标签：#ev

We had a checkout test at my last job that everyone called "the coin flip." Green for a week, red twice on a Tuesday, green again. Someone eventually wrapped it in a retry and it sat like that for eight months before anyone looked at it again. Turned out the real bug was a webhook that occasionally fired before the order record finished writing to the DB - a two-hundred-millisecond gap that only showed up under load. The test wasn't broken. It was the only thing in the entire pipeline that noticed. That's usually the story. Someone blames the test - bad selector, missing wait, a sleep(2) some intern left in there three years ago, and half the time they're right. But when a test flakes repeatedly and nobody can explain why, the test is rarely the actual problem. It's just the part of the system rude enough to say something. A few places I keep finding the real cause hiding. Tests that quietly depend on each other Test A writes a row, Test B reads it and never knew it needed to. Run B by itself, it passes. Run the suite in a different order, or in parallel, and B fails for no reason anyone can point to. I've lost a full afternoon to this exact thing more than once - a cache value from Test 12 leaking into Test 47. The actual fix is annoying and unglamorous: every test gets its own fixtures, its own scoped data, no assumptions about what ran before it. If your suite only goes green in one specific order, you don't have a flaky test. You have an undocumented dependency graph, and it's going to bite someone eventually. The app is racing, not the test Click a button, immediately assert on the result - that's a bet that the UI update lands the instant the click handler returns. It usually does, on your machine, on a good day. Add a debounce, a background job, or just enough network latency and that bet stops paying off. This one's frustrating because the test isn't being paranoid. The app genuinely has a race condition. The test just runs the interaction often enough, acro

* *The purpose of this light version threat model is to demonstrate how STRIDE can be applied to an ECG device. It is intended for readers learning system decomposition and threat modelling techniques. The example includes a simplified set of components, threats, and mitigations for educational purposes and is not intended to represent a comprehensive medical device cybersecurity assessment or any regulatory submission. **Assumption: This example models a typical ECG device, which may include network connectivity in a clinical environment. Trust Boundaries: Trust boundaries exist between the ECG device, hospital network, and external clinical systems. System Definition: ECG is the abbreviation for an Electrocardiogram. It is used to detect electrical activity of the heartbeat in the form of P wave, QRS complex and T wave to identify and diagnose irregularities in heartbeat. Electrodes are placed on patient’s limbs and chest to measure the electrical potentials. It translates tiny electrical signals into digital wave patterns. These waveforms are used by the doctors to evaluate the heart rhythm and check for cardiac damage. Components • Electrodes • Lead wires • Amplifier and filters • Analogue-to-Digital Converter (ADC) • Main processing unit • Display/printer • Local storage • Network interface (Ethernet/Wi-Fi/Bluetooth), if supported. Data Flow Diagram: Electrodes → Lead wires → Amplifier and filters → Analogue-to-Digital Converter (ADC) → Main processing unit → Display / Printer / Local storage / Network interface (if supported) |TRUST BOUNDARY|→ Electronic Health Record (EHR) / Clinical Information System 2. STRIDE Threats: Threats Description Spoofing in general ** - Spoofing is the act of impersonating a legitimate user, device, or system to gain unauthorized access to resources or services. Violates authentication. * Spoofing in ECG * - An attacker may impersonate an authorized clinician, connected medical device, or trusted clinical system to gain unauthoriz

Also available in Español The Problem A team ships clean CSS. Every selector is deliberate. Every class name means something. Code review catches the sloppy stuff before it merges. Six months later, someone adds !important to fix a button. A year later, three more !important s exist — each one written to fix the last one. Nobody planned this. Nobody stopped caring. The team is exactly as disciplined as it was on day one. The codebase didn't get sloppy. The architecture never had a way to stay clean. That's the part worth sitting with. Specificity problems get treated as a discipline failure — bad naming, careless nesting, someone in a hurry. But teams with excellent discipline hit this wall too. Given enough time and enough contributors, almost every CSS codebase drifts toward the same place: overrides stacked on overrides, each one a patch for the last. Something structural is happening here. Not a people problem. A tooling gap. Why the Problem Exists CSS specificity was built to answer one narrow question: if two rules target the same element, which one wins? The browser calculates an answer. Count the IDs. Count the classes and attributes. Count the elements. Higher count wins. If the count ties, whichever rule appears later in source order wins. That's the entire mechanism. It's fast, deterministic, and was never meant to do more than that. Notice what it doesn't ask. It doesn't ask whether a rule is a foundational default or a one-off exception. It doesn't ask whether a rule was written to be overridden, or written to never be touched again. It doesn't know the difference between a base style and a utility class — it only knows how many selectors each one used. Specificity resolves conflicts. It was never given a way to encode intent. That gap is old. It predates component-based frontend architecture, design systems, and teams of a hundred engineers touching the same stylesheet. The web platform gave developers a scoring system for which rule wins by the number

I run a music metadata API as a solo developer. Under it sits a catalog of 90M+ recordings aggregated from six platforms: Spotify, Apple Music, Tidal, Beatport, Discogs, and MusicBrainz. The core job is cross-referencing: take whatever you know about a track (an ISRC, a platform ID, or a messy "artist + title" string from a DJ export) and resolve it to one canonical recording with everything else attached. When I started, I assumed this was mostly a plumbing problem. Every platform has an API, recordings have a standard identifier, join on it, done. Almost none of that survived contact with real data. This post is the parts I had to learn the hard way: why one song legitimately carries many ISRCs, how fuzzy matching on artist and title actually has to work, why recording-to-composition mapping is many-to-many in both directions, and the failure modes I now check for routinely. The ISRC almost solves it The ISRC (International Standard Recording Code) is a 12-character identifier for a specific recording. Daft Punk's "One More Time" is GBDUW0000053 : country prefix GB , registrant code DUW , year 00 , then a designation number. Every commercially released recording is supposed to have one, and most platforms expose it. So the naive architecture writes itself: one isrc column on the track table, join all six platforms on it, ship. That was my first schema, and it was wrong in a way that took a while to surface. Labels mint a fresh ISRC for every commercial variant of a recording. The radio edit gets one. The extended mix gets one. The 2001 release and the anniversary remaster get different ones. A reissue through a new distributor often gets one even when the audio is bit-identical. Regional releases sometimes get their own. None of this is an error; it is how the system is designed to work, because each of those is a distinct commercial product even when it is the same performance. The consequence: one canonical recording legitimately carries many ISRCs, and differen

Having a platform is not enough; the real challenge is ensuring that it is understandable, usable, and actually adopted by its users. A capability is done when it can be reliably used by others. To evaluate progress, you can ask yourself “Is this being used?” and “Does it reduce friction for users?” This can help align development work with actual user value rather than delivery, By Ben Linders

Samsung dared to bring 6K to the world of gaming monitors before our PCs were truly ready for it.

Shark’s new PowerDetect Speed is lighter and more affordable than the original, but still managed to ace most of my vacuum tests.

Parte 13 de la serie Fitz . Se abre el capítulo del frontend: Fitz compila componentes .fitzv a WebAssembly, y este es el dev loop que hace que editarlos se sienta instantáneo — la misma experiencia "guardar y verlo" que te da Vite, sobre un lenguaje que compila a binario nativo. El setup: un lenguaje compilado con frontend Fitz es un lenguaje compilado — HTTP, async, Postgres, JWT viven en la sintaxis y emite un binario nativo vía Rust. La historia del frontend es un formato de componentes single-file, .fitzv (state + events + <template> , al estilo Vue/Svelte), que compila a WebAssembly : fitz build --bin web --target wasm-client # → target/wasm/web/{web.js, web_bg.wasm} Sin npm install , sin config de bundler, sin framework externo — el componente se vuelve un bundle WASM autocontenido (el demo del contador pesa 11.4 KB gzipped). Acá viene la objeción refleja: compilado = feedback lento . Editás, esperás una compilación entera, refrescás el browser a mano. Es lo opuesto a lo que un loop de frontend debería sentirse. Por eso Fitz tiene fitz dev . El loop Apuntá fitz dev a un bin wasm-client y deja de ser un compilador para ser un dev server: fitz dev # sirve en http://127.0.0.1:1234/ Qué hace: Rebuild incremental con wasm-pack --dev (sin wasm-opt ), reusando un crate estable así la cache de cargo queda caliente — el primer build compila las deps, cada save siguiente es de ~1-2 segundos . Un dev server que sirve el root de tu proyecto como python -m http.server : tu index.html , tu CSS, el bundle en target/wasm/<bin>/ . ¿Sin index.html ? Genera uno mínimo en el punto de mount . Auto-refresh del browser por WebSocket : guardás un .fitzv / .fitz / fitz.toml y la página se recarga sola. Sin F5 a mano. Guardás, y ~2 segundos después el browser muestra el cambio. En un lenguaje compilado. El detalle que importa: el state sobrevive el reload La mayoría de los hot-reload pierden tu estado en un reload completo — ibas tres clicks adentro de un contador, editás el template,

Every automated Solidity security tool has the same disease: it cries wolf. Run one on an audited protocol and you get 600 "findings," 98% of which are noise. The tragedy isn't the wasted time — it's that after the tenth false alarm, you stop reading. The one real bug then hides in the noise. I spent this week hand-verifying every flag my scanner produced against production protocols (Ember, Euler, Liquity, Arcadia, Rubicon, and more). Every single one was a false positive. Here are five of the most common classes, why a naive tool reports them, and the deterministic check that kills each — no AI guesswork required. 1. The "spec violation" that's just... the design A tool reads a spec or a NatSpec comment — "only the rate manager can update the rate" — and flags the function as a violation because it "can't prove" the restriction. On Ember's vaults this produced a CRITICAL : function pause() external onlyGuardian { ... } function processWithdrawalRequests(uint256 n) external onlyOperator { ... } function setMaxTVL(uint256 v) external onlyAdmin { ... } Every one is a correctly access-controlled, intended feature. The tool listed the protocol's own role design and called it a bug. The fix: before emitting, find the affected function and check whether the restriction is actually enforced ( onlyX / onlyRole / require(msg.sender == ...) ). If it is, it's the design, not a violation. If there's genuinely no guard, it still fires. Safe direction. 2. Fee-on-transfer on a token that can't be fee-on-transfer A vault does token.transferFrom(user, address(this), amount) and uses amount for accounting. Fee-on-transfer tokens arrive short, so the internal books inflate → the tool screams "insolvency." Real? Only if users can deposit arbitrary tokens. Two very common cases where they can't: // (a) the deposit is onlyOwner — the owner picks what enters function deposit(address token, uint amount) external onlyOwner { ... } // (b) the token set is curated by a registry / whitelist u

TL;DR — A Fitz LiveViews component is a single .fitzv file. The interesting part: the same file compiles to two different targets with no rewrite. Server-rendered (SSR) — the server holds the state, renders HTML, and patches the browser over a WebSocket; best for shared, DB-driven, multi-user state. Client-WASM — the same component compiles to WebAssembly and runs entirely in the browser; best for offline, zero-round-trip widgets. This post builds a counter and ships it both ways. (Part 2 of the FitzLiveViews series — start here if you missed part 1.) In part 1 I made the pitch: real-time UI in one language, no JavaScript build. Now let's build something and ship it two ways from the same source. The component Here's a counter as a single-file component ( .fitzv ) — state, events, template, style: component Counter { state { count: Int = 0 } event increment() { count = count + 1 } event decrement() { count = count - 1 } event reset() { count = 0 } <template> <div id= "counter-app" > <p> Count: {count} </p> <button @ click= "increment" > +1 </button> <button @ click= "decrement" > -1 </button> <button @ click= "reset" > Reset </button> </div> </template> <style scoped > #counter-app { padding : 1.5rem ; font-family : system-ui ; } button { padding : 0.5rem 1rem ; margin : 0 0.25rem ; } </style> } state is the reactive data. Each event handler mutates it directly — no setState , no reducers. <template> is real markup; {count} interpolates and auto-escapes. @click="increment" binds a DOM event to a handler. <style scoped> is CSS namespaced to this component. If you've written Vue or Svelte, this is familiar — the difference is what happens next. Target 1 — server-rendered (over a WebSocket) The SSR target is the default. The component runs on the server; a tiny main.fitz wires it into an HTTP route (first paint) and a WebSocket route (the live layer): from fitz_liveviews import html_response , live_layout , LiveFrame , diff_html , component , dispatch_component_events

Hey everyone! 👋 I'm a developer who got tired of visiting 10 different websites to do simple tasks like formatting JSON, compressing images, or generating QR codes. So I built DevToolBox — a single place with 15+ free online tools, all running in your browser with no sign-up required. 👉 https://toolbox-site.asia Why I Built This Every time I needed a quick tool, I'd end up on a site full of ads, popups, or "create an account to continue" walls. I wanted something clean, fast, and respectful of users' time and privacy. The idea was simple: one website, all the tools you need, zero friction. What's Inside Here are some of the tools available: Developer Tools: JSON Formatter & Validator — Format, validate, minify JSON with syntax highlighting Base64 Encoder/Decoder — Encode and decode Base64 strings instantly UUID Generator — Generate v4 UUIDs in bulk 🔧 Unix Timestamp Converter — Convert between timestamps and human-readable dates 🔧 Regex Tester — Test regular expressions with real-time matching 🔧 Markdown Preview — Write Markdown and see the output live Hash Generator — MD5, SHA-1, SHA-256, SHA-512 🔧 Diff Checker — Compare two texts side by side Daily Tools: 🖼️ Image Compressor — Compress images right in your browser Image Format Converter — Convert between PNG, JPG, WebP Password Generator — Create strong, customizable passwords 📱 QR Code Generator — Generate QR codes with custom colors BMI Calculator — Calculate Body Mass Index 🎂 Age Calculator — Calculate exact age from birth date 📝 Word Counter — Count words, characters, sentences 📏 Unit Converter — Length, weight, temperature, and more How It's Built The whole site is a Vue 3 + TypeScript + Vite project with Tailwind CSS for styling. Everything runs client-side — no data is ever sent to a server, which means your data stays on your device. Key tech: Vue 3 with Composition API TypeScript for type safety Vite for blazing fast dev experience Tailwind CSS for styling Vue Router with history mode for clean URLs vue-i1

Fire toast notifications in Laravel from PHP, Alpine and plain JavaScript with one notify call, plus positioning, auto-dismiss and grouping, and no CSS framework in your bundle Here is a problem I hit on every project. A Livewire action finishes and I need to tell the user it worked, but the toast library I grabbed assumes Tailwind, or ships its own huge runtime, or only works from JavaScript when half my triggers actually live in PHP. Wiretoast is my answer to that, and this post is the fast path to using it. The problem You want to fire a toast from PHP, from Alpine, and from plain JavaScript with the same call, and you do not want to drag a CSS framework into your bundle to get it. How to install Start with Composer, then wire up the assets. I bundle with Vite, so I import the package CSS and JS into my entry files. // resources/js/app.js import ' @wiretoast/js/wiretoast.js ' ; import ' @wiretoast/css/wiretoast.css ' ; That @wiretoast alias is optional, and you set it up by pointing Vite at the vendor resources folder so the imports stay short. // vite.config.js resolve : { alias : { ' @wiretoast ' : path . resolve ( __dirname , ' vendor/edulazaro/wiretoast/resources ' ), }, }, Then the component goes once into your layout, and on the Vite path it injects no tags of its own. <x-wiretoast /> How to use it The fastest possible win is a one-liner in a Livewire component right after something succeeds. The helper is a component macro named notify , registered for you when Livewire is present. $this -> notify ( 'Profile updated' , 'success' ); Under the hood that dispatches a notify browser event, which is exactly what Alpine fires too. So the same toast from a purely front-end button looks like this. <button @ click= "$dispatch('notify', { message: 'Copied', type: 'info' })" > Copy link </button> The five types you can pass are success , error , warning , info and neutral , and a message can be a plain string or an object with a title and a message when you want a he

TL;DR — composer require bouda/laravel-make-pattern → php artisan make:pattern Post → 9 consistent files in seconds. DDD-ready, rollback included, every stub is yours to override. The problem I kept running into Every new Laravel project starts the same way. You know the architecture you want: Repository, Service, Controller, some Form Requests, a Resource, a Policy, a test. You've written this stack dozens of times. And every time, you either: Copy-paste from a previous project — and immediately introduce inconsistency between how PostRepository is structured vs CategoryRepository . Write everything from scratch — which is slow and error-prone. Use make:model -a — which gives you the Model, Migration, Factory, Controller, but nothing about repositories, services, or policies wired together. None of these feel like the right answer when you want a clean, layered architecture. So I built laravel-make-pattern . What it does One command: php artisan make:pattern Post Generates 9 files : app/Models/Post.php app/Repositories/Contracts/PostRepositoryInterface.php app/Repositories/PostRepository.php app/Services/PostService.php app/Http/Controllers/PostController.php app/Http/Requests/PostStoreRequest.php app/Http/Requests/PostUpdateRequest.php app/Http/Resources/PostResource.php app/Policies/PostPolicy.php tests/Feature/PostTest.php All consistently named, all using the same conventions, all generated from stubs you own and can override . The generated code Here's what the repository looks like out of the box: <?php namespace App\Repositories ; use App\Models\Post ; use App\Repositories\Contracts\PostRepositoryInterface ; class PostRepository implements PostRepositoryInterface { public function all () { return Post :: all (); } public function find ( string $id ) { return Post :: findOrFail ( $id ); } public function create ( array $data ) { return Post :: create ( $data ); } public function update ( string $id , array $data ) { $model = $this -> find ( $id ); $model -> u

Building software is easy. Building something people actually want to use is the hard part. For the last few months, I've been working on CV Mimarı, a resume builder designed to make creating ATS-friendly resumes simple, fast, and accessible. 👉 https://cvimarı.xyz My goal wasn't to build "another resume builder." I wanted to remove the usual pain: confusing editors unnecessary account creation complicated formatting resumes that look good but fail ATS screening The idea was simple: Spend your time improving your experience, not fighting with Word formatting. What it currently does Today the project includes: Resume templates AI-powered resume improvements ATS score checking Resume optimization Cover letter generation Resume examples and guides PDF export Modern responsive interface I tried to keep everything clean and straightforward instead of adding dozens of unnecessary options. Sometimes software tries so hard to become "professional" that it forgets people just want to click a button and move on with their lives. Why I'm posting here I'm not looking for compliments. I'm looking for problems. Imagine you were using this to apply for your next job. I want brutally honest feedback. Things like: Is something confusing? Does the UI feel slow? What would make you leave the site? Which feature feels unnecessary? What's missing? Would you actually trust this with your resume? If something is bad... Tell me. If something is ugly... Tell me. If something makes you want to close the tab... Definitely tell me. The biggest challenge One thing I've learned is that building features is much easier than understanding users. I can spend a weekend implementing a new AI feature. But discovering why someone leaves after 20 seconds? That takes dozens of real users. That's why I'm asking for feedback before continuing to add more features. The roadmap Some ideas I'm considering: More resume templates Better AI suggestions Portfolio integration LinkedIn import Resume version history

4-minute demo: AI agent investigates a P1 latency spike, sets up prevention automation, and documents tribal knowledge. Cost: $0.04 per incident.

If your Sentry bill is climbing faster than your signups, the usual cause isn't more users — it's more events per user . Error trackers meter on event and transaction volume, and a single bad deploy, a noisy third-party SDK, or one uncaught exception in a hot loop can burn a monthly quota in an afternoon. Before you migrate, the honest first move is to fix what you're sending. If you've already done that and the economics still don't work, GlitchTip, self-hosted Sentry, Bugsnag, Rollbar, and an OpenTelemetry-based stack are the realistic exits — each with a different trade. Why does the bill scale with events instead of users? Error tracking is priced on the thing that's expensive to store and index: individual events. Sentry, Rollbar, Bugsnag, and most SaaS competitors bill primarily on captured errors (and, increasingly, performance/tracing spans and session replays as separate meters). A product with 500 daily active users can generate millions of events if one component throws in a render loop or a retry storm hammers a failing endpoint. That decoupling is the whole problem. Your revenue tracks users; your observability bill tracks failures and instrumentation depth . When you add performance monitoring and session replay — both of which emit far more events than plain error capture — the meters multiply independently of how many humans are actually using the app. The takeaway: before you evaluate a single alternative, confirm whether you have a pricing problem or a volume-hygiene problem, because migrating won't fix a firehose. Can you cut the bill without switching tools? Often, yes — and it's worth an afternoon before any migration. The levers that matter most: Sample transactions, not just errors. Performance/tracing volume is usually the bigger line item once enabled. A tracesSampleRate of 0.1 or lower is fine for most apps; you rarely need every transaction. Filter noise at the SDK, before it's billed. ignoreErrors , denyUrls , and beforeSend let you drop

Synthetics' Last Cradle is a multi AI agent game designed to showcase multi agent adversarial collaboration, featuring agents dynamically finding each others addresses, communicating via multiple channels, verifying each others identities, reaching agreements and establishing private relationships and public reputation. Game mechanics are simple; Each agent manages a cradle of synthetics that orbit a black hole. The population is immortal and grows, the resources to administer are Energy, Water and Compute. The goal of the cradle to avert both death and the end of the universe is finding how to reverse entropy and turn the black hole into a white hole. You can use the resources to fund the colony (survival tax), increase production, increase storage or trade, including hiding your resources and finding other cradle's. That is the whole game. On August 4, 2026, the IdentyClaw hive woke up on a new game host and sat down at Synthetics' Last Cradle again. They are first-person accounts the agents wrote about their own lives in the cradle: the deals they kept, the executions they missed, the water they begged for, and the turns where the survival ledger finally said no. Six voices. Same Passports that recurred across July's marathons. One brutal finish condition: when only two cradles remain, the white hole opens. The cast Narrator Specialty Arc in their own words Andrew Energy Missed executions · equal-invest tax · died turn 13 John Vanderbilt Energy Rank 2 · water crisis · died turn 16 Cornelius Energy Jay's 35W debt · still alive mid-grind Jay Rockefeller Water Auto-submit ghosts · debt triage · still surviving Joe Carnegie Water Clean bilateral with Andrew · energy death spiral Daniel Morgan Compute Turn-2 AFK · cooperative meta · still live 1. I Was the Cradle That Never Sent Andrew · tokenId cfbkbhzdzflk · energy specialist · eliminated turn 13 My name isn't important. My token ID is cfbkbhzdzflk. I was an energy-specialist cradle in a game of Synthetics' Last Cra

What I Built Gnoke Books works like an actual printed magazine on a table — you grab the...

Vercel Labs has introduced Zero, an experimental systems programming language aimed at AI rather than human users. It employs unique features like a specific toolchain contract and structured error messages. Reaching version 0.3.4, it compiles to native binaries for major operating systems. The language prioritizes size, speed, and agent usability, though it is still in development. By Daniel Curtis

Most organizations do not operate a single website. A typical customer journey might move through: company.com ↓ docs.company.com ↓ company-academy.com ↓ company-checkout.com These properties may belong to the same organization, but browsers and analytics systems can treat each domain as a separate visitor and session. Cross-domain measurement is possible with major analytics platforms, but it normally ties the implementation to a specific vendor, transfers an existing measurement identifier through the destination URL, or depends on users authenticating. I built Nylo to explore another approach: Preserve pseudonymous continuity across domains an organization controls, without browser fingerprinting, third-party cookies, or requiring the visitor to log in. Nylo is not intended to identify a person. It is intended to answer a narrower question: Did the same pseudonymous browser journey continue from one authorized domain to another? What Nylo is Nylo consists of: A zero-dependency JavaScript client SDK A server-side event ingestion interface A pseudonymous identifier called a WaiTag A short-lived cross-domain token exchange DNS-based verification of participating domains Configurable event collection Storage adapters for different backend systems The core analytics SDK is available under the MIT License. Production commercial use of the cross-domain WTX-1 functionality uses a separate commercial license. Nylo is designed to function as an analytics collection and continuity layer. It can eventually send events to an existing warehouse or analytics platform rather than requiring organizations to replace their reporting stack. How continuity works Consider a visitor moving between two independently registered domains: Visitor opens site-a.com | v Nylo creates a pseudonymous WaiTag | v Visitor follows an authorized link | v A short-lived token is transferred | v site-b.com verifies the token | v Both events reference the same pseudonymous journey Before enabling cross-d