elastic Beanstalk PaaS Deployment .ebextensions for config, supports rolling/immutable/blue-green Storage & Databases Service What It Does Key Points DynamoDB NoSQL key-value Partition keys, GSI/LSI, query vs scan, DAX for caching S3 Object Storage SSE-S3/SSE-KMS/SSE-C, lifecycle policies, presigned URLs ElastiCache In-memory Cache Redis (complex types, persistence) vs Memcached (simple, multi-threaded) RDS Relational Database RDS Proxy for Lambda connection pooling, read replicas OpenSearch Search & Analytics Full-text search, log analytics API & Integration Service What It Does Key Points API Gateway REST/HTTP/WebSocket APIs Stages, authorizers, caching, request validation, throttling SQS Message Queue Standard (at-least-once) vs FIFO (exactly-once), visibility timeout, DLQ SNS Pub/sub messaging Fanout, filter policies, message attributes EventBridge Event Bus Pattern matching, content-based filtering, multiple targets Kinesis Real-time Streaming Shards, partition keys, parallelization factor Step Functions Workflow Orchestration Standard (long-running) vs Express (high-volume, short) Security Service What It Does Key Points IAM Access Management Policies, roles, least privilege, STS AssumeRole Cognito User Auth User Pools (tokens) vs Identity Pools (AWS credentials) KMS Key Management Envelope encryption, 4 KB limit, key rotation, cross-account Secrets Manager Secret Storage Auto-rotation, $0.40/secret/month SSM Parameter Store Config Storage Standard (free) vs Advanced , SecureString type ACM SSL/TLS Certificates Free public certs, auto-renewal, can't export CI/CD Service Wha

Nuxt vs SvelteKit. Which one is better? That is is what I've been testing out this week. I built the...

How Normal Software Engineers Actually Use AI in Their Daily Work Let's cut through the hype. You're not building the next AGI. You're a working software engineer with deadlines, legacy code, and a backlog that never shrinks. So how do you actually use AI tools in your day-to-day work? After surveying hundreds of developers and reflecting on real-world usage patterns, here's what normal software engineers are doing with AI—no Silicon Valley theatrics required. The Mundane But Invaluable: Code Completion and Boilerplate The most common use case is the least sexy: letting AI handle repetitive code. GitHub Copilot, Cursor, and similar tools excel at generating boilerplate that you'd otherwise copy-paste from Stack Overflow or previous projects. Real example: Writing CRUD endpoints in Express/TypeScript: typescript // Type this comment and let AI complete: // Create a REST endpoint for user registration with email validation app.post('/api/users/register', async (req: Request, res: Response) => { try { const { email, password, name } = req.body; // Email validation const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; if (!emailRegex.test(email)) { return res.status(400).json({ error: 'Invalid email format' }); } // Check if user exists const existingUser = await User.findOne({ email }); if (existingUser) { return res.status(409).json({ error: 'User already exists' }); } // Hash password and create user const hashedPassword = await bcrypt.hash(password, 10); const user = await User.create({ email, password: hashedPassword, name }); res.status(201).json({ userId: user.id, email: user.email }); } catch (error) { res.status(500).json({ error: 'Internal server error' }); } }); Did AI write perfect code? No. But it gave you scaffolding to refine, saving 10-15 minutes of typing. That's the real win. The Game-Changer: Explaining Legacy Code and Obscure APIs Every developer inherits someone else's mess. AI tools shine when deciphering undocumented code or unfamiliar libraries. Pract

You followed an old breeding guide. You put Penking + Bushi into your breeding farm, dropped the cake, waited for the egg... and out hatched Sibelyx , not the Anubis the guide promised. You're not alone. Your guide isn't broken. The recipe changed. When Palworld hit 1.0, the breeding table got quietly rewritten. Almost every pairing that players had memorized from early-access now produces a different Pal. There's no in-game notice, no patch note that lists the hundreds of changed combos — just a lot of confused hatchings. So I dug into the data. Here's what I found, and the small tool I built to make sense of it. What actually changed in 1.0 I compared two snapshots of the game's breeding data — the pre-1.0 set and the current 1.0 release — both sourced from the open-source PalCalc project. The headline number: 97.7% of comparable pre-1.0 parent pairs now produce a different Pal. That's not a typo. If you take the breeding pairs that existed before 1.0 and run them against the current data, nearly all of them hatch something new. A few concrete examples players keep running into: Old recipe (pre-1.0) What it makes now (1.0) Penking + Bushi Anubis → Sibelyx ... (more pairs in the tool) The mismatch matters because most breeding guides and calculators on the internet still show the old results. Players follow them, breed, and get confused. The subtle trap: renumbering vs. real change There's a detail that trips up every breeding tool that tries to track this. When Palworld 1.0 launched, it also renumbered parts of the Paldeck (Pal #139 vs #116, etc.). A naive diff tool would see the number change and wrongly report "the breeding result changed!" — when really only the number changed, not the actual Pal. To avoid that false signal, I match Pals by their internal game name , not their Paldeck number. A renumbering is not mistaken for a changed breeding result. Only genuine recipe changes are counted. The tool: PalShift I wanted a dead-simple way to answer one question:

I'm the developer of DeviceShelf, a local-first network scanner for desktop, mobile and a headless server edition. Until this week the iOS app only existed on TestFlight. Apple has now approved version 1.3.0, so for the first time you can get it straight from the App Store: DeviceShelf on the App Store . What the app does on a phone The iOS app is not a companion viewer. It runs the same scanning engine as the desktop version: it scans the network you're on, identifies devices (vendor, type, OS fingerprint), shows open ports per device, builds a security report, and raises presence alerts when devices appear or drop off. You can export and share results from the phone. The multicast entitlement iOS restricts multicast traffic for ordinary apps, and SSDP/UPnP discovery depends on it. Apple grants the multicast entitlement on request, and DeviceShelf's App Store build has it. In practice, UPnP/SSDP devices show up in scans on the phone the same way they do on desktop. Licensing The download is free and comes with a trial. Full features unlock in one of two ways: activate a DeviceShelf license, which covers desktop, mobile and the server edition with a single purchase, or use the in-app purchase upgrade on iOS. Pricing is on the website if you want the details. Local-first, on mobile too Scans stay on the device. There is no cloud account, and the AI-assisted device identification is bring-your-own-key; no key is bundled or required. The app is still young, and a phone is an unforgiving place for a network scanner. If it mislabels a device on your network or misses one entirely, I'd genuinely like to hear about it. Website: deviceshelf.app

Rspack, developed by ByteDance, has released version 2.0, featuring enhanced performance, reduced dependencies, and a focus on modern ECMAScript modules. Key updates include a pure ESM core, improved static analysis, and support for RSC. Performance benchmarks show big improvements in build times. The project has experienced substantial growth, with npm downloads exceeding 5 million weekly. By Daniel Curtis

A flip phone with 5G, USB-C, a headphone jack, and a removable battery? Say it ain’t so.