TLDR DEV 2025-10-24

GET 50% OFF WITH CODE TLDR. Register here

HACKING FORMULA 1: ACCESSING MAX VERSTAPPEN'S PASSPORT AND PII THROUGH FIA BUGS

Devs discovered a vulnerability in the FIA Driver Categorisation portal that allowed them to escalate their privileges to administrator. This admin access granted them the ability to view sensitive PII, including passports and resumes, of F1 drivers like Max Verstappen. The vulnerability was reported to the FIA, which took the site offline and implemented a fix.

4 UNCONVENTIONAL WAYS TO CAST IN TYPESCRIPT

This article goes over four unconventional methods to cast between types in TypeScript, showing potential unsoundness in the language's type system. These methods include abusing the `is` operator, using mutation across boundaries, exploiting structural typing, and manipulating `void` type combinations. While TypeScript generally provides good type safety, these techniques can introduce subtle bugs and unsafety.

HOW MEMORY MAPS (MMAP) DELIVER 25X FASTER FILE ACCESS IN GO

Memory maps in Unix allow a file to be mapped into virtual memory, enabling direct reads via pointers instead of slower seek/read operations. Benchmarks in Go show memory maps can be up to 25 times faster than using `ReaderAt` for random lookups and iterations. While writing to memory maps is inefficient due to page faults, they can still be great for read-heavy operations when files are cached.

THE PRICE OF MANDATORY CODE REVIEWS

Based on data from 400+ companies and 3,000+ engineers, this article challenges the mandatory code review practice in software development. The research found that teams without code reviews are 1.9x more productive but produce 2.4x more bugs, while high-quality reviews (though 38% slower) reduce bugs by 61% compared to low-quality ones. Top-performing teams (90th percentile) achieve both speed and quality by being selective about when reviews are needed.

WHAT HAPPENED TO APPLE'S LEGENDARY ATTENTION TO DETAIL?

Apple's attention to detail, a hallmark of the brand, has declined in the last 8-10 years. This article points out inconsistent UI design across apps, intrusive permission requests, and the buggy, visually flawed "liquid glass" design as evidence of a decline in user experience.

traceability. Join live

WORKFLOW

Workflow is a beta TypeScript framework that simplifies building durable and reliable asynchronous JavaScript applications and AI agents. It allows devs to define workflows and steps with simple directives, handling state management and retries automatically. The framework has built-in observability with traces, logs, and metrics.

INTRODUCING PYTORCH MONARCH

PyTorch Monarch is a distributed programming framework that makes cluster programming easier by treating resources as local, similar to single-machine Python. Monarch organizes resources into meshes, enabling operations on entire clusters with fault handling and separation of control and data planes. It provides distributed tensors that integrate with PyTorch, allowing operations across thousands of GPUs.

WEB CODEGEN SCORER

Web Codegen Scorer is a tool developed by the Angular team at Google for evaluating the quality of web code generated by LLMs. It focuses on web code quality and allows users to compare models, iterate on prompts, and monitor code quality over time using built-in checks like build success, security, and coding best practices.

LIVING DANGEROUSLY WITH CLAUDE

Running coding agents like Claude with unrestricted permissions comes with increased productivity and the ability to outsource tasks, but also makes Claude vulnerable to prompt injection attacks. The safest thing to do is to sandbox coding agents, ideally on external systems with controlled network access, to mitigate these risks.

PROGRAMMING WITH LESS THAN NOTHING

An interviewer asks a candidate to solve FizzBuzz, and the candidate responds by attempting to implement the entire problem using combinatory logic in JavaScript. The interviewer is initially skeptical, recognizing the approach as an exercise in reinventing programming primitives from lambda calculus. The candidate then constructs numbers, lists, and string manipulation functions using combinators, eventually producing the desired FizzBuzz output.

TYLER TRIES DTRACE

This dev explored Node.js backpressure by modifying a Node.js build to disable it, using DTrace to measure garbage collection times, and found that disabling backpressure greatly increases garbage collection effort.

WHEN YOU GET TO BE SMART WRITING A MACRO

This dev improved their debugging tool, `hashp` (a better `println`), to work seamlessly within Clojure's thread-first (`->`) and thread-last (`->>`) macros by using a clever probe technique that dynamically detects the macro's context.

WHY /DEV/NULL IS AN ACID COMPLIANT DATABASE

Technically, `/dev/null` is an ACID-compliant database due to its atomic, consistent, isolated, and durable behavior, despite offering 0 bytes of storage.

SURF

Surf is an open-source, local-first AI notebook that helps users research and synthesize information from various media types by integrating files and web resources directly into a streamlined workflow.