DEV Community: I Want To Learn Programming

Code Challenge of the Day: Number appearing once (others thrice) (hard)

I Want To Learn Programming — Wed, 15 Jul 2026 14:00:05 +0000

Every value appears three times except one, which appears once. Return that value.
Write single_three(nums).

Starter:

def single_three(nums):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

What WebAssembly actually is, and why it escaped the browser

I Want To Learn Programming — Wed, 15 Jul 2026 14:00:03 +0000

WebAssembly (Wasm) was pitched as "fast code in the browser," a way to run C or Rust on a web page at near-native speed. In 2026 it has escaped that origin: Wasm now runs on servers, at the edge, and as workloads orchestrated by Kubernetes. To understand why it spread, you have to understand what Wasm actually is, and it's simpler and more familiar than it sounds.

The one idea: a tiny, safe, portable instruction set

Wasm is a bytecode for a stack machine, the same shape as the bytecode VM you can build in 30 lines. It defines a small set of low-level instructions (push a number, add, call a function, load from memory) that aren't tied to any real CPU. You compile a high-level language down to these instructions, and any Wasm runtime can execute them.

That's the whole concept. The interesting part is three properties that fall out of it, and together explain the takeover.

Property 1: it's portable

Because Wasm instructions are CPU-independent, the same compiled .wasm file runs on x86, ARM, in a browser, on a server, anywhere there's a runtime. It's "compile once, run anywhere", Java's old promise, delivered as a compact, language-neutral target. Here's a Wasm function in text form (WAT), adding two integers on the stack:

(module
  (func (export "add") (param i32 i32) (result i32)
    local.get 0      ;; push first argument
    local.get 1      ;; push second argument
    i32.add))        ;; pop two, push their sum

If that looks like the PUSH/ADD bytecode from a toy VM, that's because it is one, standardized and shipped at industrial scale.

Property 2: it's fast

Wasm is low-level and statically typed, so a runtime can compile it to real machine code quickly (ahead-of-time or just-in-time) and run it at near-native speed. There's no parsing of source, no dynamic-type guessing. This is why it could do the original job, running a video editor or a game in a browser tab without the JavaScript penalty.

Property 3: it's sandboxed by default (the big one)

This is the property that took Wasm out of the browser. A Wasm module runs in a sandbox: it has its own linear block of memory and cannot touch anything outside it, no files, no network, no system calls, unless the host explicitly hands it a capability. By default it can do nothing but compute.

In a browser that's a security necessity. On a server it turns out to be a superpower: you can run untrusted code safely, with near-native speed and millisecond startup. That combination, fast, portable, and safe to run code you don't trust, is exactly what serverless and edge platforms need.

Why it's suddenly everywhere

Put the three together and the 2026 spread makes sense:

Serverless / edge functions. A Wasm module starts in milliseconds (no container or VM to boot) and is safe to run on shared infrastructure. Edge platforms run your code as Wasm close to users, with cold starts a containerized function can't match.
Kubernetes workloads. Running Wasm modules under Kubernetes gives a lighter, faster-starting, more strongly isolated unit than a container for many jobs, the "ultra-performant" pattern showing up across 2026's infra writeups.
Plugin systems. Apps embed a Wasm runtime to run third-party plugins safely, the plugin literally cannot escape its sandbox to read your data. (This is also why it pairs naturally with the capability model behind tool-using AI agents.)
Polyglot. Rust, C, Go, and more all compile to Wasm, so teams aren't locked to one language.

The honest limits

Wasm isn't magic. The sandbox that makes it safe also means it can't do anything useful without the host granting capabilities, so there's a standard (WASI) defining how a module gets controlled access to files, clocks, and networking, and it's still maturing. And Wasm shines for compute-bound, self-contained work; it's not a drop-in replacement for every container or every workload. It's a new unit of deployment, not the end of the old ones.

Why this is worth understanding

WebAssembly is one of those technologies that sounds like a niche browser feature and turns out to be a quietly foundational idea: a small, safe, portable instruction set is a great way to ship and run code anywhere, including code you don't trust. Once you see it's a sandboxed stack machine, the browser demos, the edge functions, the Kubernetes modules, and the plugin systems all become the same thing pointed at different problems.

And the core of it is a stack machine, which you can build yourself, that's the bridge from "what is bytecode" to "why is half of cloud infrastructure adopting Wasm." Building runtimes and the languages that target them is the heart of the compilers track, and the general systems thinking is all over the general coding track.

Sources

Code Challenge of the Day: Number of islands (hard)

I Want To Learn Programming — Tue, 14 Jul 2026 14:00:05 +0000

Count groups of connected 1s (4-directionally) in a 2D grid of 0/1.
Write num_islands(grid).

Starter:

def num_islands(grid):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

Code Challenge of the Day: Baseball game score (medium)

I Want To Learn Programming — Mon, 13 Jul 2026 14:00:05 +0000

Process ops: an integer is a score; 'C' cancels the last, 'D' doubles the last, '+' sums the last two. Return the total.
Write cal_points(ops).

Starter:

def cal_points(ops):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

Code Challenge of the Day: Remove adjacent duplicates (medium)

I Want To Learn Programming — Sun, 12 Jul 2026 14:00:11 +0000

Repeatedly remove adjacent equal characters until none remain; return the result.
Write remove_adjacent(s).

Starter:

def remove_adjacent(s):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

A web server from raw bytes, and the framing bugs nobody warns you about

I Want To Learn Programming — Sun, 12 Jul 2026 14:00:08 +0000

Every backend developer leans on a framework, Spring or Express or whatever, and almost none of them have seen what it actually does. It is not much. Underneath, a web server is a function from bytes to a request, and from a response to bytes. Building that function by hand takes an afternoon, and it teaches you the handful of things that go wrong in production precisely because the framework normally hides them.

The whole protocol is text (in HTTP/1.1)

When a browser hits your server, it opens a socket and writes this:

GET /users/42?fields=name HTTP/1.1\r\n
Host: example.com\r\n
Accept: application/json\r\n
\r\n

That is the entire request. A request line, some headers, a blank line, and an optional body. The socket hands you bytes; the protocol is the agreement about how to give those bytes shape. Parsing is mostly splitting.

String[] lines = raw.split("\r\n");
String[] start = lines[0].split(" ");   // method, path, version
String method = start[0];               // "GET" is the whole intent
String path   = start[1];

Three details bite here, and each is a real bug I have watched people ship.

Headers are case-insensitive. Host and host and HOST must mean the same key. The spec says so, and clients rely on it. If you store headers in a plain map keyed by the literal string, you will one day fail to find Content-Type because someone sent content-type. Lowercase every key on the way in.

The blank line is the frame. \r\n\r\n is the only thing separating the headers from the body. It is not decoration; it is how the receiver knows the headers ended and the body began. Forget it in a response and the browser keeps reading your body as headers.

Percent-encoding is not optional. A space in a URL arrives as %20, an ampersand as %26. The query string ?q=a%20b is a b. You have to decode the escapes back into real characters, or every search with a space breaks.

The Content-Length bug

When you respond, you tell the browser exactly how many bytes the body is, so it knows when to stop reading:

String body = "{\"name\":\"José\"}";
// WRONG, on a string with non-ASCII:
int len = body.length();                       // counts characters
// RIGHT:
int len = body.getBytes(StandardCharsets.UTF_8).length;  // counts bytes

String.length() counts characters, but Content-Length is a byte count, and in UTF-8 a character like é is two bytes. Get this wrong and the browser either hangs waiting for bytes that never come, or truncates the body mid-character. It works perfectly on your ASCII test data and breaks the first time a user named José shows up. This is the single most common hand-rolled-HTTP bug, and the framework was quietly calling getBytes for you the whole time.

404 is not 405

Routing is matching the method and path to a handler. The interesting part is the failure codes, because there are three and people conflate the first two constantly.

GET /users/42 matches a route: 200.
GET /nope matches nothing: 404 Not Found. There is no such resource.
GET /users when only POST /users exists: 405 Method Not Allowed. The resource exists; the verb is wrong.
The handler throws: 500. Your bug, not the client's.

The 404-versus-405 distinction matters because it is the difference between "this address does not exist" and "this address exists but you cannot do that to it." Returning 404 for a wrong method hides a real route from clients and tools that probe with OPTIONS. The way to get it right is to check path-match and method-match separately: if no path matches at all, 404; if a path matches but no method does, 405.

Path parameters are the one genuinely clever bit. A route pattern /users/:id matches /users/42 and captures 42 as id. Match segment by segment, treat a :name segment as a wildcard that captures, and let the most specific route win so /users/new beats /users/:id.

Where the toy ends

Be honest about what this is not. A real server has to handle things this version ignores: chunked transfer encoding when the body length is not known up front, keep-alive and pipelining so one socket serves many requests, TLS, and timeouts and backpressure so a slow client cannot tie up a thread forever. And the "it is all text" framing is specifically HTTP/1.1; HTTP/2 and HTTP/3 are binary framed protocols with multiplexed streams, where this mental model stops being literally true.

But the core never changes: bytes become a request, a handler produces a response, the response becomes bytes. Once you have written that loop yourself, the framework stops being magic and becomes a set of defaults you now understand well enough to override. That is the entire point of building it once.

Code Challenge of the Day: Evaluate reverse Polish (medium)

I Want To Learn Programming — Sat, 11 Jul 2026 14:00:07 +0000

Evaluate a list of reverse-Polish-notation tokens (ints and + - * /, integer division truncating toward zero).
Write eval_rpn(tokens).

Starter:

def eval_rpn(tokens):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

The bootstrap, confidence intervals without the formula

I Want To Learn Programming — Sat, 11 Jul 2026 14:00:05 +0000

Open a statistics textbook and you'll find a different confidence-interval formula for every situation: one for a mean, another for a median, another for a correlation, each carrying assumptions (normality, large samples) you may quietly be violating. The bootstrap replaces that whole drawer of formulas with a single, almost suspiciously simple idea, and it works for statistics that have no clean formula at all.

The one idea: your sample is your best guess at the population

You have one sample of data and you want to know how much a statistic (say, the mean) would wobble if you could collect new samples. But you can't collect new samples, you have the one.

The bootstrap's move: treat your sample as if it were the population, and draw new samples from it, with replacement. Each "resample" is the same size as your data, but some original points appear twice or thrice and others not at all. Compute your statistic on each resample, do it thousands of times, and the spread of those values estimates how much the statistic would vary in reality. You simulate "collecting new data" by reusing the data you have.

In a few lines of R

bootstrap_ci <- function(x, stat = mean, B = 10000, conf = 0.95) {
  n <- length(x)
  # B resamples, each the same size as x, drawn WITH replacement
  boots <- replicate(B, stat(sample(x, n, replace = TRUE)))
  alpha <- (1 - conf) / 2
  quantile(boots, c(alpha, 1 - alpha))   # the middle 95% of the resample stats
}

set.seed(1)
x <- c(4.1, 5.5, 3.8, 6.0, 5.2, 4.9, 7.1, 3.3, 5.8, 6.4)
bootstrap_ci(x)            # a 95% CI for the mean, no t-distribution in sight

That's the entire method. sample(x, n, replace = TRUE) is the resample; replicate(B, ...) does it ten thousand times; quantile(..., c(0.025, 0.975)) takes the middle 95% of the resulting statistics as the interval. The "percentile bootstrap" confidence interval is literally: the range that holds the central 95% of your resampled statistics.

Three details that matter:

replace = TRUE is the whole trick. Sampling without replacement would just return your original data every time. Sampling with replacement creates the variation that mimics drawing fresh samples.
Each resample is the same size n. The amount of data you have determines how much a statistic wobbles, so the resamples must match it. A bigger original sample gives a tighter interval, exactly as it should.
No distributional assumption. We never assumed the data was normal. The interval comes from the data's own shape, which is why the bootstrap shines on skewed data and small (but not tiny) samples where formula-based intervals quietly fail.

The magic: it works for any statistic

Here's the real payoff. Want a confidence interval for the median? There's no nice textbook formula. With the bootstrap, change one argument:

bootstrap_ci(x, stat = median)

The same for a trimmed mean, a correlation, a ratio, the 90th percentile, anything you can compute. If you can write a function that returns the statistic, the bootstrap gives you its confidence interval. One method, unlimited statistics. That generality is why it became a workhorse of modern applied statistics: you stop hunting for the right formula and just resample and look.

When it doesn't work

Honesty matters. The bootstrap isn't universal:

Very small samples. If you have 5 data points, resampling 5 points can't conjure information that isn't there; the interval will be unreliable.
Extremes. It struggles with statistics that depend on the rarest values, like the maximum, because a resample can't produce values larger than your observed max.
It needs compute. It trades a formula for thousands of recomputations, trivial today, which is exactly why the method became practical only once computers were cheap.

Why this is worth knowing

The bootstrap is a beautiful example of computation replacing cleverness. Instead of deriving a formula with restrictive assumptions, you let the computer simulate the sampling variation directly from your data. Once the idea clicks, resample with replacement, recompute, look at the spread, a huge swath of "which test do I use?" anxiety dissolves: for many questions, you can just bootstrap it.

Building these resampling and simulation methods yourself, rather than calling a black-box t.test, is exactly the spirit of the statistics in R track, where Monte Carlo and the bootstrap show up as tools you construct, not incantations you trust.

Code Challenge of the Day: Make an acronym (easy)

I Want To Learn Programming — Fri, 10 Jul 2026 14:00:05 +0000

Return the uppercase first letter of each space-separated word.
Write acronym(s).

Starter:

def acronym(s):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

Code Challenge of the Day: Capitalize first letter (easy)

I Want To Learn Programming — Thu, 09 Jul 2026 14:00:07 +0000

Return the string with only its first character uppercased.
Write cap_first(s).

Starter:

def cap_first(s):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge

How SaaS data exfiltration works, the quiet breaches of 2026

I Want To Learn Programming — Thu, 09 Jul 2026 14:00:04 +0000

The headline breaches of 2026 had a new shape. Instead of hacking a company's own servers, attackers drained the SaaS platforms those companies live in: Salesforce, Microsoft 365, CRMs, support desks. The ShinyHunters extortion campaign exfiltrated customer data at scale this way; one telecom reportedly lost hundreds of terabytes. And almost none of it involved breaking software. It involved using it.

This is the modern data-theft model, and understanding it changes what "securing your data" even means when your data lives in someone else's app.

The one idea: your data lives in apps you don't control

A decade ago your customer data sat in a database on a server you ran. Today it sits in SaaS platforms, and those platforms are designed to make data easy to access and export. That's a feature for you and a target for attackers. The attack surface moved from "your server's vulnerabilities" to "who and what can log into your SaaS tenant, and what they're allowed to take."

Once an attacker has legitimate access, the platform's own export features do the rest. There's no malware to detect; it looks like normal use.

How they get in: tokens, not exploits

The way into a SaaS tenant is almost always a credential or a token, building on why credentials are the #1 way in:

Phished employee logins, sometimes with the MFA code captured in real time.
OAuth app consent. This is the SaaS-specific one. A user is tricked into clicking "Allow" on a malicious third-party app requesting broad permissions ("read all your files and email"). No password is stolen, the user granted access. The app now holds a token that reads their data directly, and it survives password changes.
Over-permissioned integrations and vendors. A connected tool or contractor with more access than it needs becomes the way in when it is compromised.

The theme: the attacker ends up holding a valid token with broad read scope. From the platform's view, every request that follows is authorized.

How they drain it: the platform's own APIs

With a valid token, exfiltration is just using the API as designed. SaaS platforms expose rich query and bulk-export endpoints so you can integrate and back up your data, exactly what an attacker wants. The pattern, conceptually:

1. Authenticate with the stolen token.
2. List the objects available (accounts, contacts, files, messages).
3. Page through them in bulk and download.
4. Repeat slowly enough to blend into normal traffic.

We won't write a working exfiltrator, but note how boring it is: authenticate, list, page, download. It's the same code a legitimate backup integration runs. That's the whole problem, the malicious export and the legitimate one are indistinguishable at the request level.

Why it's so hard to spot

It's authenticated traffic. No failed logins, no exploit signatures. Every request is "valid."
It mimics normal integration behavior. SaaS tenants have dozens of apps pulling data all day. One more reader hides in the noise.
The data is centralized. One compromised token can reach an entire org's records, because that's how the platform is meant to work for admins and integrations.

The Canvas/Instructure incident (275 million students' data, including private messages) and the SaaS extortion wave all share this: the value was concentrated in a platform, and access to the platform was the whole game.

What actually defends against it

Since you can't patch "the platform works as designed," defense is about governing access to your SaaS data:

Audit OAuth app grants. Review which third-party apps have access to your tenant and what scopes they hold. Revoke the broad, unused, and unknown ones, this directly kills the malicious-consent path.
Least privilege, everywhere. Most users and integrations don't need org-wide read or bulk-export rights. Scope them down so one stolen token reaches little.
Phishing-resistant MFA on the SaaS logins themselves, to make the tokens harder to steal in the first place.
Watch for bulk-export behavior. The one real signal is volume and pattern: a token suddenly paging through every record, an unusual mass download. SaaS platforms increasingly expose these logs, use them.
Encrypt and minimize. Don't put more sensitive data into a SaaS platform than you must, and use field-level encryption for the crown jewels so an export yields less.

Why this is the lesson that matters

"Securing your data" used to mean hardening your servers. When your data lives in SaaS, it means governing access and permissions in platforms you don't control, because the breach won't be an exploit, it'll be a granted permission used at scale. The shift from "break in" to "log in and export" is the defining data-security story of the year.

Understanding the mechanism, valid token plus the platform's own bulk APIs, makes the defenses obvious: shrink who can read, shrink what they can take, and watch for the one thing that looks different, mass export. Reasoning from the attack to the defense like this is the whole approach of the cybersecurity track.

Sources

Code Challenge of the Day: Target sum ways (hard)

I Want To Learn Programming — Wed, 08 Jul 2026 14:00:05 +0000

Count the ways to assign + or - to each number so the expression equals target.
Write count_target(nums, target).

Starter:

def count_target(nums, target):
    # TODO
    pass

Solve it interactively in your browser (no setup), check your answer instantly, and keep your daily streak going on IWTLP: https://iwtlp.com/challenge