Frontend Feeds

Today

Front-end, in one read.

The latest from the sources worth following, newest first.

  • David BushellMore Front-end Bloggers3 min read

    Cloudflare killed Deno and look I’m on TV!

    ““Didn’t you already say goodbye to Deno? Get new material!””I know, I know, but not even a week after declaring my friendship over with Deno they actually killed Deno! The runtime is going away, and sorry call me pessimistic, but I highly doubt a community fork of any value will survive for long. […]

  • DEV CommunityThe Giantsread at source

    Best Tools for Managing Parallel AI Coding Agents in 2026

    I’ve been looking at how AI coding agents are changing the way developers work, and one thing is becoming clear: the real opportunity isn’t just getting one agent to write code faster. It’s being able to run several agents at once without losing control of the development process. Imagine having one agent work on a new feature, another fix a bug, and a third write tests, all at the same time. That sounds great until they start making conflicting changes, duplicating work, or leaving you to figure out what each one has actually completed. This is where the right tools make a difference. Managing parallel AI coding agents requires more than launching multiple sessions. You need a way to organize tasks, keep work isolated, monitor progress, and review the results before anything gets merged into your codebase. I wanted to look at the tools that make this workflow easier, from platforms built specifically for coordinating AI agents to coding environments that support background execution and parallel sessions. Here are the best tools for managing parallel AI coding agents in 2026, along with what each one offers and where it fits best. What to Look for in a Parallel AI Coding Agent Tool Before choosing a tool, I think it’s worth looking at how it handles the practical challenges of running multiple agents. Task coordination: Can you assign separate tasks to different agents and track their progress? Workspace isolation: Can agents work independently without accidentally overwriting one another’s changes? Agent compatibility: Does the tool work with the coding agents and models you already use? Review and integration: Can you inspect changes, compare diffs, run tests, and decide what gets merged? Visibility: Can you quickly identify which agents are running, blocked, or finished? Scalability: Can you increase the number of concurrent agents without overwhelming your machine or development workflow? Not every tool handles all these responsibilities. Some focus on running coding agents, while others help coordinate the broader development process. 1. Sharkly: Best for Coordinating AI Agents Across Development Tasks When I think about managing parallel AI coding agents, I think beyond simply opening several coding sessions. I want a place where tasks are organized, agents can work independently, and I can see what is happening without constantly switching between terminals. That is the problem Sharkly is designed to address. Sharkly brings product and engineering work into a shared workspace. Teams can organize backlogs, manage tasks, assign work to AI agents, and track progress as the agents execute their assignments. Instead of treating each agent session as a separate activity, the workflow connects agent execution to the tasks the team is trying to complete. One useful part of this approach is workspace isolation. When tasks run in separate working directories or worktrees, agents can work on different assignments without automatically modifying the same working files. That makes it easier to run work in parallel while keeping the results organized for review. Sharkly also supports multiple coding agents, including Claude Code, Codex, Gemini CLI, and other supported agent environments. Teams can use their existing coding-agent setups rather than being forced into a single model or provider. Another practical consideration is that Sharkly supports Jira imports and two-way synchronization during migration, which can help teams that already manage their work in Jira. What I like about the approach: It treats parallel agent execution as part of the development workflow, rather than simply a way to open more coding sessions. Best for: Engineering teams that want task management, agent execution, and progress visibility in one place. Considerations: The value depends on how much coordination your workflow needs. Developers who only want to run a couple of isolated agents locally may prefer a lighter setup. Website: Sharkly.ai 2. OpenAI Codex: Best for Running Multiple Coding Tasks in Parallel OpenAI Codex is another option worth considering if you want AI agents to handle several development tasks concurrently. The Codex app supports working with multiple agents and threads, allowing developers to delegate different coding tasks instead of waiting for one task to finish before starting another. Its support for worktrees can also help keep changes isolated when agents are working on different parts of a codebase. For example, I could assign one task to investigate a failing test, another to implement a small feature, and a third to review an existing implementation. I would then inspect each result and decide which changes are ready to integrate. This workflow is particularly useful when tasks are reasonably independent. If two agents need to rewrite the same core component, parallel execution can create more review work than it saves. Codex is appealing because it brings agent execution and code review into a developer-focused workflow. However, teams that need a shared task-management layer across many projects may still want a separate coordination platform. Best for: Developers who want to delegate multiple coding tasks and review their results within the Codex ecosystem. Considerations: Parallel execution does not remove the need to define task boundaries, run tests, and review changes before merging. Website: OpenAI Codex 3. Cursor Background Agents: Best for Asynchronous Coding Tasks Cursor is well known as an AI-powered code editor, but its background-agent capabilities also make it relevant for parallel development. Background agents can work asynchronously in remote environments, allowing developers to delegate tasks without keeping every operation in the foreground. Depending on the workflow, agents can work on code, make changes on branches, and return results for review. I find this approach particularly useful for tasks that take time but do not require constant interaction. For example, I could ask an agent to investigate a bug or implement a self-contained improvement while continuing to work on another feature locally. The remote execution model also means that background work does not have to consume all the resources on your own development machine. That can be helpful when running several tasks, although concurrency, usage limits, and pricing depend on the applicable plan and product configuration. Cursor is a strong option for developers who already use its editor and want to extend their workflow with asynchronous agents. Best for: Developers who want background coding tasks integrated into their existing Cursor workflow. Considerations: Remote execution and branch-based changes are helpful, but developers still need to coordinate overlapping tasks and review the output. Website: Cursor 4. Conductor: Best for Managing Multiple Coding Agents in Separate Workspaces Conductor focuses on running multiple coding agents concurrently while keeping their work organized in separate environments. Rather than making every agent operate in the same working directory, Conductor gives parallel tasks their own workspaces. This helps developers run multiple sessions, inspect their changes independently, and manage the results without constantly switching between manually configured environments. It supports several coding-agent workflows, including Claude Code, Codex, Cursor, and OpenCode. This makes it worth considering if you prefer to choose an agent based on the task rather than standardizing on one tool for everything. For instance, I could use one agent to implement a feature and another to investigate a separate issue. Each can work in its own environment, reducing the chance that one task will interfere directly with another's uncommitted changes. The main advantage is organization. When several agents are active, having a clear view of their workspaces and changes can make the development process easier to manage. Best for: Developers who want a dedicated environment for running multiple coding agents side by side. Considerations: Separate workspaces help prevent direct file collisions, but changes can still conflict when they are eventually combined. Website: Conductor 5. Claude Code: Best for Developers Who Want Flexible Agent Workflows Claude Code offers several ways to work with multiple agents, making it useful for developers who want more control over how coding tasks are delegated. Its subagent capabilities allow a primary agent to delegate certain tasks to specialized agents. For example, one agent might investigate a problem while another explores the relevant code or performs a separate analysis. Developers can also use multiple Claude Code sessions and Git worktrees to keep independent coding tasks separated. This is useful when you want to work on different features or investigations without making every agent share the same files. The important distinction is that running multiple Claude Code sessions is not the same as having a complete team-wide task coordination system. Developers still need to decide how tasks are divided, how branches are managed, and how completed changes are reviewed. For people who enjoy customizing their development environment, that flexibility can be an advantage. Best for: Developers who want agent-assisted coding, delegated sub-tasks, and flexible terminal-based workflows. Considerations: More control can mean more setup and coordination, particularly when managing many independent tasks. Website: Claude Code 6. Git Worktrees: Best for Lightweight, DIY Parallel Development Git worktrees are not an AI coding agent manager, but I would still include them in this discussion because they solve one of the most important problems with parallel coding: workspace isolation. A worktree allows you to check out another branch of the same Git repository into a separate directory. Instead of repeatedly switching branches in one working directory, you can have multiple working directories available at the same time. That makes it possible to run separate coding agents against separate worktrees. One agent might implement a feature while another fixes a bug in a different worktree. The benefit is that the agents do not automatically edit the same working files. You can inspect each branch, run tests, and integrate the changes when they are ready. However, worktrees do not provide task assignment, agent monitoring, or automatic conflict resolution by themselves. You still need to manage the sessions, track progress, and decide when to merge changes. Best for: Developers who want a lightweight way to run parallel agents using their existing Git workflow. Considerations: Worktrees require some manual coordination, and separate branches can still produce merge conflicts. Documentation: Git Worktree 7. OpenAI Agents SDK: Best for Building Custom Multi-Agent Systems The OpenAI Agents SDK takes a different approach from the developer tools above. Rather than providing a ready-made interface for coordinating coding sessions, it gives developers building blocks for creating agent-powered applications and workflows. You can define agents with different instructions and tools, then configure how work is handed off or delegated. In suitable workflows, a coordinating agent can assign independent tasks to other agents and combine their results. For example, a custom development assistant could ask one agent to analyze a bug report, another to identify relevant code, and a third to propose tests. A coordinating workflow could then collect the findings and present them for review. This approach offers considerable flexibility, particularly if you want to build your own internal developer platform or automate a specialized engineering process. However, it also means that you are responsible for implementing the surrounding workflow. Workspace isolation, task tracking, Git operations, access controls, and code review may require additional components. Best for: Developers and engineering teams building custom multi-agent applications or orchestration systems. Considerations: It is a framework for building agent workflows, not an out-of-the-box project-management interface for parallel coding tasks. Documentation: OpenAI Agents SDK Quick Comparison These tools are not direct substitutes for one another. Some focus on executing coding tasks, some provide a way to isolate work, and others help coordinate the wider development process. How I Would Choose the Right Tool After comparing these options, I would start with the main problem I am trying to solve rather than the number of agents a tool claims to support. If I want task management and agent execution together, I would look at Sharkly. It connects agent assignments to a broader engineering workflow, which is useful when several people and agents are contributing to the same projects. If I mainly want to delegate coding tasks, I would consider Codex or Cursor Background Agents, depending on the environment I already use. If workspace separation is my biggest concern, Conductor or Git worktrees would be worth exploring. Both approaches help keep concurrent work organized, although the amount of manual setup differs. If I want more control over how agents collaborate, Claude Code or the OpenAI Agents SDK may be a better fit. The former supports flexible coding-agent workflows, while the latter is useful when building custom orchestration. I would also consider the cost of running agents concurrently. More agents can mean more compute usage, model consumption, and review overhead. Starting with two or three independent tasks is often more useful than immediately trying to run ten agents at once. Best Practices for Managing Parallel AI Coding Agents Choosing a tool is only part of the equation. How you structure the work matters just as much. 1. Give Each Agent a Clear, Independent Task Avoid assigning several agents vague instructions such as "improve the application." Instead, define the expected outcome, relevant files or components, constraints, and acceptance criteria. For example, an agent can update input validation while another adds tests for an unrelated service. This makes it easier to identify overlapping work before execution begins. 2. Isolate Workspaces Where Possible When agents share the same working directory, their changes can interfere with each other. Separate worktrees or isolated execution environments help reduce this risk. Isolation does not eliminate every problem, though. Two agents working on separate branches can still make incompatible changes to the same API or shared component. 3. Track Progress and Blockers When multiple agents are running, it is easy to lose track of which tasks are complete and which are waiting for input. Use a task board, agent dashboard, or another tracking system to record assignments, status, blockers, and results. This becomes increasingly important as the number of concurrent tasks grows. 4. Limit Concurrency to What You Can Review Running more agents does not automatically make development faster. If ten agents finish at the same time and you cannot review their work, you may simply move the bottleneck from coding to quality assurance. Start small, measure how much review each task requires, and increase concurrency only when the workflow can support it. 5. Review and Test Every Change Treat agent output as a proposed change, not a guarantee of correctness. Inspect the diff, run relevant tests, and check for regressions before merging. For important changes, consider security, performance, dependency updates, and compatibility with the rest of the application. 6. Keep Dependencies Between Tasks Explicit Some tasks cannot begin until others are finished. For example, a frontend agent may depend on an API contract that another agent is still implementing. Identify these dependencies in advance. Run independent work in parallel and sequence tasks that depend on one another. Frequently Asked Questions What does it mean to run AI coding agents in parallel? It means running multiple AI agents on separate coding tasks at the same time rather than completing every task sequentially. Depending on the tools, agents may run in separate sessions, worktrees, remote environments, or coordinated workflows. Can multiple AI coding agents work on the same repository? Yes. Multiple agents can work on the same repository, but they should generally use separate branches, worktrees, or isolated environments when changing code concurrently. Their changes still need to be integrated and tested. Is a parallel AI coding agent manager necessary? Not always. If you run only two agents occasionally, terminal sessions and Git worktrees may be sufficient. A dedicated coordination platform becomes more valuable when you need to assign tasks, monitor progress, manage several workspaces, and review results consistently. Which tool is best for managing parallel AI coding agents? There is no single best option for every developer. Sharkly is worth considering for task coordination and agent execution, Codex and Cursor for their respective coding workflows, Conductor for managing separate agent workspaces, and Git worktrees for a lightweight manual approach. Does running more agents make coding faster? Not necessarily. Parallel execution can reduce waiting time when tasks are independent, but it can also increase model usage, compute costs, review effort, and integration conflicts. The best results usually come from dividing work carefully and keeping tasks independent. Final Thoughts I think parallel AI coding agents are most useful when they help developers move several independent tasks forward without creating extra coordination work. The tools in this list approach the problem from different angles. Some focus on coding, others on workspace isolation, and others on coordinating agents across a broader development workflow. For a lightweight setup, Git worktrees can be enough. If you already work in Cursor, its background agents are a natural option to explore. Codex and Claude Code offer their own approaches to delegating and running coding tasks, while the OpenAI Agents SDK is useful for building custom multi-agent workflows. For teams that want to connect agent execution with task management and progress tracking, I would also take a look at Sharkly. Ultimately, the goal is not to run as many agents as possible. It is to get more useful development work done while keeping the codebase organized, the results reviewable, and the final decisions in the hands of the people responsible for the software.

  • DEV CommunityThe Giantsread at source

    Stop Pasting API Keys Into Your Terminal: Use Windows Environment Variables Instead

    TL;DR: Windows System Environment Variables store API keys and secrets at the operating system level, eliminating terminal history leaks and accidental GitHub commits. Set them once through Windows settings, reference them in code via process.env or os.getenv() , and never paste another credential into a terminal again. Every developer has done it at least once. You copy an API key from OpenAI or Anthropic, paste it directly into a terminal command or test script, and run your code. It works. You move on. A few weeks later, you push that script to GitHub without thinking. Your key is now public. Forever. Terminal history leaks and accidental commits are not edge cases. They are the default outcome when you treat secrets like throwaway strings. Windows System Environment Variables exist to solve this exact problem, yet most developers skip them because they assume environment variables are "too advanced" or "only for production." That assumption is wrong. Environment variables are not advanced. They are foundational. Once you understand how they work, you will never paste another API key into a terminal again. What Windows System Environment Variables Actually Are Windows System Environment Variables are key-value pairs stored inside Windows itself. They live at the operating system level, not inside your code, not inside your terminal session, and not inside any file you will ever commit to version control. Each variable has a name and a value. The name is how your application references it. The value is what your application retrieves. You set them once through Windows settings, and every application running under your user account can read them. Two types exist: User Environment Variables and System Environment Variables . User variables apply only to your Windows user account. System variables apply to every user on the machine. As a developer, you will almost always use User Environment Variables because you want secrets scoped to you alone. When you store a variable like OPENAI_API_KEY , Windows makes it available to every process you launch. Node.js can read it. Python can read it. PowerShell can read it. Your text editor can read it. You set it once. It persists across reboots. It never touches your codebase. This is not new technology. Environment variables have been part of operating systems since Unix systems in the 1970s. They are battle-tested, widely supported, and built into every major programming language runtime. They are also the standard way production environments manage secrets in cloud platforms, CI/CD pipelines, and containerized deployments. Environment variables have been part of operating systems since Unix systems in the 1970s, and they remain the industry standard for managing secrets in production environments today. Why Developers Rely on Environment Variables for Secrets The core reason is simple: separation of configuration from code . Your source code should describe logic, not contain live credentials. Hard-coding an API key into a script ties your code to one environment, one key, and one security failure waiting to happen. Environment variables decouple secrets from source files. Your code references process.env.OPENAI_API_KEY in Node.js or os.getenv("OPENAI_API_KEY") in Python. The actual key lives in Windows, completely separate from your repository. This separation unlocks three immediate benefits: Security : Your API key never appears in a file you can commit. It never shows up in terminal history. It never gets logged by accident. Someone reading your GitHub repo will see process.env.OPENAI_API_KEY but not the actual key. Portability : You can share your codebase with teammates or publish it publicly without sharing secrets. Each developer sets their own environment variables on their own machine. The code stays identical. Flexibility : You can change an API key by updating one Windows setting, not by hunting through every script where you hard-coded it. You can use different keys for different projects without modifying code. Production deployments use environment variables for the same reasons. Heroku, Vercel, AWS Lambda, and every major cloud platform inject secrets as environment variables at runtime. Learning to use them locally means you are already practicing production patterns on your own machine, which directly ties into AI tools impact your data privacy in modern deployment workflows. The Risky Path: Pasting Keys Into Terminals and Scripts Let's walk through what actually happens when you paste an API key directly into PowerShell or a script file. You open PowerShell. You run a command like this: powershell curl -H "Authorization: Bearer sk-proj-abc123yourkeyhere" https://api.openai.com/v1/models The command works. You get your response. What you don't see is PowerShell writing that entire command, including your API key, into its history file. On Windows, PowerShell history is stored at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt where anyone with access to your user account can extract every command you've ever run. Anyone with access to your user account can open that file and read every command you have ever run. If you share your machine, if you back up that folder to cloud storage, or if malware scans common history paths, your key is exposed. The second failure mode happens when you paste a key into a script file. You create test-openai.js and write: javascript const apiKey = "sk-proj-abc123yourkeyhere"; fetch("https://api.openai.com/v1/models", { headers: { Authorization: `Bearer ${apiKey}` } }); You test it. It works. You keep working. A week later, you commit that file to GitHub without realizing the key is still inside. GitHub scans for exposed secrets and may revoke the key automatically, but that depends on pattern matching. If you obfuscated it slightly or if it doesn't match known patterns, the key stays public. Even if you delete the file later, it remains permanently accessible in Git commit history. Anyone who clones your repository can run git log and extract the key from an earlier commit. Deletion doesn't remove history. It just hides it from the current branch view. What Goes Wrong in Real Scenarios Here's a real failure case. You initialize a new Node.js project and create test.js : javascript const apiKey = "sk-proj-realkeyfromanthropichere"; console.log("Testing API key:", apiKey); You run it: bash node test.js Output: plaintext Testing API key: sk-proj-realkeyfromanthropichere You forget about the file. Two weeks later, you run git add . and git commit -m "initial commit" without checking what's staged. The key is now in your repository forever. You can remove the file in a later commit, but the original commit still contains it. Anyone who forks or clones your repo can retrieve it. The fix is simple: never put the key in the file in the first place. The Secure Path: Windows User Environment Variables They can be reviewed using a system configuration audit checker . Here's how to store an API key as a User Environment Variable on Windows, then reference it in your code. Step 1: Open Environment Variables Settings Press Win + S and search for "environment variables." Click Edit the system environment variables . In the System Properties window, click Environment Variables at the bottom. You will see two sections: User variables (top) and System variables (bottom). Click New under User variables. Step 2: Create Your Variable In the New User Variable dialog: Variable name : OPENAI_API_KEY Variable value : sk-proj-yourrealkeyhere Click OK , then OK again to close all dialogs. The variable is now stored in Windows. Step 3: Restart Any Open Terminals Environment variables are loaded when a process starts. If you already have PowerShell, Command Prompt, or VS Code open, close and reopen them. The new variable will be available in all new sessions. Step 4: Reference the Variable in Code In Node.js: javascript const apiKey = process.env.OPENAI_API_KEY; console.log("API key loaded:", apiKey ? "Yes" : "No"); In Python: python import os api_key = os.getenv("OPENAI_API_KEY") print(f"API key loaded: {'Yes' if api_key else 'No'}") In PowerShell: powershell $apiKey = $env:OPENAI_API_KEY Write-Host "API key loaded: $($apiKey -ne $null)" Your code now reads the key from Windows at runtime. The key never appears in your source file. You can commit test.js or test.py to GitHub safely. Anyone who clones your repo will see process.env.OPENAI_API_KEY but not the actual key. Step 5: Verify It Works Run your script again: bash node test.js Expected output: plaintext API key loaded: Yes If you see "No", you either mistyped the variable name or forgot to restart your terminal. What You Gain as a Developer Using environment variables changes how you write, share, and deploy code. Here's what you gain immediately: No more terminal history leaks. You never paste a key into a command again. Your PowerShell history file contains no secrets. If you share your machine or back up that folder, no credentials are exposed. No more accidental commits. Your source files reference process.env.OPENAI_API_KEY , not the actual key. You can commit every script, push to GitHub, and share your code publicly without exposing credentials. Portable code. Your teammate clones your repo, sets their own OPENAI_API_KEY variable on their machine, and runs the same code without modification. Different developers, different keys, identical codebase. Production-ready patterns. You are already using the same secret management approach that Heroku, Vercel, AWS Lambda, and every major cloud platform uses. When you deploy, you set environment variables in the platform's dashboard. Your code stays identical. Easier key rotation. You can change an API key by updating one Windows setting. You don't hunt through every script where you hard-coded it. You update the variable once, and every script that references it picks up the new value. Separation of configuration from code is not just a best practice. It is the foundational pattern that makes modern DevOps workflows possible. This approach scales beyond API keys. Database connection strings, OAuth client secrets, feature flags, deployment URLs, and any configuration that changes between environments should live in environment variables. Your code references the variable. The environment provides the value. This pattern is outlined in detail in our DevOps best practices guide . Common Mistakes to Avoid Even after setting environment variables correctly, developers make predictable mistakes. Here are the most common: Logging the variable value during debugging. You write console.log(process.env.OPENAI_API_KEY) to verify it loaded, then forget to remove the line. Now your key is in your application logs. If those logs go to a monitoring service or get committed to a repo, the key is exposed again. Log "loaded" or "not loaded", never the actual value. Committing .env files. Many Node.js projects use .env files with libraries like dotenv . These files store environment variables locally for development. They are not environment variables in the Windows sense. They are plain text files. If you commit .env to Git, you commit all the secrets inside. Always add .env to .gitignore . Using System Environment Variables instead of User. System variables apply to all users on the machine. If you store a personal API key as a System variable, every user account can read it. Use User variables for personal secrets, System variables only for shared configuration. Forgetting to restart terminals. Environment variables are loaded when a process starts. If you set a variable and immediately try to use it in an already-open terminal, it won't be there. Close and reopen the terminal first. Hardcoding fallback values. You write const apiKey = process.env.OPENAI_API_KEY || "sk-proj-fallbackkey"; intending to make the code "more robust." Now your code works even when the variable isn't set, and the fallback key ends up in your repository. Never hardcode fallback secrets. If the variable is missing, fail loudly. Where to Go From Here You now know how to store secrets outside your codebase using Windows System Environment Variables. This is the single most effective way to prevent terminal history leaks and accidental commits. Start by identifying every API key, database password, or secret you currently have hardcoded in a script or pasted in a terminal. Move each one to a User Environment Variable. Update your code to reference process.env.VARIABLE_NAME or os.getenv("VARIABLE_NAME") . Restart your terminal. Run your code. Verify it works. Do this once for every secret you use. From that point forward, you will never paste a key into a terminal again. Your code will be shareable, portable, and production-ready. Your secrets will stay secret. This is not advanced. This is foundational. Every developer should know how to do this before they run their first API call. If you skipped it until now, you haven't lost anything. You just gained the most important security habit you will ever build. 📦 Publishing Kit — Dev.to Title Options (5) Selected: Stop Pasting API Keys Into Your Terminal: Use Windows Environment Variables Instead Alternates: How to Permanently Stop Leaking API Keys Using Windows System Environment Variables Windows Environment Variables: The Developer's Guide to Never Committing Secrets Again Secure Your API Keys Forever: A Practical Guide to Windows Environment Variables Why Every Developer Should Use Windows Environment Variables for API Keys and Secrets Slug stop-pasting-api-keys-use-windows-environment-variables Tags security, tutorial, beginners, envvars

  • DEV CommunityThe Giantsread at source

    Firefox for Security Researchers: Burp Suite, XSS Testing, Certificate Analysis, Privacy Auditing

    Firefox has become a go-to browser for security researchers, penetration testers, and privacy advocates. Its open architecture, powerful DevTools, extension ecosystem, and commitment to web standards make it well-suited for security work. Here's how security professionals use Firefox effectively. Why Security Researchers Prefer Firefox Open source : mozilla-central is publicly auditable; security researchers find and report bugs Independent certificate store : doesn't inherit corporate MITM certs unless explicitly configured, so you see what's actually there Strict CSP enforcement : finds CSP misconfigurations that Chrome's more lenient behavior masks uBlock Origin at full capability : MV2 extensions can intercept/block at the network level Proxy support : native SOCKS5+DNS, per-browser proxy config (doesn't inherit system proxy) Private browsing : no telemetry in private mode, no third-party cookies Configuring Firefox for Security Research Essential about:config changes for research work: security . OCSP . require = false ( don ' t fail on OCSP timeouts during offline research ) network . proxy . socks_remote_dns = true ( DNS through SOCKS to prevent leaks ) dom . security . https_only_mode = false ( allow HTTP when testing HTTP - only apps ) Disable Safe Browsing for offline work (Safe Browsing sends URLs to Google for checking): browser . safebrowsing . malware . enabled = false browser . safebrowsing . phishing . enabled = false Note: only disable safe browsing in isolated VMs used for malware analysis, not your daily driver. Burp Suite Integration Burp Suite is the standard proxy for web app security testing. Firefox integration: Set Firefox proxy: Settings → Network Settings → Manual → HTTP Proxy: 127.0.0.1:8080 Navigate to http://burp in Firefox → download Burp's CA cert Settings → View Certificates → Authorities → Import → select the cert → trust for websites Burp now intercepts all Firefox HTTPS traffic For per-project configs, use FoxyProxy to switch between Burp proxy and direct connection per URL pattern. OWASP ZAP Integration OWASP ZAP is an open-source web app scanner: ZAP → Tools → Options → Dynamic SSL Certificates → Generate → Save Firefox → Import that cert as a trusted CA Set Firefox proxy to ZAP's proxy address (default: 127.0.0.1:8080) ZAP's passive scanner analyzes traffic as you browse; active scanner auto-sends attack payloads. Cookie and Session Analysis Firefox's Storage Inspector (DevTools → Storage tab) shows: All cookies for the current origin (session, persistent, httpOnly, Secure flags) LocalStorage and SessionStorage IndexedDB contents Cache entries For cookie security testing, look for: Missing HttpOnly flag → cookie accessible via JavaScript (XSS risk) Missing Secure flag → cookie sent over HTTP Missing SameSite attribute → CSRF risk on older endpoints Overly broad domain scope ( Domain=.example.com ) XSS Testing in Firefox Firefox handles some XSS vectors differently from Chrome. Both should be tested: DevTools Console: test JavaScript injection directly // Test if inline event handlers work (CSP check) document . body . innerHTML = ' ' // Test for DOM-based XSS via URL fragments location . hash = ' # ' Firefox's stricter CSP enforcement means a CSP bypass that works in Chrome may not work in Firefox — and vice versa. Network Traffic Analysis Firefox DevTools Network tab for manual traffic inspection: Filter by type : XHR/Fetch, JS, CSS, Doc, WS (WebSocket) Copy as cURL : right-click any request → copy as cURL with all headers Edit and Resend : right-click → Edit and Resend → modify request and replay HAR Export : save entire session as HAR file for offline analysis For WebSocket analysis: filter by WS type → click the WebSocket connection → Messages tab shows all frames in both directions. TLS and Certificate Analysis Firefox's Security tab in DevTools (available per-request in Network tab → click request → Security tab) shows: TLS version negotiated Cipher suite Certificate chain Whether HSTS is active For deeper certificate analysis: address bar → padlock → Connection Secure → More Information → Security → View Certificate. Check for: Unexpected certificate issuers (MITM detection) Certificate transparency logs (crt.sh) Expired or soon-to-expire certs Weak cipher suites (RC4, DES — Firefox blocks these by default now) Extension Security Testing Firefox extensions are easier to inspect than Chrome extensions because AMO requires unobfuscated source code: Firefox → Add-ons (about:addons) → extension page "Source Code" link on the AMO listing → browse the source on AMO Or: find the extension XPI file in ~/.mozilla/firefox/PROFILE/extensions/ and unzip it Look for: Content scripts that run on all pages ( matches: [" "] ) Broad permissions in manifest.json External script loading Data exfiltration via background script Privacy Analysis Firefox's Developer Tools + extensions make it excellent for privacy analysis: Ghostery or uBlock Origin logger shows all third-party connections a site makes. Lightbeam for Firefox : visualizes third-party tracking connections across sites you visit. DevTools Network filter for tracking: filter by third-party or search for known tracker domains (doubleclick.net, google-analytics.com). WebRTC leak testing : Firefox's WebRTC can expose local IP even through a VPN. Test at ipleak.net with and without VPN. In about:config, set media.peerconnection.enabled = false to disable WebRTC completely. Isolated Testing VMs For malware analysis or high-risk security testing, run Firefox in an isolated VM: Snapshot the clean state Perform analysis Revert snapshot to clean state Firefox profiles within the VM are disposable Firefox's portable mode (running from a USB drive or temp directory with a custom profile) also works for isolated testing without affecting your main installation.

  • DEV CommunityThe Giantsread at source

    Leaving Netlify and Render without losing a user, a video or a link

    By Simon Frisk, Eyevinn Technology In the previous post I moved users from Supabase to Open Source Cloud without anyone resetting a password. This time it is the hosting itself: a full-stack app leaving Netlify and Render for Open Source Cloud (OSC), and bringing its database and media along. The app is Classync, a video review tool where teachers and students leave time-coded comments on videos. Three rules applied. Every user keeps their password, everything comes along (videos, comments, projects, all of it), and every old link keeps working. Everything on the OSC side is open source, so the same steps work in reverse. Each step ends with what moving again would take. What the move actually covers Classync is small: 24 users, 179 comments, 21 projects, about 0.1 MB of data and about 1.7 GB of media. Every problem below came from behavior, not scale. Getting it running on OSC OSC runs open-source services as managed instances, and runs your own code next to them as a My App. I did the work with a small team of Claude Code agents (plan, build, deploy, review), and I made the call at each step. The snippets below are illustrative, written for this post rather than copied from the repo. Step 1: Map what Netlify and Render did Before moving anything, list everything each platform did for you, not just the obvious parts. Job Before On OSC Static frontend, SPA fallback Netlify, with _redirects Served by the backend My App Node backend Render, with build, start and env vars in its dashboard Same My App Config and secrets Render's dashboard One parameter store Database MongoDB Atlas FerretDB, on a PostgreSQL backend Media Cloudinary MinIO Backups None of its own Nightly dumps to a separate MinIO The quiet part on Netlify was this line, sending every unknown path to the app shell: /* /index.html 200 Its replacement must do the same, or deep links break. Moving again: every row on the right is plain Node, environment variables, MongoDB-compatible or S3-compatible, so the map works backwards too. Step 2: Turn two services into one My App A My App is built from the repo with build and start scripts at the root, so one root package.json builds both halves. Folder names here are examples: { "scripts" : { "build" : "cd frontend && npm ci && npm run build && cd ../backend && npm ci" , "start" : "node backend/server.js" } } The frontend first went on My Pages, OSC's static hosting. It served / but returned 404 on reload of client routes like /review/:id or /signUp?token=... . So Express serves the built frontend instead, with health first and the browser fallback last. This is Express 4; the * route is written differently in Express 5: app . get ( ' /health ' , ( req , res ) => // 1. health first, never the app shell res . sendStatus ( mongoose . connection . readyState === 1 ? 200 : 503 )); app . use ( ' /api-docs ' , swaggerUi . serve , swaggerUi . setup ( spec )); // Swagger moved off "/" app . use ( apiRouter ); // 2. API routes app . use ( express . static ( distDir )); // 3. built assets app . get ( ' * ' , ( req , res , next ) => // 4. browser fallback, last req . accepts ( ' html ' ) ? res . sendFile ( path . join ( distDir , ' index.html ' )) : next ()); // At boot: retry the database with backoff, then process.exit(1) // so the platform restarts the app. One origin means no CORS between frontend and API. The health check changed too. Before, a database outage at boot left the app up, broken, and reporting OK. Moving again: plain Node and Express with standard root scripts. Nothing in the code is OSC-specific. Step 3: Move environment variables to a parameter store The backend's variables from Render, and the frontend's build-time variables, now live in one OSC parameter store attached to the app. Two things to know: Vite inlines VITE_ variables at build time, and the platform runs the build, so they go in the same store. Keep one-off switches out of it. A flag that wipes or reseeds the database, such as RESET_DB , is read again on every restart. Moving again: the app reads ordinary environment variables; the parameter store just supplies them. Step 4: Bring the data along without password resets FerretDB is the MongoDB-compatible database on OSC, so Mongoose only needs a new connection string. Rehearse first: mongodump from Atlas, mongorestore into a throwaway FerretDB, then compare counts, indexes and password hashes. The passwords are bcrypt hashes, so a straight copy keeps every password working. I checked the hashes, then logged in with my real account. Users still sign in once on the new address, because the login token in browser storage belongs to the old site. Two things behaved differently. FerretDB 2.7 has no multi-document transactions, and writes inside a transaction apply at once with nothing to roll back. And unsorted queries came back in a different order. MongoDB never promised an order there. Atlas was just consistent. // Ordered steps instead of a transaction. Reassign first, // so a failure never leaves orphaned comments. await Comment . updateMany ({ author : user . _id }, { author : placeholder . _id }); await User . deleteOne ({ _id : user . _id }); // Every list a user sees gets an explicit sort. Comment . find ({ project : projectId }). sort ({ timestamp : 1 , _id : 1 }); OSC's built-in backup tool does not cover the FerretDB backend, so the app writes its own nightly mongodump -format backup to MinIO. A restore drill passed. Moving again: the code runs unchanged against Atlas or self-hosted MongoDB, and the nightly backups restore into any MongoDB with plain mongorestore . Step 5: Bring the media along Uploads used to pass through the backend, but OSC My Apps have a request size limit, so large files can no longer go that way. The browser now uploads straight to MinIO as S3 multipart uploads in 8 MiB parts, and the backend only signs: // Backend: start, sign each part, complete. const { UploadId } = await s3 . send ( new CreateMultipartUploadCommand ({ Bucket , Key })); const partUrl = await getSignedUrl ( s3 , new UploadPartCommand ({ Bucket , Key , UploadId , PartNumber })); await s3 . send ( new CompleteMultipartUploadCommand ({ Bucket , Key , UploadId , MultipartUpload : { Parts } })); // Browser: PUT each slice, with no extra headers. const res = await fetch ( partUrl , { method : ' PUT ' , body : file . slice ( start , start + PART_SIZE ) }); OSC's ingress allows only a few request headers on cross-origin calls, hence no extra headers. Videos are capped at 400 MiB, but that is a setting I chose ( MAX_VIDEO_MB ), not a technical limit. With 8 MiB parts, S3 multipart allows up to 10,000 parts, about 78 GiB per file, so the real limits are storage space and upload time. On Cloudinary's Free plan the ceiling was 100 MB. The browser now also makes thumbnails and refuses HEVC video and .mov files with uncompressed audio, asking for an MP4 export. [SCREENSHOT: the upload dialog that refuses HEVC video and .mov files with uncompressed audio, with the "export as MP4" message, or showing the 400 MiB setting] The copy covered only files the database references, out of about 1.7 GB in Cloudinary: 64 objects, about 780 MB, each hash-verified. The rest were files no record pointed to, such as Cloudinary's sample files and leftovers from deleted uploads, so they were left where they were. The stored URLs in 67 documents were rewritten only after a dry run showed every URL mapped, a backup was taken and a reverse run was ready as the undo. MinIO versioning, with a 90-day rule for old versions, keeps deleted files recoverable, and a nightly job mirrors the media into the backup MinIO. But on the MinIO release OSC runs, plain delete permission also covers old versions, so the app's MinIO credentials needed an explicit Deny on s3:DeleteObjectVersion . Only the MinIO owner account can permanently delete media. Moving again: MinIO is S3-compatible and the uploads are standard S3 multipart with presigned URLs, so the same code works against AWS S3 or any S3-compatible storage. Leaving MinIO would mean a copy and a settings change, with no code to rewrite. Step 6: Cut over and keep old links working After one more rehearsal against the production database, the switch was a fresh read-only dump from Atlas, a restore into FerretDB, a check of counts and hashes, and a new database setting. It took about 3.5 minutes, mostly two app rebuilds. Then the old Netlify site became a forwarder. One line in its _redirects keeps path and query, so invitation links still work: /* https:// /:splat 301! Moving again: Render, Atlas and Cloudinary stayed a working fallback throughout, so the way back was always open. Why open source matters here Open source means no black box: you can read the code and run the exact same software yourself. It also means you are not locked in: The software moves with you. FerretDB and MinIO run the same on your own server or another cloud, so a price change or a shutdown does not mean rebuilding. Your data stays in open formats. MongoDB dumps and S3 objects work anywhere. You set the limits and choose where data lives. Upload caps are your own settings, not a pricing plan's. For a school app, it also means keeping student data where it has to be. This move showed the difference. Leaving Cloudinary meant a new storage driver, a copy job and 67 rewritten records. Leaving OSC would mean the same dump, copy and settings change, with no code to rewrite. Wrapping up The app will run on about 41 OSC tokens per day once the two rehearsal databases are removed: the app, the parameter store, FerretDB and its PostgreSQL backend, and the two MinIO instances for media and backups. [CHECK: add a currency equivalent only if there is a confirmed token price to cite] Render, Atlas and Cloudinary stay as a fallback for about four weeks. If you have an app split across Netlify and Render, try the same move on Open Source Cloud . If something behaves differently for you, let us know in the community Slack or on GitHub . What is Open Source Cloud? Managed open-source cloud for developers who want infrastructure, not DevOps. Run unmodified open-source services, deploy your own code alongside them as a My App, and spin up Postgres, Valkey and S3-compatible storage without touching Kubernetes or cloud config.

  • DEV CommunityThe Giantsread at source

    Your Monitoring Reports Are Accurate. Are They Still Worth Sending?

    Juan Camilo Auriti built a monitoring product that compared website properties across runs. The reports were correct. 78% of them showed a delta of exactly zero. His first response was technical: the change-detection thresholds must be too coarse. He spent about a month tuning them. That was the wrong layer. The product let someone audit a site, fix issues such as robots.txt or schema markup, and then watch those properties over time. Once the fixes were made, the site could remain stable in the dimensions being measured. That is a successful first task. It is not automatically a reason to send a new report every week. An empty recurring report can mean two different things: The customer completed the job, and there was nothing new to act on. The report did not carry a decision for the recipient in the first place. Those interpretations point to different engineering and product work. If the product promises assurance that a site remains stable, “no change” can be the result the customer wants. The question is whether the promise and cadence match that outcome. If the product promises to tell the customer what to do next, increasing sensitivity does not solve the problem by itself. A report can detect smaller changes and still change no decision. Juan Camilo Auriti described the turning point in his own monitoring product this way: “The thresholds weren't the problem. The artifact was the problem.” One commenter gave the problem a useful name: decisionless . Before sending a recurring artifact, ask: what decision does this change? Auriti agreed that this is a property you can check before sending, rather than an interpretation you make afterward. This is why threshold work is so attractive. It produces code changes, diffs, and a number. The question “should this artifact exist at this frequency?” produces no diff and may force a change to the product promise. For a report, alert, digest, or recurring audit, separate these questions before adding another feature: Did the first task succeed so completely that the original problem stopped occurring? Or does the recurring artifact fail to connect to a decision the recipient still has to make? The first points to the promise and cadence. The second points to the artifact and its handoff into a decision. They are different failure layers, so they should not share the same next fix. The figure is self-reported and the underlying query is not independently audited. This is not a rule that monitoring products should stop sending weekly reports. Stability may be the product. The point is narrower: an empty report is not enough evidence to choose between threshold work, delivery work, and a promise change. When your recurring report comes back empty, what decision was the next issue supposed to change?

  • freeCodeCamp.orgYouTube ChannelsVideoWatch on YouTube

    Inside an AI Factory – Power, Cooling, and GPUs Explained

  • PiccalilliMore Front-end Bloggersread at source

    The Index: Issue #202

    Tiny Little Office This is really smart. It's a word processor, along with other common office software like spreadsheets, but it's completely URL powered. Introducing the Accessible Components Library You could not be in better hands than with TetraLogical and they've produced a really good collection of common components, all with thorough documentation, accessibility requirements and testing scenarios. we were online Something we've certainly noticed about this particular morale-draining era is there seems to be a real drive to create websites centered around a shared human experience and long may it continue. What 10,000 home pages put in their head So much about web performance is linked to what's in your which this article (and very useful looking tool) breaks down well. Study explores how AI use affects performance on math and reasoning tasks A worrying read for fans of healthy cognition. A handful of reasons JavaScript won’t be available Here's one from the Piccalilli archives that you might have missed to wrap up this issue. P.S. this is a good website from personalsit.es . Sponsor message There's been a drive to ship ship ship in this AI era but increasingly that means a lot of volume and very little substance. At Set Studio, we move incredibly fast because we center everything around a solid strategy and work with the amazing capabilities that modern browsers give us, underpinned by progressive enhancement, to make sure every user gets a high quality equitable and accessible experience. We're also the agency behind The Index and Piccalilli because we think it's important to share this way of working with the wider community. With availability opening up in 2027, we're the agency you can actually trust to do right by you and your user base. Reach out to us for a chat and let us show you how. Check out our work

  • Flavio CopesMore Front-end Bloggersread at source

    Build vs buy software: when AI can replace a SaaS

    AI changes the build-versus-buy calculation, but a working prototype is only part of it. How to compare ownership, maintenance, risk, and recurring costs.

  • Smashing MagazineThe Giants10 min read

    Is Your Organization Messing Up AI Adoption?

    What can digital transformation teach us about AI adoption? Paul Boag revisits his book Digital Adaptation to show how lessons from the past can help organizations navigate the challenges of AI today. - AI - Workflow - Business

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: A Music-Reading Trainer

    Comments

  • Hacker News Front PageThe Giantsread at source

    Tesla's new Roadster makes a flying debut, hitting 60 MPH in under a second

  • SitePointThe Giantsread at source

    Why AI Agents Break and How to Test Them?

    Why AI agents that pass every test still fail in production — the specific ways they break (compounding errors, lost constraints, false success reports) and how to actually test for it. Continue reading Why AI Agents Break and How to Test Them? on SitePoint .

  • HeyDesignerDeveloper/Designer Newsread at source

    Interfere design system

    Pure UI in the agentic era, Toolcraft, Someone behind the software.

  • Flavio CopesMore Front-end Bloggersread at source

    How to compete with AI-generated SaaS clones

    Cheap software clones change what a small SaaS business can charge for. A practical look at differentiation, maintenance, distribution, and earning trust.

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Gitsu.app – A Linear-alternative built on GitHub Projects

    Comments

  • Hacker News Front PageThe Giantsread at source

    The Folders Programming Language

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Continuous Trunk Builds of Network Ups Tools (Nut) for Fedora/EL

    Comments

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Lobby Domains: Find Domains with Chrome's On-Device AI

    Comments

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Kitaphone – Call mobile phones and landlines directly from the browser

    Comments

  • Hacker News Front PageThe Giantsread at source

    Comparing Chromium Development at Google and Igalia

  • Hacker News Front PageThe Giantsread at source

    Any window from your Mac, on your iPhone and iPad

  • Hacker News Front PageThe Giantsread at source

    Thank You, Deno

  • Frontend Masters BlogMore Front-end Bloggers3 min read

    SVG “Linked Parameters” Will Change How We Do Icon Systems

    Maybe we can get back to an img-based icon system?

  • Google for DevelopersYouTube ChannelsVideoWatch on YouTube

    📖 Explore custom voice narration with Gemini 3.8 Flash TTS

  • AbduzeedoMulti Author Blogsread at source

    Studio Marcus Kraft Unveils Klangwelt Toggenburg Rebrand

    Studio Marcus Kraft built the Klangwelt Toggenburg rebrand around a dynamic typeface whose letters expand and scatter like sound in the Alps. The key visual says everything in one frame: the wordmark ...

  • AdactioTop Front-end Bloggersread at source

    The Mountain In The Sea by Ray Nayler

    Back in 2019 , I read the book Other Minds: The Octopus, the Sea, and the Deep Origins of Consciousness by Peter Godfrey-Smith and said: I really enjoyed this evolutionary tale. It’s equal parts biology and philosophy. I will never look at cephalopods quite the same way again. Reading Ray Nayler’s The Mountain In The Sea reminded so much of that book that I couldn’t resist flipping ahead to the acknowledgements at the back. Sure enough, Other Minds gets a big shout-out. But that’s only part of the make-up of The Mountain In The Sea . There’s just as much William Gibson as Peter Godfrey-Smith. I don’t just mean that the book is an unexpectedly rip-roaring cyberpunk thriller—which it is—but that it’s also got that Gibsonian narrative structure; three disconnected protagonists in three separate stories that you just know are going to connect before the book is done. The great accomplishment of this book is how well it balances the two genres of philosophy and cyberpunk. There’s plenty of musings on the nature of consciousness, be it human, octopus, or artificial intelligence. But there’s also plenty of high-tech hacking shenanigans. Above all, it’s an excellent example of one of my favourite subgenres of science fiction: first contact . It’s as linguistically satisfying as Ted Chiang’s Story Of Your Life , the pinnacle of the first-contact subgenre. The fact that there are no extra-terrestrial species just adds to its realism.

  • SitePointThe Giantsread at source

    Responsive Typography With Modern CSS: Create Readable Interfaces Without Excessive Media Queries

    null Continue reading Responsive Typography With Modern CSS: Create Readable Interfaces Without Excessive Media Queries on SitePoint .

  • SitePointThe Giantsread at source

    JavaScript Performance Optimization: Practical Techniques for Faster Web Applications

    null Continue reading JavaScript Performance Optimization: Practical Techniques for Faster Web Applications on SitePoint .

  • Flavio CopesMore Front-end Bloggersread at source

    Meta released Muse Spark Open: what you can run, and what it takes

    Meta released Muse Spark Open with downloadable weights, a million-token context, and support for coding agents. Here are the hardware and license limits.

  • Flavio CopesMore Front-end Bloggersread at source

    The complete guide to Void: full-stack Vite apps with Hono and Cloudflare

    Build and deploy full-stack Vite apps with Void, Hono, React, and Cloudflare D1. Learn typed routes, forms, migrations, authentication, and team hosting.

  • AbduzeedoMulti Author Blogsread at source

    How KIND Reimagined the Osland Rebrand

    KIND's Osland rebrand grows from biology: circular forms inspired by trout roe, DNA and the fish itself, set in coral reds and marine blues. The mark is a circle that behaves like a living thing: an o...

  • Google for DevelopersYouTube ChannelsVideoWatch on YouTube

    Turning raw hardware sensor data into music with Gemini

  • Engineering at MetaCompany/Startup Blogs8 min read

    How Meta Built Forum With AI-Native Engineering

    Meta’s newest app, Forum, is for anyone who wants to go deeper into the conversations in their Facebook groups. To build Forum, Meta engineers adopted a whole new way of working by bringing an AI agent into the development cycle. We’re sharing insights into what it took to build Forum with agentic AI: how we [...] Read More... The post How Meta Built Forum With AI-Native Engineering appeared first on Engineering at Meta .

  • Jim Nielsen’s BlogMore Front-end Bloggersread at source

    We Need All the Disciplines

    From where I sit, figuring out what to build, building it, and shipping it are all part of the art of making software. Many disciplines have emerged through the years to facilitate this work: product, design, engineering, devops, etc. We need all these disciplines to make great, dependable software (granted, in different doses). Each brings different values and judgments; each sees things the others don’t. And including all might mean going a bit slower. Human collaboration may seem less “efficient” than handing the work over entirely to the machines. But inefficiency may be the cost of collaborating with humans, rather than extracting an output from a machine. We gain not only from their judgment and expertise in a particular discipline, but from the relationship, trust, and shared understanding that blossoms from making something together. As the old proverb says: “If you want to go fast, go alone. If you want to go far, go together.” Reformulated for today: If you want to go fast, go with the LLM. If you want to go far, go with your fellow humans. Reply via: Email · Mastodon · Bluesky

  • Engineering at MetaCompany/Startup Blogs4 min read

    2026 World Cup: Breaking Records, Spiky Charts and Reliability at Scale

    Every four years, the World Cup becomes the largest planned stress test of our infrastructure. This year it also set an all-time record! There are a few moments throughout the year, like New Years Eve, that really let us see the collective impact of everything we’ve built — but none are bigger than the quadrennial [...] Read More... The post 2026 World Cup: Breaking Records, Spiky Charts and Reliability at Scale appeared first on Engineering at Meta .

  • Jeffrey Zeldman PresentsMore Front-end Bloggers1 min read

    Silly Old Bear

    Remembrance of Poohs past. The post Silly Old Bear appeared first on Jeffrey Zeldman Presents .

  • HeyDesignerDeveloper/Designer Newsread at source

    The fake double diamond is dead. The real double diamond is immortal

    Imperfection, The convergence of design, Designing for voice first, What the 500 in blue-500 means, Fluid functionalism, Anatomy, and more.

  • Heroku BlogCompany/Startup Blogs3 min read

    Front-End Web Deep Dive: Runtime Config

    Runtime configuration has been brought to the Front-End Web Cloud Native Buildpack in a way that is standard, secure, and requires zero re-builds. By revisiting Twelve-Factor principles through the lens of modern web standards, we have created a strategy that works for any framework. The post Front-End Web Deep Dive: Runtime Config appeared first on Heroku .

  • DigitalOcean BlogMulti Author Blogs23 min read

    Building a computer that can pause and resume in milliseconds: Inside the MicroVM architecture behind Managed Agents

    An agent starts a test suite, edits a file, calls a model, and waits. Later, it resumes work with the same processes, files, and context. Sometimes it needs to fork that environment and try two approaches at once. These workloads force a tradeoff on conventional infrastructure.…

  • SitePointThe Giantsread at source

    When AI-Generated Documentation Is Unreadable: A CI Playbook

    Stop unreadable AI-written docs from merging. A four-section skeleton, PR checklist, Vale prose rules, and a tested shell check, all enforced in GitHub Actions CI. Continue reading When AI-Generated Documentation Is Unreadable: A CI Playbook on SitePoint .

  • SitePointThe Giantsread at source

    Vibe Coded App Security Audit: How to Vet Code Before Running It

    A repeatable checklist to audit an AI-generated Node.js app before you run it: Docker isolation, npm --ignore-scripts, npm audit, Semgrep rules and --network none. Continue reading Vibe Coded App Security Audit: How to Vet Code Before Running It on SitePoint .

  • SitePointThe Giantsread at source

    Dark Mode CSS Variables: Build a Modern Theme with light-dark()

    Build a no-flash dark mode toggle with plain CSS and JS. Use color-scheme, light-dark() and CSS variables, persist the choice in localStorage, and add a fallback. Continue reading Dark Mode CSS Variables: Build a Modern Theme with light-dark() on SitePoint .

  • Microsoft Edge BlogBrowsers, engines, etc.4 min read

    Faster protection, fewer interruptions: How Microsoft Edge is rethinking updates

    At a glance Microsoft Edge is developing new ways to help security updates reach people faster with less disruption. A seamless-updates prototype shows how Edge could update while work continues. Available today, Restar The post Faster protection, fewer interruptions: How Microsoft Edge is rethinking updates appeared first on Microsoft Edge Blog .

  • Engineering at MetaCompany/Startup Blogs2 min read

    Sapienz Receives ISSTA 2026 Impact Paper Award

    Ke Mao, Mark Harman, and Yue Jia have been recognized with the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) 2026 Most Influential Paper Award for their 2016 research, “Sapienz: multi-objective automated testing for Android applications.” The recognition celebrates a decade of impact from work that began at University College London and went [...] Read More... The post Sapienz Receives ISSTA 2026 Impact Paper Award appeared first on Engineering at Meta .

  • Google for DevelopersYouTube ChannelsVideoWatch on YouTube

    Gemini 4 Argon in Antigravity

  • The Mozilla BlogBrowsers, engines, etc.5 min read

    What does the (Fire)fox say?

    It all started with a question: What does Firefox sound like to you? Over the past year, Mozilla developed a small but meaningful set of sounds to add a sonic dimension to the Firefox experience. When we started this process, we knew we wanted something warm, human, and representative of our open source identity. We […] The post What does the (Fire)fox say? appeared first on The Mozilla Blog .

  • Web Tools WeeklyMulti Author Blogsread at source

    Web Tools Weekly Issue #691

    Fimo Review, CSS/HTML, Testing, Uncats

  • SitePointThe Giantsread at source

    Next.js Caching: How to Fix revalidate Failures and Stale Data

    Fix Next.js pages that stay stale or turn into cached 404s. Learn why revalidate fails, how notFound() can cache a 404 during a CMS outage, and a safer fetch helper. Continue reading Next.js Caching: How to Fix revalidate Failures and Stale Data on SitePoint .

  • SitePointThe Giantsread at source

    TypeScript Discriminated Unions: Refactoring Boolean Flags into State Machines

    Replace boolean flags and optional fields with TypeScript discriminated unions. Covers narrowing, exhaustive checks with never, and a typed form state machine. Continue reading TypeScript Discriminated Unions: Refactoring Boolean Flags into State Machines on SitePoint .

  • AbduzeedoMulti Author Blogsread at source

    Inside the Craft of ADC: Living Brand Identity by CLEVER°FRANKE

    CLEVER°FRANKE built ADC a living brand identity: generative patterns from mathematical symbols, refined by an AI model and human feedback. The system starts with the raw material of ADC’s business: ma...

  • AbduzeedoMulti Author Blogsread at source

    Nescau Display: Type Design by Plau Design

    Plau Design teams up with FutureBrand São Paulo on Nescau Display, a custom type design system weaving lightning bolts into 36 styles. Every kid in Brazil knows that yellow lightning bolt. For over 90...

  • LogRocket BlogCompany/Startup Blogs6 min read

    Traditional GPT vs. looping Transformers: Key differences

    Explore how looping Transformers reuse layers and compare with traditional GPT models in reasoning tasks. The post Traditional GPT vs. looping Transformers: Key differences appeared first on LogRocket Blog .

  • AdactioTop Front-end Bloggersread at source

    I am afraid my stuffed dinosaur will eat us all. He must be stopped

    My computed probability of the risk that Chomp will eat me, or in statistical terms, P(CHOMP), is approximately 95%. This has been a tough realization for me, because I consider Chomp a close friend, and I insist that no harm or regulation should come to him. However, if he should succeed in making me his first human sacrifice, it gives me no joy to inform you that there is nothing to stop him from eating us all. I know what you’re thinking, because I’ve heard it all before: Aren’t you just making up the words he’s saying? You’re the one who’s saying he wants to eat humans . I have to say, I’m insulted, and kind of sad for you. This kind of ad hominem attack only bolsters my argument. Why won’t you engage with the facts I have presented, namely that a stuffed dinosaur wants to devour all humans and only I can save us from that outcome? adactio.com/links/22800

  • AbduzeedoMulti Author Blogsread at source

    Editorial Design: Word's Eye by Crtomir Just

    Crtomir Just creates an expressive editorial design for literary festival Word's Eye, using lenticular prints and kinetic eye graphics. Slovenian graphic designer Črtomir Just developed the visual ide...

  • Flavio CopesMore Front-end Bloggersread at source

    How to use OpenCode

    Learn how to install OpenCode, connect a model, make your first code change, and configure project instructions and permissions in this hands-on tutorial.

  • HeyDesignerDeveloper/Designer Newsread at source

    Design systems directory

    Agentic systems are the future of brands, The best way to use icons in Web UIs, Fit height to background pattern size with calc-size().

  • AbduzeedoMulti Author Blogsread at source

    Editorial Web Design: Rambling Muse by SocioDesign

    Discover the sophisticated editorial web design for Rambling Muse by SocioDesign, featuring modular grids, custom icons, and refined typography. Commissioned by writer Clarisse Lehmann, London-based a...

  • Jake Archibald's blogTop Front-end Bloggers64 min read

    JPEG XL vs AVIF for web use-cases

    JPEG XL has landed, but how does it compare?

  • Ahmad ShadeedMore Front-end Bloggersread at source

    Fit height to background pattern size with calc-size()

See everything from the last 30 days →