标签：#dev

After migrating Spark pipelines to Azure Kubernetes Service, two infrastructure settings interacted destructively: spark.kubernetes.local.dirs.tmpfs=true backed shuffle spill with RAM instead of disk, and a hard podAffinity rule forced all executors onto one node. Together, they caused repeated OOM kills invisible to standard diagnostics. By Pranav Bhasker

Hey everyone, I recently landed a freelance gig to build out a complete SaaS platform from scratch. The client is incredibly generous and is treating this as an opportunity for me to learn and implement things as we proceed with development. I want to make sure I choose the right architecture from day one. I can't reveal the exact idea, but it functions as a two-sided platform connecting service providers with end-users. I need to pick a tech stack that plays to my strengths while keeping infrastructure costs as close to zero as possible. Here is my profile and the project constraints: - My Background: I am a frontend-heavy developer. My backend knowledge is only "okay-ish," so I’m looking for a stack that minimizes complex backend boilerplate and dev-ops headaches. - Timeline: I have 4 to 5 months maximum to build and fully deploy the MVP. - Strict Budget: The monthly budget for deployment, database, and any necessary transactional emailing cannot exceed $40/month for the MVP phase. - Expected Scale: To start, the web app needs to comfortably sustain 100 service providers and roughly 1,000 active users. - Payments and subscription : Stripe - Team Size: It's just me (Solo dev). Based on current trends, I've been leaning toward a meta-framework (like Next.js) paired with a BaaS (like Supabase or Firebase), but I’d love to hear from folks who have recently shipped something similar. Questions for the community: What specific tech stack would you recommend that allows a frontend dev to move fast without getting bogged down in backend setup? - Are there specific databases, ORMs, or auth providers you'd suggest that will confidently keep me under that $40/month limit for my expected user count? - Any hosting or deployment "gotchas" I should watch out for when launching a two-sided platform on a shoestring budget? Appreciate any guidance you can share! Note : Used AI for articulation. submitted by /u/chutneypow [link] [留言]

Hi r/webdev , As web developers, we frequently get stuck fighting the tools we use for e-commerce. You find a great framework, but it forces you to use a specific database, or it only deploys nicely to one cloud platform. I built Storecraft to solve this frustration. It is an open-source, headless e-commerce core that treats both the database and the runtime hosting environment as completely swappable dependencies. Why it makes building easier: Deploy Anywhere: It runs identically on traditional servers (Node), modern runtimes (Deno, Bun), or lightweight edge infrastructure (Cloudflare Workers). Choose Your DB: Switch between Postgres, MongoDB, or SQLite by simply changing your driver configuration. Purely Headless: Connect it to any frontend stack you prefer via a clean, predictable API. Whether you are building a small storefront for a local client or a globally distributed edge application, the engine adapts to your infrastructure—not the other way around. Repository link: https://github.com/store-craft/storecraft website: https://storecraft.app/ I'd love to get your feedback on the setup ergonomics. What are the biggest pain points you usually hit when deploying open-source e-commerce backends for your clients? submitted by /u/hendrixstring [link] [留言]

We run Quackr, a virtual phone number platform that lets developers and individuals receive SMS verifications without exposing a real number. We just published our first inventory transparency report and the data was surprising enough that we thought the dev community would find it useful. The Numbers Right now, 97.6% of our entire virtual phone number inventory is actively rented. 66,214 out of 67,815 numbers assigned and in use across 15+ countries. Over 1,000 numbers available at any given moment but they move fast. That utilisation rate tells you something about how the market has shifted. Virtual numbers are no longer a niche throwaway tool. Developers, businesses, and privacy-conscious users are holding them long term. What Developers Actually Use Virtual Numbers For The obvious use case is SMS verification during testing. Spin up a number, verify an account in staging, move on. But that is not what drives the bulk of demand on our platform. The real volume comes from: Multi-account management — developers and businesses running multiple instances of platforms that require unique phone verification per account. Privacy layers in production apps — applications that need to verify users without collecting their real numbers. A virtual number sits between the user and the platform. Automated verification pipelines — this is where our API and MCP Server come in. If you need to provision numbers programmatically and retrieve OTPs without manual intervention, this is the use case we built for. Geographic flexibility — needing a UK number from Australia, a US number from Ukraine, or any combination that your real SIM cannot provide. The OTP Blocking Problem Something worth knowing if you are building anything that involves SMS verification: platform-level VoIP blocking has become significantly more aggressive over the past two years. WhatsApp, Telegram, Google, and TikTok all run detection on incoming verification requests. A VoIP number gets flagged and the OTP simp

This is a submission for the GitHub Finish-Up-A-Thon Challenge I wired edge-context-mode into my own...

Node.js will change its release schedule starting with version 27 in October 2026, moving from two major releases per year to one. All releases will become Long-Term Support (LTS), removing the distinction between odd and even versions. An Alpha channel for early testing will also be introduced. This decision addresses maintenance challenges and aims to align with user needs. By Daniel Curtis

AI Coding Agents in 2026: From Pair Programming to Autonomous Teams Slug: ai-coding-agents-2026-stack-comparison 1. The Three Categories That Actually Matter The 2024‑2025 hype cycle treated every AI coding tool as a single‑dimensional “best‑of‑list.” 2026 data shows that professional developers now average 2.4 tools per workflow (Stack Overflow Survey 2025). The real decision is architectural: Layer Goal Typical Agent Type Line‑level editing Speed, low latency Editor assistants Repo‑level planning Context depth, multi‑file changes Autonomous agents Enterprise governance Isolation, audit, CI/CD integration Platform agents Choosing a “one best tool” ignores the trade‑off between context window size (how many tokens the model can see) and execution speed (how fast the tool returns a suggestion). A narrow‑window editor assistant excels at instant autocomplete, while a wide‑window autonomous agent can rewrite an entire microservice in a single run. The three‑tier framework aligns the tool’s strengths with the architectural layer where they matter most. 2. Tier 1: Editor Assistants — Speed at the Line Level Tool Market Position Key Feature (2026) Pricing (per developer) Cursor $500 M+ ARR, fastest growth in Q1 2026 Parallel agents update git worktrees; 2‑second latency on 8‑core laptops $15 /mo (individual) – $120 /mo (team) GitHub Copilot 4.7 M paid subscriptions, 75 % YoY growth Agent Mode with multi‑agent workflows; deep VS Code integration $10 /mo (individual) – $100 /mo (enterprise) Windsurf 1.2 M active users, strong UI polish Real‑time code‑style enforcement; limited to 4‑file context Free tier up to 5 k lines, $30 /mo premium Tabnine Enterprise‑only after 2026 pivot Air‑gapped deployment; NVIDIA Nemotron 4‑bit models for on‑prem inference $200 /mo per seat (minimum 10 seats) When to choose each Cursor – prioritize raw typing speed and git‑aware suggestions. Ideal for startups that need rapid iteration without heavy IDE lock‑in. Copilot – best for teams already on

Hello Dev Community! 👋 It is officially Day 12 of my journey to master the MERN stack! Today, I wrapped up Lecture 3 of Apna College's JavaScript playlist with Shradha Didi, focusing on a fundamental data type we use every day: Strings . Before today, I thought strings were just plain text wrapped in quotes. Today, I learned how much power JavaScript gives us to manipulate, slice, and dynamically format text. 🧠 Key Learnings From JS Lecture 3 (Strings) I explored how JavaScript handles text strings and the built-in properties and methods that make text manipulation effortless: 1. Template Literals (The Ultimate Game Changer) Shradha Didi introduced Template Literals , which use backticks ( ` ) instead of standard quotes. This allows us to perform String Interpolation —embedding variables directly inside a string using ${variable} . It makes code look clean and professional: javascript let obj = { item: "pen", price: 10 }; // Old way: console.log("The cost of", obj.item, "is", obj.price, "rupees."); // Modern way: console.log(`The cost of ${obj.item} is ${obj.price} rupees.`);

Honest question: Besides running AI agents interactively, while you work, do you also keep them running after hours, so that work continues or not? I am just trying to figure out how much software development has shifted towards this direction. At my workplace, we only use them while we're at work and always review the output. But I am getting the feeling that many have gone further, by having the agents work continuously. Please share your experience! submitted by /u/kagelos [link] [留言]

So, what does full-stack web development even mean with AI around these days? I mean, if I say I'm a full-stack web developer, I should probably be handling the frontend, backend, database, deployments, and all that jazz. But now, with AI advancing so much, what skills are a must for someone who wants to call themselves a full-stack web developer? Should we also be thinking about product engineering, like what architecture to pick for our projects? And should we even start thinking about shipping, the business side of things, and working with distributions? What do you all think, where should this full-stack development process begin and end now? submitted by /u/zonayedahmed [link] [留言]

Most developer tools in 2026 want your data. They want you to create an account, sync to the cloud, share analytics, and join a team plan. Every new tool is another service that knows what you are working on. I wanted something different. CodeFootprint CodeFootprint is a Mac app that tracks file changes in your project folders. It records every edit with full diff, every deletion with recoverable content, and precise timelines for everything. And it does all of this without ever connecting to the internet. How It Works Select a folder to monitor Code as normal — CodeFootprint records in the background Open it anytime to see what changed, when, and how Export change traces to share with AI tools for debugging The Design Decision I made a deliberate choice: no accounts, no cloud, no telemetry, no data leaving your machine. Not because cloud is bad, but because your project files are some of the most sensitive data you own. Your code, your configs, your unpublished work — a file change tracker sees all of it. A tool that watches everything you change should be trustworthy by design, not by promise. For Developers Who Use AI Tools If you work with multiple AI coding tools, CodeFootprint gives you something valuable: a shared context you can export. Instead of manually explaining to each new AI tool what happened in your project, you hand it a trace file and say "here is the history." Available Now CodeFootprint is on the Mac App Store . No account needed. No internet required. Your files stay on your machine. More convenience. More protection. More peace of mind.

With shiftbloom studio. I build tools and projects about a variety of experimental approaches to real-world problems. The issue for such use-case often was how most small media systems start out: one big always-on recorder that keeps costing money even when nothing is happening. For live capture you obviously need to stay ready at all times — sometimes you can’t risk losing the first minutes. But for everything else it’s complete overkill. The Core Problem Backfills, VOD downloads, clip imports, repairs and re-encodes are queue work. They can wait a few seconds, run on burst capacity, or even on a regular VPS or laptop. They don’t need the same always-hot infrastructure as the live recorder. That’s why I split the system. Instead of one large monolith, I deployed: Observer cells — only for live streams (time-critical) Harvest cells — for all queue processing (can be delayed) The Three Roles 1. Mothership A small control-plane cron job. It checks queue sizes, currently live channels and running observer tasks, then decides: how many harvest cells should exist right now which channels need an observer cell It’s intentionally simple. The database remains the single source of truth. 2. Observer Cells Each observer cell records exactly one live channel. It receives its assignment through environment variables: +++env OBSERVER_VOD_ID OBSERVER_CHANNEL_ID OBSERVER_CHANNEL_LOGIN OBSERVER_CHANNEL_NAME +++ It starts recording immediately, writes HLS segments to object storage, sends heartbeats, and waits a short standby window after the stream goes offline. This window is important because streams sometimes drop and reconnect quickly. Without it you end up with many small broken VOD fragments. 3. Harvest Cells These handle all background work: downloading VODs, re-encoding, recovering broken files, etc. They can run anywhere Docker is available — AWS tasks, a small VPS, or even a spare laptop. They only need outbound access to Postgres and object storage. What Changed Previous

This is the technical, reproducible version of a fix I shipped on my own homelab. If you want the narrative version, that's on Medium. This one is the recipe: the measurements, the math, the Modelfile, and the exact prompt I gave Claude Code to generate it. Copy-paste friendly. Repo for the dashboard used throughout: https://github.com/SikamikanikoBG/homelab-monitor TL;DR One 24GB RTX 3090, two GPU services: WhisperX large-v3 (STT, 7.7GB peak) and a Devstral Small 24B email-triage LLM (Q4_K_M, ~18.3GB). 18.3 + 7.7 = 26GB → CUDA OOM whenever they overlapped. The LLM was loaded with a 40k context window but the triage job never needed more than ~5–8k tokens. Capped num_ctx to 8192 → KV cache drops from ~6.1GB to ~1.25GB → model footprint ~18.3GB → ~14.2GB . 14.2 + 7.7 = 21.9GB → both resident, zero OOM, no quality loss. The setup Host : openSUSE, Xeon (56 threads), 125GB RAM, 1x RTX 3090 (24GB) GPU svc : WhisperX large-v3 (speech-to-text) GPU svc : Ollama -> devstral-small-2 (24B, Q4_K_M) for background email triage Both services run all the time. The OOM only happened when I dictated to my assistant (WhisperX) while the triage loop was active. Step 1 — Make the contention measurable nvidia-smi shows instantaneous VRAM. It can't show you which service spiked or when two of them overlapped — and an intermittent OOM is a timing problem. You need per-service VRAM history. I use my own dashboard (homelab-monitor) for this. The relevant view is "AI Models", which attributes VRAM per model server and per loaded model, over a time range, with OOM markers and a capacity ceiling line. What the history showed at the overlap window: Service Peak VRAM Devstral 24B (triage) ~18.3 GB WhisperX large-v3 7.7 GB Total ~26 GB on a 24 GB card If you want to reproduce the measurement, the dashboard runs as a single container: git clone https://github.com/SikamikanikoBG/homelab-monitor cd homelab-monitor docker compose up -d --build # open http://<host>:9800 -> AI Models / GPU views (NVIDI

Is it safe? I know nothing.. help me submitted by /u/Free-Ant-463 [link] [留言]

It's free and open source with markdown files on how to setup it for your team and host it yourself. No more paying for votes or not being able to have sessions persist longer than a few days. Enjoy and please don't eat me alive! This is my first public repo (that is actually substantial) I've put out in the world haha. JIRA Planning Poker Website submitted by /u/brut3F0rc3 [link] [留言]

Exam Guide: Developer - Associate 🏗️ Domain 2: Security 📘 Task 2: Implement Encryption By Using AWS Services. Encryption shows up everywhere, especially on this exam. S3, DynamoDB, SQS, Lambda environment variables, RDS, and more. You need to know the difference between client-side and server-side encryption, how KMS works, and when to use each approach. 📘Concepts Encryption at Rest vs Encryption In Transit Encryption At Rest Data stored on disk: S3 Objects, DynamoDB tables, EBS volumes, RDS databases. Encryption In Transit Data moving between services or between client and server: HTTPS, TLS, VPN. Where At Rest In Transit S3 SSE-S3, SSE-KMS, SSE-C HTTPS (enforced via bucket policy) DynamoDB Encrypted by default (AWS owned or KMS) HTTPS (always) RDS KMS encryption SSL/TLS connections SQS SSE-KMS HTTPS Lambda env vars KMS (default + optional CMK) HTTPS KMS Key Types Type Managed By Cost Use Case AWS owned keys AWS Free Default encryption (DynamoDB, S3 SSE-S3 ) AWS managed keys AWS (in your account) Free (per-use charges) aws/s3 , aws/dynamodb (you can't manage them) Customer managed keys (CMK) You Monthly + per-use Full control: rotation, policies, cross-account Envelope Encryption KMS can only directly encrypt up to 4 KB . For larger data, it uses envelope encryption: 1. KMS generates a data key (plaintext + encrypted copy) 2. You encrypt your data with the plaintext data key 3. You store the encrypted data key alongside the encrypted data 4. You discard the plaintext data key from memory 5. To decrypt: KMS decrypts the data key → you decrypt the data The AWS Encryption SDK handles this automatically. Server-Side Encryption Options for S3 Option Key Management Use Case SSE-S3 AWS manages everything Simplest, no KMS costs SSE-KMS You control the KMS key Audit trail via CloudTrail, key policies SSE-C You provide the key with every request Full key control, AWS doesn't store the key Client-Side vs Server-Side Encryption Aspect Server-Side Client-Side Who encrypts AWS (

If you've used other browser-based code editors, you've probably noticed that the terminal feels off. You can run a script. You can print to stdout. But the moment you try to install a package and then actually use it in the next command, something breaks. The environment doesn't carry over. It feels like every command starts from scratch in a vacuum. That was the problem I wanted to solve when building the terminal for Cloudpen. Not just a place to run isolated snippets, but a proper environment where you can install dependencies, run build tools, and have everything you did in one command still be there for the next one. What most cloud terminals get wrong The core issue is that running code in the browser is hard to do without cheating somewhere. A lot of tools use sandboxed environments that look like a terminal but don't behave like one. They're good enough for demos. They fall apart in real work. The thing developers actually need is simple: if I install something, it should be there when I run the next command. That's it. That's the whole requirement. Surprisingly few cloud tools actually deliver it. How Cloudpen handles it Without going into the full technical detail, the short version is this: every command runs in a completely isolated environment, but all commands within your session share the same filesystem. So when you run npm install, those files are written somewhere. When you run your next command, that somewhere is exactly where it looks. Package installs work. Build tools work. Multi-step workflows work. And because each command runs in a clean, isolated environment, there's no bleed between users or sessions. The current terminal is optimized for commands that run to completion, while live application previews are handled through Cloudpen's deployment system. On the free plan, you can run any file in your project and see the output directly in the terminal. The live coding environment where you type commands yourself is on the Pro plan. Both use

Just released an open-source bash checker for CIFSwitch (CVE-2026-46243) — the 19-year-old Linux kernel LPE disclosed last week that lets any unprivileged local user get root by abusing the CIFS/SPNEGO upcall path. The script runs on bare-metal, VMs, and inside containers, and is CI/CD-friendly with JSON output and clean exit codes. It checks: ✅ Kernel version against patched thresholds (6.18.22 / 6.19.12 / 7.0+) ✅ cifs-utils presence and exploitable version ✅ CIFS kernel module load state and blacklist status ✅ Unprivileged user namespace sysctl (the pivot point for the exploit) ✅ Active request-key cifs.spnego rules ✅ SELinux / AppArmor enforcement ✅ Container capabilities (CAP_SYS_ADMIN) ✅ Kernel symbol verification for the fix commit Outputs human-readable or JSON for SIEM ingestion. Exit 0 = safe, exit 1 = action needed — drop it straight into a pipeline. CIFSwitch is the fourth Linux LPE in under six weeks (after Copy Fail, Dirty Frag, and Fragnesia). If you're running multi-tenant Linux, CI runners, or container build farms, now is a good time to audit. I have also updated the cve_checks.conf in my my K8s-container_escape_audit toolkit to detect this issue.

Microsoft launched seven new in-house AI models at Build 2026 on June 2, 2026, marking the company's most significant push yet to build its own frontier AI stack independent of OpenAI. The centerpiece is MAI-Thinking-1, Microsoft's first large-scale reasoning model, built from scratch on clean commercially licensed data using a sparse Mixture of Experts architecture. Alongside it: MAI-Code-1-Flash, a 5-billion-parameter coding model that outperforms Claude Haiku 4.5 by 16 percentage points on SWE-Bench Pro while using 60% fewer tokens on complex tasks. This is the complete developer guide to all seven MAI models, their specs, benchmarks, deployment paths, and what they mean for the AI development ecosystem. Why Seven Models at Once? The strategic context matters. For three years, Microsoft's AI product surface — GitHub Copilot, Azure AI, Bing Chat, Microsoft 365 Copilot — ran almost entirely on OpenAI models. The Build 2026 announcement is Microsoft's public declaration that it is building a parallel, proprietary model stack. Every new MAI model is trained from scratch using "clean and appropriately licensed data, without distillation from third-party models" — language that directly addresses the intellectual property concerns that have accompanied third-party model licensing. The distribution strategy is equally deliberate. Microsoft is not routing MAI models exclusively through Azure. MAI-Thinking-1 and MAI-Code-1-Flash are available via Fireworks AI, Baseten, and OpenRouter — three infrastructure providers that collectively reach developers who explicitly do not want cloud vendor lock-in. This signals a platform-first posture: Microsoft wants MAI to become a model ecosystem, not just an Azure feature. MAI-Thinking-1: The Reasoning Flagship MAI-Thinking-1 is Microsoft's answer to Claude Opus 4.x and GPT-5.5 on the reasoning side of the model spectrum. The architecture is a 35-billion-parameter active / approximately 1-trillion-parameter total sparse Mixture of Ex

Crypto APIs are no longer just tools for fetching Bitcoin prices. In 2026, they are becoming the...