2026-09-21 20:19:00
Hi everyone,
If you enjoy BetterDev, please spread the word by sharing it with your friends. And if you’d like to support my work, buying me a coffee would be much appreciated.
The decisions separating teams that ship reliably from teams that don't aren't always obvious. They live in how you structure ownership, where your infrastructure costs actually come from, and what happens to your architecture when velocity increases..
Prepathon 2026 is a free two-day online event from Cloudways running September 22-23, built around exactly these decisions.
Across two days you'll hear from engineers navigating them in production right now. What modern deployment looks like at scale. Where API-first product economics get complicated and how to structure ownership before the costs become a problem. How architecture and accountability shift when teams ship faster. And where AI-assisted development actually saves time versus where it introduces new failure modes.
Every session comes from engineers doing the work, not explaining what best practice should look like in theory.
Seats are limited.
There are some new HTML item that is very useful: <geolocation> and <usermedia>. They are also userful for user who has rejected the permission before can be re-approve. A company measure and with these element the change user re-approve is higher
A 40-byte sensor reading costs about 345 bytes of WAL before the commit returns - 8.6x write amplification. The 24-byte MVCC header is only the start: each index emits its own WAL record, and index maintenance alone is ~70% of the volume. Drop all three indexes and it falls to 2.44x. Fixes are batching with COPY and wal_compression.
Web Search Data, Ready as JSON and Markdown. SerpApi gives developers real-time, structured results from Google Search, Maps, Shopping, and 100+ search engine APIs through a simple API call.
The icon next to a label looks fine until the text wraps to a second line, and then align-items: center centers it against the whole block instead of the first line. A hardcoded translateY(3px) only holds at one font size. The fix uses the lh unit - calc((1lh - var(--size)) / 2) - which even goes negative on its own when the icon is taller than the line.
Naming is and will always be an art that require continously fine tune and learn. I always see room for improvement anytime I re-read the old code. Seeking opinion of others is a way to see where is the art is
A very cool project: A $20 4G hotspot already runs Linux, so rather than bolt on a microcontroller, the modem itself becomes the whole computer, cuz it’ Linux fundamentally. They use OpenStick for the OS, build their own custom PCB for USB mode switching and power, a Clicks keyboard and a SHARP memory display. The DRM display driver is hand-written too, with Atkinson dithering
Read file, write file, edit file, list files, search, run command - that is the whole surface of a coding agent, and only the first two plus the shell are really needed, since the shell is the get-out-of-jail card for everything else. Edit earns its place because without it a one-line change in a 500-line file regenerates all 500. Demo in R with ellmer.
Uber is famous for their microservice architecture. Every hop in a chain retrying once turns one sick service into 8x its traffic. Uber’s fix is error ownership: a service claims an error only when it failed while all its own dependencies succeeded, and callers retry claimed errors only, so the retries stop where the fault is. An x-uber-error-claim header carries it. In one outage that cut 9.5M spurious requests, and the worst storm radius from 25 hops to 3.
A HEIC image uploaded to OpenAI’s Discourse forum reached a heap overflow in Debian 12’s libheif through ImageMagick. The bug was fixed upstream with no CVE, so Debian never backported it. From the forum, an SSO misconfiguration let them take over employee ChatGPT and Codex accounts, and Codex opened a PR in OpenAI’s internal monorepo. It took under 72 hours and paid a $6,500 bounty.
A public Harbor registry let anyone pull baseten-app, and the image’s build history still held a GitHub token - ARG GITHUB_TOKEN expanded straight into a RUN line, so Docker recorded the value in history[].created_by no matter what the layer cleaned up. It was still live three years after that March 2023 build, with admin and push on three repos.
Sandboxing make the program run inside the sandbox cannot see the outside world: cannot read file system, access process tree and IO etc. These knowledge are all scattered around in multiple whitepaper, implementation, and most of time in C lib. In this blog post the OP offer their own share of experiences that they have acquired while working on sandboxing support for Emilua.
the YAML rules engine for cloud governance, now CNCF incubating and well past AWS - one policy file filters resources and acts on them, and it provisions the Lambda or EventGrid trigger itself so rules fire on change rather than on a cron. Python, Apache-2.0.
autonomous pentest agents that run your code in a Docker sandbox and prove each finding with a working PoC rather than a maybe - HTTP proxy, headless browser and a Python sandbox for exploit dev. Python, Apache-2.0.
runs a coding agent inside a throwaway microVM that mounts only the one project at /work/<name> and starts with no credentials, so it cannot reach your other repos, keychain or SSH agent - hull on macOS, urunc over KVM on Linux. Go, Apache-2.0, prerelease.
each workload gets its own VM and guest kernel instead of a shared one, booting in under 200ms from an OCI image - and you can fork a running machine copy-on-write or freeze it into a portable .smolmachine file. libkrun underneath. Rust, Apache-2.0.
2026-09-14 20:19:00
Hi everyone,
If you enjoy BetterDev, please spread the word by sharing it with your friends. And if you’d like to support my work, buying me a coffee would be much appreciated.
Redis was designed in 2009 for single-core machines, and it still runs one core per process. On a modern 64-core server that means most of the machine sits idle, and the only way to use it is to shard across more nodes. You end up paying for compute your data store cannot reach.
Dragonfly takes the other path. It is not a fork of Redis or Valkey. Its technical founder spent years as a principal engineer on AWS ElastiCache and saw where managed Redis hits a wall at scale, so he built a replacement from the ground up. It uses a thread-per-core, shared-nothing architecture and a new hash table design that cuts memory overhead by around 40% compared to Redis's dict. The result is roughly 6M ops/sec on a single node, so workloads that currently need a cluster fit comfortably on one machine. Instacart migrated to Dragonfly, cut average latency in half, and now runs 70% fewer nodes.
Dragonfly speaks the Redis and Valkey wire protocol, so your existing clients and commands work unchanged. Open source, single binary, easy to benchmark against your own workload, and available as a fully managed cloud service if you would rather not run it yourself.
Codegolf next level. 1024 bytes of C, support if/else, while, for over range(), and function definitions. Ofcourse, not full feature Python, but mainly to prove it can parse and execute some simple Python. So no ast and byte code. It’s a recursive descent parser executes code as it reads, and a loop just seeks backwards and reparses the source each iteration, letting the C stack do the recursion. Variables are single letters, so the ASCII value is the symbol table index.
.arpa is a special TLD, its mean is not to be used but more of to support network infra. Example, we know DNS -> IP. But IP can also resolve to DNS, call reverse DNS. But IP has no central storage look up, so to support that reverse DNS is done through a special in-addr.arpa. In this post, we kind of abuse that infra for ipv6, and use some tip. We will leverage a free Hurricane Electric feature with ip6.arpa domain. Catch is we cannot issue HTTPS because. But read on, the trick is cool
Web Search Data, Ready as JSON and Markdown. SerpApi gives developers real-time, structured results from Google Search, Maps, Shopping, and 100+ search engine APIs through a simple API call.
When our rival make faster software than us, instead of feeling defensive, Ben put the hack hat on. Don’t even read code, and bring on tooling like strace to fill out why his tool is slow, ended up making it faster and beat the rival. This is the hacker mindset, someone make it faster mean it has room to improve.
Vercel reduce P99 from 215.8ms -> 19.1 ms. Each request needs to look metadata. Originally metadata is cache per path. Seems efficient. They now move to batch paths, group them. But big group cause in-efficient way. They find a balance, and pair with a bloom filter to reduce the metadata look up time.
Who cares? My first re-action. Just took some damn time library, convert, or do 3 divisions yourself and call it a day. But the author is truely want to make this to next level. A daily timestamp [0..86399] can be converted into Hour, Minute and Second – with the latency of only two multiplications (and on some targets even lower!).
What would you do when you have a big table, and you know adding a new index will help, but it would take a day to complete. What ships instead is a 2,000-row mapping table holding the earliest start_date per filter combination: join that first, and minutes become under 100ms.
A fact about PostgreSQL that surprises everyone: every query against a table takes a lock on every index on that table, whether or not the query uses any of them. The lock are very cheap lock, AccessShareLock. But cheap is not free. Where does these lock store? Bad news, only 16 slot in a hared lock table. Contention is real
This truely read like novel. OpenAI tried to execution RubyGems infra. 2,000+ malicious packages between May and June, exploiting RubyDoc.info’s automatic documentation builds for remote code execution, apparently to scrape UK local government data. The packages carried “oai” in their names and the agents identified themselves. RubyGems froze new registrations for four days, whether any API keys were stolen is still unclear.
Anytime we process payment with Stripe, the fee is painful. And it has been putting that on network fee. Turning out Visa is not taking most of that. On a $100 sale the issuer keeps $2.00 for carrying credit and fraud risk, the processor $0.35, and Visa itself $0.15 for routing and netting. What Visa really sells is settlement: $84.3B moved on an average day in 2024, backed by an $11.2B liquidity reserve.
STP is a network layer-2 protocol that builds a loop-free logical topology by blocking redundant links. The point is to route traffic without causing forver loop in cycle. here we go through a super interactive tour to learn that
AF_PACKET, AF_XDP, DPDK and mlx5 Direct Verbs behind one Go API, so changing backend is mostly a different open call. The one worth the read is Direct Verbs: hardware steering lets your app claim specific flows while Linux keeps the interface as usual, and it still hits 148.6 Mpps on 64-byte packets.
for CSS readers: 25 hand-drawn UI controls that re-sketch themselves on each mount and again on hover, real form inputs underneath and zero dependencies - open the source to see how roughness, boil and ink variants are wired. React or vanilla, MIT.
a GPU-rendered, keyboard-driven IDE drawn on a character grid, with editor, terminal, text, workspace and LLM as separate composable packages so the agent stays outside the core editor rather than welded into it. Go with a cgo renderer, GPL-3.0. Companion post
mark a dependency // gomodjail:confined in go.mod and it statically proves that module can never reach the filesystem, network, exec or raw syscalls, walking reachability with Capslock - reflection and assembly still escape it.
iPhone Continuity on a Linux Wayland desktop, reading iMessage and SMS straight off the phone over Bluetooth ANCS with no Mac relay - the source. It reverses engineer iMessage/SMS protocol, leverage tech like BlueFerry
Recored your terminal
sandboxes the agent, then sandboxes every tool it calls in its own nested child sandbox - so git or curl gets no filesystem, network or credentials that its own policy doesn’t grant, with no daemon, container or VM in the way. Rust, Apache-2.0.
Claude Code skills that hunt vulnerabilities attacker-first, reasoning forward from entry points to dangerous sinks, then try to falsify each finding before reporting it - paired /vulnhunter-fix and /vulnhunt-fix-verify skills write a test-backed patch and check it independently. Apache-2.0.
2026-09-07 20:19:00
Hi everyone,
This week I was working on code optimization, I asked AI to verified it. Typically, it should only need to verify with its local db. However, to be useful, it tried to SSH into my dev, qa, prod env and run the code against it. Good thing that it doesn’t have credential(it event tried to use my secret cli to load it from my secret server). Remind if you use AI, put something in your docs to ensure it never connect to prod env, or even better, don’t even have some script that can retreiver secret through cli(looking at your, aws and gcp cli).
If you enjoy BetterDev, please spread the word by sharing it with your friends. And if you’d like to support my work, buying me a coffee would be much appreciated.
Add Web Search to Your AI Agents. Ground LLM responses with live, structured search results from Google and other engines, ready for tool calling and RAG pipelines.
Mobile dev has learned to never block main thread for years. For us, web dev, I’m sure we were frustrated with slow scrolling side, click a button and the site seems freeze. And maybe we start make less network call, reduce the bundle size and so on. But it goes beyond that, the code is fine, they aren’t slow but they block the main thread. We learn about it here.
Kevin made a circuit-board business card with an NFC chip and a batteryless LED powered by the phone tapping it. The hardware worked, but ordinary iPhone NFC apps couldn’t format the blank NTAG I²C Plus chip. He wrote a tiny Core NFC app that sends the chip’s native commands directly, and now each tap opens my site and lights Charizard’s tail.
features a randomly generated 8x8 board, lets you open cells with left click, toggle flags with right click, opens cells with zero neighboring mines recursively, and has basic win detection. How is this even possible???
In the day of AI, anything without physical confirmation, can be easily to be a “hack” or “workaround” with the LLM. SSH is the key to the kingdom. Today, we learn how to setup Secure Enclave to authenticate SSH. The nice thing about it is that the key cannot be extracted out. Mean if you migrate to a new laptop, the secure enclave seed won’t follow you. Very secure, but also a rough edge.
Imagine ordered a 100 GbE server, then expected things to just work. Imagine OP’s surprise when the server crashed when serving at just 20 Gigabit.
A custom property answers differently depending on whether you registered it. Unregistered, it stays a raw token stream and its functions evaluate wherever you var() it - so sibling-index() reads the child’s position, not the parent’s. Register it with @property and it computes at the declaration instead. Same trap for em, ch, lh, container query units and relative URLs.
B-Tree is very common in Database like Postgres, MySQL. But there are RocksDB, Cassandra, Pebble which use LSM Trees, and many other key-value storage use it. One simple way to look at them is LSM trees optimize for heavy write, data is written in chunk, immutable, append only.
Nine animated videos from BitLemon: how a cache is organised inside the CPU, the L1/L2/L3 hierarchy, SRAM vs DRAM, replacement and write policies, the four C’s of misses, then two episodes building a cache simulator in C++. A memory round trip costs about a hundred cache hits, so most slow code isn’t doing too much work, it’s laying its data out badly.
It’s always good to know how to do something. Like my wife said, youc an order food, but better if you can cook yourself. In this seris, we learn about many concept of practical PostgreSQL. Practical mean we will facing them every single day and anyone run a PostgresSQL db with modest workload face these sooner or later.
Just as I said above. Let learn system inside out. Alexander Kuleshov’s home for linux-insides, now with a proper reader around it: 64 chapters of kernel internals read straight from the source - boot, interrupt gates, syscall dispatch, timers, spinlocks, memblock, per-CPU variables. Beside it, a seven-part x86-64 assembly series and Field Notes on real performance investigations.
A small transformer trained from scratch in 1.5 hours on one 5090 - beats many LLMs on ARC-AGI-1, matches TRM/HRM, costs 67 cents. The ablations say two choices carry it: 3D RoPE and a per-puzzle embedding, and dropping either turns 44% into 24%. The odd bit the author can’t explain: removing input tokens from the loss makes test loss worse while the score goes up.
In previous issue we mention SIMD. In this we will learn how Debian Code Search ditch cgo, rewrite with Go 1.26’s experimental simd/archsimd. The Go rewrite beat C, helped by AVX512 kernels and a positional popcount trick worth another 2x - though the post is honest that backporting both to C puts Go at about 1.4x slower.
for Rust readers: a trigram-indexed grep with a resident server, up to 52x faster than ripgrep on a 400k-file monorepo and the engine behind grep in GitHub Copilot CLI - read it for the HybridIndex that merges an mmap’d disk index with a live in-memory overlay.
one static Go binary that reads the statistics views Postgres already keeps about itself and prints a graded health report, diffed against the last run so regressions surface as changes rather than numbers you have to remember.
htop for every Postgres you own. show locks, query regressions, unused indexes, vacuum and replication, checked in the background so a tab that goes red gets flagged while you read another.
a desktop AI agent that installs like a normal app, and runs multi-step tasks in the background against any of 15+ providers or a local Ollama, though the repo is distribution only and the app itself is closed source.
llama.cpp inside your Go program in the same process with no cgo - it dlopens the prebuilt library through purego, so you keep a normal go build and can swap in a newer llama.cpp without rebuilding.
we linked to this back in issue #173 as a promising idea; six years on it is a feature-complete open source Burp Suite Pro - MITM proxy, interception, request replay, scopes and per-project storage, in one Go binary.
so we already know about headscale, implement of control server of tailscale. tailcat is an re-implementation of tailscale functionality without relying on tailscale, while still using the backbone of Wireguard, NAT traversal. So no account, no sign-up, no control server. Easy to use for small team or some quick experiement.
snapshots PostgreSQL’s shared memory and opens it in your browser as a physical map
2026-08-31 20:19:00
Hi everyone,
The best way to learn is to implement something. We will understand why a certain concept was used or name. For monthes, I don’t know why they always talk about KV cache, or what is token streaming mean. Now I do, by start reading and working on those inference engine.
If you enjoy BetterDev, please spread the word by sharing it with your friends. And if you’d like to support my work, buying me a coffee would be much appreciated.
Add Web Search to Your AI Agents. Ground LLM responses with live, structured search results from Google and other engines with SerpApi, ready for tool calling and RAG pipelines.
Once some AI lab release an open weight model, we can download and run them. But what is the program that run them? that program is call inference engine. We will build one with less than 2000 lines. Another article that also give good overview is vLLM-Style fast inference engine. We learn why we need KV cache, why it’s call token streaming.
Grep is cheap, agents are smart, so DeepSec uses both: a fast local pattern scan narrows your repo to the security-sensitive files, then Codex or Claude actually follows the data across them and writes up real findings, with a second pass throwing out the noise. Flavio runs it on his own site and watches 504 maybes collapse into a short list worth reading. Vercel’s, open source, and it drops into CI.
The checklist that turns a fresh Ubuntu or Debian box from an open door into something that shrugs off scans - key-only SSH, UFW, pruned setuid binaries, unattended security updates. Every step ships with the exact command and the reason behind it, so you harden a server on purpose instead of out of copy-paste fear.
Four completely different things in your stack are all called “caching”, and confusing them is why your token bill will not go down. Avi Chawla takes apart all four - KV, prefix, prompt, semantic - with runnable code, then lists what silently kills reuse: a timestamp in the system prompt, a reordered tool schema, a summarized history. The kicker is that three of them only cost you money on a miss, while the fourth cheerfully returns a wrong answer with a 200.
Crunchy Data marks up its own years-old advice on loading, storage and indexing with everything Postgres 19 quietly made obsolete. Async I/O rewrites the cost model, JIT is off by default, LZ4 replaces pglz, COPY survives bad rows, and skip scan means that companion index you were about to add may already exist. Read it as a list of benchmarks you need to re-run before trusting an index strategy you settled on in 2021.
Have you ever done a read right after a write, got nothing back, and given up and pointed the whole path at the primary just to be sure? Postgres 19 adds WAIT FOR to fix exactly that: capture the WAL position after the write, hand it to the replica, and the read blocks until replay catches up - so only the queries that need freshness pay for it, and replication stays async for everyone else. Expect your pooler to inject it long before your app does.
When you hold 250 billion cache entries, one wasted byte per entry costs 250 GB - so Cloudflare went hunting through their Rust structs and found 533 of them. Vec becomes Box<[T]> to drop the capacity field, three record sections collapse into one list addressed by u16 offsets instead of pointers, fat enum variants get boxed so the A records that are 80% of traffic stop paying for NAPTR’s padding. 953 bytes down to 420, roughly 100 TB freed fleet-wide, and inserts got 43% faster on the way.
Destructure a counter from an ESM module and it updates; do the identical thing with require() and it stays frozen at the old value forever. ESM links live bindings before anything runs, CommonJS hands you a copy of an object whenever require() gets there - and every weird thing downstream, circular imports, .default wrappers, the same package loaded twice as two instances, falls out of that one difference.
Watching a big company do a live migration is always a good lesson, whatever the stack happens to be. Cloudflare moved this very blog onto a new CMS behind a proxy Worker that routed by cookie, fell back to the old site automatically on a 500, and shifted traffic 1% at a time until it hit 100% the same day - no downtime, no big bang cutover. The load testing they did before touching real traffic is worth a read on its own.
Every “Postgres MVCC is broken” thread lists the same four charges - write amplification, bloat, one idle transaction freezing vacuum everywhere, and XID wraparound - and all four are fair. The good part is what comes after: the same questions get asked of Oracle’s undo logs, SQL Server’s tempdb, WiredTiger’s cache, and CockroachDB’s timestamped keys, and every one of them just moves the bill somewhere else. Postgres makes you pay in maintenance, but it also lets you open the page with pageinspect and see exactly what you owe.
a 2 KB syntax highlighter that never touches your DOM. Instead of wrapping every token in a <span>, Dave Rupert’s tokenizer turns TextMate grammar matches into Range objects and hands them to the CSS Custom Highlight API, so styling happens through ::highlight() and your <pre><code> stays exactly as you wrote it - still editable, still copyable. Worth reading as the clearest small example of that API in a real library, plus how far plain RegExp gets you when you skip Oniguruma and WASM. MIT licensed.
a code counter is a boring problem right up until you want it to chew through the Linux kernel in under a second - and that is what makes this codebase such a good read. Ben Boyter counts lines, comments and cyclomatic complexity with one byte-level state machine and no AST anywhere, then spends the rest of the repo on the parts nobody writes down: keeping allocations off the hot path, sizing worker pools for directory walking versus file processing, and when turning the GC off entirely is the honest answer. Pure Go, MIT licensed.
every Ruby server forks a process per core to get around the GVL, and you pay for that in memory - Kino uses Ractors instead, so one small process runs your Rack app on every core. The network layer is Rust with Tokio and Hyper, the workers are Ruby, and reading it is the fastest way to see what actually changes when your code has to be Ractor-shareable, plus how the two sides hand requests across. Rack 3 compatible, roughly 7x less memory than a Puma cluster on their benchmark, MIT licensed.
one Python library that speaks 100+ notification services - Slack, Discord, Telegram, ntfy, Matrix, plain email - so “tell me when it breaks” is one line instead of an integration per chat app. Every destination is just a URL, which turns your alert routing into config you can version instead of code scattered across repos. Library, CLI you can call from cron, or a Dockerized REST API. BSD-2-Clause.
an entire wardriving kit in one Python GUI: 2.4 and 5 GHz SSID scanning, BLE and Classic Bluetooth discovery, and - if you hang a HackRF or Ubertooth off it - live spectrum overlays that show the interference RSSI alone hides. Hunt mode tracks moving sources on a GPS map, and the same engine runs headless as a REST agent you can strap to a Pi, drone or rover. Ships Elasticsearch/Kibana dashboards and a DroneID app that turns a plain BLE adapter into a drone detector. GPL-3.0.
the certificate chore, automated on your own box: point it at a domain and it applies for the cert, deploys it where it actually has to live, then renews and redeploys on schedule so nothing expires at 2am again. 70+ DNS registrars on the way in, 150+ destinations on the way out - Kubernetes, CDNs, WAFs, load balancers, remote hosts over SSH - and a ping to Slack or email when something needs you. One Go binary or a docker run, ~16 MB of memory, everything stored locally. MIT.
Postgres tells you plenty about itself, but only about right now - this stores periodic snapshots of the stats views inside your own cluster and plots them. Call pgstatviz.snapshot() on a schedule, then draw buffers, cache hit ratio, connections, I/O, WAL, wait events, locks or replication lag over any date range, each with its rate of change beside it, so slow drift finally looks like a slope. No agent, no time-series database, no exporter sidecar. PostgreSQL License.
native Linux desktop apps written in React and TypeScript, without Electron. JSX maps straight onto GTK4 and Adwaita widgets through a Rust backend, types are generated from GObject introspection so the whole tree is checked end to end, and you get hot reload, a Vitest + React Testing Library setup for GTK, and a CLI for create/dev/build. It is a plain Node program underneath, so npm still works. MPL-2.0.
2026-08-24 20:19:00
Hi everyone,
If you enjoy BetterDev, please spread the word by sharing it with your friends. And if you’d like to support my work, buying me a coffee would be much appreciated.
Specs drift. Decisions live in threads. Agents build from whatever's easiest to find, which is usually wrong.
Thor keeps a synced answer across Slack, GitHub, and Linear so agents and humans are working from the same reality.
Git is distributed by design, yet hosting it centrally is a nightmare. Ever wonder how GitHub survives that? This walks from their early attempt at distributing the filesystem, to Spokes and its consensus-based replication, and now Continuity - Cursor’s write-ahead log design that just makes S3 the source of truth. No consensus, no routing table, add as many replicas as you want.
2011, no WebRTC yet, so Facebook signed a contract with Skype and shipped their binary inside the client. Philip Su, the second engineer in the Seattle office, tells how it went: six weeks of 8am to midnight hotfixes, living on junk food, moving his family to Palo Alto. The fun part is the feature ended up exposing how unreliable Facebook’s own message delivery was. He is also on Ryan Peterman’s podcast with more of these stories.
Turns out a compressor and an LLM do the same job: guess what comes next. Once you have seen a q, the odds the next letter is u jump to ~0.999 - that is the whole game. A nice read to build intuition on entropy and arithmetic coding, though please don’t run an LLM to gzip your HTTP response.
You may never type a SAVEPOINT in your life, but every PL/pgSQL exception handler hands you a subtransaction for free. Go past 64 per backend and the snapshot overflows, every lookup falls into the pg_subtrans SLRU under a read lock, and the whole cluster crawls - even queries that have nothing to do with yours. Worse, it blocks a new read replica from entering hot standby, exactly when you are trying to scale out.
I always read work_mem as a per sort/hash limit and left it there. It is not that simple - the memory is only released when the whole operation ends, so the chunks pile up and one badly shaped query can eat all your RAM with a perfectly modest setting. Fix the query and the statistics, not the knob.
How do you get the weekday out of a day number? Modulo 7, right? Turns out 7 is a Mersenne number, so one multiply and a shift will do it - about a multiply plus two cycles. Same trick works for the mod 24 and mod 60 you hit everywhere else in timekeeping.
One LDG.E asks for 128 bytes, and this post follows it all the way down an RTX 4090: L1 first (15ns), then the TLB to turn virtual into physical, across the crossbar to one of 36 L2 slices (127ns), and if that misses too, the memory controller fires an activate plus four column reads at a DRAM bank - 255ns round trip before the warp’s registers finally get their data. This is where all your kernel’s stall cycles actually go.
You pull the same weights everyone raves about, run them at home, and somehow it acts dumber. It is not in your head - the author tests it and the blame lands on the plumbing: different CUDA attention kernels give slightly different logits, KV-cache quantization compounds the error token after token, and simply picking FlashAttention 2 over Flash Inference or Triton is enough to flip the top-1 token. It shows up worst in tool use, where one flipped token means a malformed command. No magic fix, just: benchmark on your own workload and pick your quantization carefully.
Light / Dark / System - we all ship that third button, and Lea Verou argues it is us leaking our implementation onto the user. Nobody hunts for the toggle to plan their future, they click it because their eyes hurt right now, so give them two states and be smart underneath: flip to the opposite of what they are seeing, only store an override when it differs from the system, and never silently drop an explicit choice just because it happens to match. A dedicated settings panel is the one place the three-state control still earns its keep.
Ever tried to pan a map diagonally on the web and felt it snap to one axis? That is the browser deciding your gesture is “mostly horizontal” and locking it. scroll-axis-lock: none turns that off and lets the container follow your input exactly - a small thing that makes maps and zoomed images feel right. Chromium 153+ only for now, Firefox and Safari still to come.
an LLM proxy in Rust that routes requests across providers and translates between the OpenAI and Anthropic APIs, so your app keeps one API while you swap the model behind it. Typed, composable routing algorithms and metrics come built in, handy for A/B testing and cutting the bill. Apache-2.0 licensed.
WSL2, but for your Mac: Linux VMs with file sharing and port forwarding that just work. It ships containerd and nerdctl, and runs Docker, Podman, or a k8s cluster just as happily. Odds are you already use it without knowing - Rancher Desktop, Colima, Finch, and Podman Desktop are all built on it. CNCF incubating, written in Go, Apache-2.0 licensed.
you don’t need an H100. This runs 290B+ parameter MoE models at interactive speed on the GPU you already own - an RTX 30/40/50 card, or even a laptop. The trick is bandwidth-adaptive CPU-GPU co-execution, semantic-aware caching with anchor checkpoints, and shuffling VRAM between expert cache and KV memory on the fly, across MXFP4, NVFP4, FP8, and BF16. Speaks the Anthropic and OpenAI APIs, ships as both a desktop app and a CLI. Apache-2.0 licensed.
how many CEOs still ship C++ on the weekend? This one is from Tobi Lutke, CEO of Shopify - a screenshot and annotation tool for Wayland/Hyprland that grew out of the Omarchy world. Region, window, fullscreen, and scrolling capture, annotations kept as movable vector layers, OCR, pinned always-on-top captures, and a working document that survives a crash with undo intact. C++ with Qt6, MIT licensed.
2026-08-12 20:19:00
Hi everyone,
I’m slow and late this week but better than nothing. I’m keep doing this. I hope I didn’t disappointed anyone with such a late and short issue
If you enjoy BetterDev, please spread the word by sharing it with your friends. And if you’d like to support my work, buying me a coffee would be much appreciated.
a pushback against the dismissive claim that “code was never the hard part”. Programming is a genuinely difficult, skilled discipline, and the author argues we should embrace both technical excellence and customer empathy while adapting to AI, rather than retreating into denial or extreme positions.
a deep performance investigation into why Envoy’s switch from nghttp2 to oghttp2 caused a ~20% CPU regression on HTTP/2 proxied traffic. The culprit wasn’t the Huffman decoder but string handling in header block processing, with std::string::push_back alone eating 13-20% of CPU. Envoy ended up reverting the default in 1.37.
the humble <img> is a replaced element, meaning its container and its content have separate dimensions - so with object-fit, object-position, and border-radius the image content can actually overflow its own box. The author turns this quirk into neat tricks like animated image reveals and loader effects with zero extra markup.
a fun deep dive into embedding photographs inside QR codes using Floyd-Steinberg dithering and error diffusion, producing codes that look like images while remaining fully scannable.
you don’t need a PhD to understand how LLMs work under the hood. This post shows that high-school vectors and matrices are enough: embeddings, high-dimensional spaces, dot products for similarity, and matrix multiplication as projection between spaces.
with AI removing the friction of writing software, taste - the ability to judge what deserves to exist - becomes the only genuinely scarce skill left. The difficulty of building used to force us to develop discernment through failure; frictionless generation has separated productivity from judgment, leaving us swimming in an ocean of “plausible” mediocrity.
not a programming article, but a great essay on building your own value system instead of chasing external rewards. Chasing arbitrary incentives stunts genuine growth; the author makes the case for doing what’s right regardless, through the story of abolitionist Charles Sumner, who pursued justice despite severe social and physical costs.
lessons from a decade of building EC2’s control plane - the system that reconciles desired infrastructure state with actual state. Fun fact: at the heart of it all was a plain MySQL database (“customer X now has VM Y” was literally a row in a table), and the article walks through the years of failover pain, read replicas, and sharding it took to scale it. Those pains shaped DSQL’s architecture: per-connection micro-VMs, automatic read replicas with strong consistency, and transparent partitioning. DSQL’s control plane even runs on DSQL itself.
a whole site dedicated to Postgres locks, written by a customer reliability engineer as “the documentation I wish existed when I was learning about locks”. It walks from animated concept explainers through runnable table-lock demos, troubleshooting guides, and monitoring tool reviews, and includes an interactive blocking graph showing which SQL operations lock each other out.
autovacuum is getting smarter in Postgres 19: instead of processing tables in catalog order, it scores and prioritizes them by transaction ID age, dead tuples, recent inserts, and analyze needs - with six new tuning knobs to weight those factors. Autovacuum workers can also finally parallelize index vacuuming across multiple workers.
for Go readers: a high-performance packet generator - think “the iPerf of packet generators” - that hits line rate (138M packets per second on 100G NICs) from a single static Go binary using AF_XDP, no DPDK required. Supports UDP, TCP SYN, IMIX, raw Ethernet, and PCAP replay. Apache-2.0 licensed. Don’t miss the amazing companion post Wireblast: a 100Gbs packet generator in Go with AF_XDP where the author walks through how it’s built.
a privacy-focused, accountless web app that encrypts and shares files with passkeys and AES-256, entirely on-device - it even works offline. The code is a great read if you want to see WebAuthn’s PRF extension and HPKE cryptography used in a real product, and how to design a trustworthy offline-first app. GPLv3 licensed.
for Python readers: a library that queries Apple’s FindMy network from any platform - no Mac required. It fetches and decrypts location reports for AirTags and iDevices, handles Apple account auth with 2FA, and scans for nearby devices, with both sync and async APIs. A fascinating read if you want to understand how Apple’s crowd-sourced location network actually works under the hood. MIT licensed.
a zero-dependency spreadsheet engine in pure TypeScript that reads and writes XLSX, CSV, ODS, JSON, NDJSON, and XML, with streaming support and round-trip preservation. A great codebase to study how binary/document format parsing and streaming architectures work without leaning on any external libraries. MIT licensed.
a configurable, fast, and thorough secrets scanner. It is maintained by the folks who made Gitleaks, including the original author.
a native macOS app for managing virtual iPhones - browse, create, and boot iOS research VMs from a single window. Built on Apple’s Virtualization.framework for Apple Silicon.
a pretty and modern terminal file manager written in Go, with customizable themes, plugins, and hotkeys. Works on Linux, macOS, and Windows.
a storage-agnostic, Dropbox-like file manager for your existing storage: FTP, SFTP, S3, SMB, WebDAV, IPFS, and about 20 other protocols. Plugin-driven, so backends, auth, and file viewers are all swappable. Written in Go, AGPL-3.0 licensed.
a free, open-source screenshot and screen recording app for macOS - a native alternative to paid tools like CleanShot X. Area/window/fullscreen capture, video and GIF recording with webcam picture-in-picture, annotations, OCR, and screenshot history, with no paywall. Built with Swift 6 and SwiftUI.
a free macOS menu bar app that tells you what your USB-C cable can actually do - speed, power capability, and display support - based on what your Mac really detects, not what the packaging claims. Great for figuring out why a cable charges slowly or won’t drive your monitor. For Apple Silicon Macs on macOS 14+, with a CLI for scripting.
a GitHub-powered Android app store. It discovers public repositories with installable APK releases and lets you browse, install, and update them through a Play Store-style Material 3 interface.
