Codrops

freeCodeCamp

Hacker News

InfoSec Write-ups

iOS Dev Weekly

<h2>Must know</h2>
<ul>
<li><strong>Vercel open sources React and Next.js optimization rules for AI</strong>: Vercel has released ‘react-best-practices’, a collection of over 40 performance rules specifically formatted for AI coding agents like Cursor and Claude Code. Unlike standard ESLint rules, these focus on high-level architectural optimizations such as eliminating async waterfalls and reducing bundle sizes. The repository has already seen massive community adoption, though some developers are raising valid concerns regarding supply chain security for AI-generated code. <a href="https://app.daily.dev/posts/J6VGCUvIf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google API keys silently exposed Gemini data for months</strong>: Researchers at Truffle Security discovered that GCP API keys, originally intended only for billing, were quietly upgraded to full authentication credentials for the Gemini AI API without notifying developers. This change left nearly 3,000 live keys exposed in public repositories, potentially allowing attackers to access private datasets or rack up massive API bills. Google has since acknowledged the bug and restricted the affected keys, but manual rotation is strongly advised. <a href="https://app.daily.dev/feed-by-ids?id=InhdaYtFz&amp;id=601vxKUqh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AirSnitch vulnerabilities bypass WiFi client isolation</strong>: UC Riverside researchers introduced ‘AirSnitch’, a set of flaws that break the security feature preventing devices on the same network from attacking each other. The vulnerability affects hardware from Cisco, Ubiquiti, and Netgear, enabling man-in-the-middle attacks even on encrypted WPA3 networks. This discovery highlights a critical lack of standardization in how network layers bind device identities. <a href="https://app.daily.dev/posts/tSnGJTDSb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cloudflare proposes a faster pull-based Streams API for JavaScript</strong>: A core contributor argues the current WHATWG Streams API is fundamentally broken and demonstrates an async-iterable alternative that is up to 120x faster. <a href="https://app.daily.dev/posts/x39TDoHIL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft releases evaluation kit for enterprise AI agents</strong>: The ‘Evals for Agent Interop’ kit provides a standardized harness to measure schema adherence and tool-call correctness for AI agents. <a href="https://app.daily.dev/posts/0RYNFsgWk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go 1.26 optimizes slice allocations to reduce GC pressure</strong>: New compiler improvements move more slice allocations from the heap to the stack, improving performance without requiring code changes. <a href="https://app.daily.dev/posts/9nI5Vn4pu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>India blocks Supabase access under opaque IT laws</strong>: Major Indian ISPs have restricted access to the open-source Firebase alternative, impacting 9% of its global traffic without a public explanation. <a href="https://app.daily.dev/posts/x9ggXCarx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubetorch simplifies remote PyTorch development on Kubernetes</strong>: A new project allows ML code to run remotely via a simple .to() API, featuring sub-2-second hot reloading for faster iteration. <a href="https://app.daily.dev/posts/3II62MbL8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NextSilicon Maverick-2 reconfigurable supercomputer enters testing</strong>: Sandia Labs is evaluating a system that reconfigures hardware data flow for specific workloads, claiming half the power of Nvidia Blackwell. <a href="https://app.daily.dev/posts/t9r2wgx3C" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GNOME redirects Git traffic to GitHub to save costs</strong>: In a pragmatic move, the project is mirroring traffic to GitHub to reduce infrastructure data transfer expenses through February 2026. <a href="https://app.daily.dev/posts/HFJOel4V2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>OpenAI secures a circular $110 billion investment</strong>: OpenAI is now valued at $730 billion thanks to ‘investments’ from Amazon and Nvidia that are largely just compute credits for their own chips. It’s a brilliant accounting trick where the money never really leaves the building, but the valuation gets a nice shiny coat of paint while profitability remains a 2029 pipe dream. <a href="https://app.daily.dev/feed-by-ids?id=8imM4YubL&amp;id=ShShzSJ3B" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Perplexity pivots to the $200 per month computer</strong>: Perplexity is abandoning its ad model to sell a $200/month ‘agentic tool’ that supposedly makes ‘GDP-moving decisions.’ It’s the classic pivot from ‘we can’t monetize users’ to ‘let’s call it enterprise and charge 10x,’ banking on the hope that routing queries to 19 different models is worth a car payment. <a href="https://app.daily.dev/posts/JYBUJ8DSb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The six hour AI built dashboard miracle</strong>: A new Docker dashboard is making waves for being ‘built in 6 hours’ using AI tools, which is the new ‘I did CrossFit this morning’ of the dev world. While the tool looks fine, the marketing focuses more on the speed of the AI-assisted birth than whether the world actually needed another TypeScript wrapper for the Docker socket. <a href="https://app.daily.dev/posts/GVRafeRV4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
