标签：#dev

The Problem We Were Actually Solving Our event platform at Veltrix ran a treasure hunt game that gave users real-world rewards. It started as a simple Rails app with a PostgreSQL counter column for each hunt. By 3 AM on Black Friday, that counter column became a single point of failure. Every leaderboard update blocked the entire leaderboard query because PostgreSQL row-level locks escalated to table-level for SERIAL columns. Our error rate jumped from 0.2% to 18% under 2000 concurrent writes. The system didnt just slow down; it started failing writes with could not serialize access due to concurrent update deadlocks. We lost $47K in rewards payouts before we could scale up the database. What We Tried First (And Why It Failed) Our first fix was to shard the PostgreSQL counter by hunt ID, splitting the hot row into 1024 partitions. That reduced the lock contention, but introduced new problems. Each hunt now needed its own sequence, and our Rails code had to route writes to the correct shard. The shard routing introduced 400ms extra latency on leaderboard queries because we had to union results across 1024 tables. Meanwhile, PostgreSQL sequences had gaps up to 1024 when nodes restarted, so our reward payouts were off by thousands on high-traffic hunts. Our Redis cache didnt help because the leaderboard queries were point lookups against 1024 tables, and Redis couldnt pipeline those efficiently. The Architecture Decision We ripped out the PostgreSQL counter and replaced it with a Kafka Streams-based event sourcing system called HuntStream. Every hunt action (point earned, reward claimed) became an immutable event in a Kafka topic. We built a materialized view on top of RocksDB that consumed the topic and maintained the current leaderboard state in memory. The materialized view was partitioned by hunt ID, which meant leaderboard queries only hit one RocksDB partition per hunt. We used RocksDBs built-in caching to keep hot leaderboards in memory, and fall back to disk fo

I've been looking into creating a site that would host an almost Youtube like platform (for a specific niche) where creators can post their videos and viewers can watch it for free. The site would have advertisement which would fund it as well as premium for viewers, but don't focus about the fund generation for this question. As some may know hosting and streaming videos is very expensive (Looking specifically at CloudFlare and Mux, which are the best options but come up to insane numbers if streaming to a high population of views per video at high minute counts like half an hour) so trying to find a cost viable way to host videos I found Rumble Cloud which is used as a cloud provider, which summed up stores the videos (a big part of what the other options offer) for an incredibly more reasonable price. So knowing that, I looked into what I needed to make up what something like CloudFlare and Mux does already. I don't know anything about webdev or anything like this, I've only been using research and what little business knowledge I know to figure this out, I'm way out of scope so I need the help. So the question is: If I used Rumble Cloud to store the uploaded videos, had whoever I hire build in an FFmpeg (used to shred up the stored content into a watchable video that won't destroy everything), then used a CDN (looking into bunny.netCDN but not sure yet) to lessen the load that watching a video would have on the site and viewers, would all of that allow me to host and stream videos on the site with minimal issue and if not what am I missing. Again I know very little about this as a whole and have only done research for some time in the past months, I may be missing many things but could really use the help. If there is absolutely any more details or information you need me to give you to help you answer the question please let me know. (Also I'm looking into an alternative I have questions about so this is one of two related but not rlly related questions) submit

I wanted a soft gate on my resume download. Not a paywall. Just an email field — enough friction to filter bots, enough signal to know who's interested. What started as a straightforward feature turned into a three-part lesson: stateless token signing, S3 public access, and email delivery mechanics. Here's the full story. The Feature The flow I wanted: Visitor clicks "Download Resume" on the About page or Hero A modal asks for their email Backend validates the email (format + disposable domain check) A signed, time-limited link is emailed to them They click the link, the PDF opens No database tokens. No cron jobs. No permanent S3 URLs floating around. Part 1 — The Model and the Gate The Resume Model Resume follows the singleton pattern I already use for page headers — force pk=1 on every save, restrict add/delete in admin. One row, forever. class Resume ( models . Model ): pdf = models . FileField ( upload_to = " resume/ " , storage = private_resume_storage ) last_updated = models . DateField ( default = date . today ) def save ( self , * args , ** kwargs ): self . pk = 1 super (). save ( * args , ** kwargs ) ResumeDownloadRequest logs every email that requests a link — no tokens, no expiry columns, just a record of who asked and when. class ResumeDownloadRequest ( models . Model ): email = models . EmailField () created_at = models . DateTimeField ( auto_now_add = True ) unsubscribed = models . BooleanField ( default = False ) class Meta : ordering = [ " -created_at " ] The unsubscribed flag is there for a future newsletter broadcast — when a new blog post goes out, skip anyone who opted out. Blocking Disposable Emails Before signing anything, the email is checked against a frozenset of ~70 known throwaway domains: # core/validators.py DISPOSABLE_EMAIL_DOMAINS : frozenset [ str ] = frozenset ({ " mailinator.com " , " guerrillamail.com " , " yopmail.com " , " 10minutemail.com " , " trashmail.com " , # ... ~70 total }) def is_disposable_email ( email : str ) -> bool

I am developing SuperRails and LazyCafe . Recently, I realized that email was the only way to receive bug reports and feedback requests for my products. In 2026, the barrier for people to send an email is incredibly high. Therefore, I have introduced Discord, a tool that I use every single day. Here is the link: https://discord.gg/WjCp7Qvt7 It is also linked on the SuperRails and LazyCafe homepages. If you have any questions, requests for improvement, complaints, or refund requests regarding our products, please feel free to leave a comment in the respective channels. You can also send a direct message (DM) to Hulk in Public. If the barrier to signing up for Discord is too high for you, we will continue to handle support via haruku.maniwa@laicos.tech as well. Why we chose Discord for user support Now, let me share the reasons why we decided to adopt Discord. Currently, I am challenging myself as a company to release one product every month. Thanks to everyone's support, I have managed to release up to our second project. Actually, for the third project, I was planning to build a user support tool in June. However, I decided against it. I realized that no user would leave complaints or feedback on a platform they don't yet trust. (So, the direction for the product to be developed in June is still undecided!) I realized that Discord, which I already use and love daily, could function perfectly fine as an MVP. Plus, you can use most of its features for free. Our goal is not just to develop products; it is to make our users happy. I thought Slack might be more suitable than Discord (which is aimed at gamers) since many developers likely use Slack for work. However, with Slack's free plan, you can only use a limited set of features. Most importantly, you cannot view messages older than 90 days. This is a huge dealbreaker. In fact, Discord is widely adopted as a community tool for many open-source (OSS) projects. It should be more than enough to serve its purpose for Supe

As developers, indie hackers, and solo founders, we launch numerous static sites, minimal landing pages, and open-source project documentation blocks. Every single one of these deployments shares a universal prerequisite: a reliable path to gather raw incoming user feedback, inbound sales leads, or bug reports. The traditional path of least resistance has long been to embed a hardcoded HTML <form> inside our page, or worse, expose a standard mailto: link. However, we all know what happens next. Within hours of your app hitting public hosting servers or GitHub, automated asynchronous spam bots find your raw source code, harvest your personal email address, and turn your inbox into a living nightmare. I used to spend hours configuring captchas, writing honey-pot filters, or spinning up custom Serverless Lambda routines just to secure a simple contact form. Eventually, I realized I was fighting the wrong battle. The best way to protect your inbox isn't to build a better shield around your frontend form; it's to remove the form from your code entirely. That is why I built FormCrab.com . 🦀 The Problem: Why Client-Side Forms are a Risk When you embed a custom form or mailto link into your landing page, you are effectively publishing your communication architecture to the world. Spam bots don't even need to render your page anymore; they use basic regex scrapers to crawl through millions of raw static HTML repositories looking for keywords like type="email" or action="..." . Once your endpoint or raw email identity is captured, it is added to bulk programmatic marketing lists. The Trade-Off We All Hate: Option A: Spin Up a Custom Backend. Configuring an Express or Spring Boot API routing layer solely to act as an authenticated SMTP relay. This adds infrastructural complexity and database burdens to what should be a 15-minute frontend project. Option B: Use Form Backends. Even if you use a standard form endpoint handler, you still have to code the frontend UI, handle valida

Successful developers, question above. How much time do you devote to web dev/programming/learning outside of your regular working hours? How much time do you spend involved in the web-dev-sphere and absorbing knowledge and/or discussing with others? I was browsing remote jobs and came across one that seemed pretty cool but in the application , just the application that you fill out to see if they are interested, they asked mandatory/required questions like " What’s an idea, book, blog post, or talk that recently changed how you think about your craft?" and "What’s a controversial or unpopular opinion you hold about software engineering, and why?" I've been a webdev for 15 years and I don't even know how to answer either of those questions. None? I read daily posts and blogs about webdev (subbed to TLDR) but I haven't read anything mindblowingly earthshattering to change how I think about web dev. Am I just not devoting enough time outside of work to "the craft"? Am I supposed to spend 15+ hours a day thinking/reading/discussing web dev? *HONEST QUESTION, NOT A RANT OR COMPLAINT. I honestly want to know if I need to be doing more?* submitted by /u/X5455 [link] [留言]

I've got a repo that is currently a CSS library and a javascript library in one package, and it's kind of getting a bit clumsy. You'd figure this would be a simple thing to do, but all the resources I'm finding are along the lines of "here's how you can take your 10-repo project and make a mono repo" or "here's how you can still use this tool and have a single-package repo". I don't think I need anything incredibly sophisticated. Maybe I'll have more than two packages at some point, maybe not. Does anyone know of any guides for this? Do you have any advice for tools I can use? I know pnpm has support for monorepos, but it's not really well-documented. Would that be sufficient, or would I need a tool like nx or the thousand other monorepo tools that are out there? submitted by /u/CoVegGirl [link] [留言]

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

When loading custom themes made by the user & stored somewhere for example local storage, I assume the flow is: 1-Read theme data from storage 2-Flatten theme & generate CSS text 3-Dynamically inject it as a style to the document, os use cssom to add sheets 4-Use [data-theme="custom1...n"] to switch themes Or Have a single placeholder [data-theme="slot"]{} In your static CSS, just read the user selected theme only, flatten, loop over variables & use cssom set property to set the values of tge slot style to those of the theme, & use data-tgeme=slot to activate it, & when the user selects another custom theme load it the same way using cssom & so on & so on, basically injecting a style css vs cssom adoptsheet (which I think has/had? A bug in FF), & load all/many (maybe lazy load), or swap in & out in a static pre-defined css style slot? submitted by /u/Ok-Weakness-3206 [link] [留言]

At a previous job I worked at as a Dev we had someone who ran Semgrep on our codebase for the first time. It came back with 180 findings. We had no security engineer. The developer who ran it looked at the output, closed the terminal, and we never ran it again. That's not a story about a careless team. That's a story about a tool that produced output most teams in small companies with no expertise knew what to do with. I've seen this exact moment happen more times than I can count working with small dev teams. And it's the reason I spent the last year building SecOpsium. But before I get to that let me explain the actual problem, because I think it's misunderstood. The problem isn't the scanning Semgrep and Gitleaks are excellent tools. They're free, actively maintained, and genuinely powerful. If you're not using them you should be. The problem is what happens 10 minutes after you run them. You get 200 findings. Some are critical. Some are test files. Some are commented-out code from 2021. Some are legitimate secrets. Some are variable names that pattern match against a rule but contain nothing sensitive. They all look the same in the output. Now you're a developer who also does DevOps, also reviews PRs, also handles incidents, and you're staring at 200 items with no clear indication of which three actually matter this week. So you close the terminal. Or you create a Jira ticket labeled "security findings" that lives in the backlog forever. Or you spend two days triaging manually and burn out before you fix anything. This is the real problem. The scanning was never the hard part. Why rule based scanners produce so much noise It helps to understand technically why this happens. Semgrep and Gitleaks are rule-based. They match patterns. A variable named api_key_example in a test file flags the same way as a live Stripe key in an active production config. Gitleaks scans for entropy and known credential patterns but can't distinguish between a key that was rotated and r

Today I discovered something I honestly should have explored a long time ago: Google Lighthouse. Funny enough, revamping my portfolio is one of those projects I kept pushing forward with the classic “I’ll do it tomorrow” mindset — and somehow tomorrow kept winning. But today I finally sat down and started improving it, and during that process, I came across Lighthouse. For anyone who hasn’t heard of it yet, Google Lighthouse is an open-source automated tool designed to help developers improve the quality of web pages. You can run it on almost any page — whether it’s public or behind authentication. What immediately caught my attention is that it audits things like: Performance Accessibility SEO Best Practices And probably a few more things I’m still discovering You can run Lighthouse directly inside Chrome DevTools, through the command line, or even as a Node.js module. The process is simple: You give Lighthouse a URL, it scans the page, runs a series of audits, and then generates a detailed report showing how your website performs. What makes it powerful is that it doesn’t just tell you what’s wrong it also explains: _ Why the issue matters How it affects users And how you can fix it _ As a beginner software engineer and developer, I’m slowly realizing that writing code is only one part of building great applications. Performance, accessibility, maintainability, and user experience matter just as much. And honestly, tools like Lighthouse make the learning process feel less overwhelming because they point you in the right direction. One thing I’ll say though don’t fall into the trap of chasing a perfect Lighthouse score instead of building useful projects. A lot of developers start optimizing numbers before validating whether the product itself solves a real problem. Lighthouse is a guide, not the final goal. For my portfolio specifically, Lighthouse exposed a few weaknesses immediately: Large unoptimized images Accessibility issues Slow-loading assets Missing metad

You know that feeling when you join a new project or want to contribute to an open-source repo, and you spend the first two days just trying to figure out where everything is? I did. Every single time. Clone the repo. Open the files. Stare at 47 folders. Wonder which one actually matters. Grep for the entry point. Follow imports down a rabbit hole. Give up and ask someone. That's not learning. That's just wasted time. So I built CodeAutopsy. What it does Paste any GitHub URL. That's it. CodeAutopsy clones the repo, parses every file into an AST (Abstract Syntax Tree), traces every import and dependency, and gives you: An interactive dependency graph showing exactly what imports what The entry points — where execution actually starts A blast radius map — click any file and instantly see everything that breaks if you change it An AI-generated architectural summary explaining what the codebase does, how it's structured, and how to get started Live Health Telemetry: An Edge API that generates a live SVG health badge (A to F grade). Drop the markdown in your README once. Every time you refactor and re-scan, your badge updates everywhere instantly. My own CodeAutopsy repo just hit 99/100. Drop the markdown snippet once and forget about it. What used to take days now takes about 10 seconds. The real problem it solves Every developer has been here: You're onboarding at a new job. The codebase has 200 files. Your tech lead says "just read the code." You spend a week feeling lost. You want to contribute to an open-source project. The repo has no architecture docs. You don't know where to start. You're doing a code review on a PR that touches 15 files. You have no idea what the blast radius of those changes is. CodeAutopsy solves all three. The interesting engineering problems The hardest part wasn't the AST parsing — it was keeping it serverless without hitting Vercel's 504 timeout limits, while making the AI analysis feel instant. The Serverless Timeout Hack: Doing AST extra

🗓️ This Week Completed two more sections of the SwiftUI tutorial 🦾 As I continue working through the tutorial, I can feel my understanding of SwiftUI fundamentals becoming more solid 🔥 It was my first time posting a standalone article about reverse engineering📝 If you're interested, feel free to check it out 👇 A Curious Journey Into Reverse Engineering an AI-Generated Python .exe Umitomo Umitomo Umitomo Follow May 26 A Curious Journey Into Reverse Engineering an AI-Generated Python .exe # beginners # reversing # security # python 5 reactions Comments Add Comment 5 min read I started creating UI designs for my future portfolio website in Figma. I was able to roughly sketch out the overall structure of the site, but I also realized how difficult it is to create modern and stylish UI designs. (It really made me realize I don’t have much design sense yet 😂💦) While struggling with the design process, I came across several articles about Figma MCP . That made me interested in exploring how generative AI could help with UI design ideas, so I decided to start researching Figma MCP further. Completed Securing AI Systems room from the AI Security Learning Path on TryHackMe this week🤖 📱 iOS (SwiftUI) Worked through the SwiftUI tutorial and completed "Create an Algorithm for Badges" and "Add inclusive features" 🌐 Web Development Posted my weekly dev log on Dev.to and a standalone article about my first attempt at reverse engineering 📝 Created rough portfolio website UI layouts in Figma Used shadcn/ui component library design templates in Figma Started learning UI design in Figma using community resources 🔐 Security (TryHackMe) Completed Securing AI Systems room (part of the AI Security Learning Path) on TryHackMe. 💡 Key Takeaways 📱 SwiftUI Learning Add inclusive features Learned that SwiftUI automatically adapts UI elements for Light and Dark Mode by default. Learned how to preview and compare Light and Dark Mode layouts in the Xcode canvas. Understood that system-provided sema

We were burning 400ms in p99 tail latency on a core event-processing path in Veltrix. The upstream teams kept blaming the network, but the numbers didnt lie—64% of the time was spent inside the JVM, specifically in sun.misc.Unsafe.park during GC pauses. Every time we hit 80% heap pressure, the throughput collapsed and we lost 300k events per minute. That was the exact moment I stopped believing in the JVM as the runtime and started looking at the system boundary. The first attempt was aggressively tuned HotSpot with G1GC and pinning the critical threads to their own NUMA nodes. We set -XX:MaxGCPauseMillis=20 , -XX:+UseNUMA , and even migrated to Azul Zulu Prime because its handling of large heaps was supposedly better. The p99 dropped to 280ms, but the GC telemetry still showed a sawtooth pattern of 30–40ms spikes every 230ms on a 16GB heap. Profiling with JDK Flight Recorder told us 18% of CPU time was spent in card-table scanning. At that point I knew we were fighting the runtime, not the problem. The event pipeline was small—just JSON parsing, enrichment, and a single RocksDB write—but the JVMs generational collector couldnt stop moving objects. The architecture decision came during a four-day blackout window after a failed Blue-Green deploy. Three of us sat in a war room with a single Grafana dashboard showing 100% CPU steal time on the Kubernetes nodes. We had two choices: squeeze more life out of the JVM by manually balancing the heap or rewrite the critical hot path in Rust and give the compiler full control over memory layout. The Rust option meant losing the JVM ecosystem (no more async-profiler, no more one-liner heap dumps) but gave us stackless futures, zero-cost abstractions, and compile-time memory safety. We chose Rust. We forked the Cargo.toml wed used in a sidecar for metrics and started porting the event collector. The numbers after the rewrite told the story. We recompiled the same two endpoints— POST /events and GET /aggregates —and served them f

I Built a Local AI Agent That Thinks Like a Brain, Not a Database Most AI agents today are sophisticated autocomplete engines. Ask them something, they answer. Ask again in a new conversation, they start from zero. The context window is the only memory they have. Serenity is different. It's a fully local AI agent that encodes experiences the way biological brains do — semantically clustered, causally structured, and self-organizing. No cloud. No API calls to a vector database. No data leaves your machine. Ever. The Core Problem with Current AI Memory The standard approach to AI memory is essentially a hack: you stuff embeddings into a vector DB, do nearest-neighbor retrieval, and dump the results into the prompt. It sort of works. But it's not how brains work. Your brain doesn't search for memories. When one fires, related ones light up automatically. Serenity's architecture — called S.E.R.A (Semantic Experience Reasoning Agent) — tries to bridge that gap. Here's the key difference: Traditional Approach Serenity Vector search on embeddings Semantic node activation Prompt-injected context Persistent working memory One-shot retrieval Emergent recall via association Static embeddings Pruned & crystallized over time How It Works: The Neural Node Network At the core is the Neural Node Network (NNN) . Instead of storing facts in isolation, Serenity encodes experiences in causal format: ACTION → BEFORE → OUTCOME → AFTER When she learns something, she doesn't file it in a folder. She finds where it semantically belongs in a web of related concepts. Similar things cluster together — the same way neurons that fire together wire together. Then the abstraction layer kicks in. Three or more related concepts crystallize into a higher-order node: the thing they all have in common that none of them says directly. Those nodes bundle into pathways. Those pathways grow into domains. She also has inhibitors and pruning — weak connections get cut so strong ones sharpen. Her knowledge ge

Getting this 0.0.0.0 error while signing in to my website with Google oauth , any fixes ? I can still get inside if I try again but it may be irritating for end consumers submitted by /u/Haunting-Soft3896 [link] [留言]

I just need to get this out before I break my laptop in half. I have worked in UX/UI for nearly 10 years. I've used so many website builders. The worst BY FAR is Webflow. Where do I start? Very little custom code support: seriously, pretty much all styles and JS needs to be added in the site settings? SO CLUNKY. Give me page level control at the very least - I refuse to hack everything together with embeds. Insane. Components are too locked down: so I can't modify one thing (outside of properties) in a special exception? I get that's how a code base works, but you are a VISUAL designer. Be more like Figma Animations are a nightmare: why the funk do I have to define the hover out state? Are you kidding me? One hover state, animate in and out by default. Doing custom hover outs should be an exception, not the standard. I know this is the basic setup for very simple element level animations, which is crazy that they expect any web designer to use those more than multi-level animations. Also WHY CAN'T WE ANIMATE MARGIN AND PADDING??? You can't organize CMS collection content: complex data entry? Have fun scrolling through a massive list of inputs and selects with no hierarchy Naming every fudging element is hell. Can we please just switch to a css framework native approach? Just apply class names based on something like Tailwind when we use the visual editor to adjust properties. Sure, custom classnames when desired, but omg the brainpower it takes to care about classes makes me gag Along those lines: why can't we see a list of all the classes??? If everything is going to create a custom class then at least let me see a list/the CSS for the love of gourd No inline SVG element option is infuriating. Yes SVGs can be a security vulnerability but it's 2026 FIGURE IT OUT. So nasty to have to use embedded code if you want to be able to easily change the color, line weight, etc of an icon I swear who is this product even for 😭 my clients can't use it because you need to have k

I have tried to use the custom html block via WordPress but it seems to be limited with complexity. I am trying to add many sections and subcategories that follow a tree structure onto my webpages. What should I know before modifying the page's code directly, I think I have a raw HTML plugin installed. submitted by /u/neonrider2018 [link] [留言]

A few years ago I would've said crashes are the worst bugs. Now I think it's the opposite. The worst bugs are the ones where everything technically works. The request succeeds. The button works. The API returns 200. Nothing shows up in logs. Meanwhile users are getting confused, clicking the same thing repeatedly, or abandoning a flow entirely. By the time someone notices, it's been happening for weeks. What's the most frustrating example of this you've run into? Edit:- I am not getting the point why everyone is downvoting this post ? It's a serious question guys submitted by /u/Icy-Roll-4044 [link] [留言]

As the title goes. I'm just too f*cking slow! I'm sitting with a client's project for 6+ months (without pay) and I've covered only about 50% so far. This project is mildly complex- a custom video distribution platform with background jobs. However, have I been faster, it would have gone live by now! I took a whole lot of time understanding the technical concept, the underlying system design. Right then, I got hold of the sinister thing called procrastination, in combination with fear of failure, as well as perfectionism! The actual implementation is going even slower. I'm the perfect candidate to be replaced by AI; at least in terms of speed. I fear how will I learn and work on other technologies later on! This is also destroying my overall confidence and career. I have seen the sentence 'ship fast, polish later.' But I just won't follow it even if I go broke financially. Man, I'm fed up of myself! Has anyone ever recovered from similar situation? submitted by /u/swb_rise [link] [留言]