The Register
When you just need to build a tiny desktop app: TinyJS
How a micro JavaScript runtime uses native OS webviews to shrink the desktop footprint.
12 Oct 2026
DEV Community
Stop Hardcoding Secrets: How Production Applications Manage Credentials on AWS
Imagine you're building a Node.js backend using Express and MongoDB. During development, you might have a .env file containing: PORT=5000 MONGO_URI=mongodb+srv://... JWT_SECRET=... API_KEY=... Your application works perfectly. But now imagine pushing the project to GitHub, deploying it through a CI/CD pipeline, and running it on AWS. Where should those secrets live? Should we put them directly inside the source code? Add them to the Docker image? Store them in GitHub? Or let every developer man
12 Oct 2026
Medium
One Asterisk Ran Your Cron Job 60 Times
How to read a cron expression from left to right, plus the handful you’ll use all the time Continue reading on Medium »
12 Oct 2026
DEV Community
Cloudflare Email Sending activity log shows only failures: 3 checks
Originally published at guushu.com/notes. I keep the original updated, so this copy may lag. A Worker sent mail through Cloudflare Email Service, the messages were arriving, and the sender had checked the raw sources to be sure. The Cloudflare Email Sending activity log still listed only failures, and Analytics showed 0 successes and a 100% failure rate. I answered that thread on Cloudflare Community on Sep 24. You don't have to take the dashboard's word for it, or anyone's guess. The Activity l
11 Oct 2026
DEV Community
Green Tests, Lying Agent
Originally published on Medium. Seventh in a series on building an autonomous AI organism that operates real infrastructure under a constitutional safety model. Part 1 introduced two gates, Part 2 the wall, Part 3 the layers, Part 4 the governor, Part 5 the memory, and Part 6 the whole anatomy. This one is about a number I did not expect to write down: how often an agent's report about its own work disagreed with the world, once we started checking every time. This week Sam Altman sat down with
11 Oct 2026
Medium
Green Tests, Lying Agent
Seventh in a series on building an autonomous AI organism that operates real infrastructure under a constitutional safety model. Part 1… Continue reading on Medium »
11 Oct 2026
freeCodeCamp
How to Measure Conformance Between an Operational Specification and Its Execution
In my previous article, I explored executor independence: the idea that different execution mechanisms should be able to satisfy the same operational specification. By executor independence, I mean th
11 Oct 2026
DEV Community
Restrict SSH Logins with AllowUsers Without Locking Yourself Out
A valid SSH key or password does not guarantee that an account can log in. OpenSSH can apply an additional server-side filter: AllowUsers lists which accounts are eligible to connect. That makes it useful for limiting remote access on a shared server—but a typo or incomplete list can lock out administrators and automation. Treat it as an access-control change, not just a line to add to a config file. AllowUsers does AllowUsers is an sshd setting. It belongs in the active SSH server configurati
11 Oct 2026
DEV Community
SSH Connection Reset by Peer: Trace the Failure Before Changing Config
An SSH connection that resets is different from one that is refused or simply times out. The TCP connection may have started successfully, only for the server—or something between you and it—to terminate it before you reach a password or key prompt. That timing matters. Changing SSH keys won't fix a connection that never reached authentication. Start by finding where the connection stops, then check the server and network path. You might see one of these errors: ssh_exchange_identification: read
11 Oct 2026
DEV Community
The Tools the Enterprise Actually Lets Me Run: My SRE Stack
People ask what tools I use as an SRE. The better question is which tools survive enterprise security review. Most of the shiny stuff never makes it past procurement. Here is what I actually open every day. It starts in the cluster and ends with the paperwork. 1. GitHub Copilot 2. k9s 3. kubecolor and k8s extensions 4. ArgoCD console 5. Rancher console 6. Opsgenie 7. Grafana dashboards Behind a Grafana Dashboard Migration: What JSON Can't Do. 8. Splunk 9. Grafana Tempo 10. GCP console 11. Postma
10 Oct 2026
DEV Community
Small Business Uptime Explained: 4 EU Signals Across SaaS and Self-Hosted Monitoring
A small property-management app should start with externally hosted uptime checks for its public health endpoint and heartbeat checks for delivery jobs. Self-host the monitor only when control over data location or the monitoring path matters enough to justify operating another failure domain. TL;DR: choose the setup that produces the clearest evidence with the least configuration, then send four signals: reachability, dependency readiness, job completion, and delivery outcome. A monitor that pa
10 Oct 2026
Medium
I Thought Python Would Throw an Error. I Was Wrong.
I was sure that a Python function with no return statement would throw an error. I was wrong. Before I explain, I want to ask you… Continue reading on Medium »
10 Oct 2026
DEV Community
I Held One Lever Still
A free model and a free server are two levers. Move both, then quote one pass rate, and you did not review a model. You published a blend. I will not publish a blend. You know the afternoon this happens. The endpoint answers. The box is up. The suite is already on disk, so you fire it, crop the fraction, and feel done. Which lever moved? If the honest answer is both, plus a retry you forgot to count, the fraction is a story about a pile. Free infrastructure makes the pile feel scientific. No inv
10 Oct 2026
DEV Community
A Review-Hour Gate for Free, Paid, and Local Agent Work
I do not choose a free, paid, or self-hosted agent seat by the invoice that arrives later. I choose it by the review hours I can still spend on the diffs that seat will emit. If I cannot read the patch, the cheaper seat is not a bargain, and the expensive seat is not safer. The question I keep asking is simple: whose eyes are actually on this change before it lands? A seat is only a place where an agent edits files, runs commands, and talks back to me. The free option, the paid box, and the mach
10 Oct 2026
DEV Community
Cloudflare Pages not updating after deploy: the s-maxage trap
Originally published at guushu.com/notes. I keep the original updated, so this copy may lag. A new Pages deploy showed Success and was marked Production, yet the custom domain and <project>.pages.dev both kept serving the old index.html for over a day. I answered that thread on Cloudflare Community on Sep 28. Cloudflare Pages not updating after deploy on both hostnames at once points at a header, not at the deploy. The headers in the post said it all: cf-cache-status: HIT, an age of about 30 hou
10 Oct 2026
DEV Community
Building a Secure AWS VPC with EC2: A Hands-On Networking Lab
Launching an EC2 instance is a great starting point for learning AWS, but real cloud environments require more than virtual machines. We need network segmentation, controlled access, routing, and a secure way for application components to communicate. In this hands-on project, I worked on an AWS VPC and EC2 lab that brings these concepts together. The environment includes public and private subnets, route tables, security groups, an OpenVPN server, a Squid forward proxy, an NGINX reverse proxy,
10 Oct 2026
DEV Community
AI Agent Decision Logs: Record Evidence Without Storing Chain of Thought
An agent can update a customer record, trigger a refund, or route a support case while every dashboard stays green. Then someone asks the only question that matters: why was this action allowed, and what actually changed? A trace may show tokens and latency. An application log may show an HTTP 200. Neither is a dependable answer. The missing piece is an AI agent decision log: a small, structured record for each meaningful choice. It links the task, the bounded evidence, the policy and release in
10 Oct 2026
DEV Community
Crypto Alert: Your Chart Does Not Need a Night Shift Supervisor
At 02:14, the chart moves. At 02:15, an operator refreshes it. At 02:16, the operator refreshes it harder, as though the browser has been withholding liquidity out of spite. We can automate this shift. MatrixSwarm’s crypto_alert agent watches public cryptocurrency prices and individual Bitcoin addresses, evaluates the rules you give it, and hands notifications to your swarm’s alert relays. Phoenix provides the Crypto Watches panel for creating, editing, pausing, and deleting those rules. The age
9 Oct 2026
DEV Community
ubuntu-latest moves to Ubuntu 26.04 on October 19 — 22 toolset differences that can break your CI
Between October 19 and November 19, 2026, GitHub moves the ubuntu-latest runner label from Ubuntu 24.04 to Ubuntu 26.04. Nothing in your repository changes — the machine underneath your CI does. I diffed the official actions/runner-images toolsets (toolset-2404.json vs toolset-2604.json) on 2026-10-10 and found 22 differences. These are the ones most likely to break or silently change a build: mercurial (hg), mediainfo, sphinxsearch, haveged — removed from the image Globally preinstalled Node to
9 Oct 2026
The New Stack
Amazon ECS now auto-repairs failing GPUs and instances. Here’s why it matters for SREs.
Running applications in production means maintaining an “always-on” posture through disruptions. Infrastructure fails; dependencies slow down, and networks partition, not The post Amazon ECS now auto-repairs failing GPUs and instances. Here’s why it matters for SREs. appeared first on The New Stack.
9 Oct 2026
Medium
DevOps Training in Noida Sector 2: Tools, Projects and Career Skills
DevOps Training in Noida Sector 2: Tools, Projects and Career Skills Continue reading on Medium »
9 Oct 2026
The New Stack
Harness bought Augment’s coding agents. The best feature hasn’t shipped yet.
Harness announced Thursday that it acquired Augment Code’s Cosmos software factory, Auggie CLI and Code Context Engine, along with the The post Harness bought Augment’s coding agents. The best feature hasn’t shipped yet. appeared first on The New Stack.
8 Oct 2026
The New Stack
Most AI incident tools still leave a key decision to humans
An AI SRE agent can help troubleshoot an incident. But can you trust it to decide on its own when The post Most AI incident tools still leave a key decision to humans appeared first on The New Stack.
8 Oct 2026
DEV Community
Cloudflare free plan WAF rules I kept after 7 days of scanner logs
Originally published at guushu.com/notes. I keep the original updated, so this copy may lag. These are the Cloudflare free plan WAF rules running on my zone today: three custom rules and one rate limiting rule. I got there by reading a week of firewall events, and by undoing one change that blocked my own images. The short version: path rules do most of the work. The rate limit is where you hurt yourself. Between September 17 and 24, the zone saw about 34,000 requests. 55% of them hit a security
8 Oct 2026
DEV Community
Building a Multilingual Blog Pipeline That Auto-Posts to Zenn, dev.to, and velog
Why I built this As a Korean engineer working in Japan, I've long wanted to publish technical articles in three languages: Japanese on Zenn, English on dev.to, and Korean on velog. Manually copy-pasting every article into three platforms was never going to happen, so I built a pipeline with a single GitHub repository as the hub — push once, and the article goes out to all three platforms automatically. I expected Zenn to be the easy part and got tripped up anyway, and velog turned out to have
8 Oct 2026
Medium
Docker for engineers who have never touched it
Containers, images, volumes, networks, Compose, Swarm. No fluff. Just the stuff you’ll actually code. Continue reading on Medium »
8 Oct 2026
AWS Machine Learning Blog
Automate remediation post AWS DevOps Agent investigation
AWS DevOps Agent can diagnose production incidents but is kept in observe-and-report mode so it does not change resources directly. This post shows how to use AWS Lambda Durable Functions, Amazon EventBridge, and Amazon Bedrock to turn its investigation summaries into pre-validated fixes an on-call engineer can approve with a single action.
7 Oct 2026
DEV Community
How did I automate a VS Code Marketplace release without a PAT?
Question: How can I publish a VS Code extension from a Git tag without storing a long-lived Marketplace token, and what should I check when the build passes but publishing fails? Answer: I split the problem into packaging, federation, publisher access and Marketplace readback. Treating those as separate steps made today's 0.0.2 release straightforward to diagnose. The 0.0.2 listing update also included the new logo, official website and documentation, instructions for the required CLI, and a con
7 Oct 2026
DEV Community
Building a Terminology Pipeline for Multi-Jurisdiction Tax Compliance (Pillar Two and Beyond)
Tax and compliance teams aren't the only ones who feel the pain of Pillar Two reporting. If you work on internal tooling for finance, legal, or compliance departments at a multinational, you've probably been asked to build or maintain some version of a "generate the GloBE Information Return in six languages without anyone catching a terminology mismatch" system. That's a data consistency problem as much as a translation problem, and it's one we can actually solve with tooling instead of throwing
7 Oct 2026
DEV Community
ISO 42001 for Engineering Teams: Practical Readiness Steps and Five Companies to Evaluate
An AI feature passes its tests and reaches production. Two weeks later, the team changes the model provider. Who approves the change? Which evaluations need to run again? Where are the results recorded? Who can disable the feature if its behavior becomes unacceptable? These questions connect AI governance to everyday engineering work. ISO/IEC 42001 defines requirements for an Artificial Intelligence Management System, or AIMS. It covers how an organization establishes, operates, maintains, and i
7 Oct 2026
DEV Community
Cron Expressions Demystified — Build a Human-Readable Cron Parser
Cron Expressions Demystified — Build a Human-Readable Cron Parser Cron expressions are one of those things that look scary until you break them down. Here's how to parse them and generate human-readable descriptions in JavaScript. ┌───── minute (0–59) │ ┌───── hour (0–23) │ │ ┌───── day of month (1–31) │ │ │ ┌───── month (1–12) │ │ │ │ ┌───── day of week (0–7, 0 and 7 = Sunday) │ │ │ │ │ * * * * * * — every value */n — every n-th value n-m — range from n to m n,m — specific values n and m fun
6 Oct 2026
DEV Community
How to Add Quality Gates to a GitHub Actions Pipeline (Step by Step)
Most CI pipelines run tests. Far fewer pipelines actually stop bad code from reaching production. The difference is a quality gate: a check that must pass before the pipeline is allowed to move to the next stage. In this tutorial, you'll build a GitHub Actions pipeline with four gates: Lint: code style and obvious errors Unit tests + coverage threshold: fail if coverage drops below a minimum API tests: verify the running service behaves correctly Manual approval: a human signs off before product
5 Oct 2026
DEV Community
Audit-Ready CI/CD: What Regulated Industries Teach Us About Shipping Software
In many startups, a release is a merge and a deploy button. In a regulated industry like banking, every release must also answer a set of questions, often months later, from an auditor: Who approved this change? What exactly was deployed? Was it tested, and where is the evidence? Could anyone have bypassed the process? For years, many teams answered these questions with spreadsheets, screenshots and change-request forms filled in by hand. That approach is slow, error-prone and painful for engine
5 Oct 2026
DEV Community
Node.js Uptime Health Monitoring API Explained (with Rollback-Safe Status Evidence)
TL;DR: A green Node.js status response is not enough evidence for a safe customer-support rollback. Keep app and job health as logs and metrics, preserve the release and request identifiers that let support reconstruct an incident, and use an external heartbeat monitor for scheduled work. The practical design is two signals: queryable runtime evidence for what happened, plus a dead-man's switch for work that never happened. My decision rule is blunt: do not roll back because one chart turned red
5 Oct 2026
DEV Community
6 Practical Ways to Fix Flaky Tests in Your CI Pipeline
A flaky test passes sometimes and fails sometimes, with no change to the code. One flaky test is an annoyance. Twenty of them destroy trust in your pipeline: developers start clicking "re-run" by reflex, and real failures slip through because everyone assumes it's "just flakiness again." After many years working on QA and release pipelines, I've found that most flaky tests come from a small number of root causes. Here are six practical fixes, roughly in the order you should try them. You can't f
5 Oct 2026
Medium
“Patch everything” is not a security policy. It is the absence of one.
Security is not the thing I am arguing with. “Patch everything” is. Continue reading on Medium »
5 Oct 2026
DEV Community
I forked a live AI agent three ways, and every copy came up with its web server already running
The expensive part of working with a coding agent is rarely the last step. It is all the steps before it: the exploring, the false starts, the files it wrote and rewrote until the thing finally worked. Once an agent has got somewhere good, the state it is in is worth more than any individual output, and the uncomfortable truth is that you usually cannot get back to it. Run the same prompt again and you get something else. DigitalOcean's Managed Agents runs each session in its own microVM and let
5 Oct 2026
DEV Community
ColdFusion cfspreadsheet vs Apache POI: Handling Large Excel Files Without Memory Crashes
cfspreadsheet and Apache POI are not really rivals — ColdFusion's Office/spreadsheet handling is built on Apache POI, so the real question is which POI mode your code ends up using. The classic ColdFusion spreadsheet functions work on a workbook held in the JVM heap, and Apache POI's own documentation says the standard XSSF (.xlsx) API "gives access to all rows in the document" and has a higher memory footprint than the older .xls format. That is why a .xlsx with hundreds of thousands of rows ca
5 Oct 2026
freeCodeCamp
How to Separate Operational Intent from the Executor
In my previous article, I argued that software automation needs a layer between operational intent and execution. The reason is simple: the specification should describe what success means, and the ex
4 Oct 2026
Medium
Kubernetes GPU Scheduling Is Harder Than You Think
How Kubernetes Discovers, Allocates, Places, Shares, and Dynamically Manages GPUs Across Nodes Continue reading on Towards AWS »
4 Oct 2026
DEV Community
Node.js Scheduled Job Alerts with Heartbeat Monitoring (for Safer Rollbacks)
TL;DR: A scheduled Node.js job needs two signals. Emit a structured completion or error event so operators can search what happened, and send a heartbeat to an independent monitor so it can notice when nothing happened. Logs alone can explain a crash, but they cannot prove that a scheduler ever launched the job. For a nightly media pipeline, I would keep those signals behind a tiny application-owned interface and deploy the monitor change before the job change. That makes rollback boring: the ol
3 Oct 2026
The New Stack
AI is speeding up exploits. Vulnerability spreadsheets can’t keep up.
Artificial intelligence has changed almost every aspect of software development and cybersecurity. But perhaps one of the most profound changes The post AI is speeding up exploits. Vulnerability spreadsheets can’t keep up. appeared first on The New Stack.
3 Oct 2026
DEV Community
Week 2: Learning Python, Cloud, DevOps, Terraform, SSH, and CLI Basics
Note: These are my learning notes from my current phase. I am keeping them as I wrote them so I can look back and see my progress. This section talks about computer langauges from Low level languges to high level language, the compiler and interpreted languages. Numbers: integers, floating-point numbers, and complex numbers Strings: Are character sequences. List are ordered group of elements tuples are ordered immutable collections of elements. Dictionaries are collections of key-values pairs t
3 Oct 2026
DEV Community
JadePuffer Isn't the AI Apocalypse, It's Just Ransomware With Better Scripting
Zero points, zero comments on HN, and yet this is probably a more honest signal of where cloud attacks are heading than half the AI security keynotes you'll sit through this year. Let's place this where it actually belongs. Ransomware crews automating their kill chains is not new. What's changed over the last decade is the target moved from on-prem file servers to cloud tenants, and the tooling moved from static scripts to something that can make decisions mid-attack. JadePuffer, per the reporti
2 Oct 2026
DEV Community
Bitbucket app passwords removal: what breaks
Key takeaways In the final brownout week app passwords worked for only four one-hour gaps a day — 05:00, 11:00, 17:00 and 23:00 UTC. Anyone reporting that theirs still works was living in those gaps. The REST API returns 401 and git-over-HTTPS returns 410. Two different codes for the same dead credential, which is why the two halves of an integration fail differently. There are three usernames, not one: your account email for REST, x-bitbucket-api-token-auth for git with an API token, and x-t
2 Oct 2026
Medium
Azure’s VM Lifecycle Policy: Retirement Is the Last Deadline, Not the First
What each stage changes for quota, capacity, and reservations, two Resource Graph queries to find your exposure, and a plan to move Dv3… Continue reading on CodeToDeploy »
2 Oct 2026
DEV Community
We Raised $0 to Disrupt the $15M "AI-Powered PDF" Startup Clown Show with Pure In-Browser WASM
Let's talk about the absolute intellectual bankruptcy of the modern venture-backed startup ecosystem. Over the last two years, hundreds of millions of dollars in VC funding flowed into companies whose entire technological architecture consists of: User Document ──> AWS S3 ──> LangChain / OpenAI API ──> $30/month Subscription Paywall They call it "Next-Gen Enterprise Document Intelligence." In reality, it's a glorified wrapper that adds 4 seconds of network latency, introduces catastrophic data
2 Oct 2026
DEV Community
PromptTest: The Zero-Code Autonomous Mobile QA Brain for Android & iOS (Appium & Detox Alternative)
Traditional mobile automation frameworks like Appium and Detox are notoriously brittle. Flaky locators, heavy WebDriver dependencies, complex device farm setups, and constantly broken test suites slow engineering velocity to a crawl. PromptTest (https://shriramsingh.github.io/prompttest-studio-site/) was engineered to solve this: a high-speed, local-first mobile QA and visual regression testing brain that lets you author and run tests in plain human English without writing a single line of boile
2 Oct 2026