Parse notes
Sponsored
On March 27, seasoned engineering and product leaders will take the (virtual) stage at Swarmia Circle, a half-day event [4] centered on the 3 pillars of engineering effectiveness: business outcomes, developer productivity, and developer experience.
Chrome's new built-in AI APIs can be used to correct typos in user input. This article experiments with both the general-purpose Prompt API and the Rewriter API, providing code snippets and examples of their performance on deliberately misspelled text. The Prompt API produced cleaner, but slightly altered results, while the Rewriter API stayed closer to the original phrasing but sometimes failed to correct all errors.
A memory-safe JSON parser can be made in C using struct methods for a more ergonomic API. The parser represents JSON values using a `json_value` struct with unions for different data types and includes functions for freeing memory and printing the parsed structure. The parsing process combines lexing and parsing into a single pass, handling atoms (numbers, null, true, false), strings, arrays, and objects with helper functions for whitespace skipping and error handling.
By default, browsers allow cross-site write requests but restrict cross-site reads, a behavior governed by the Same-Origin Policy. CORS is a mechanism to selectively allow cross-origin requests, while CSRF protection uses tokens to verify the legitimacy of requests. CSRF protection is especially important for simple POST requests allowed cross-site.
Including an "Other" enum value can create too much ambiguity as new enum values are added later. Returning new values contradicts the meaning of "Other" as "not mentioned elsewhere." Instead, document the enum as open-ended, letting each application define its own "Other" category for unrecognized values.
Video game speedrunners use reverse engineering, static/dynamic analysis, and custom tooling to discover and exploit game glitches, which is similar to techniques used by cybersecurity professionals. Their skills translate directly to valuable security roles and should be used more often for testing security in software in general.
Northflank ditched Next.js because they found it had negative SEO impacts for them, poor performance at scale, and also was a "black box" during debugging. They replaced it with a custom React SSR solution using Express.
BLAFS is a bloat-aware filesystem that reduces container size by identifying and removing unused files, leading to smaller, faster, and still functional containers.
Maestro is a UI testing framework for mobile and web apps. It addresses flakiness and delays inherent in mobile testing with built-in tolerance and fast iteration. The framework uses a declarative YAML syntax, has a simple setup with a single binary, and is open-source.
After struggling with Git, this developer created Git-Sim to visualize Git commands, but realized it only helped those already familiar with Git. To make Git more accessible, they created Devlands, a voxel-world game where users can explore Git concepts and codebases in an immersive, tangible way. Devlands has a Git tutorial and a freeform mode to interact with files, commits, and branches within the game world.
A security researcher discovered a vulnerability in todesktop, an Electron app bundler service, that could allow remote code execution on millions of users of popular applications like ClickUp, Cursor, and Linear. The researcher found hardcoded Firebase credentials and secrets within todesktop's deployment pipeline, letting them push malicious auto-updates to any application using the service. They promptly reported the issue to todesktop, who quickly implemented a fix involving a privileged sidecar for signing and uploading.
Slow Xcode builds can often be due to unnecessary connections to developerservices2.apple.com during the "Gather provisioning inputs" phase. This developer blocked these connections with Little Snitch, which sped up builds. He also found that Xcode connects to devimages-cdn.apple.com on launch and appstoreconnect.apple.com whenever an Xcode project is opened, likely to send data to Apple.
Despite advancements in JavaScript tooling and the unification of client and server-side rendering, the sheer amount of JavaScript frameworks and the challenges of choosing the right one continue to create "JavaScript fatigue" for developers.
This developer, with no prior OpenGL experience, rendered 1 million dynamic, lit, and textured spheres at 60 FPS by porting a C++ OpenGL implementation to WASM/WebGL after encountering performance issues on their local machine.
VSCode has a lack of transparency and inconsistently applies security measures in remotely uninstalling an extension based on a potentially flawed threat analysis.
A developer discovered that LLMs like ChatGPT sometimes suggest a non-existent syntax for dynamically preloading associations in Rails, which ironically originated from a flawed idea they themselves posted on a Rails forum years ago.