📰 Dev.to · Odilon HUGONNOT

A second spam comment sailed straight past my captcha, honeypot and rate-limiting. Why those layers only stop lazy bots, and the content-based filter that close

Wrap at every layer or once at the boundary? Even Dave Cheney changed his mind. The real criterion: the API contract %w creates with the caller.

Meta tags live in the head and are invisible on the page. That's exactly why they get forgotten. Here's how to fill in title, description, Open Graph and Twitte

Your pod runs with limits.cpu: 2 but GOMAXPROCS is 32. Silent CFS throttling, spiking P99 latencies. Here's the diagnosis, the automaxprocs fix, and what Go 1.2

time.Sleep in concurrent tests is a gamble. testing/synctest replaces the real clock with a virtual one inside an isolated bubble — deterministic, instant, no m

9 skills in production. The audit put them under the microscope: length, salience dilution, long-context drift. What holds, what falls apart, and why the search

Event Sourcing and CQRS explained without the jargon: what they are, the three real wins, when to use them (and when not to), the complete mental model and a Go

A page going from 80 ms to 9 seconds in prod, because of a bug-free ten-line loop. Big O explained through that real case: the O(n²) loop, the array vs linked l

From Dijkstra's goto to Rust's ownership: every major language leap removed a power from the programmer. Could AI design the minimal universal language, the Esp

Copy-paste Claude Code hook examples: auto-format after edits, block dangerous commands, and the Stop hook that forces a final check without an infinite loop. R

Go iterators explained through the real traps: the yield contract, the 'continued iteration' panic, cleanup on break, iter.Pull and its stop(), and when NOT to

How I reworked 109 interactive lessons with 5 desirable difficulties (active recall, spaced repetition, the generation effect) and AI agents, all tested in prod

Chaining order, recover, context timeouts, the ResponseWriter wrapping that breaks streaming, request IDs: the Go HTTP middleware that holds up in production, w

La meilleure façon d'apprendre SQL : par la pratique, dans le bon ordre (SELECT, filtres, agrégats, jointures, puis sécurité). Plus un cours interactif gratuit

Après les bases de JavaScript, la marche d'après : les classes, le piège de this et les prototypes, les modules, les Web APIs et Canvas. Dans le bon ordre, avec

On n'apprend pas Git en mémorisant des commandes, mais en comprenant le modèle mental (les trois zones) puis en pratiquant la boucle de base avant les branches.

How to use Claude to learn JavaScript without becoming dependent: closures, event loop, async/await — the workflow to understand before copying.

If your login responds in 1ms for unknown users and 50ms for known ones, you have an oracle. The fix is 3 lines. The trap that breaks it 6 months later is just

First N failures are silent, then exponential backoff capped at 15 min. Why the status code must never distinguish locked vs wrong creds, and how to reset prope

Synchronizer token server-side vs double-submit cookie: when the latter fails, why middleware wire-order matters, and how to handle JS non-form requests.

A single TLS port serving three hosts via SNI with different ClientAuth levels. Plus the session cert binding pattern to block cookie replay attacks.

tls.Config.VerifyConnection only runs at handshake. A client on keep-alive after revocation keeps serving. Double-gate pattern and CRL hot-reload with monotonic

The pre-pentest audit in successive passes. How to verify findings before panicking, and how to select which probes become permanent regression tests.

You put everything in your CLAUDE.md because "more context = better". How I cut 52% of a production CLAUDE.md after a security audit, and why the agent codes be