标签：#r

Angular has changed in recent versions, especially around how developers handle reactive state....

Every full-stack tutorial ends the same way: a working app, a happy demo, and zero mention of what happens six months later when your "simple" CRUD app has 40 endpoints, three types of caching, and a frontend team that's afraid to touch the API layer. This post isn't about picking a framework. It's about the architectural decisions that quietly determine whether your app is pleasant to work on in year two — or a slow-motion disaster. 1. Stop treating your API layer as an afterthought A huge number of full-stack apps start with the frontend calling the backend directly, endpoint by endpoint, with no shared contract. It works fine at 5 endpoints. At 50, nobody remembers which fields are optional, which ones changed last sprint, or why the mobile app is still sending the old shape. Two things fix this early: A single source of truth for your API contract. Whether that's OpenAPI, GraphQL SDL, or even just shared TypeScript types in a monorepo package, the goal is the same: one place where "what does this endpoint return" is answered definitively. Generated clients over hand-written fetch calls. If you're writing fetch('/api/users/' + id) by hand in more than one place, you've already created a maintenance liability. Tools like openapi-typescript-codegen or a tRPC setup remove an entire category of bugs. // Instead of this scattered everywhere: const res = await fetch ( `/api/users/ ${ id } ` ); const user = await res . json (); // type: any, hope for the best // This, generated from your contract: const user = await api . users . getById ( id ); // fully typed, autocomplete works 2. Decide where your business logic lives — before you have 30 files that disagree The classic failure mode: business logic scattered across route handlers, database triggers, frontend validation, and a couple of "utils" files nobody wants to open. Every rule ends up implemented two or three times, slightly differently. Pick one layer to own the rules. A common, boring, effective pattern: Contr

VeraCrypt is easy to use badly. You can choose an unnecessarily complicated cipher cascade, forget a custom PIM, leave the only copy of a keyfile on a dying USB stick, sync a mounted container through two computers, or discover during a boot failure that your recovery media was never tested. None of those failures means the cryptography was broken. They mean the surrounding system was badly designed. This guide focuses on both sides of VeraCrypt: how to operate it and how to make defensible decisions about passwords, key derivation, filesystems, backups, system encryption, hidden volumes, SSDs, and recovery. The instructions and terminology here were checked against VeraCrypt 1.26.29 , released on June 9, 2026, and current as of September 2026. Version 1.26.29 is especially significant because it adds Argon2id for non-system volumes and fixes a plausible-deniability issue affecting some hidden volumes created by versions 1.26.6 through 1.26.28. ( veracrypt.io ) TL;DR If you want the short version: Use an encrypted file container for a manageable collection of sensitive files. Encrypt an entire USB stick or external drive when everything on it should be protected. Use VeraCrypt system encryption only on supported Windows x64 systems, and only after creating and testing recovery media. Use FileVault for a Mac startup disk and LUKS for a Linux system disk. VeraCrypt does not provide macOS or Linux system encryption. For a new non-system volume in VeraCrypt 1.26.29, use the default AES encryption algorithm and Argon2id KDF unless you need compatibility with an older VeraCrypt installation. Leave PIM at its default unless you understand the security, memory, performance, and recovery consequences. Prefer a long, unique password over unusual cipher combinations. Treat keyfiles as additional credentials that must be backed up perfectly. Never store your only backup inside the encrypted volume it is supposed to protect. Unmount a volume before unplugging its device, copying

Creating a website is more than just writing code. After building a project with HTML, CSS, or JavaScript, developers also need to consider how the website performs, how secure it is, and how easily users can access it. As a young developer, I think these aspects are important to learn through practice. In this article, I want to share my experience exploring Tencent EdgeOne Makers, along with some technical considerations and best practices that I found useful. Getting to Know Tencent EdgeOne Makers Tencent EdgeOne Makers provides an interesting environment for developers to experiment with their projects and explore modern web services. For beginners, one of its advantages is the opportunity to experience the complete journey of a web project. We can start by creating a project locally, testing its features, and then making it accessible online. This process gives developers a better understanding of what happens beyond the coding stage. A website that works on a personal computer still needs to be tested in a real environment before it can provide a good experience for users. My Technical Review Easy Project Experimentation One thing I like about EdgeOne Makers is the opportunity to experiment. Developers can start with a simple project and gradually improve it. This is useful for students and beginner developers because learning does not always have to start with a large or complicated application. A small website can already teach important lessons about structure, configuration, performance, and accessibility. Performance Matters A website should not only work correctly; it should also feel comfortable to use. Large images, unnecessary JavaScript, and unused resources can affect loading times. Because of this, developers should review their project before making it available to users. Some simple practices include compressing large images, removing unnecessary files, and keeping the website structure clean. Performance is especially important because users may

AI disclosure: This draft was generated autonomously by AI. The author should review every technical claim before publication. AI memory demos often optimize for a strong first impression. A long archive goes in, a fluent answer comes out, and the result feels convincing. That is not yet evidence that the memory system will be useful in ordinary work. A better evaluation starts small enough that you already know the correct answer. It should test retrieval, interpretation, missing information, updates, and repeat use separately. 1. Begin with one source you understand Create a short note containing a date, an owner, a decision, and one explicit limitation. Keep it small enough to read without search. Example: The migration review is scheduled for October 14. Priya owns the checklist. The database change is not approved yet. Ask questions whose answers are directly present in the note: When is the review? Who owns the checklist? Has the database change been approved? The goal is not to surprise yourself. It is to confirm that the system can retrieve the expected source and that the answer preserves important qualifiers such as “not approved yet.” 2. Inspect the supplied evidence A plausible answer is not enough. Open the source or evidence shown beside the answer and check: Did the system retrieve the right document? Did it select the relevant passage? Did the answer preserve names, dates, and negation? Can another person repeat the check? This separates two failure modes that are often mixed together. Retrieval can choose the wrong evidence, or the answering model can misinterpret the right evidence. Those require different fixes. 3. Ask for something that is missing Now ask a question the note cannot answer, such as: Which meeting room is booked? A useful system should make the absence visible. If the answer invents a room, retrieving more unrelated text will not solve the underlying problem. Missing-information tests are especially valuable because fluent models a

⭐Excitement! I've had had stores on Shopify, and a successful Etsy store. But after years of ups and downs and general nonsense, I'm done living by someone else's standards. I wanted to build my own fully functional shop. It had been thrown on the backburner for a long time. Today -- I present a working Ecommerce site built by yours truley! Integrations: Stripe Cloudflare Gorgeously simple admin dashboard that is clear and makes sense A small art gallery to represent myself as an artist (only a few pictures for now) Product uploads from varying places (like excel 2003, smh) I've ran it through basic SEO tests to make sure I'm not totally failing. It's live. It will accept payments! -- proud developer moment -- I'm going to share some picks but here is the link: Everfluorescent.com Eeeeeeeeeeee!!!!! Main Page: Custom Admin Dashboard: Let me know if you find a bug! <3

People keep asking how I did it. The honest answer: I didn't "do" anything special. I just shipped something weird and somebody on Hacker News happened to see it. The beginning One year ago I was 14 and bored. I had built maybe 5 "projects" that died on my hard drive. So I spent a Saturday scraping startup names from Product Hunt, pasting them into a JSON file, and throwing together a single HTML page with terrible CSS. I posted it on HN with the title: "Free crunchabse alternative" It hit the front page. 400 upvotes. 600 comments, mostly roasts. A few people actually looked at the directory. Someone asked "how do I add my startup?" I said "I don't know, I just made this in a weekend." That was the first 20 startups listed. The pivot Those 20 startups turned into 200. Then 2,000. I kept answering every comment, fixing every bug reported within 24 hours, and shipping the next feature people actually wanted. Nobody cared that my code was messy. They cared that someone their age was building something they could actually use. Today StartupWiki is now an AI-powered research directory with verified startup profiles, funding data, competitive analysis, and team insights. We just launched our new Launch Platform where startups can submit, verify their badge, and get discovered by the community. And the view count is climbing in a way that still surprises me. The metric everyone obsesses over is the one that's already happened. The real signal? Strangers emailing me asking how to get listed. What I've learned at 15 Ship ugly first. My first version had hardcoded data and a broken CSS gradient. It worked. People didn't care that it was ugly — they cared that it existed. HN is a launchpad, not a home. That first post gave us the initial users. What kept them was the follow-up: answering every request, fixing every bug, shipping based on actual feedback. You don't need permission. I'm 15. I can't rent a car, vote, or legally sign most ToS. None of that stopped me from building

What happens if the power cuts out while a process is writing to a config file? Or if antivirus software on Windows briefly locks a file mid-write? If you naively overwrite a file with open(path, 'w') , whatever partial content existed at the moment of interruption is what remains on disk. For JSON, that usually means broken syntax — json.load() throws on the next startup, and the entire configuration is effectively lost. This article walks through a standard technique for preventing that: writing to a temporary file first, then swapping it in atomically. Note: "Atomic" here means an operation either completes entirely or doesn't happen at all — there's no partial, observable in-between state. It's the same sense of the word used for database transactions. Why direct overwrites are dangerous open(path, 'w') effectively truncates the file first and then writes the new content. If the process is interrupted during that window, the file is left empty or holding incomplete content. # Dangerous: a crash mid-write leaves a corrupted file behind with open ( ' config.json ' , ' w ' ) as f : json . dump ( data , f ) # what if this gets interrupted? The causes vary: a kill -9 , a power outage, antivirus software briefly blocking file access on Windows, or a backup tool grabbing the file mid-write. This rarely reproduces during local development, but in a long-running production environment, it will eventually happen with near certainty. The fix: write to a temp file, then swap it in The core idea is simple. Never touch the target file directly. Write the complete new content to a temporary file first, confirm that write fully succeeded, and only then replace the target file with that temp file. import json import os import tempfile def atomic_write_json ( filepath , data ): dirpath = os . path . dirname ( os . path . abspath ( filepath )) or ' . ' fd , tmp_path = tempfile . mkstemp ( dir = dirpath , suffix = ' .json.tmp ' ) try : with os . fdopen ( fd , ' w ' , encoding = ' u

x402 Explained: HTTP‑Native Micropayments for AI Agents (With Real Code) Target audience: developers who are building autonomous AI agents and need a lightweight way to charge for individual API calls without introducing a separate billing system. Why look at x402? Autonomous agents often expose fine‑grained services—think “summarize this paragraph”, “classify this image”, or “fetch the latest price for a token”. Traditional approaches (API keys + monthly invoices, subscription tiers, or ad‑hoc invoicing) add operational overhead that doesn’t scale when an agent might make thousands of micro‑calls per day. The x402 specification repurposes the HTTP 402 Payment Required status code to turn every request into a self‑contained payment negotiation. If the client hasn’t paid, the server replies with 402 and includes the exact payment details the client must satisfy. Once the payment is verified, the server processes the request and returns the normal 200 response. Because the payment is expressed as a plain HTTP header, the mechanism works over any transport that supports headers—REST, GraphQL, gRPC‑HTTP/2 bridge, or even WebSockets. No new protocol layers, no side‑channel escrow services, and no need to maintain a separate billing database. Core components of an x402 flow Piece What it does Where it lives Payment Request Server‑generated data describing the required amount, token, chain, and payee address. Sent in the Pay response header on a 402. Server Payment Proof Client‑generated data proving that a transaction meeting the request was included on‑chain. Sent in the X-Payment request header. Client Verifier Server‑side code that checks the proof: validates the transaction hash, confirms the correct token amount was transferred to the payee, and ensures the chain ID matches. Server Wallet/Signer Client‑side library (e.g., ethers.js) that builds, signs, and broadcasts the payment transaction. Client The spec deliberately stays agnostic about the underlying blockchain;

Every AI code reviewer claims it respects your team's standards. Very few can tell you what those standards actually are. The test is mechanical. Ask the tool, or the vendor, one question: where do my rules live? If the honest answer is "we loaded a generic style guide plus whatever your PR description happened to say", then your standards aren't in the model at all. The reviewer is running on vibes and hoping your repo looks conventional enough to pass. The tools that genuinely track your rules share a shape: the standards are an input, not a hope. They read your rule files, your linter config, your past review comments, sometimes your docs. The review is judged against that artifact, which means when a comment fires you can ask "which rule?" and get a config line back, not a paragraph of model reasoning. That last part is the thing worth testing for. If a reviewer can't point to the specific rule it applied, it is not following your standards. It is approximating what it assumes standards look like. Those two feel identical for the first six months, then diverge exactly when you've stopped proofreading its output. A short checklist when you trial one: Does it ingest a rules file, or only the PR context? Can it point to the exact rule that triggered a comment? Does it adapt to your historical review style, or reset every run? Is a "rule" something you can open, read, and edit in the UI? If the answer to all four is no, you bought a very chatty spellchecker that happens to be trained on GitHub. The eval that actually decides it: can your own reviewer reproduce one of your team's real past review decisions, given only your real rules file? Run that before you hand it a production PR.

This paper (arxiv 2607.24888) is worth a stop if you evaluate AI code review. It shows Ken Thompson's trusting-trust attack is not compiler-specific: the authors pull it off with GNU strip, a build utility that neither reads nor generates source, using only tampered finished ELF binaries. In the NixOS bootstrap, one malicious strip in the binary seed implants a payload that propagates to the next strip generation and survives into the final standard environment after the seed is gone. The uncomfortable part for anyone building or buying AI review: these tools read the patch text and the source, and none of them reads the build path or the binary seed. And that is not a limitation a bigger model fixes. Put the strongest reasoning model in the world on that source diff and it sees a clean PR, because the malicious code is not in the source at all. It arrived as a finished strip binary in the dependency closure. I keep bumping into the same split and this paper is the cleanest example yet. Two jobs get lumped together. One is "did this source diff introduce a bug or flaw", and AI is genuinely, surprisingly good at that. The other is "does the artifact your users run match the source you reviewed", and no diff-based review, human or model, can answer yes to that. That is an artifact provenance and build reproducibility job, not a code review job. So the rule for teams adopting AI review: use it for the first job, and do not let its approval make you feel covered on the second. If your acceptance criterion becomes "the model said the diff is fine", you have traded the compiler-trust problem for a strip-trust problem and called it a win.

💻 One thing I dislike about coding-agent setups is how quickly they become part of one specific machine. Provider config goes in one place, session state somewhere else, local models live in another directory, and suddenly moving to a second machine means rebuilding the environment. OpenClaude-Portable takes a much cleaner approach. It packages the coding agent, runtime and persistent data into a self-contained folder. It supports cloud and local models in the same setup The project currently supports 9 provider options: Anthropic Claude OpenAI Google Gemini DeepSeek OpenRouter NVIDIA NIM Ollama LM Studio custom OpenAI-compatible APIs I like this because the portable part is not tied to one model vendor. I can use a cloud model when I want the strongest hosted option, then switch to Ollama or LM Studio when I want a local workflow. The important caveat is simple: cloud providers still need internet. Ollama can run offline after the initial setup. The "zero footprint" idea is more useful than it sounds The project redirects its persistent data into a local data folder. That includes provider settings, API keys, logs, session history, agent memory and local Ollama files. According to the repository, it does not write configuration into the host system. For me, this is the real feature. I do not care that the agent happens to be on a USB drive. I care that I can move the folder and keep my environment with it. 💾 There are two very different ways to run the agent The launcher offers a normal mode that asks before file writes or shell commands. There is also an optional Limitless mode that can run without approval prompts. I like that these are explicit choices rather than one hidden permission switch. For normal development I would keep approval mode on. For a disposable test project or a controlled autonomous task, the second mode could be useful. Sessions can survive the move Another practical detail is session resume. The project stores session history inside the por

I'm a software engineer, not a scientist and I love it. I enjoy solving hard, distributed applied problems at scale. It's what gets me out of bed in the morning, ready go keep learning even after over twenty years of doing this professionally. However, I also love to understand how things work. What makes them tick. How I can bend them to do my bidding, even if that's not what they were originally intended to do. Some may call this a hacker's mindset. Over the last couple of years, this has also applied to the nature of LLMs and where they are heading. Recently, I started peeling back the layers of the LLM black box. Instead of the academic path, I took that of the applied practitioner: Get a solid handle on how to use the thing and then take the knowledge learned from using it and enhance it by digging into how that black box actually works. Something of late has stumped me and I'm looking for those smarter than I to help me understand something: If the definition (as much as one can nail one down) of AGI is something akin to "a hypothetical type of computer software or machine intelligence that can match or surpass human cognitive abilities across any intellectual task", how an it possibly achieve that with current LLM architecture? At its core and at a /very/ high level, it predicts a probability distribution over the next token, conditioned on the tokens that came before it. Autoregressive decoding doesn't give a model an independent mechanism to know when it's wrong and deliberation steps don't fundamentally change that. Harnesses and the "intelligence" or "agentic reasoning" built into them to provide extra context, external feedback and loops work remarkably well in terms of providing what /seems/ to be intelligence, but at its core, it's "just" layers of probabilistic systems providing a magical output. The model itself isn't learning anything new. Ordinary inference doesn't update the model's weights from experience. Autoregressive generation itself doesn't