Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A flaw in Google's "Sign in with Google" OAuth allows attackers to access accounts of former employees at defunct startups by purchasing the company's domain. This vulnerability affects millions of Americans, granting access to sensitive data across various SaaS platforms like Slack, Notion, and HR systems containing social security numbers. Google is currently working on a fix.
rqlite is a distributed relational database that uses a testing strategy based on the testing pyramid. This strategy prioritizes comprehensive unit testing of individual components, followed by integration tests focusing on the interaction between Raft consensus and SQLite. A minimal set of end-to-end tests verify basic functionality, while performance testing pushes the database to its limits under heavy load.
React Server Components (RSCs) come with the "double data problem," where the same data is sent as both HTML and a "payload" (serialized React Element tree), potentially increasing bandwidth usage. RSCs use techniques like streaming and React's `Suspense` to optimize performance, but careful consideration of component placement (client vs. server) is necessary to avoid issues.
This developer rewrote their simple website from SvelteKit to plain HTML and CSS due to frustration with the Javascript bundler and build process, available free time, and a desire to migrate to Cloudflare Pages. The rewrite involved using Pandoc to convert Markdown blog posts to HTML, Python with the `uv` library for scripting, and the `http.server` module for serving the site. The result was a significantly smaller website (~88kb vs ~356kb).
This post goes over common mistakes new Rust programmers make. These mistakes include neglecting dedicated study time, diving into complex algorithms without sufficient foundational knowledge, and misinterpreting compiler errors and warnings. Best practices from other languages don't always apply directly to Rust, especially due to Rust's unique ownership and borrowing system.
Using `navigate(-1)` in Remix/React Router for creating "Back" links can be problematic as it accesses the browser's history, potentially navigating outside the application. A better approach is to use the `Link` component's `state` property to pass a `back` URL, allowing controlled navigation within the app.
Pyper is a pure Python framework for concurrent and parallel data processing that simplifies building data pipelines using a functional paradigm. It has an intuitive API to unify threaded, multiprocessed, and asynchronous operations safely.
Mirai is a Server-Driven UI framework for Flutter that allows developers to build dynamic, cross-platform apps using JSON configurations. It simplifies UI delivery, allowing for real-time updates without redeployment, and supports mobile, web, and desktop platforms.
pnpm 10.0 released with improved security by no longer running lifestyle scripts of dependencies by default, improved hashing, and other performance & feature improvements.
Achieving a "modern" terminal setup can be frustrating. Key aspects of a modern experience include multiline paste support, infinite shell history, and 24-bit color. Popular shells like bash and zsh often lack essential features out-of-the-box.
Using cosine similarity carelessly when comparing vectors generated from text embeddings can be problematic. While seemingly simple and widely used, cosine similarity often fails to capture true semantic similarity, instead focusing on superficial aspects like writing style or matching questions to questions rather than questions to answers. More effective approaches include directly querying LLMs for similarity comparisons, training task-specific embeddings, and pre-processing text to remove irrelevant information before embedding.
Traditional engineering metrics like features shipped or lines of code focus on outputs, which often fail to capture the true impact of engineering efforts. Outcome-oriented metrics, such as customer retention, feature adoption, and revenue growth, better align with business goals by measuring value delivered.
When creating deep copies of nested JavaScript objects, using `structuredClone` instead of shallow cloning methods like the spread operator (`...`) prevents unexpected state mutations by verifying that all nested objects and arrays are duplicated, not just referenced.
This website provides a collection of examples that demonstrate various FFmpeg functionalities, like extracting multiple video clips with one input.
"Epoch Semantic Versioning” is a new versioning scheme that extends Semantic Versioning by adding an "Epoch" number to better communicate the significance of changes, addressing the limitations of zero-major versioning and the logarithmic human perception of version numbers.
In 2024, Express.js released version 5.0, improved governance, enhanced security measures, and increased community engagement.
React's first animation API, `ViewTransition`, is built upon the browser's View Transition API. It offers animation capabilities previously unavailable in React. The View Transition API has limitations like uninterruptible animations and complex pseudo-element management. `ViewTransition` fixes these by integrating deeply with React's render cycle and using asynchronous updates.
Shopify successfully transitioned all its mobile apps to React Native over five years. This decision resulted in blazing-fast and stable apps, exceeding its performance goals. While it still had common React Native challenges like debugging and updates, Shopify found the benefits of React Native, like hot reloading and Typescript's contribution to talent flexibility, very useful.
Many tools today natively support TypeScript, including frameworks (e.g., Next.js, Astro), runtimes (e.g., Deno, Bun), and bundlers (e.g., Vite, Parcel), reducing the need for custom configuration. With Node.js soon supporting TypeScript by default, the ecosystem is shifting toward making TypeScript integration a standard.
Consumers should have the “right to root access,” which means they have the freedom to install any software on devices they own outright regardless of the device type. Currently, manufacturers often lock bootloaders and restrict software installation for “security reasons.”
A/B testing is inefficient and flawed because it sacrifices user experience for data. A better alternative is the "multi-armed bandit" algorithm, specifically the epsilon-greedy method, which allows for simultaneous testing of multiple options and dynamically optimizes choices based on real-time performance.
Sponsored
Semantic reranking often improves relevance, particularly in a zero-shot setting, and can also be used to trade-off indexing compute cost for querying compute cost. This blog post [9] introduces semantic reranking and how it can fit into your search and RAG pipelines. Read
werk is a new build system written in Rust that addresses shortcomings found in existing tools like make and just. These shortcomings include unreliable handling in spaces in file paths and cross-platform compatibility. werk is a simpler, more portable, and easier-to-debug alternative for building complex projects, especially video games.
trimMiddle shortens strings by removing characters from the middle and replacing them with a specified filler. It handles emojis correctly.
The legal battle between WordPress's creator Matt Mullenweg and WP Engine has caused a lot of issues in the WordPress community. Mullenweg's actions, including a prolonged WordPress.org holiday break and a drastic reduction in Automattic's open-source contributions, have led to community unrest. This has led to the resignation of key members from the WordPress Sustainability committee.
Screen readers rely on the accessibility tree to help users with disabilities navigate and interact with web apps, providing information about element roles, labels, states, and hierarchy. Proper accessibility testing involves using multiple screen readers, double-checking proper keyboard navigation, focus management, descriptive labels, and dynamic content announcements.
Expo SQLite and Drizzle can be used together to make using a local database in React Native. The combination offers type safety and developer-friendly abstractions, removing the need for raw SQL queries (though they still can be used) and manual schema management.
2024 saw advancements in JavaScript tooling, including new and improved frameworks, package managers, and runtimes, but the most impactful changes were the emergence of AI-powered tools capable of generating and deploying entire applications.
Optimizing Interaction to Next Paint (INP) in React apps can be done by reducing DOM size, dividing components into simple and extended versions, using `Suspense`, handling hydration errors, and carefully using `useEffect()`.
LLMs offer a productivity boost by automating a large portion of coding tasks.
Microsoft created a new "CoreAI – Platform and Tools" engineering team to develop an AI-first application stack for building and deploying agentic AI applications and workflows.
Sponsored
In 2021, you could get 6-figure salaries straight out of a bootcamp. Today, a high-quality education is essential to advance your career in Big Tech or the startup world.
Looking to advance to executive positions?
In 2015, the author prevented a repeat of a previous system failure caused by a leap second by implementing "leap smearing." This involved subtly slowing down the company's internal time for 20 hours before the leap second, making it effectively one second behind the rest of the world. The author tested this method extensively using custom-built clocks and various systems.
Canva experienced a major outage triggered by a seemingly innocuous deployment of a new editor page. A stale Cloudflare traffic rule misrouted user traffic over the public internet, causing latency and a backlog of 270,000+ requests for JavaScript files. This led to a "thundering herd" effect, overwhelming Canva's API gateway with 1.5 million requests per second. Canva engineers mitigated the outage by manually increasing capacity and using Cloudflare's firewall to temporarily block traffic.
The author re-created a Bad Apple music video within Vim using only search queries. The process involved converting the video frames into binary data, representing each pixel as a character in a Vim-compatible grid using a square font. They then developed algorithms to decompose each frame into a minimal set of rectangles, which are expressed as complex Vim search patterns. Finally, a Vim macro iterates through these patterns.
Daishi Kato, the creator of the popular React state management libraries Zustand, Jotai, and Valtio, discusses the future of them in light of the React Compiler and Server Components (RSCs). The React Compiler's optimization capabilities may diminish the core need for these libraries by removing unnecessary re-renders, a problem they currently solve. RSCs also lessen the reliance on these libraries for server-side state caching. However, these libraries still offer valuable features like state organization and composability.
Widespread serverless adoption hasn't occurred due to lingering challenges from the previous microservices transition and concerns about making complexity worse, and organizational readiness lags too. The shift to serverless requires investment in new infrastructure and tooling to support the fragmented architecture.
Trying out new software services is often frustrating due to the relentless sales tactics of companies. This often involves a series of unwanted calls and demos showcasing irrelevant features. This has led the author to switch to open-source alternatives often, freeing them from the cycle of unwanted sales interactions.
Sponsored
RAG is table stakes for modern AI applications. Learn how you can make it more effective and impactful by using human-labeled datasets, appropriate metric choices (recall vs. precision), and employing advanced techniques [13] such as parallel queries and agentic RAG.
Dockview is a zero-dependency layout manager supporting React, Vue, and TypeScript. It has features like tabbed views, grids, and split-views with an API.
Txtlog is an open-source text log service that handles various data formats, including JSON and raw text. It offers features like automatic GeoIP checks and a functional dashboard. Users can log application data via POST requests or use provided scripts for monitoring server logins on Linux and Windows systems.
Tabby is a self-hosted, open-source AI coding assistant. Recent updates include Llamafile deployment integration and improved Answer Engine functionality.
As VP of Engineering, James Shore addressed his CEO's request to measure software engineering productivity by defining the "best product engineering organization" through six key areas: People, Internal Quality, Lovability, Visibility, Agility, and Profitability. He detailed strategies for improvement in each area, including fostering an “Extreme Programming” culture, improving code quality through iterative refinement rather than large-scale rewrites, and using a "product bets" system for strategic prioritization. For reference, “Extreme Programming” practices include evolutionary design, merciless refactoring, and test-driven development.
Researchers have discovered that some developers are exploiting a loophole in Google's Chrome Web Store to promote shady extensions through keyword manipulation. They achieve this by hiding thousands of irrelevant keywords in lesser-used language translations within extension descriptions, manipulating search results to prioritize their extensions over legitimate ones.
v0, Bolt, and Lovable each offer distinct strengths for building web applications. v0 is great at rapid UI prototyping, especially within the React ecosystem, while Bolt prioritizes full-stack development speed in a browser-based environment. Lovable focuses on guided full-stack development and collaborative features.