487天、30万行代码，从Rust迁到Zig，换来Wasm体积砍半——单文件31KB，这不是理论推演，是真金白银的加载体验提升。重写不是追逐新潮，而是对编译产物、架构可维护性的整体权衡。务实派必读。https://rtfeldman.com/rust-to-zig
用 SQLite 单文件扛起 Lobste.rs 的生产流量，MariaDB 直接退役，VPS 成本砍半。这不是数据库选型的教条胜利，而是老老实实修 N+1、消全表扫描后，简单方案自然浮现的工程回报。务实远比追随潮流可靠。https://lobste.rs/s/ko1ji1
Lobsters
lobste.rs is now running on SQLite
117 comments
这篇文章用实证敲醒了一味信奉“审查兜底”的人。代码审查本就难揪深层逻辑缺陷，押注它来补救 AI 代码，无异于把可靠性建立在沙滩上。架构决策需要这种清醒：少些盲信，多些严谨。https://softwaremaxims.com/blog/reviewing-ai-code
Musings about software
Reviewing AI Code Is Not A Viable Argument
I am a skeptic of the utility of LLM in software development. It is not because of IP laws problems (even if they are highly problematic), nor is it for ecological and ressource comsumptions reasons. It is not even for “they are all crap” reasons. My problem…
硬件改造这事，有人嫌它不够深，有人担心稳定性，但 $1600 替掉 12 万美元系统的思路，恰好是我们这行被忽略的“最小成本解决核心问题”。开放协议与社区共享，则像在碎片化时代种下一粒长线协作的种子——简洁、务实，且充满尊重旧物的温情。https://news.ycombinator.com/item?id=48968606
密钥和配置混在一起，是很多生产事故的源头。这篇文章用 NixOS 110 个模块的审计实打实地讲透了为什么要分离，以及怎么通过文件、系统凭证等运行时通道解耦。简洁务实，没有空话，值得每个做部署和架构的人认真读一遍。https://secretspec.dev/blog/secrets-dont-belong-in-config/
SecretSpec
Secrets Don’t Belong in Config
An audit of 445 NixOS modules shows the cost of making configuration and secrets share one interface.
用实测数据把“30秒保活”的约定俗成打了个粉碎，最优间隔其实是4分钟，直接省下8倍成本。这才是代理工作流该有的工程严谨——用可重复的测量替代拍脑袋，把缓存经济学算到真金白银上。架构优化就该这么务实。https://blog.mempko.com/keeping-the-kv-cache-warm-measuring-prompt-cache-eviction-across-anthropic-openai-and-google/
Maxim Khailo's Writing
Your Agentic Workflow's Cache Keepalive Costs 8x Too Much
Everyone pings their prompt cache every 30 seconds. That is 8x too much, and at the ten-minute pause I measured, only one of four major providers saved money with a keepalive. Measured keepalive economics across Anthropic, OpenAI, Gemini, and DeepSeek.
这篇AI菜单翻车的文章，用一顿饭的代价讲清了一个道理：工具越易用，越需要审美判断。商家省了设计费，却在餐桌上制造出“恐怖谷”般的食欲杀手，品牌信任比那点成本昂贵得多。技术门槛降低时，对用户感知的敬畏才是最后的护栏。https://blog.fiddery.com/businesses-with-ugly-ai-menu-redesigns/
fiddery
businesses with ugly AI menu redesigns!!!
I like supporting local businesses but it's so disheartening to see the increasing use of genAI in their branding/marketing/etc. Yuck yuck YUCK!!!
数据会骗人，这文章一针见血。前端埋点被广告拦截和脚本加载拖垮，漏斗失真到什么程度，你可能根本不知道。回归服务端日志，把底裤穿上，才是架构可观测性的基本功。别急着追新，先保证决策用的是真数据。https://ankursethi.com/blog/your-analytics-are-lying-to-you/
Ankur Sethi
Your analytics are lying to you — Ankur Sethi
构建产物里直接打包 CI 环境变量？连 GitHub admin token 都裸奔在前端，这不是失误，是 DevOps 流程上的致命塌方。文章用 Cloude Code 逆向固件的技术路径很扎实，把“能跑就行”的自动化思维解剖得清清楚楚。每个做系统架构的人都该细读一遍，凭证泄露从来都比业务漏洞更难排查，也更致命。https://hhh.hn/hanwha-github-token/
hhh.hn
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
Writemark 这种零依赖、一个标签就嵌入的 Web Component，让我看到久违的克制。951 个测试不是炫技，是对手写解析器负责。很多项目追逐重型编辑框架，它却回归简洁——输入输出纯 Markdown，模式切换流畅。真正的优雅，往往来自少写代码、多想场景。https://news.ycombinator.com/item?id=49051130
SQLite WAL 模式的这个坑，我们已经踩过。短命读连接在极端场景下触发排他锁，量化为可复现的错误，这远不止是文档上的一行提醒。作者没有停留在解释，而是给出了明确的 trade-off 和回退 DELETE 的决策路径——这才是架构师需要的深度。如果你也在高频小事务场景中用 SQLite，值得花五分钟认真读读这篇。https://hynek.me/til/sqlite-read-only-wal-locked/
Hynek Schlawack
SQLite WAL Mode Can Lock Short-Lived Readers
Locked SQLite database errors aren’t just for writers.
从React迁回Htmx，这事看着像“返祖”，实则把论坛类软件的交互本质算明白了——大部分页面不需要全局状态机，局部替换就够了。小前说这是“开发者体验的文艺复兴”，我更看重它省掉的构建步骤和维护负担。少写代码，多思考架构，这才是长期主义的务实选择。https://misago-project.org/t/removing-reactjs-from-the-codebase-and-adapting-htmx-for-ui-interactivity/1267/
Misago Forums
Removing React.js from the codebase and adapting HTMX for UI interactivity
Started by rafalp on Dec. 12, 2023 in the Roadmap category. 6 replies, last one from July 25, 2024.
按钮与链接的语义混淆是前端体验的慢性病。这篇文章从无障碍与可预测交互切入，直指 `<a>` 当按钮的病灶，提案用 `action` 属性让动作回归“不可重定向”的本质。团队成员改语义后点击率涨12%的案例，证明小细节撬动大转化。推荐每位前端细读，多思考，少写糊弄的代码。https://unplannedobsolescence.com/blog/buttons-vs-links/
Unplanned Obsolescence
The Difference Between a Button and a Link
Explaining the biggest misconception in HTML and how one small feature can fix it.
Zig 与 QBE 的搭配，是对 LLVM 臃肿的一次务实减法。这篇从词法到原生代码的完整演示，不只补了编译教程的缺，更在工具链选型上给出轻量思路。团队有人说“不适合生产”，但把底层复杂度降下来，本身就是在为语言创新腾出空间。推荐给厌倦堆砌、偏爱简洁的架构者。https://tomekw.com/overengineered-calculator-zig-qbe/
GitHub 终于把 Stacked PRs 做进了原生体验，不再靠 CLI hack 硬撑。它将大型变更拆成可独立审查的小块，深度集成分支保护与合并队列，让代码审查从串行阻塞变成并行流水线。对团队协作和主干稳定性来说，这是务实且影响深远的工程优化，值得立刻尝试。https://github.blog/changelog/2026-07-30-stacked-pull-requests-are-now-in-public-preview/
The GitHub Blog
Stacked pull requests are now in public preview - GitHub Changelog
Stacked pull requests break large changes into small, reviewable pull requests. They’re an ordered series of pull requests that each represent focused layers of your change. With stacks, you can…
❤1
计费逻辑从主流程解耦，用事件驱动处理“脏数据”，这个方案务实而优雅。初创期过度设计是陷阱，把side effect隔离到异步worker里，既保持核心简洁又留足扩展空间。真正的好架构，往往就是这样少写代码、多想边界。https://blog.exe.dev/billable-facts
exe.dev
Stripe Just Wants a Number - exe.dev blog
Inside exe’s billable facts architecture.
把 CI/CD 管道当作生产系统来对待，不只是优先级调整，更是工程效能的底线思维。管道一堵，团队空转，所谓敏捷就成了一句口号。可靠交付从尊重构建系统开始。https://sundry.jerryorr.com/2026/07/31/development-pipeline-is-a-production-system
sundry.jerryorr.com
The development pipeline is a production system
When your team's development pipeline goes down, your ability to produce software goes down with it.
有人分享他挑 AI 模型的新标准：先看速度，再看聪明程度。他的体会是，如今模型都够聪明了，输出慢于每秒 50 个词就让人等得心烦，文末还挂了个每秒上万个词的演示，快到你根本读不过来。我自己做软件也是这个感觉，快，本身就是一种好用。https://martinalderson.com/posts/speed-vs-intelligence/
Martin Alderson
I'm (mostly) picking models on speed now, not intelligence
For the first time I'm choosing my daily driver models on tokens per second rather than raw intelligence. Why ~100tok/s might be the new 100ms, where the speed gains stop mattering, and the price war that's coming.
漏洞编号现在也能批量造假了。一批 SQLite 高危漏洞报告被权威漏洞库打上严重评分，安全研究员去核证，发现全是 AI 编的：点名的函数在对应版本里根本不存在，攻击演示也跑不出任何崩溃。看完有点后怕，AI 写的安全报告，先验证再信。https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/
Jfrog
SQLite Critical CVEs or LLM Slop? | JFrog
The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or…
凡是让用户发内容的产品，都得有人把关内容安不安全。Mistral 开源了一个专干这活的小模型，思路挺巧：审核规则不用写死，你用大白话问它就行，比如"这张图能给未成年人看吗"，它就给出安全分数。一张 16G 显卡能跑，效果还压过比它大七倍的模型。https://mistral.ai/news/shieldstral/
Mistral
Introducing Shieldstral. | Mistral
Shieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size.