There are some new HTML item that is very useful: <geolocation> and <usermedia>. They are also userful for user who has rejected the permission before can be re-approve. A company measure and with these element the change user re-approve is higher

A 40-byte sensor reading costs about 345 bytes of WAL before the commit returns - 8.6x write amplification. The 24-byte MVCC header is only the start: each index emits its own WAL record, and index maintenance alone is ~70% of the volume. Drop all three indexes and it falls to 2.44x. Fixes are batching with COPY and wal_compression.

The icon next to a label looks fine until the text wraps to a second line, and then align-items: center centers it against the whole block instead of the first line. A hardcoded translateY(3px) only holds at one font size. The fix uses the lh unit - calc((1lh - var(--size)) / 2) - which even goes negative on its own when the icon is taller than the line.

Naming is and will always be an art that require continously fine tune and learn. I always see room for improvement anytime I re-read the old code. Seeking opinion of others is a way to see where is the art is

A very cool project: A $20 4G hotspot already runs Linux, so rather than bolt on a microcontroller, the modem itself becomes the whole computer, cuz it’ Linux fundamentally. They use OpenStick for the OS, build their own custom PCB for USB mode switching and power, a Clicks keyboard and a SHARP memory display. The DRM display driver is hand-written too, with Atkinson dithering

Read file, write file, edit file, list files, search, run command - that is the whole surface of a coding agent, and only the first two plus the shell are really needed, since the shell is the get-out-of-jail card for everything else. Edit earns its place because without it a one-line change in a 500-line file regenerates all 500. Demo in R with ellmer.

Uber is famous for their microservice architecture. Every hop in a chain retrying once turns one sick service into 8x its traffic. Uber’s fix is error ownership: a service claims an error only when it failed while all its own dependencies succeeded, and callers retry claimed errors only, so the retries stop where the fault is. An x-uber-error-claim header carries it. In one outage that cut 9.5M spurious requests, and the worst storm radius from 25 hops to 3.

A HEIC image uploaded to OpenAI’s Discourse forum reached a heap overflow in Debian 12’s libheif through ImageMagick. The bug was fixed upstream with no CVE, so Debian never backported it. From the forum, an SSO misconfiguration let them take over employee ChatGPT and Codex accounts, and Codex opened a PR in OpenAI’s internal monorepo. It took under 72 hours and paid a $6,500 bounty.

A public Harbor registry let anyone pull baseten-app, and the image’s build history still held a GitHub token - ARG GITHUB_TOKEN expanded straight into a RUN line, so Docker recorded the value in history[].created_by no matter what the layer cleaned up. It was still live three years after that March 2023 build, with admin and push on three repos.

Sandboxing make the program run inside the sandbox cannot see the outside world: cannot read file system, access process tree and IO etc. These knowledge are all scattered around in multiple whitepaper, implementation, and most of time in C lib. In this blog post the OP offer their own share of experiences that they have acquired while working on sandboxing support for Emilua.