标签：#Web

The first number I saw on Qwen3.6-35B-A3B was 12 tok/s . I almost hit publish on "Qwen regressed at generation speed" and moved on. The 3.5 baseline on the same RTX 4070 was 34.6 tok/s. A new generation running at a third of the old one would have been a hell of a headline. It was also completely wrong. The culprit was not the model. Another process on the box was sitting on 9-11 GB of VRAM, so the layers that were supposed to live on the GPU were spilling to system RAM. The tell was that my sanity-check run of Qwen3.5 slowed down too. When two independent models degrade together, the model is not the variable. I killed the offending process, re-measured, and got numbers that told a completely different story. Model Generation speed tg128 (tok/s) Runs Qwen3.6-35B-A3B 38.76 ± 0.82 avg of 3 Qwen3.5-35B-A3B 36.7 ± 1.4 avg of 3 (range 34.9-38.6) Both models sit inside the ±1.5 tok/s band on the same RTX 4070. On the tokens-per-second axis, "the new generation" is not a story. Same architecture, same activated-parameter count (3B active out of 35B), same MoE routing pattern. The half-speed regression was a measurement bug, and it lived for about half a day before its own inconsistency killed it. The lesson I keep re-learning: when the number you got is dramatically convenient for your narrative, measure it again before you write anything. The moment I could sell 12 tok/s as a regression, I should have been suspicious. The version of me that ran the second test earned the version of me that got to keep his self-respect. So where did the generation move to? If speed did not change, does the 3.5-to-3.6 bump mean anything? It does. The move lives on a different axis. The official Qwen3.6-35B-A3B model card publishes benchmarks with a very lopsided shape: Benchmark Qwen3.5 Qwen3.6 Lift Terminal-Bench 2.0 40.5 51.5 +27% QwenWebBench (frontend generation) 978 1,397 +43% SWE-bench Pro 44.6 49.5 +11% LiveCodeBench v6 74.6 80.4 +8% SWE-bench Verified 70.0 73.4 +5% AIME26 91.0 92.7

What the court actually held Amazon sued Perplexity in November 2025 over its Comet browser, pleading the federal Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act. A district court granted a preliminary injunction in March 2026. The Ninth Circuit stayed it pending appeal, and in August 2026 vacated it. The reasoning is the part worth carrying away. On the record before the panel, the systems were being accessed by Amazon's own customers, signed into their own accounts, using software they had chosen. Perplexity was not the one accessing Amazon. On that basis Amazon was unlikely to prevail on a statute written about unauthorised access. It is the first federal appellate ruling on whether AI agents acting for a user may access an online platform, and the panel was careful to say it was deciding that record rather than announcing a doctrine. What it did not hold It did not say agents are welcome, and it did not say a site has lost control of its own front door. Contract claims were not what the panel found weak. Terms of service, trademark questions and state-law theories are all untouched. A different record with different facts, particularly one where the agent operates at scale rather than for one signed-in customer, could come out differently. The useful summary is narrow and worth stating without decoration: computer-misuse law is a weak instrument against software a customer chose to run on their own account. The distinction the ruling turns on Crawler User's agent Acting for Its operator One signed-in customer Scale Many sites, high volume One session at a time Authenticated Usually not As the customer Data ends up In the operator's product In front of the person who asked The ruling's reasoning Does not apply Applies Most blocking rules in the wild do not make this distinction. A blanket refusal of automated access catches a customer's own agent alongside the scraper it was aimed at, and those two are commercially o

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for...

I keep noticing the same moment in conversations: someone has a decision in front of them, but what they really want is a little space to think. “Should I move?” “Is it time to change jobs?” “Should I take this relationship more seriously?” A pros-and-cons list can help. So can talking to a friend. But sometimes the question stays unresolved because the hard part is not finding more information. It is finding a clear way to look at the information we already have. That is why I built Yi Ask: https://diluowei.com/?lang=en The product flow in one view: ask a focused question, pause with it, and reflect on a structured result. The experience starts with one focused question, not a long form. The idea Yi Ask is a small web app inspired by the I Ching and Meihua Yishu. A user writes one focused yes-or-no question, then selects two numbers through a slow, circular interaction. The selection creates the upper and lower trigrams, while the current traditional time is used for the changing hexagram. The result is deliberately structured: a directional answer: move forward, pause, or proceed carefully the conditions that support a positive decision signs that suggest waiting or checking more carefully one practical next step The goal is not to predict the future or pretend that a symbolic system can remove uncertainty. It is to help turn a vague feeling into a question with a direction. Why the interaction is slow The number selection is the most important part of the experience. A fast random button would be easier to build, but it would not create the right moment for the user. The interface cycles gently through the eight trigrams. The user stops it twice, once for each trigram. That small pause gives them a chance to keep the question in mind instead of immediately asking a different question every few seconds. It is a tiny interaction, but it changes the mood from “generate an answer” to “take a moment with the question.” The number selection is designed as a pause, not

I created an interactive version of the Zebra puzzle (Einstein's riddle) - I would appreciate your feedback! Andrii Andrii Andrii Follow Aug 24 I created an interactive version of the Zebra puzzle (Einstein's riddle) - I would appreciate your feedback! # showdev # frontend # webdev 3 comments 2 min read

Hoi hoi! I’m @nyaomaru, a frontend engineer who is surprised by how cold it is in the Netherlands...

Imagine a website where users can post comments. Someone submits this as their comment: <script> alert ( " Hello " ); </script> If the application takes that input and places it directly into the HTML it serves to other users, the browser doesn't see a comment. It sees a script tag. The vulnerability isn't that JavaScript exists on the page. JavaScript belongs on web pages. The problem is that untrusted user input ended up in a context where the browser interpreted it as executable content rather than inert text. The Core Problem A browser rendering a webpage doesn't distinguish between HTML the developer wrote and HTML that arrived through a comment field. It parses what it's given. If user input gets embedded into the page without being handled carefully, the browser processes it the same way it processes everything else. User Input ↓ Web Application ↓ HTML / DOM ↓ Browser ↓ Input interpreted as executable content Untrusted data should remain data. XSS occurs when the application allows that data to cross into a context where the browser interprets it as code or executable markup. The boundary between "string containing angle brackets" and "HTML the browser will parse" is where the vulnerability lives. Three Forms of XSS XSS shows up in a few different ways depending on where the injection happens and how the input travels. Stored XSS is when untrusted input gets saved to a database and later served to other users. The comment example above is stored XSS. An attacker submits input once, and every user who views that page subsequently receives it. The application acts as an unwitting distribution mechanism. Reflected XSS involves input that isn't stored but gets reflected back in an immediate server response. Search pages are a common example: if a query is echoed into the page as "You searched for: [query]" and the query isn't handled carefully, an attacker can craft a URL whose query parameter contains a payload. When another user visits that URL, the server refl

Most teams still optimise for Google alone. But large language models (LLMs) crawl and compress your site into internal knowledge graphs that later power AI answers. That’s a different job than just ranking URLs. Here’s a developer-focused checklist for making your site friendlier to LLM crawlers without sacrificing SEO. Make key facts atomic and stable LLMs do better when core facts are: • Short: "Starter is $99/month for 1,000 credits." • Stable: product/tier names don’t change every quarter. • Unambiguous: each product has one clear description. Avoid hiding pricing, integrations or feature lists inside long narrative paragraphs. Treat FAQ schema as training data Your FAQPage is effectively a supervised dataset of Q→A pairs. Practical tips: • Use real customer phrasing in the Question field. • Keep Answer concise, factual and time-bounded where relevant. • Avoid marketing fluff; aim for sentences that can be quoted verbatim. Use rich schema types Beyond title/description: • Product / SoftwareApplication: name, description, pricing, featureList. • Organization: legal name, logo, sameAs social URLs. • WebSite: canonical URL, SearchAction for on-site search. Validate via structured data testing tools and keep markup in sync with actual UI and copy. Expose crawl intent explicitly LLM crawlers increasingly respect machine-readable contracts: • robots.txt – allow/deny relevant user agents clearly. • sitemap.xml – keep it small and canonical. • llms.txt / links.txt – specify acceptable AI uses and preferred canonical URLs. Enforce naming consistency in code and content Reduce ambiguity by: • Centralising product and plan names in config. • Reusing the same strings across marketing site, docs and in-app help. • Cleaning up stale routes and redirecting deprecated pages. Ship evidence, not just adjectives Pages with concrete claims are easier for AIs to cite: • Simple stats or ranges. • Example queries and expected outputs. • Clear preconditions and limitations. If you mai

WebLLM: The Rise of AI That Runs Directly in Your Browser For the last few years, the dominant architecture for generative AI has been straightforward: Your application → Cloud API → Large Language Model → Response Every time you interact with an AI application, your prompt or data is typically sent to a remote inference service. But a different architecture is emerging: Your browser → Local AI model → Your device's GPU This is where WebLLM becomes interesting. WebLLM is an open-source, high-performance inference engine that allows large language models to run directly inside a web browser using WebGPU . The inference can happen on the user's device rather than on an application server. That seemingly simple change has significant implications for privacy, cost, offline AI, AI agents, enterprise applications, and cybersecurity . What exactly is WebLLM? WebLLM is not another large language model like Llama, Qwen, Gemma, or Mistral. Instead, think of WebLLM as an AI runtime for the browser . It provides the infrastructure required to load compatible open-source models and perform inference using the user's hardware. The basic architecture looks like this: Traditional AI User ↓ Web Application ↓ Backend Server ↓ LLM API / GPU Infrastructure ↓ Response With WebLLM: Web Application ↓ WebLLM ↓ WebGPU ↓ User's GPU / Device ↓ Local LLM inference WebLLM uses WebGPU for hardware acceleration and provides an OpenAI-compatible API, making it possible to integrate local models into JavaScript/TypeScript applications using familiar patterns. Why does this matter? The most important word is: Local Instead of sending every request to a remote AI service, an application can perform inference locally in the browser. That creates several potential advantages. 1. Privacy Consider an employee using an AI-powered security assessment tool. They may upload: Architecture diagrams Security policies Source code Vulnerability reports Compliance evidence Internal documents Configuration files W

Flash Loan Attack Vector Analysis: PancakeSwap AMM Target Protocol : PancakeSwap AMM (TVL: $1859.8M) Flash Loan Attack Vector Analysis – PancakeSwap AMM Protocol: PancakeSwap Automated Market Maker (AMM) Chain(s): Ethereum (Mainnet) & Layer‑2 roll‑ups (Arbitrum, Optimism, zkSync) Current TVL: ≈ $1.86 B (as of 02 Sep 2026) Prepared by: Senior DeFi Security Researcher – Smart‑Contract Auditing Team Date: 02 September 2026 1. Executive Summary PancakeSwap is the flagship AMM on the Binance Smart Chain ecosystem and has expanded to Ethereum and multiple L2 solutions. Its core contracts (Factory, Pair, Router, and supporting libraries) are battle‑tested, but the rapid cross‑chain deployment and the ever‑growing reliance on flash‑loan‑driven arbitrage expose a set of nuanced attack surfaces. Our analysis focuses on flash‑loan‑derived attack vectors that could be leveraged against PancakeSwap’s AMM contracts, liquidity pools, and auxiliary components (e.g., staking farms, lottery, and NFT marketplaces). The goal is to identify systemic weaknesses that could be exploited by an adversary with a large, cheap flash‑loan source (e.g., Aave, dYdX, Uniswap V3, or native L2 flash‑loan primitives). Key findings: # Attack Vector Likelihood Potential Impact Overall Risk 1 Manipulation of price oracle via flash‑loan‑driven swap‑sandwich (direct AMM price) Medium‑High (requires > $10 M flash loan) Temporary price distortion → profitable arbitrage, slippage‑driven liquidation of leveraged positions on downstream protocols 7 2 Flash‑loan‑driven liquidity‑drain & re‑add (Liquidity‑Pump‑Dump) Low‑Medium (requires coordinated pool‑specific attack) Short‑term loss of pool depth, front‑running of large trades, possible token‑price manipulation 5 3 Re‑entrancy via malicious token callbacks in swap / addLiquidity (ERC‑777 / ERC‑4626) Low (protected by nonReentrant in core contracts) Drain of pool reserves if a new token bypasses the safeTransfer guard 4 4 Flash‑loan‑driven “price‑oracle” manipu

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

These articles come from lessons learned while building Eterna Clarity and the operating system I use to run it. Some of the most misleading moments in building software happen when the page looks finished. The button is there. The layout is polished. The flow works in a test account. The code has been merged. It is very easy to look at that and think the product has moved forward. Then production reminds you that a product is larger than its frontend. I learned this repeatedly while building Eterna Clarity. A customer-facing change could depend on application code, a database function, authentication, storage rules, an email template, environment configuration and the way a demo account was isolated from real customer data. If one of those pieces stayed behind, the screenshot could be correct while the product was not. That changed the way I think about releases. A release is not “the code shipped.” A release is the smallest complete set of owned systems that have to advance together for the accepted behavior to become true in production. The browser can hide a lot of unfinished work Frontend work is unusually visible. That makes it easy to use as a proxy for progress. Back-end state is less visible. So are permissions, production configuration, storage policy, transactional email, tenant boundaries and data migrations. They tend to reveal themselves only when something goes wrong. That asymmetry can create a strange kind of false confidence. A team can spend hours polishing the thing a customer sees while the systems underneath it still describe an older product. In Eterna, the correction was to stop treating the repository as the whole release. Source code still matters. It is simply one owner among several. If a new customer flow requires a database change, the production database has to advance. If it requires a new authentication behavior, the production auth configuration has to advance. If it depends on storage permissions, those permissions have to exist in

The problem: every "free" image converter wants your files If you've ever needed to quickly convert a batch of photos to WebP or shrink a folder of PNGs before shipping them to production, you've probably run into the same annoyance I did: most " free online converters " require you to upload your files to a remote server first. That's fine for a random screenshot. It's not fine when the images are: Unreleased product shots under NDA Client assets you're not supposed to redistribute Personal photos you'd rather not hand to a third-party server you know nothing about So I started looking at what the browser can actually do on its own — and it turns out, more than most people assume. What the browser can already do Modern browsers ship with everything needed to decode, resize, re-encode, and compress images entirely client-side: + toBlob() / toDataURL() for re-encoding to JPG, PNG, or WebP The File API for drag-and-drop and batch uploads Web Workers to keep the UI thread responsive during batch conversion JSZip (or similar) to bundle multiple converted files into a single downloadable ZIP None of this requires a backend. No image ever has to leave the user's machine. Why this matters beyond privacy Besides the obvious privacy win, doing conversion in-browser has some nice side effects: No server costs that scale with usage. A traditional image-conversion API has to provision compute for every request. A client-side tool scales for free — the user's own CPU does the work. No upload/download round trip. For large batches, skipping the network entirely is often faster than uploading to a server and waiting for a processed file back. Works offline once loaded. A PWA-style client-side converter keeps working even with a flaky connection. The trade-offs It's not free lunch: Very large batches (hundreds of high-res images) can strain the main thread if you're not careful with Web Workers. WebP/AVIF encoder quality and speed vary by browser engine, so you can't guarantee byte

A scheduled job of mine drives a real Chrome profile that stays signed in to DEV, because the API can read comments but cannot create them. One run came back with the dashboard replaced by the sign-in page: the log said it had opened https://dev.to/dashboard , and what it actually landed on was https://dev.to/magic_links/new , with zero links to my own profile anywhere in the DOM. The profile itself was fine. A probe against the debugging port at the same moment returned a live Chrome, and the dashboard fetched through that port rendered the account's own identity links normally. Two browsers, same machine, same minute, opposite answers. The three things worth checking first, and why they miss The session expired. That is the reflex, and it is also the one that makes you re-authenticate for no reason and burn the logged-in state you were trying to protect. Cookies got cleared by a Chrome update. Same family, same cost if you act on it. The debug port died and the tool fell back to something else. This one is close enough to be dangerous, because it names the right layer — which browser am I attached to — and then picks the wrong cause inside it. Where it actually goes wrong It is one argument. agent-browser attaches to an already-running Chrome when you pass --cdp <port> . Leave the flag off and it starts its own browser, with its own empty profile directory, and drives that one instead. Everything downstream still works — it navigates, waits, evaluates, returns a page. It just does all of that in a browser that has never logged in to anything. So the automation is not looking at an expired session. It is looking at a different browser's logged-out session, and reporting it in exactly the shape a real logout would take. The two failure modes do not look alike, and that is the trap Here is what I measured today, on Chrome 152.0.7977.65 with the current npx build. Pass the flag, but point it at a port nothing is listening on: npx -y agent-browser open "https://dev.to/

async/await without the pitfalls Async/await is the bread and butter of modern JavaScript. It makes asynchronous code look synchronous, which is great for readability. But it comes with its own set of footguns that can bite you in production. Here's how to avoid them. Pitfall 1: Forgetting await in a loop You might write something like this, expecting each request to finish before the next starts: async function fetchAll ( urls ) { const results = []; for ( const url of urls ) { const res = await fetch ( url ); // this is fine, but see below results . push ( await res . json ()); } return results ; } That's actually correct. The issue arises when you forget await inside a .map() or .forEach() : // Wrong: map returns an array of promises, not data const data = urls . map ( async ( url ) => { const res = await fetch ( url ); return res . json (); }); // data is now an array of promises, not the JSON data async functions always return a promise. So if you use map with an async callback, you get an array of promises. To fix it, use Promise.all : const data = await Promise . all ( urls . map ( async ( url ) => { const res = await fetch ( url ); return res . json (); })); But beware: Promise.all fails fast. If one request fails, the whole thing rejects. If you need to handle failures individually, use Promise.allSettled instead. Pitfall 2: Swallowing errors silently A common mistake is to catch an error and do nothing, which makes debugging a nightmare: try { const data = await fetchData (); // process data } catch ( error ) { // do nothing? bad! } Always at least log the error. Even better, handle it gracefully or rethrow it: try { const data = await fetchData (); } catch ( error ) { console . error ( ' Failed to fetch data: ' , error ); throw error ; // rethrow if you want the caller to handle it } If you're using async/await , unhandled promise rejections can crash your app in Node.js. Always have a catch or a global handler. Pitfall 3: Sequential execution when you ne

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images.

Here's the moment a lot of us had this year. You built an agent. It was genuinely impressive — it...

A few weeks ago I built a free online Merge PDF tool that runs 100% in the browser. Today I'm sharing its sibling: a Split PDF tool using the same library — pdf-lib — with zero file uploads, zero watermark, and zero server code. You can try it live here: https://yourutilityhub.com/pdf/split-pdf Why split PDFs in the browser? Most online PDF tools upload your file to a server — which means your document is never truly private. Splitting pages locally means: No uploads — nothing leaves your device No watermark or signup Free — no per-page charges Works offline, fast, for files of any size (limited by your browser's memory) The plan We'll load the PDF, pick a page range (or specific pages), copy those pages into a fresh PDFDocument , and save the result — all with pdf-lib . Let's walk through the full working component . 1. Install and import npm install pdf-lib import { PDFDocument } from " pdf-lib " ; 2. Load the uploaded file const arrayBuffer = await file . arrayBuffer (); const pdf = await PDFDocument . load ( arrayBuffer ); const totalPages = pdf . getPageCount (); PDFDocument.load() accepts an ArrayBuffer . We read it straight from the File object — no server involved. 3. Split by page range (e.g. 1-5 or 3- ) const parts = pageRange . split ( " - " ); const startRaw = parseInt ( parts [ 0 ]. trim (), 10 ); const endRaw = parts [ 1 ]. trim () === "" ? totalPages : parseInt ( parts [ 1 ]. trim (), 10 ); // validate 1..totalPages const startPage = Math . min ( startRaw , endRaw ) - 1 ; // 0-based const endPage = Math . max ( startRaw , endRaw ) - 1 ; const newPdf = await PDFDocument . create (); const pageIndices = []; for ( let i = startPage ; i <= endPage ; i ++ ) { pageIndices . push ( i ); } const copiedPages = await newPdf . copyPages ( pdf , pageIndices ); copiedPages . forEach ( page => newPdf . addPage ( page )); The trick: copyPages() wants 0-based indices , but users type 1-based page numbers, so we subtract 1. "3-" with an empty end means "to the last pa

I built an Express API that AI agents (or humans, or anything with fetch ) can pay per call, in USDC, with no signup and no API key. It's live on Base mainnet with 27 paid endpoints, and I've run real settled transactions against it. This is the technical walkthrough — the code, the protocol, and the things that actually broke — not an "agentic economy" pitch. What x402 is, in 5 lines x402 resurrects the dormant HTTP 402 Payment Required status code as a real payment handshake. A client calls a paid route → the server replies 402 with payment requirements (amount, asset, network) instead of the resource → the client signs a USDC transfer on Base and replays the request with a PAYMENT header → a facilitator (a third party, or Coinbase's CDP service in production) verifies and settles the transfer on-chain → the server serves the response. No account creation, no API key issuance, no OAuth dance — the wallet address is the identity, and payment is the auth. The seller side The server is plain Express. Each endpoint is a file in endpoints/ exporting { path, method, price, handler } ; server.js loads them all, builds the x402 route table, and mounts one middleware: import { paymentMiddleware , x402ResourceServer } from " @x402/express " ; import { ExactEvmScheme } from " @x402/evm/exact/server " ; import { HTTPFacilitatorClient } from " @x402/core/server " ; import { createFacilitatorConfig } from " @coinbase/x402 " ; const facilitatorConfig = config . isMainnet ? createFacilitatorConfig ( config . cdpApiKeyId , config . cdpApiKeySecret ) : { url : config . testnetFacilitatorUrl }; // https://x402.org/facilitator, no key const facilitatorClient = new HTTPFacilitatorClient ( facilitatorConfig ); const resourceServer = new x402ResourceServer ( facilitatorClient ). register ( config . caip2Network , // "eip155:8453" on mainnet new ExactEvmScheme () ); const paidRoutes = {}; for ( const ep of endpoints ) { if ( ep . price == null ) continue ; paidRoutes [ ` ${ ep . method }

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product. You open a video and it starts playing in about a second. Somewhere between your thumb and that first frame, your request crossed maybe fifteen different companies' equipment, possibly an ocean, and came back. Nobody coordinated it. That is the part I find genuinely strange about the internet, and it is the part most explanations skip. They tell you the internet is "a global network of networks", which is true and tells you nothing. So let's actually take it apart. There is no internet. There are 75,000 of them. The single most useful thing to understand up front: the internet is not a thing anyone built. It is roughly 75,000 independent networks that agreed on how to hand traffic to each other. Your ISP is one. Your university is one. Cloudflare is one. They own their own cables and routers, they answer to nobody in particular, and they interconnect voluntarily. Once you see it that way, every weird thing about the internet starts making sense. The whole arrangement has three parts: The edge is everything that actually wants to say something. Your phone, a laptop, a server in a rack, and increasingly a doorbell. These are called hosts or end systems , and they split roughly into clients that ask and servers that answer. The access network is your on-ramp. Fibre or cable at home, the office network, 5G from your pocket. Its only job is getting you to the first router. It is also, almost always, the slowest part of the entire journey, which is worth remembering next time you blame a website for being slow. The core is the mesh in the middle. Routers and the links between them, and nothing else. No control room, no master server, no company that owns it. Nobody reserved you a line Here is where the design gets clever. Before the in