标签：#t

You've got a Next.js app on one domain and your API on another. The login works, the dashboard fills up, everything looks fine. Then one day you open the Network tab and there it is: your access token, in plain text, in a request header the browser sent all by itself. At that point every line of JavaScript on the page can read it. Not just your code. The analytics snippet you added last week, the twelve transitive dependencies you've never opened, whatever an XSS bug manages to slip in. And you never really decided this. It just happened, because calling the API straight from the component was the path of least resistance, and nothing complained. The browser is not a trusted client The version that gets you here looks completely reasonable: // ❌ a Client Component talking to your API ' use client ' ; export function Profile () { useEffect (() => { fetch ( ' https://api.example.com/me ' , { headers : { authorization : `Bearer ${ token } ` }, }) . then (( r ) => r . json ()) . then ( setProfile ); }, []); } Look at what that actually signed you up for. The token is in JavaScript, so the protection an HttpOnly cookie would have given you is simply gone. The call is cross-origin, so you're now on the hook for CORS: preflight requests, an allowed-origins list to maintain, Access-Control-Allow-Credentials , and the quiet worry that you've opened it wider than you should. And because the request leaves from the browser, anyone with devtools can read your API's base URL, its routes, and how it expects to be authenticated. That's a decent map of your backend, handed out to every visitor. What makes this hard to catch is that none of it breaks. It works in the demo, it works in production, it reviews clean. It just sits there as a liability until the day it stops being quiet. The browser talks to your server. Your server talks to your API. The Backend-for-Frontend pattern draws one line: the browser only ever talks to your Next.js server. The Next.js server talks to your API.

This report analyzes pricing shifts across 35 developer tools tracked over a seven-week period from 2026-W19 to 2026-W29. We have identified 37 total pricing changes during this window, providing a clear snapshot of how platform tiers are evolving for engineering teams. GitHub Copilot’s Tier Expansion GitHub Copilot has seen significant activity in its subscription structure over the last two months. On May 25, the platform solidified its existing pricing, maintaining the Free tier at $0, Pro at $10/mo, and Pro+ at $39/mo. By June 15, the service introduced a "Max" tier priced at $100/mo. This was followed on July 12 by the addition of two enterprise-focused options: Business at $19/mo and Enterprise at $39/mo. Cursor’s Rapid Plan Iterations Cursor has undergone a series of rapid adjustments to its tiering model since late May. On May 25, the platform introduced a Free Hobby plan and a $20/mo Pro plan while removing the Individual tier. This structure was short-lived; on June 15, the platform removed both the Hobby and Pro tiers, replacing them with a single $20/mo Individual plan. As of the latest tracking, the current price for the Cursor Pro plan is listed at $20/mo. Netlify and Windsurf Pricing Shifts Infrastructure and IDE-integrated tools are also shifting their cost models. On July 12, Netlify moved its Enterprise tier from a "contact sales" model to a defined starting price of $500/month. Windsurf also saw a notable change on June 15 regarding its Teams offering. The price shifted from a flat $40/user/month to a base of $80/mo plus an additional $40/mo per seat. This follows Windsurf's earlier introduction of a Free ($0/month) tier on May 25. Vercel and Firebase Updates Platform-as-a-Service providers have focused on refining their entry-level and usage-based offerings. On May 25, Vercel added a Free Hobby plan and updated its Pro tier to $20/mo (plus additional usage). During that same week, Firebase added a Spark plan ($0) and a usage-based Blaze plan, whi

I would never go so far as to say there's no place for AI in music (I'm a fan of Holly Herndon, after all). But I generally find music made with generative AI to be offensively boring, especially the outputs of Suno. So I'm having a bit of a tough time processing the fact that […]

Clone any website into clean code. Free & open source Discussion | Link

Your personal context file for every agent. Discussion | Link

According to the New York Times, federal agents have been told that the FBI will no longer be investigating confrontations involving ICE agents. The DHS and DOJ denied the change in policy to The Times. The reported change in guidance follows renewed scrutiny of violence by ICE agents who have killed two people in the […]

Manage your team of AI agents by voice, from anywhere Discussion | Link

Free browser tools for everyday tasks, no login Discussion | Link

Welcome back to TechCrunch Mobility, your hub for the future of transportation and now, more than ever, how AI is playing a part.

I’ve been out of context with my computer science degree for years, and honestly, it feels overwhelming. I want to change that, so I'm starting this log to document my comeback story, my failures, and my progress. What I did today: Acknowledged the starting line. Took 10 minutes to think about where I left off and what I need to tackle first. Decided to write daily logs. This is not my first attempt to finish the degree, but hopefully with some public eyes on it, it will be the last. 10 subject left. Starting with Mathematical analysis. The biggest challenge right now: Feeling completely out of context and fighting the urge to get distracted by everything else. Many things have changed since i was actively going to classes. My generation graduated many years ago and i feel like getting all the information I need will be extremely difficult since i don't know anyone. Getting information from the university websites and emailing professors will be slow. Next steps: Tomorrow, I'm going to try to overcome my overdramatic anxiety and post in the student groups I was in, in hope that somebody might have new information about the subjects. I will go start lesson #1. Goal is to ease into the material and start a habit, rather than pressuring myself to do everything at once. Come back tomorrow.

The line between editorial content and paid promotion has been eroding for years. On most major retail platforms, in countless lifestyle publications and across the breadth of social media, content that presents itself as independent assessment is frequently underwritten by the very brands being assessed. This is not a new problem, but it is a worsening one. The consequences are practical. Consumers who believe they are reading a review and acting accordingly may be making purchasing decisions on the basis of what is, in effect, an advertisement. The financial cost of that mistake is modest in most individual cases. The cumulative effect on consumer trust is not. Understanding what separates a genuine review from disguised promotional content requires more than checking for a disclosure label. It requires looking at structure, incentive, methodology and language - and recognising that some of the most effective adverts are those that most convincingly resemble reviews. What a Review Is Actually Supposed to Do A review serves one primary function: to help a reader make an informed decision about a product, service or brand. That function is incompatible with advocacy. A reviewer who is trying to help a reader decide cannot simultaneously be trying to persuade that reader to buy. This distinction sounds obvious. In practice, it collapses quickly when the person writing the review has a financial relationship with the brand, when the product was provided free of charge without conditions, or when the publication depends on advertising revenue from the sector it covers. None of those arrangements automatically invalidates the content produced. But each one creates a structural incentive that pushes in a specific direction - and that direction is rarely towards harder scrutiny. The Disclosure Problem Regulatory frameworks in the UK, including guidance from the Advertising Standards Authority and the Competition and Markets Authority, require that paid-for content be clea

Over the weekend, I participated in the OpenAI Build Week Hackathon with a simple goal: Build something I would actually use as a developer. By Friday evening, I had an idea. By Sunday, that idea became an open source project called Arcovia . It wasn't just another AI coding experiment. I wanted to solve a problem I've faced while working on large React applications for years. The Problem We have excellent tools for code quality. ESLint catches code smells. Prettier formats code. SonarQube reports issues. AI reviews code and suggests improvements. But none of them answer questions like: Is my architecture healthy? Which modules are becoming bottlenecks? Where is technical debt accumulating? Which files should I refactor first? Why did my project receive this score? Architecture is often something we discuss during code reviews or realize too late when the codebase becomes difficult to maintain. I wanted a tool that could measure architecture health before it became a problem. Introducing Arcovia Arcovia is an Architecture Intelligence tool for React and Next.js projects. Instead of generating hundreds of isolated warnings, it analyzes the project as a whole and produces an interactive HTML report. It includes: 📊 Architecture Health Score 🕸️ Dependency Graph 🎯 Architecture Hotspots 📈 Explainable Score Breakdown 🛠️ Rule-based Findings 📉 Maintenance Burden ✅ Actionable Recommendations The goal isn't to replace linting. The goal is to help developers understand the bigger picture. How It Works Internally, Arcovia follows a deterministic analysis pipeline. Project │ ▼ Scanner │ ▼ AST Parser │ ▼ Project Model │ ▼ Dependency Graph │ ▼ Rule Engine │ ▼ Score Engine │ ▼ Interactive HTML Report The analyzer currently detects things like: God Modules High Fan-In High Fan-Out Orphan Modules Large Components Deep JSX Nesting Oversized Modules Duplicate Imports Unused Exports Instead of simply reporting findings, Arcovia combines them into an explainable architecture score. Determ

This is a submission for DEV's Summer Bug Smash: Clear the Lineup , powered by Sentry . Project Overview I built LeakLens Control Room to keep AI away from the financial math. Python calculates every dollar. The optional model explains the evidence. A human decides whether to act. LeakLens is a live, functional restaurant margin-review application built with Python, SQLite, HTML, CSS, and JavaScript. It uses synthetic data in the public demo. The optional application narrative provider defaults to GPT-5.6, but every rate, threshold, ranking, and dollar scenario comes from deterministic code. Then a date string proved that deterministic code can still lie. I had let a raw CSV field decide which operating day counted as "current." Bug Fix or Performance Improvement The symptom LeakLens groups channel metrics by date, sorts those dates, and analyzes the last one against prior days. That works when every input is canonical ISO data such as 2026-07-09 . The loader only checked that the date field was not blank. This input slipped through: metrics = [ DailyMetric ( " 2026-7-9 " , " direct " , 500 , 250 , 0 , 0 , 125 ), DailyMetric ( " 2026-07-10 " , " direct " , 1000 , 50 , 0 , 0 , 250 ), ] July 10 is later than July 9. Python's string ordering sees something else: sorted ([ " 2026-07-10 " , " 2026-7-9 " ]) # ['2026-07-10', '2026-7-9'] LeakLens selected the final string, 2026-7-9 , as the current day. That mistake spread through the report: expected current date: 2026-07-10 actual current date: 2026-7-9 actual gross sales: 500.00 sales-loss scenario: 500.00 discount scenario: 225.00 The input had not shown a current sales collapse or discount leak. The analyzer compared the days backward and produced $725 of false scenario impact from synthetic data. For a restaurant operator, this is worse than a visible crash. A crash asks for attention. A plausible financial report can send someone to audit the wrong promotion, question the wrong manager, or change a schedule that was

TL;DR: Passing a historical blockNumber to eth_call , eth_getBalance or eth_getLogs silently routes your request to the archive tier of hosted RPC providers. In our production metrics, archive calls cost on average 26.7x more compute units than the same call at latest . This post explains why, shows the exact client code pattern that triggers it, and gives you three Prometheus queries to measure your own archive exposure in under a minute. Full cross provider measurements are published in the OpenChainBench RPC benchmarks . Last week our RPC cost dashboard flagged an overage projection above four thousand dollars for a single billing cycle on a single provider. On paper, our services were doing normal eth_call operations. In practice, one small pattern buried in three separate indexers had multiplied our compute unit consumption by more than an order of magnitude, and nothing in the code review process had surfaced it. This post breaks down what an archive multiplier is, why it silently inflates blockchain RPC bills across every major hosted provider, and how to detect it in your own Prometheus stack before the next overage alert lands in Slack. What does "archive" mean at the Ethereum node level? Every request that reads the state of a smart contract, whether through eth_call , eth_getBalance , eth_getStorageAt , eth_getCode , or a batch of these, requires the RPC node to reconstruct the world state at a specific block height. Ethereum clients handle this in two modes. Full node mode. The state trie is kept in memory or on fast SSD for the tip of the chain plus a rolling window of recent blocks. On Geth default settings that window is 128 blocks deep. Any query targeting latest , pending , or a block within that window resolves in a few milliseconds against the current state. Archive node mode. The client preserves every intermediate state trie since genesis. Answering a query at a block from months or years ago requires reading historical trie data off disk and re

TypeScript Generic Constraints in Depth: extends , keyof , and the Patterns That Prevent Runtime Errors This article was written with the assistance of AI, under human supervision and review. Most TypeScript runtime errors stem from unconstrained generics that accept anything and crash on nothing. Teams write function get<T>(obj: T, key: string) and ship code that compiles cleanly but throws Cannot read property 'undefined' of undefined in production. The compiler stays silent because the generic accepts any type and the key accepts any string—no constraint exists to prove the key belongs to the object. Generic constraints solve this by restricting what types a generic parameter can accept. The extends keyword establishes a boundary—the generic must satisfy a specific shape. The keyof operator extracts valid keys from that shape. Together they form a type-level contract that makes illegal property access unrepresentable. The corrected signature function get<T, K extends keyof T>(obj: T, key: K): T[K] proves at compile time that key exists on obj , eliminating the entire class of property-access errors. This distinction is critical. Unconstrained generics provide no safety beyond what any offers. Constrained generics encode domain rules directly into the type system, shifting entire categories of bugs left from runtime to compile time. The patterns that follow demonstrate how production codebases use extends and keyof to build type-safe APIs that fail fast during development instead of silently in production. Key Takeaways Generic constraints with extends restrict type parameters to specific shapes, preventing the compiler from accepting types that would cause runtime failures. The keyof operator extracts object keys as a union type, enabling type-safe property access when combined with extends keyof constraints. Combining T extends SomeType with K extends keyof T creates a compile-time proof that a key exists on an object, eliminating property-access errors. Conditi

Rds challenge lab devto post 🗄️🐬 aws #rds #database #tutorial Build Your DB Server and Interact With Your DB INTRO Did a hands-on AWS challenge lab on Amazon RDS. Task: spin up a managed database, connect from a Linux server, and run real SQL — create tables, insert data, join across tables. No hand-holding here, just requirements to figure out myself. Here's the walkthrough. SCENARIO Service: Amazon RDS Role: Cloud/DB Admin Goal: Launch RDS under set constraints, connect via EC2, run SQL (create, insert, select, join) ARCHITECTURE LinuxServer (EC2) sits in the Lab VPC — this is the client RDS instance (Aurora or MySQL) in the same VPC Security group lets LinuxServer talk to RDS Flow: LinuxServer -> MySQL client (port 3306) -> RDS -> tables STEP 1: LAUNCH THE RDS INSTANCE Constraints for this lab: Engine: Aurora (Provisioned) or MySQL — no serverless Template: Dev/Test or Free tier No standby instance (single-AZ only) Instance size: db.t3.micro to db.t3.medium Storage: gp2, up to 100 GB — no Provisioned IOPS Network: Lab VPC Security group must allow LinuxServer access MySQL only: turn off Enhanced Monitoring On-Demand only These limits keep costs in check — Provisioned IOPS and Multi-AZ are the fastest ways to blow up an RDS bill. Noted the master username, password, and endpoint — needed next. STEP 2: CONNECT TO THE LINUX SERVER Downloaded the PEM key, grabbed the LinuxServer address, connected over SSH: chmod 400 labsuser.pem ssh -i labsuser.pem ec2-user@<LinuxServer-address> This box is just the SQL client — it needs network access to RDS, nothing more. STEP 3: INSTALL MYSQL CLIENT AND CONNECT On the LinuxServer: sudo yum install mysql -y Connect using the master credentials from Step 1: mysql -h <rds-endpoint> -u <master-username> -p If it hangs, it's almost always the security group — check port 3306 inbound. STEP 4: CREATE THE RESTART TABLE CREATE DATABASE lab_db ; USE lab_db ; CREATE TABLE RESTART ( StudentID INT , StudentName VARCHAR ( 100 ), RestartCity VA

Over the past few months, I've been exploring how AI can move beyond chatbots and become an active part of business workflows. That journey led me to build SmartStock AI , an inventory management platform that combines modern web technologies with AI agents, Retrieval-Augmented Generation (RAG), demand forecasting, and automation. Instead of only tracking inventory, SmartStock AI helps businesses make proactive decisions. What SmartStock AI Can Do 🤖 Forecast future product demand 📦 Recommend purchasing decisions through AI agents 📚 Answer inventory-related questions using Hybrid RAG with source citations 📄 Process invoices using multimodal AI ⚡ Generate real-time inventory alerts 🔐 Secure the platform with JWT authentication and role-based access control Technology Stack Frontend React 19 Backend Django 5 Django REST Framework Database PostgreSQL pgvector AI LangChain Hybrid RAG AI Agents Prophet Forecasting Infrastructure Celery Redis Docker GitHub Actions What I Learned Building SmartStock AI taught me much more than integrating an LLM into an application. Some of the biggest lessons were: Designing AI features that solve real business problems. Building reliable agent workflows instead of simple chatbot interactions. Combining vector search with structured database queries. Managing asynchronous AI tasks using Celery and Redis. Creating production-ready APIs with Django REST Framework. Deploying and maintaining a modern full-stack application. Demo 🎥 YouTube Demo https://www.youtube.com/watch?v=DQJqs6bgE98 🌐 Live Demo https://smart-stock-dev.vercel.app/ Demo Account Email: viewer@smartstock.ai Password: Viewer123! 💻 GitHub Repository https://github.com/Eng-Ayman-Mohamed/SmartStock-AI Final Thoughts This project was developed as my graduation project during the Information Technology Institute (ITI) Full Stack Web & Generative AI Program. It was an incredible opportunity to explore AI engineering, backend architecture, and modern software development while buildin

Reading a public website and changing something inside a signed-in account are not the same kind of job. I wanted an AI agent to collect the first 10 Hacker News stories, explain how it gathered them, and place that work inside my DEV editor. Save the article as a draft. Do not publish it. The hard part was not finding the stories. It was giving the agent enough access to finish inside my signed-in account without giving it permission to publish. That instruction contained two jobs with different access needs: Read public data from Hacker News. Change private account state by creating a draft in my signed-in DEV account. Using a full browser for the first job would add machinery and access that the result did not need. The public fetch path had neither the authenticated context nor the authority required for the second job. The useful question was not “Which browser tool should do everything?” It was “Where does this task actually cross into a browser?” Disclosure: I work on Unchained, SearchAgentSky, and Unbrowser. This article was prepared with AI assistance and reviewed before publication. The public step needed only fetch I initially opened Hacker News in a lightweight page session and queried its story links. It worked—but that did not mean it was necessary. Hacker News has a public API . The same result could be produced with ordinary HTTP: const base = " https://hacker-news.firebaseio.com/v0 " ; const ids = await fetch ( ` ${ base } /topstories.json` ). then ( r => r . json ()); const stories = await Promise . all ( ids . slice ( 0 , 10 ). map ( async ( id , index ) => { const story = await fetch ( ` ${ base } /item/ ${ id } .json` ). then ( r => r . json ()); return { rank : index + 1 , title : story . title , url : story . url ?? `https://news.ycombinator.com/item?id= ${ id } ` }; })); console . log ( JSON . stringify ( stories , null , 2 )); At 2026-07-19T03:19:04Z , the page query returned 30 Hacker News story anchors. At 2026-07-19T03:35:29.670Z , fetch

Bluetooth may seem the obvious next step in the remote's evolution, but there are reasons that infrared hasn't died out.

**🙄 فى كتاب chapter الصدمة دي هي بالظبط اللي حسيت بيها وأنا بقرأ أول “operating system: three easy Pieces “ ‘OSTEP’. 🖤اهلا بيكم ! يارب تكونوا بخير 💯 حابه اشارك معاكم رحلتى مع قراءة الكتاب ونستفيد منه سوا قبل ما نعرف هو !!!! ولا لا OS is virtual machine 🤔 !!!!دا يعنى ايه ووظيفته ايه OS تعالوا الاول نعرف ال موجودة فى الكمبيوتر ولا لا ؟؟؟؟ RAM وال CPUزى ال HARDWARE وهل هو قطعة ::هنبدأ من الاخر موجود على الكمبيوتر SW هو عبارة عن HW يسيدى مش قطعة OSال .على الجهازINSTALL ولازم يبقى ووظيفته ايه؟؟؟ OS طب يعنى ايه ‘OS’ اختصار “OPERATING SYSTEM”. .“يعنى نظام تشغيل “ .👁‍🗨👁‍🗨 تعالوا نعرف معنى ” نظام تشغيل” ونفسرها نظام تشغيل يعنى مسئول عن 1_ “HWالنظام “من غيره مش هيبقى فيه نظام خصوصا لقطع ال . يعنى بناخد منه الاذن للعمليات HW ببعضه وكمان بيدير ال HWيعنى هو بيربط ال 👏 . (Order)من الاخر بيخلق “النظام” 2_.”التشغيل “هو المسئول عن تشغيل البرامج Learn about Medium’s values هو اللي بيتحكم في دورة حياة البرنامج بالكامل؛هو اللي بيبدأ تشغيله في الذاكرة،OSيعني الـ وبيحدد هو محتاج إيه من إمكانيات الجهاز عشان يشتغل بكفاءة وبيفضل مراقبه ويحميه طول ما هوشغال ، ولحد ما تقفليه بنفسك 🌹 .ويقوم هو بتنظيف الذاكرة وتوفير المساحة لغيره 🧐::وظيفته بقا بيخلي البرنامج يشتغل بسهولة:1️⃣ لأنه بيخلق للبرنامج بيئة وهمية مريحة، وبيخفي عنه كل التعقيدات والأسلاك بتاعة الهاردوير عشان يشتغل بسلاسة 2️⃣: بيسمح للبرامج إنها تشارك الذاكرة بين كل البرامج بالعدل RAM بيشتغل كعسكري مرور بيوزع مساحة الـ . وبيحمي كل برنامج في مساحته الخاصة 3️⃣: بيمكن البرامج إنها تتعامل مع الأجهزة بيعمل كـ “وسيط” أو مترجم بيوصل كود البرنامج بالقطع الحقيقية (زي الشاشة أو الهارد) .عشان ينفذ أوامره فوراً بيعمل التلات حاجات دول إزاي في نفس الوقت وبمنتهى السلاسة؟ ؟؟؟OS طب الـ بيعملهم يسيدى عن طريق أكبر خدعة سحرية في عالم الكمبيوتروهي الـ Virtualization👌 كنت حابة جداً أكلمكم المرة دي عن خدعة الـ “Virtualization” 💎 😌👁👁اللي اتكلمنا عليها في العنوان، بس لقيت البوست هيبقى طويل أوي عليكم ✔🔥!!وعشان متعبكمش معايا.. هنخليها للبوست الجاي إن شاء الله 💯✅!!بيعمل الخدعة دي إزاي OSاستنوا البوست الجاى عشان نعرف الـ 💋.دمتم بخير **