标签：#dev

You've probably registered a domain with Route53 or another popular registrar. You pick something...

A lot of platform teams face a problem: they build a lot of really cool stuff, and then their developers don't use it. Be visible to management, talk to stakeholders and listen to their problems, make your value measurable with metrics like DORA, create narratives, and show the hidden pain to make it personal: these are lessons that Lucas Hornung and Christian Matthaei presented. By Ben Linders

What I learned at Zone01 Kisumu's IP training Introduction Yesterday, I attended an Intellectual Property training at Zone01 Kisumu, and it fundamentally changed how I think about the code I write. As developers, we spend countless hours building software, but how many of us truly understand the value of what we create,and how to protect it? In Kenya's rapidly growing tech ecosystem, understanding IP isn't just a legal nicety, it's a competitive advantage. Whether you're building an app, contributing to open source, or launching a startup, knowing your rights can mean the difference between owning your work and losing it. This article breaks down the essential IP frameworks every software developer should know. What is Intellectual Property in Software? Intellectual Property (IP) in software encompasses legal protections designed to safeguard the rights of creators and developers. The four primary types of IP protection relevant to software are: patents, copyrights, trademarks, and trade secrets . Copyright: Protecting Your Code Copyright is the most immediate form of protection for software developers. In Kenya, copyright protection arises automatically at the moment of creation,registration is not mandatory . This means that when you write code, you automatically own the copyright to that expression, provided the work is fixed in a tangible medium . However, a crucial distinction exists: copyright protects the expression of ideas, not the ideas themselves . This principle was reinforced in the Kenyan case of Solut Technology Limited v Safaricom Limited, where the court confirmed that without access to source code, it's difficult to prove infringement because the "expression" (the code itself) wasn't shared . Key Insight: Registering your copyright with KECOBO in Kenya provides prima facie evidence of ownership and can make enforcement faster if someone copies your work . Patents: Protecting Functionality While copyright protects the expression of code, patents pro

MCP for AWS Security Engineers: Build a Read-Only Security Hub Triage Agent For AWS-heavy security work, I would start with AWS Agent Toolkit for AWS and the managed AWS MCP Server , not a custom MCP server. The reason is practical. AWS now provides a managed MCP path that can connect AI coding agents to AWS documentation, AWS APIs, AWS skills, and existing IAM credentials. The Agent Toolkit also provides plugin-based setup for supported agents such as Claude Code and Codex. For security teams, that is the right starting point because the enforcement point remains AWS IAM, not the model. The initial operating model should be strict: Read-only first. No production write authority. No access to secrets. No raw customer PII or sensitive incident logs in prompt context. No automatic remediation. No AI-approved suppression, exception, merge, deploy, or risk acceptance. Human review and CI/CD remain the release authority. That is the same posture I would use for a governed Claude Code or Codex rollout: named identities, SSO, scoped credentials, default deny, tool approval, audit logs, and security evidence tied back to tickets, pull requests, CI logs, and cloud findings. What we are building This article walks through a practical security workflow: A read-only Security Hub triage assistant that helps a junior security engineer produce a daily or weekly findings summary, remediation backlog, and evidence pack without allowing the agent to modify AWS. The agent will be able to: Read AWS Security Hub findings. Group findings by account, severity, product, resource, and control. Explain why a finding matters. Draft remediation tickets. Draft a Slack-ready summary. Produce local markdown, CSV, and JSON evidence files. The agent will not be able to: Suppress findings. Archive findings. Mark findings resolved. Disable Security Hub standards. Modify IAM, S3, EC2, KMS, GuardDuty, Inspector, or Config. Deploy remediation. Run destructive scripts. Approve risk acceptance. This is no

I spent the last few months building a Chrome extension that detects HTML code blocks inside ChatGPT, Claude, and Gemini and lets you deploy them straight to a live URL. The "deploy" part turned out to be the easy 20%. The hard 80% was reliably watching three completely different, constantly-changing chat UIs without breaking every other week. Here's what actually taught me something. 1. MutationObserver is non-negotiable, but it will still lie to you None of these chat apps render the full response at once — they stream tokens in, which means the DOM you're watching is incomplete almost every time your observer fires. My first version tried to detect a finished <pre><code> block the moment it appeared. Result: I was grabbing HTML mid-stream, cut off halfway through a <div> . What actually worked was debouncing on DOM stability instead of DOM presence: let debounceTimer ; const observer = new MutationObserver (() => { clearTimeout ( debounceTimer ); debounceTimer = setTimeout ( scanForCodeBlocks , 600 ); }); observer . observe ( document . body , { childList : true , subtree : true }); 600ms of "nothing changed" turned out to be a much more reliable signal than "the tag now exists." Not elegant, but it works across all three sites' streaming speeds. 2. Every AI chat UI restructures its DOM without telling you ChatGPT, Claude, and Gemini all ship frequent frontend updates, and none of them are obligated to keep a stable class name for you to hook into. I initially selected code blocks by class name ( .language-html , .hljs , etc.) and had selectors silently break in production within two weeks of launch. What's held up better: matching on structural patterns instead of class names — a <pre> containing a <code> whose text content starts with <!DOCTYPE or <html . It's slower to write the first time, but it doesn't care what CSS class the framework decided to use this month. 3. "Detect the code" is easy. "Detect the right code" is the actual problem A single AI response

Parallel Routes let you render multiple pages simultaneously within the same layout. Instead of navigating away from a page to show another one, you can display both at the same time — a dashboard with independently navigable sections, a main content area alongside a sidebar that changes with its own navigation, or a feed with an openable detail panel that doesn't replace the feed. This is one of the more powerful App Router features and one of the more confusing to set up initially. Here's the complete pattern, including the design approach used for complex multi-panel interfaces like the generation tool at Pixova . The Core Concept — Named Slots Parallel routes use named slots: special folders prefixed with @ that define independent rendering areas within a layout. app/ ├── layout.tsx ← Receives slot props ├── page.tsx ← Default slot content ├── @sidebar/ │ ├── page.tsx ← Sidebar default │ └── settings/ │ └── page.tsx ← Sidebar settings view └── @modal/ ├── page.tsx ← Modal default (null) └── photo/[id]/ └── page.tsx ← Photo modal The layout receives each slot as a prop: // app/layout.tsx export default function Layout ({ children , sidebar , modal , }: { children : React . ReactNode ; sidebar : React . ReactNode ; modal : React . ReactNode ; }) { return ( < div className = "flex h-screen" > < aside className = "w-64 border-r" > { sidebar } </ aside > < main className = "flex-1" > { children } </ main > { modal } </ div > ); } Now children , sidebar , and modal can each navigate independently. Independent Navigation — The Key Behavior Each parallel route slot navigates independently. When a user navigates from / to /settings , the children slot updates. The sidebar slot stays exactly where it was — its navigation state is independent. This is the key difference from nested layouts. Nested layouts rerender from the changed segment outward. Parallel routes don't affect each other. User is at / (children shows home, sidebar shows default nav) User navigates to /setti

This week's tooling news clusters around two themes that don't usually arrive together: token-efficient multimodal reasoning and infrastructure-level agent safety. The Inkling model launch dominates the conversation, but the more quietly significant story is Microsoft and Vercel independently shipping primitives that make running untrusted agent code and managing agent credentials meaningfully less dangerous. Here's what's worth your attention. Inkling mixture-of-experts model enables token-efficient reasoning Inkling is a decoder-only MoE with 1T total parameters and 40B active per token, native multimodal I/O (text, image, audio), and a reasoning_effort API parameter that lets you tune compute depth per request. It's live on Together Serverless today with no capacity queue. The practical upside is architectural simplification. If you're currently chaining a vision model, a transcription service, and a text LLM into a single reasoning pipeline, that's three API clients, three failure surfaces, and three billing relationships. Inkling collapses that into one endpoint. The reasoning_effort knob is the other interesting piece—per-request control over inference depth means you can spend tokens proportionally to task complexity rather than paying full reasoning cost on every call. The caveat: exact reasoning_effort parameter values aren't fully documented yet. Don't hardcode assumptions about accepted values into production before checking the official docs. Verdict: Evaluate. Worth spinning up against your current multimodal workload to benchmark latency and cost. Hold production migration until parameter documentation stabilizes. Inkling open model handles image, text, and audio natively This is the self-hosted side of the same model. The 1T-parameter MoE ships with day-0 support in transformers 5.14.0+ and SGLang, plus llama.cpp quantizations for teams that want to run trimmed variants. The catch is hardware: full NVFP4 precision requires 600GB VRAM; BF16 needs 2TB.

Just shipped Timezone Convert API — DST-aware IANA timezone conversion. Free, no key, CORS-enabled. Endpoints GET /convert?time=2026-07-16T09:00&from=Asia/Kolkata&to=America/New_York GET /now?zone=Europe/London GET /offset?zone=Pacific/Auckland GET /diff?a=Asia/Tokyo&b=Asia/Kolkata GET /zones (400+ IANA zones) Try it curl "https://timezone-convert.techtenstein.com/now?zone=Europe/London" Live at https://timezone-convert.techtenstein.com — OpenAPI 3.1 spec at /openapi.json . MIT.

What Is My IP Address? IPv4 vs IPv6 Explained for Developers If you've ever debugged a CORS error, set up an IP allowlist, or wondered why req.ip returned something weird in your Express logs, you've run into the same question from a different angle: what actually is an IP address, and which one is "mine"? fastestchecker.com This post breaks down IPv4 vs IPv6, public vs private IPs, and how to reliably detect a user's IP address in your own code — plus a fast way to check yours right now. fastestchecker.com TL;DR IPv4 addresses look like 192.168.1.1 — four numbers, 0-255, separated by dots. There are about 4.3 billion of them, and we've run out. IPv6 addresses look like 2001:0db8:85a3::8a2e:0370:7334 — a much larger address space designed to replace IPv4. Your device usually has a private IP (local network) and shares a public IP (internet-facing) with everyone else on your router. You can check your current public IP instantly with a tool like FastestChecker's IP Checker — useful for confirming what your server or API actually sees. > IPv4 vs IPv6 : What's the Actual Difference IPv4 IPv4 has been the backbone of the internet since the 1980s. It's a 32-bit address, which caps the total number of unique addresses at roughly 4.3 billion. Given how many devices are online today, that pool has been effectively exhausted for years — which is why NAT (Network Address Translation) exists: it lets an entire household or office share one public IPv4 address. Example IPv4: 203.0.113.42 IPv6 IPv6 uses 128-bit addresses, which gives it an address space so large it's effectively unlimited for practical purposes (2^128 addresses). It was designed specifically to solve IPv4 exhaustion, and adoption has been climbing steadily — most major cloud providers and mobile carriers support it by default now. ** Example IPv6:** 2001:0db8:85a3:0000:0000:8a2e:0370:7334 Quick Comparison IPv4IPv6Address length32-bit128-bitFormatDotted decimal (192.168.1.1)Hexadecimal, colon-separatedTotal addre

Every time you open a website, sign into an application, or send a request to an API, a server responds with a small but powerful message: an HTTP status code. Most developers encounter these codes every day. But behind every number is a story about what happened between the client and the server. HTTP status codes are part of a standardized response system defined by RFC 9110. They help applications understand whether a request succeeded, needs attention, or failed. The HTTP Status Code Families 🟢 2xx — Success The request was received, understood, and completed successfully. Examples: 200 OK — The request succeeded. 201 Created — A new resource was successfully created. These responses tell the client: everything worked as expected. 🔵 3xx — Redirection The requested resource requires an additional step. These responses help clients find another location or use a different version of a resource. Examples include redirects and cache-related responses. 🟠 4xx — Client Errors Something is wrong with the request sent by the client. Common examples: 400 Bad Request — The request format is invalid. 401 Unauthorized — Authentication is required. 403 Forbidden — The client does not have permission. 404 Not Found — The requested resource does not exist. In simple terms: the problem is usually on the client side. 🔴 5xx — Server Errors The request was valid, but the server failed while processing it. Example: 500 Internal Server Error — An unexpected error occurred on the server. These responses indicate problems within the server or its internal systems. Why HTTP Status Codes Matter HTTP status codes are not just numbers. They are: The language of web communication Essential signals for API behavior Valuable tools for debugging and monitoring A foundation of backend engineering and distributed systems Understanding status codes helps developers build better applications, diagnose problems faster, and design more reliable systems. A single three-digit number can reveal what ha

Most Android media apps solve only one part of the problem. A video player plays videos. A music player handles songs. A PDF reader displays documents. A text-to-speech app reads text. A vault hides private files. But real media libraries are not separated that neatly. My phone may contain downloaded movies, music, lecture notes, ebooks, PDFs, recordings, subtitles, and files I do not want exposed in the normal gallery. Constantly moving between different apps creates friction and breaks playback or reading continuity. That is why I built Nexo Player : an offline-first Android media app that brings local playback, document reading, audiobook generation, text-to-speech, and private storage into one experience. What Nexo Player does Nexo Player currently supports: Local video and audio playback PDF and EPUB reading PDF, EPUB, and text narration Background audiobook generation MP3, M4B, and ZIP export Multiple narrator voices Resume playback and reading progress Equalizer, sleep timer, subtitles, and playback-speed controls Picture-in-Picture Secure Vault protected with PIN or biometrics The app is built natively for Android using Kotlin , Jetpack Compose , and Android Media3 . The main product idea: local-first media The core rule behind the app is simple: A local file should remain local unless the user explicitly chooses otherwise. This rule influenced the entire product. Opening a downloaded video should not require an account. Reading a PDF should not require uploading it to a server. Listening to a generated audiobook should remain possible without a permanent internet connection. Private files should not leak into normal galleries, thumbnails, or recent-history screens. Offline-first is not only about caching data. It means the main workflow must remain useful, understandable, and recoverable without depending on the network. Building the playback layer For video and audio playback, I used Android Media3 as the foundation. The visible player looks simple, but a

Hi DEV community! 👋 I'm Widodo, an independent web and mobile app developer. In my day-to-day workflow—whether I am developing mobile apps, structuring databases, or setting up serverless continuous integration pipelines—I constantly rely on quick online utilities. Things like formatting code, generating QR codes, or stripping metadata from images. But I realized a massive flaw in the current ecosystem of free online tools: Privacy and Performance. If you search for a "Free EXIF Data Remover" or "JSON Formatter," 90% of the top results force you to upload your sensitive files to their remote servers just to perform a basic operation. Not only is this a massive privacy risk, but it also introduces unnecessary latency. Since my core development philosophy has always leaned towards offline-first architectures and minimal server dependencies, I decided to build my own solution. Enter Ic2Share.com . It is a growing directory of web utilities built on a strict zero-server-upload architecture. Everything executes instantly within the user's browser. Here is a breakdown of how I built some of the tools and the client-side APIs powering them. Secure EXIF & Metadata Stripper (Canvas API) Most EXIF strippers use backend libraries (like PHP's exif_read_data or Python's Pillow). I wanted this to happen entirely offline so users wouldn't have to upload their personal photos. The solution? HTML5 Canvas Re-rendering. When a user drops an image, the browser reads it via the FileReader API. I then draw that image onto a hidden element. When you export the canvas back to a Blob using canvas.toBlob(), the browser automatically discards all original EXIF headers (including the exact GPS coordinates and camera models). It is fast, secure, and costs $0 in server compute. The Online Teleprompter (requestAnimationFrame) I built an auto-scrolling teleprompter for video creators. Initially, I thought about using CSS transitions or setInterval for the scrolling text. However, CSS can cause jit

GitHub's July 13, 2026 changelog lists REST API management for secret scanning custom patterns. That makes a reviewed configuration-as-code workflow possible. Primary source: GitHub Changelog archive, July 2026 . Follow the July 13 entry to the current REST documentation before implementation. The transport below is an unexecuted design. Endpoint paths, payload fields, permissions, pagination, and plan availability must come from the linked official API reference—not from guessed examples. Define the sync contract A safe synchronizer should: read desired patterns from version control; fetch the remote collection; match each pattern by a stable identity; emit create, update, unchanged, and delete actions; refuse deletion unless explicitly enabled; apply only after the plan is reviewed. patterns.json -> normalize -> diff remote -> plan.json -> approval -> apply Keep API-specific payloads opaque to the diff engine: { "patterns" : [ { "stableKey" : "internal-service-token-v1" , "remoteId" : "SET_AFTER_CREATION" , "payload" : { "REPLACE_WITH_DOCUMENTED_FIELD" : "REPLACE_WITH_REVIEWED_VALUE" } } ], "allowDelete" : false } Placeholders are deliberate. A secret detector's regex fields and matching semantics are security contracts and should never be invented from a blog post. Build a deterministic planner export function plan ( desired , current ) { const remote = new Map ( current . map ( x => [ x . id , x ])); const changes = []; for ( const item of desired . patterns ) { if ( ! item . remoteId ) { changes . push ({ action : " create " , key : item . stableKey }); continue ; } const found = remote . get ( item . remoteId ); if ( ! found ) throw new Error ( `Missing remote pattern ${ item . remoteId } ` ); const same = JSON . stringify ( canonical ( found )) === JSON . stringify ( canonical ( item . payload )); changes . push ({ action : same ? " unchanged " : " update " , key : item . stableKey }); remote . delete ( item . remoteId ); } for ( const orphan of remote . valu

I wanted to play with AI image generation without paying for Midjourney or dealing with Discord bots. So I built SnapShift — a free web tool that transforms photos into artwork in seconds. What it does: Upload any photo (portrait, pet, landscape, product) Pick from 50+ styles — cyberpunk, anime, oil painting, Ghibli, movie posters, 3D figurines, and more Download in 1K or 2K quality No signup, no limits, completely free Tech stack: static site on GitHub Pages, AI generation via Agnes API with Cloudflare Worker proxy. Try it: https://snapshit.fun Would love to hear what other styles you'd like to see!

Every "build an AI app" tutorial stops at the demo. Prompt goes in, response comes out, ship it. Nobody covers the part where that demo has real users and you're staring at a Gemini or OpenAI invoice trying to figure out which feature did that. I've spent the last several months building the AI layer for a consumer app that fires vision and language calls on almost every user action. Not a chatbot getting occasional traffic. A product where the model call basically is the product. Here's what I actually had to build, in the order I had to build it. Four problems, not one Cost first, obviously. Tokens are metered, and past a certain volume, calling the model on every request means paying for answers you already gave someone five minutes ago. Latency next. A cache hit lands in milliseconds. A cold model call takes seconds. Users feel that, especially anything camera-driven where they're staring at a loading spinner over their own kitchen counter. Reliability too. Your provider will have an outage or a degraded day at some point. Not if, when. And blast radius. One bug, one bot, one traffic spike, and a $50/day bill becomes a $5,000/day one while everyone's asleep. You don't see any of this in a demo. It shows up with real traffic, and by then it's a lot more expensive to fix than it would've been to build right the first time. Cache on what the query means, not its exact string Key your cache off the literal request text and you've built something close to useless. "What can I make with chicken and rice" and "chicken and rice, what should I cook" mean the same thing and share almost no characters. So embed the query, run a vector similarity search against everything already answered, and if something clears a high threshold, serve that instead of paying for another call. I use 0.95 cosine similarity as the bar. async function checkSemanticCache(embedding: number[], taskType: string, threshold = 0.95) { const { data } = await db.rpc("find_similar_response", { query_emb

Não é novidade para ninguém que estamos passando por uma transformação na área de desenvolvimento de software, em que a IA está assumindo diversas atividades. E isso me faz pensar: o que vamos medir, ou o que teremos como parâmetro para qualidade de software daqui pra frente? É sobre isso que vou falar neste texto. Antes das métricas: entenda o momento do seu time Antes de entrarmos nas métricas em si, precisamos entender o momento em que o nosso time está. É muito fácil eu simplesmente jogar métricas aqui e você aplicá-las ao seu time de maneira automática — mas será que elas fazem sentido para o seu contexto? Uma coisa que eu falo bastante aos meus alunos da mentoria que dou na He4rt Developers é: pra que eu quero isso? Softwares representam necessidades do mundo real, logo, medir o sucesso e a qualidade deles vai depender muito das necessidades que eles buscam suprir. Partindo agora para as métricas, eu gosto de dividi-las em dois grupos: Métricas para stakeholders Métricas para o time Qualidade de software não se resume a número de bugs — ela se aplica tanto em como o software é recebido pelo cliente final, quanto em como ele é desenvolvido. Métricas para stakeholders Uma coisa que eu aprendi neste tempo na empresa em que tenho atuado, principalmente com a transformação digital, é que mostrar número de bugs abertos ou resolvidos não mostra para o público o que realmente importa: como está a qualidade do produto. E, para me ajudar nisso, eu sempre tento me colocar no lugar de um cliente que não tem conhecimento profundo sobre o ciclo de desenvolvimento de software. A primeira coisa que eu gostaria de ver quando um QA, ou o time, vier me mostrar os resultados de uma sprint ou de um quarter é: quantos problemas eu tenho em produção — mas não só isso, quanto tempo tenho levado para resolvê-los. Mean Time to Resolve/Repair (MTTR) Essa é a famosa métrica que vai mostrar o tempo que leva desde que o problema é identificado até ele ser resolvido em produção. Dependendo

🔒 ATLOCK v4 — I stopped trusting my own app's encryption, so I rebuilt it TL;DR — ATLOCK is a...

There is no reliable “magic button” that turns an arbitrary HTML website into a clean, responsive, fully editable Elementor project. At first glance, converting an HTML website to WordPress sounds like a file-format conversion. You already have the design, text, images, CSS, and JavaScript. Why not upload everything, click Import, and continue editing the page in Elementor? The problem is that HTML and Elementor do not describe a website in the same way. An HTML page is the final output: a tree of elements styled by CSS and controlled by JavaScript. Elementor stores an editable model made of containers, widgets, global styles, responsive settings, and WordPress-specific data. A browser can render both results so that they look similar, but their internal structures can be completely different. What automated converters can do Modern converters and AI tools can read HTML, identify visual sections, and generate a rough WordPress layout. They are useful for prototypes and simple landing pages. Some tools can also copy styles or place the original code inside an HTML widget. But visual similarity is not the same as a production-ready Elementor website. A converted page may look acceptable on one screen while still containing: deeply nested containers; duplicated CSS; fixed pixel dimensions; broken mobile layouts; inaccessible elements; content that a client cannot edit. Forms, menus, sliders, animations, dynamic content, and custom JavaScript usually require separate work. The real challenge is rebuilding meaning, not copying pixels A human developer does not only see a rectangle with text. They need to decide whether it should become a Heading widget, a reusable global component, a dynamic WordPress field, or part of a template. The same applies to the rest of the page: Navigation must work with WordPress menus. Forms need validation, delivery actions, and spam protection. Repeated content may need posts, custom fields, or WooCommerce products. Fonts, colors, spacing,

Disclosure: this is a write-up about my own side project — a combat analytics tool for AION 2. No affiliation with the game's publisher. Links at the end. Architecture A Windows desktop app: Rust backend + Tauri v2 webview UI . It passively captures the game's TCP traffic (npcap), reassembles streams, parses the game's undocumented binary protocol, feeds a combat model (damage, heals, buffs, deaths, boss detection), and pushes aggregates to a small JS frontend. Nothing touches the game client — no injection, no memory reading. If the packet didn't say it, we don't know it. Pain #1: the protocol is a moving target Nobody hands you a spec. The protocol is varint-heavy, partially compressed, and changes with game patches. You end up doing packet archaeology: capture a fight, stare at hex dumps, correlate "I pressed this skill at 19:32:04" with byte patterns, build a parser, and then — the fun part — keep it alive after every patch , usually reverse-engineering the diff within hours because your users' raids are tonight, not next week. One hard-won lesson: log everything behind toggleable trace categories. Our tracing setup keeps hot-path log callsites at literally zero cost when disabled (Rust tracing with Interest::never() + atomic per-category flags), so a user can flip a "Trace: Packets" checkbox, reproduce a bug, and send a log that actually contains the bytes we need. Pain #2: entity identity is a lie The single hardest correctness problem wasn't parsing — it was identity . A player is not one ID: your character has a stable "owner" entity that carries your buff bar, your damage lands under a transient combat entity whose ID changes between pulls, leave the dungeon and the game re-binds you to a brand-new ID, names arrive from different packets than damage, sometimes seconds later, sometimes never (mid-fight app start). Get any of this wrong and a healer's healing lands on a ghost row, or a player's buffs vanish from the saved fight because their ID was recycled 7

After I published my last article about building a Chrome extension that speaks browser notifications aloud, a commenter asked a question I didn't have a good answer to. He pointed out that a lot of web apps — Slack, Gmail, most modern tools — fire their notifications from a service worker via registration.showNotification() , not from the page's JavaScript context. My MAIN world override of window.Notification would never reach those. He was right. And I told him I'd look into it. I spent a week researching whether there was any way to close that gap. There isn't. But the reason why is more interesting than a simple "no." Two ways a website can show you a notification When a website sends you a browser notification, it can do it in one of two ways. The first is the constructor path. The page's own JavaScript calls new Notification("You have a message") directly. This is common for in-tab alerts, real-time updates when you're actively on the site, or any notification triggered by something you just did. The second is the push path. The browser receives a push event from the website's server, wakes up the website's service worker in the background, and the service worker calls self.registration.showNotification() from inside its own scope. This is what happens when Slack notifies you of a new message while the tab is closed or backgrounded. The page never runs. No page JavaScript ever fires. My extension catches the first path. The MAIN world content script overrides window.Notification before any page code runs. But the service worker never touches the page's window. It has no window . It runs in a completely isolated thread, completely separate from the page, and calls showNotification on itself. The override is never reached. Why can't the extension reach the service worker? This is the part that took me a week to fully accept. Chrome extensions can inject content scripts into web pages. They can run code in the MAIN world or the ISOLATED world of a page. They can