标签：#java

A practical introduction to WebGPU, WGSL, render pipelines, compute shaders, and the future of high-performance graphics on the web. Your browser can stream 4K video, run a complete code editor, render complex 3D scenes, and host multiplayer games. But for years, web developers accessed the GPU through an API based on an older generation of graphics programming. WebGPU changes that contract. WebGPU is not simply a faster version of WebGL. It is a new approach to graphics and parallel computation on the web—one built around explicit pipelines, modern GPU architecture, compute shaders, predictable resource management, and a shader language designed specifically for the browser. This article expands on the progression presented in the uploaded High Performance Graphics: Introduction to WebGPU material: why WebGPU matters, how it differs from WebGL, how WGSL works, how the rendering pipeline is constructed, and how compute shaders extend the GPU beyond graphics. WebGPU is not WebGL 3.0 This is the first mental model to correct. WebGPU does not build on WebGL. WebGL exposes a browser-friendly version of the OpenGL ES programming model. WebGPU instead uses concepts associated with modern GPU APIs and provides a portable abstraction over the graphics capabilities available on the user’s system. WebGPU and WGSL are W3C standards for accessing GPU acceleration from web applications. The API supports both graphics rendering and general-purpose parallel computation. ( W3C ) WebGL │ └── OpenGL ES-style state machine WebGPU │ ├── Explicit pipelines ├── Explicit resource bindings ├── Command encoding ├── Compute shaders └── Modern GPU execution model The difference is architectural, not cosmetic. In WebGL, you frequently change global rendering state and then issue a draw call. In WebGPU, you describe the pipeline and resources more explicitly, record commands, and submit those commands to the GPU. WebGL mental model Change state ↓ Change more state ↓ Bind resources ↓ Draw WebGPU

This button passes every automated accessibility scan we've thrown at it: <button class= "btn-primary" type= "button" > Check availability </button> And it breaks every AI agent that tries to book a room through it. The markup is clean: a real <button> , a proper accessible name from its text content, an explicit type . Nothing to flag. The failure isn't in the button, it's in what happens after the click. And no static scanner ever clicks. What a scanner actually sees Static accessibility scanners evaluate the DOM at a point in time. Usually the initial render: HTML parsed, framework hydrated, nothing interacted with. They check that state against WCAG rules, missing alt text, contrast ratios, label associations, heading order. That's genuinely useful. It's also a photograph of a lobby, when the task happens in the hallways. Here's what never appears in the initial DOM of a typical booking flow: The date picker that mounts when the check-in field receives focus The error message injected after a failed form submit The room-selection modal that opens on "Check availability" The loading state between "Book now" and the confirmation A scanner reports zero issues on all of these, for the simple reason that at scan time, none of them exist. What an agent actually traverses An AI agent completing a booking doesn't evaluate a snapshot. It walks the flow: reads the accessibility tree, decides on an action, performs it, waits for the interface to respond, reads the tree again. Every state transition is a place where the tree can lie to it. Let's look at three patterns we keep finding in real audits. All three pass static scans. All three stop an agent. 1. The modal that exists on screen but not in the tree { isOpen && ( < div className = "modal-overlay" > < div className = "modal" > < h2 > Select your room </ h2 > < RoomList rooms = { available } /> </ div > </ div > )} Visually: a modal. In the accessibility tree: a div soup appended somewhere in the body, with no role="di

Hi everyone! I’m a developer at the beginning of my journey, and I’ve just finished working on a small project that brought me a lot of joy: Capybara Game. It’s a cute game where you feed your capybara and improve her happiness level. You can choose between 5 different types of food or pick your own snack. If the capybara likes the snack, her happiness level rises; if she doesn't like it, the happiness level falls. Your progress is saved automatically. Keep in mind that your capybara gets hungry over time, so make sure to check back and feed her regularly! I went for a minimalist, cozy design. The interface is clean and intuitive, focusing on a relaxing user experience that lets the player focus entirely on the capybara. I built this project using HTML, CSS, and JavaScript. Hope you're interested in playing! You can do it here: Play the game here I’d love to hear your thoughts! If you have any ideas for new features or if you find any bugs, feel free to let me know in the comments.

Part 3 of the quantum-audit series. Part 1 | Part 2 * 🌐 Tool: quantum-audit-site.vercel.app Most security tools tell you there's a problem. Then you close the tab and forget about it. The only way to actually fix that is to make the problem block your deployment . quantum-audit exits with a non-zero code when it finds critical quantum-vulnerable cryptography. That means you can drop it into any CI pipeline and have it fail the build automatically. Here's how. The exit code behaviour npx quantum-audit . echo $? # 0 = no critical findings, 1 = critical findings found Exit 0 — no critical findings (safe to deploy) Exit 1 — critical findings detected (block the build) Medium findings (SHA-256, AES-128) don't fail the build — they appear in the output as warnings but don't block deployment. Only CRITICAL findings (RSA, ECDSA, secp256k1) cause a non-zero exit. GitHub Actions Add this to your .github/workflows/ci.yml : name : CI on : push : branches : [ main ] pull_request : branches : [ main ] jobs : quantum-audit : runs-on : ubuntu-latest steps : - name : Checkout uses : actions/checkout@v4 - name : Setup Node.js uses : actions/setup-node@v4 with : node-version : ' 20' - name : Run quantum-audit run : npx quantum-audit . If your project uses ethers , web3 , elliptic , or any other ECDSA/RSA library — the step will fail and your PR cannot be merged until the finding is addressed. JSON output for custom reporting Need to parse the results programmatically? Use the --json flag: npx quantum-audit . --json Output: { "project" : "my-dapp" , "score" : 60 , "grade" : "C — Moderate Exposure" , "findings" : [ { "algorithm" : "ECDSA (secp256k1) signing" , "risk" : "critical" , "weight" : 40 , "file" : "package.json" , "line" : null , "source" : "ethers" }, { "algorithm" : "SHA-256 (crypto.createHash)" , "risk" : "medium" , "weight" : 8 , "file" : "src/utils/hash.js" , "line" : 14 } ] } You can pipe this into a Slack notification, a dashboard, or a custom reporting step. Slack notif

You didn't set out to build a framework. You set out to test a login form. But somewhere between the first WebDriver driver = new ChromeDriver() and the fiftieth flaky CI run, you built one anyway. There's a BaseTest . There's a DriverFactory . There's a WaitUtils class that everyone copies, and no one fully trusts. There's a reporting hack bolted onto TestNG listeners, and a block of CI YAML that only one person understands. That's a framework. You just never called it one — and that's exactly why it's so expensive. The framework you didn't mean to build Here's the pattern, repeated at nearly every Java shop: // The BaseTest that grows a little every sprint public class BaseTest { protected WebDriver driver ; @BeforeMethod public void setUp () { driver = new ChromeDriver ( /* options someone tuned in 2022 */ ); driver . manage (). timeouts (). implicitlyWait ( Duration . ofSeconds ( 10 )); // …plus retries, screenshots, and env switching bolted on over time } @AfterMethod public void tearDown ( ITestResult result ) { if ( result . getStatus () == ITestResult . FAILURE ) { // take a screenshot… somehow… attach it… somewhere } driver . quit (); } } It looks harmless. It's ten lines. But it never stays ten lines, because production testing keeps asking for more: parallel execution, a second browser, cloud grids, retry-on-flake, a report your manager will actually open. Each request adds a little more plumbing — and every line of that plumbing is code you now own. The five costs nobody budgets for 1. Maintenance you can't schedule. Selenium 4 lands. ChromeDriver changes its options API. A dependency bump breaks your screenshot logic. None of this is on the roadmap, all of it is on you, and it always arrives the week before a release. 2. Onboarding that lives in someone's head. A new engineer can't just read the docs — there are no docs. Onboarding is "sit with Priya and she'll explain the wait helpers." The framework's real specification is tribal knowledge, and it wal

Chrome ships a real LLM inside the browser now — Gemini Nano, exposed through a handful of built-in...

Originally published at daniel-yang.com . I've been using passkeys for a while now, and at some point I noticed an extension in the WebAuthn spec that almost nobody talks about: PRF. It lets a website ask your authenticator to evaluate a pseudo-random function during login. Deterministic output, 32 bytes, keyed to that specific credential, never leaves your browser. That's an encryption key. Sitting inside the same ceremony everyone already uses for login. So I built pknotes to see how far the idea goes: an end-to-end encrypted notes app with no master password anywhere. Your passkey unlocks your notes in the literal, cryptographic sense. This post is the architecture writeup. There's a live demo if you'd rather poke it first (notes wiped daily). One ceremony, two jobs A normal passkey login proves who you are and nothing else. With the PRF extension, the same ceremony does double duty: The server verifies the WebAuthn assertion. That's login. The client reads the PRF output from the same response and derives a key from it. That's decryption. The server never sees the PRF bytes. They're returned to client-side JavaScript only, after user verification (Face ID, Touch ID, PIN), and only for the requesting origin. Requesting it looks like this: const credential = await navigator . credentials . get ({ publicKey : { challenge , userVerification : ' required ' , extensions : { prf : { eval : { first : new TextEncoder (). encode ( ' pknotes/prf-eval/v1 ' ) } }, }, }, }); const prfOutput = credential . getClientExtensionResults (). prf . results . first ; // 32 bytes, deterministic for this credential + this input, never sent anywhere The key hierarchy Raw PRF output shouldn't encrypt data directly, and you also want to be able to add and remove devices without re-encrypting everything. So there's a small hierarchy: Passkey PRF output │ HKDF-SHA256 ▼ KEK (key-encryption key, exists only in browser memory) │ unwraps ▼ Master key (random AES-256, generated once at signup) │

GitHub热门项目 | Modular logistics and supply chain operating system (LSOS) | Stars: 2,098 | 43 stars today | 语言: JavaScript

GitHub热门项目 | PairDrop: Transfer Files Cross-Platform. No Setup, No Signup. | Stars: 10,914 | 107 stars today | 语言: JavaScript

GitHub热门项目 | Local-first AI token usage & cost tracker for 27 coding tools — with a desktop pet, 4 widgets, achievements, native macOS/Windows apps, and a one-command CLI. Never reads prompts. | Stars: 1,018 | 12 stars today | 语言: JavaScript

GitHub热门项目 | A WhatsApp client library for NodeJS that connects through the WhatsApp Web browser app | Stars: 22,200 | 12 stars today | 语言: JavaScript

I spent the last few months building a Chrome extension that detects HTML code blocks inside ChatGPT, Claude, and Gemini and lets you deploy them straight to a live URL. The "deploy" part turned out to be the easy 20%. The hard 80% was reliably watching three completely different, constantly-changing chat UIs without breaking every other week. Here's what actually taught me something. 1. MutationObserver is non-negotiable, but it will still lie to you None of these chat apps render the full response at once — they stream tokens in, which means the DOM you're watching is incomplete almost every time your observer fires. My first version tried to detect a finished <pre><code> block the moment it appeared. Result: I was grabbing HTML mid-stream, cut off halfway through a <div> . What actually worked was debouncing on DOM stability instead of DOM presence: let debounceTimer ; const observer = new MutationObserver (() => { clearTimeout ( debounceTimer ); debounceTimer = setTimeout ( scanForCodeBlocks , 600 ); }); observer . observe ( document . body , { childList : true , subtree : true }); 600ms of "nothing changed" turned out to be a much more reliable signal than "the tag now exists." Not elegant, but it works across all three sites' streaming speeds. 2. Every AI chat UI restructures its DOM without telling you ChatGPT, Claude, and Gemini all ship frequent frontend updates, and none of them are obligated to keep a stable class name for you to hook into. I initially selected code blocks by class name ( .language-html , .hljs , etc.) and had selectors silently break in production within two weeks of launch. What's held up better: matching on structural patterns instead of class names — a <pre> containing a <code> whose text content starts with <!DOCTYPE or <html . It's slower to write the first time, but it doesn't care what CSS class the framework decided to use this month. 3. "Detect the code" is easy. "Detect the right code" is the actual problem A single AI response

Every organisation that has run a significant software system for more than a few years has felt a version of the same thing: a change that should have taken days takes months, nobody can quite explain why, and the explanation that eventually gets offered — the domain is complex, the requirements changed, the previous team was careless — is almost never checked against an alternative approach for the software architecture or alternative framework choices, because the alternative was never built. There is no possible comparison to determine the solution chosen is a good one and there is no benchmark to measure "fit for purpose." This is the unfalsifiability problem, and it is worth stating plainly before anything else in this piece, because it is the reason the cost described below is so rarely traced back to its actual cause. Every system is built once. There is no version of your platform built the other way, running alongside it, that anyone can compare it to. So when a system works, the approach that produced it gets read as validated. When a system becomes expensive to change, the cost gets attributed to anything except the structural decision that caused it — because that decision was made years ago, by people who may have moved on, and there is no control group to prove that the structure was the variable that mattered. That absence of a control group is not a minor academic point. It is the reason a specific, avoidable pattern of cost has been able to spread through the industry for decades, get taught in courses, get validated in interviews, and still never be clearly named as a mistake. This article is an attempt to name it — and to offer something more useful than a diagnosis: a way to check, this week, whether it applies to you. The Villain: Process Over Product Ask almost any team building a significant piece of software what the goal of the project is, and the honest answer, more often than anyone would like to admit, is not "build the best-fitting prod

Hi DEV community! 👋 I'm Widodo, an independent web and mobile app developer. In my day-to-day workflow—whether I am developing mobile apps, structuring databases, or setting up serverless continuous integration pipelines—I constantly rely on quick online utilities. Things like formatting code, generating QR codes, or stripping metadata from images. But I realized a massive flaw in the current ecosystem of free online tools: Privacy and Performance. If you search for a "Free EXIF Data Remover" or "JSON Formatter," 90% of the top results force you to upload your sensitive files to their remote servers just to perform a basic operation. Not only is this a massive privacy risk, but it also introduces unnecessary latency. Since my core development philosophy has always leaned towards offline-first architectures and minimal server dependencies, I decided to build my own solution. Enter Ic2Share.com . It is a growing directory of web utilities built on a strict zero-server-upload architecture. Everything executes instantly within the user's browser. Here is a breakdown of how I built some of the tools and the client-side APIs powering them. Secure EXIF & Metadata Stripper (Canvas API) Most EXIF strippers use backend libraries (like PHP's exif_read_data or Python's Pillow). I wanted this to happen entirely offline so users wouldn't have to upload their personal photos. The solution? HTML5 Canvas Re-rendering. When a user drops an image, the browser reads it via the FileReader API. I then draw that image onto a hidden element. When you export the canvas back to a Blob using canvas.toBlob(), the browser automatically discards all original EXIF headers (including the exact GPS coordinates and camera models). It is fast, secure, and costs $0 in server compute. The Online Teleprompter (requestAnimationFrame) I built an auto-scrolling teleprompter for video creators. Initially, I thought about using CSS transitions or setInterval for the scrolling text. However, CSS can cause jit

GitHub announced on July 2, 2026 that Issue fields are generally available, including integration with GitHub's MCP server. Primary source: GitHub Changelog, July 2, 2026 . That creates a useful beginner project: validate structured issue metadata before an MCP client—or any program—uses it. The schema below is invented for learning. It is not GitHub's API schema. Define three fields // schema.mjs export const schema = { priority : { kind : " singleSelect " , required : true , options : [ " P0 " , " P1 " , " P2 " , " P3 " ] }, estimate : { kind : " number " , required : false , min : 0 , max : 100 }, customerImpact : { kind : " text " , required : false , maxLength : 120 } }; A schema describes both type and domain rules. estimate must be a number, but it also has to fit the range this project accepts. Validate at the boundary // validate.mjs import { schema } from " ./schema.mjs " ; export function validate ( input ) { const errors = []; if ( ! input || Array . isArray ( input ) || typeof input !== " object " ) { return [ " fields must be an object " ]; } for ( const [ name , rule ] of Object . entries ( schema )) { if ( rule . required && ! ( name in input )) errors . push ( ` ${ name } : missing` ); } for ( const [ name , value ] of Object . entries ( input )) { const rule = schema [ name ]; if ( ! rule ) { errors . push ( ` ${ name } : unknown field` ); continue ; } if ( rule . kind === " singleSelect " && ( typeof value !== " string " || ! rule . options . includes ( value ))) { errors . push ( ` ${ name } : expected ${ rule . options . join ( " , " )} ` ); } if ( rule . kind === " number " && ( typeof value !== " number " || ! Number . isFinite ( value ) || value < rule . min || value > rule . max )) { errors . push ( ` ${ name } : expected ${ rule . min } .. ${ rule . max } ` ); } if ( rule . kind === " text " && ( typeof value !== " string " || value . length > rule . maxLength )) { errors . push ( ` ${ name } : expected at most ${ rule . maxLength } charact

After I published my last article about building a Chrome extension that speaks browser notifications aloud, a commenter asked a question I didn't have a good answer to. He pointed out that a lot of web apps — Slack, Gmail, most modern tools — fire their notifications from a service worker via registration.showNotification() , not from the page's JavaScript context. My MAIN world override of window.Notification would never reach those. He was right. And I told him I'd look into it. I spent a week researching whether there was any way to close that gap. There isn't. But the reason why is more interesting than a simple "no." Two ways a website can show you a notification When a website sends you a browser notification, it can do it in one of two ways. The first is the constructor path. The page's own JavaScript calls new Notification("You have a message") directly. This is common for in-tab alerts, real-time updates when you're actively on the site, or any notification triggered by something you just did. The second is the push path. The browser receives a push event from the website's server, wakes up the website's service worker in the background, and the service worker calls self.registration.showNotification() from inside its own scope. This is what happens when Slack notifies you of a new message while the tab is closed or backgrounded. The page never runs. No page JavaScript ever fires. My extension catches the first path. The MAIN world content script overrides window.Notification before any page code runs. But the service worker never touches the page's window. It has no window . It runs in a completely isolated thread, completely separate from the page, and calls showNotification on itself. The override is never reached. Why can't the extension reach the service worker? This is the part that took me a week to fully accept. Chrome extensions can inject content scripts into web pages. They can run code in the MAIN world or the ISOLATED world of a page. They can

Array An Array is a collection of multiple values stored in a single variable. let fruits = [ " Apple " , " Mango " , " Orange " ]; Here, fruits contains three values. Why Do We Need Arrays? Without an array, you would write: let fruit1 = " Apple " ; let fruit2 = " Mango " ; let fruit3 = " Orange " ; Using an array: let fruits = [ " Apple " , " Mango " , " Orange " ]; This makes the code shorter and easier to manage. Array Index Each value in an array has an index. The index always starts from 0. Index: 0 1 2 ------------------------- Array: Apple Mango Orange Accessing Array Elements Use the index number to access a value. let fruits = [ " Apple " , " Mango " , " Orange " ]; console . log ( fruits [ 0 ]); console . log ( fruits [ 1 ]); // Output: Apple Mango Changing an Array Element You can update any value using its index. let fruits = [ " Apple " , " Mango " , " Orange " ]; fruits [ 1 ] = " Banana " ; console . log ( fruits ); // Output: [ " Apple " , " Banana " , " Orange " ] Finding the Length of an Array Use the "length" property. let fruits = [ " Apple " , " Mango " , " Orange " ]; console . log ( fruits . length ); // Output: 3 Adding Elements push() – Add at the End let fruits = [ " Apple " , " Mango " ]; fruits . push ( " Orange " ); console . log ( fruits ); // Output: ["Apple", "Mango", "Orange"] unshift() – Add at the Beginning let fruits = [ " Mango " , " Orange " ]; fruits . unshift ( " Apple " ); console . log ( fruits ); // Output: ["Apple", "Mango", "Orange"] Removing Elements pop() – Remove from the End let fruits = [ " Apple " , " Mango " , " Orange " ]; fruits . pop (); console . log ( fruits ); // Output: ["Apple", "Mango"] shift() – Remove from the Beginning let fruits = [ " Apple " , " Mango " , " Orange " ]; fruits . shift (); console . log ( fruits ); // Output: ["Mango", "Orange"] Looping Through an Array Use a "for loop" to print all elements. let fruits = [ " Apple " , " Mango " , " Orange " ]; for ( let i = 0 ; i < fruits . length ; i

GitHub热门项目 | The open source server management software for SSH, VNC & RDP | Stars: 4,790 | 97 stars today | 语言: JavaScript

Hey everyone, I recently had an "aha!" moment regarding how React handles updates under the hood, and I wanted to share it because I realize a ton of developers (including myself, until recently) trip over this exact concept. The common mental model is that React Reconciliation compares the Virtual DOM directly to the Real Browser DOM and surgically updates only what changed. But that’s fundamentally incorrect. React never reads or directly compares the real DOM during the diffing process. It actually splits the process into two entirely separate phases —The Render Phase and The Commit Phase —which creates a massive distinction between Re-rendering and Re-painting. Here is the exact breakdown of what happens when a single state change affects just 1 out of 100 divs in a component: The Render Phase (Pure JavaScript) When state changes, React calls your component function. It doesn't know which of your 100 divs changed yet, so it has to evaluate the entire JSX block. The Scope: React re-renders all 100 virtual divs in memory. The Process: It builds a brand-new Virtual DOM tree and compares it to the previous Virtual DOM tree (JavaScript object vs. JavaScript object). The Outcome: It spots that 99divs are identical, but 1 div has an update. It flags that single virtual node with an "Update" tag. Because this happens purely in-memory as JavaScript, it is incredibly fast and cheap. The Commit Phase (The Real DOM Update) This is where Reconciliation does its primary job. It acts as a shield to protect the browser from doing unnecessary work. The Scope: React completely ignores the 99 unchanged elements. The Process: It surgically targets the single real browser div associated with the flagged Virtual DOM element and updates only its modified property (e.g., element.textContent = "New Value"). The Outcome: The browser repaints only 1 single div on the screen. The Conclusion: Reconciliation isn't about stopping React from re-rendering (re-running JS to calculate the UI). It

Building a Lightweight Product Filter with Vanilla JavaScript While building a small e-commerce project, I wanted users to filter products instantly without refreshing the page. Instead of relying on a frontend framework, I opted for a simple solution using HTML data attributes, vanilla JavaScript, and a little CSS. The goal was straightforward: let visitors filter items by size while keeping the interface fast, responsive, and easy to maintain. HTML Structure Each product card stores its information in data-* attributes. This keeps the markup clean and makes filtering straightforward. <div class= "filters" > <button class= "filter-btn" data-filter= "all" > All </button> <button class= "filter-btn" data-filter= "small" > S </button> <button class= "filter-btn" data-filter= "medium" > M </button> <button class= "filter-btn" data-filter= "large" > L </button> </div> <div class= "product-grid" > <div class= "product-card" data-size= "medium" data-style= "cargo" > Cargo Shorts </div> <div class= "product-card" data-size= "large" data-style= "chino" > Chino Shorts </div> <!-- More product cards --> </div> Using data attributes means you can add new filter categories later without changing your overall structure. JavaScript Filtering Logic The filtering logic listens for button clicks and simply shows or hides product cards based on the selected size. const filterButtons = document . querySelectorAll ( " .filter-btn " ); const productCards = document . querySelectorAll ( " .product-card " ); filterButtons . forEach (( button ) => { button . addEventListener ( " click " , () => { const filterValue = button . dataset . filter ; productCards . forEach (( card ) => { const cardSize = card . dataset . size ; if ( filterValue === " all " || cardSize === filterValue ) { card . classList . remove ( " hidden " ); } else { card . classList . add ( " hidden " ); } }); filterButtons . forEach (( btn ) => btn . classList . remove ( " active " )); button . classList . add ( " active "