DEV Community: Luciano Menezes

Your Distributed Lock Can Expire Correctly and Still Corrupt Data

Luciano Menezes — Sun, 26 Jul 2026 16:25:03 +0000

A worker acquires a distributed lock, starts updating a document, and freezes for 12 seconds.

Its 10-second lock expires. Another worker acquires the same lock, finishes the update—and then the first worker wakes up and overwrites it.

Nothing in that sequence requires the lock service to malfunction.

That is the trap: most “distributed locks” are leases. A lease can tell everyone who owns a resource for a limited window. It cannot recall code after that window or pull a delayed write out of the network.

The fix is not a longer TTL. It is a fencing token enforced by the resource being protected.

The lock expired correctly—and data still lost

Imagine two workers and a lock with a 10-second TTL:

worker A: acquire #41 ───── paused ─────────────────── write #41 ✗
lease:                         expires
worker B:                         acquire #42 ─ write #42 ✓
resource:                                      remembers 42

Worker A may pause for garbage collection, CPU starvation, a page fault, a frozen container, or SIGSTOP. Its write may also sit in a network queue after the process sent it.

Those delays are not theoretical. During a 2012 GitHub outage, network traffic between access switches was blocked for roughly 90 seconds. Active/passive file-server pairs missed heartbeats, fencing commands were not delivered, and multiple pairs later believed they were active for the same resource. GitHub kept the site in maintenance mode while recovering its file-storage infrastructure; recovery took more than five hours.

GitHub’s architecture was not our toy worker, but the lesson transfers directly: a timeout is evidence about time, not proof that the old owner has stopped acting.

A TTL turns your mutex into a lease

The usual code looks comforting:

const lease = await locks.acquire(resourceId, { ttlMs: 10_000 });

try {
  const current = await load(resourceId);
  await save(resourceId, update(current));
} finally {
  await lease.release();
}

The hole is the save, not only the release.

Redis’s official locking pattern uses SET key random-value NX PX ttl. The random value matters: release must delete the key only if its value still matches. Otherwise worker A can wake after expiry and delete worker B’s newer lock. Redis 8.4 added DELEX ... IFEQ; older versions use a compare-and-delete Lua script.

But that random value answers only:

“Is this still the lock instance I acquired?”

It does not answer:

“Is this operation newer than every operation previously accepted?”

A UUID has identity but no order. It prevents an unsafe unlock; it cannot reject a stale write.

What if A checks the lock immediately before save? A can pause between the check and the write. What if the process uses a monotonic clock and aborts after its deadline? The packet can be delayed after the process sends it.

There is always a final gap unless the protected resource participates in the decision.

Fencing gives the resource the final say

On each successful acquisition, the coordinator returns a strictly increasing generation:

first owner  → token 41
next owner   → token 42
next owner   → token 43

Every protected write carries that token. The resource remembers the greatest generation it has accepted and rejects anything older.

For a PostgreSQL row, the core can be one atomic statement:

UPDATE documents
SET body = $1,
    fencing_token = $2
WHERE id = $3
  AND fencing_token < $2;

If token 42 has already landed, the later-arriving token 41 updates zero rows. Worker A is stale, regardless of what it believes about its lease.

The comparison and mutation must be atomic. This is subtly broken:

const seen = await db.getFence(id);
if (token > seen) {
  await db.updateDocument(id, body, token);
}

Two workers can both pass the check before either update commits. Use one conditional update, or lock the fence row and perform the fence update plus all business mutations in one database transaction.

For inserts, store the accepted generation beside the logical resource. For a multi-row operation, keep one fence record and the business changes inside the same transaction. For an object store, use its conditional-write primitive if it exposes one.

This pattern has history. Google’s Chubby paper describes a monotonically increasing 64-bit lock generation. A Chubby “sequencer” contains the lock name, mode, and generation; clients pass it to file servers and other protected services, which validate it or compare it with the latest sequencer observed.

The lock service grants an opinion. The resource enforces the order.

Why `INCR` is not automatically token 42

Fencing needs a token source whose order matches lock acquisition order, including failover.

Adding INCR lock:counter somewhere beside a lease is safe only if the combined grant path guarantees one total order. If the lock is granted but token allocation fails, what happens? If a primary fails after issuing a value that its replacement never saw, can a later owner receive a lower value? If acquisition and increment happen on unrelated systems, which one defines ownership?

This is why the distinction between an owner UUID and a fencing generation matters. Redis’s current distributed-lock documentation explicitly recommends fencing tokens for correctness-sensitive work and warns not to assume a lock remains held as long as its process is alive.

Consensus-backed coordinators already expose useful order. Chubby has lock generations. ZooKeeper’s lock recipe creates ephemeral sequential nodes; the smallest sequence owns the lock, and each waiter watches only its immediate predecessor, avoiding a thundering herd.

Do not invent a distributed counter because the SQL example looks easy. The easy part is comparing generations. The hard part is issuing them in an order you can defend during partitions and failover.

Production-grade means observing lease loss

Fencing handles stale writes, but it does not make leases operationally free.

AWS’s DynamoDB Lock Client guide shows a 10-second lease with a 3-second heartbeat. It also names the costs developers skip in diagrams: extra table capacity, clock-skew sensitivity for short leases, and consistent acquisition ordering when an operation needs multiple locks.

In production, capture at least:

acquisition wait time
time the lease is held
successful-renewal slack before expiry
renewal failures and lost-lease events
rejected stale generations

fence_rejected_total should be almost boring—and never ignored. One increment means an old owner attempted a write that would have been accepted without fencing. That metric is evidence that the safety mechanism just prevented corruption.

Renewal is still useful. It reduces unnecessary takeovers during healthy long work. It is not the correctness proof: after the last successful heartbeat, a process or packet can still be delayed past expiry.

Longer TTLs make that overlap less likely but make crash recovery slower. Shorter TTLs improve takeover time but increase false lease loss. Fencing separates that availability tradeoff from data safety.

Sometimes the right lock is no distributed lock

Before adding a coordinator, ask where the protected truth already lives.

Situation	Prefer
One relational database owns all state	Row lock, unique constraint, advisory lock, or conditional update in a transaction
Work is naturally a durable job	Queue claim/ack with retry semantics
Duplicate request can be replayed safely	Idempotency key
Several processes coordinate an external mutable resource	Lease plus a fence the resource enforces
Duplicate cache refresh is only wasted work	A simple best-effort lease may be enough

Fencing also has a hard boundary: the recipient must understand the token. You cannot fence an email after it was sent or ask an arbitrary payment API to compare your generation. For irreversible external effects, route the effect through one durable owner, use the provider’s idempotency facility, or record an outbox entry transactionally and let a controlled dispatcher deliver it.

The lock is not a magical “exactly once” wrapper.

If you remember one thing

A distributed lease can expire while its former owner is still capable of acting. Therefore, ownership alone cannot protect correctness.

Make every sensitive write prove that its generation is newer than the last accepted one—or choose a primitive that keeps coordination and state in the same transaction.

Where are you currently using a TTL lock, and can the resource it protects actually reject a stale owner?

One Bad Regex Can Freeze Node.js: Here's How to Stop It

Luciano Menezes — Thu, 23 Jul 2026 13:26:23 +0000

A single regular expression once pushed Cloudflare's HTTP-serving CPUs to nearly 100% worldwide.

The network returned 502s for 27 minutes. The rule had passed review and CI.

The regex returned the right answers. It just needed a catastrophic amount of work to return one of them.

That is the uncomfortable lesson behind Regular Expression Denial of Service (ReDoS): for a pattern that touches untrusted input, correctness has two dimensions. It must accept the right language, and it must reject the wrong input within a bounded amount of work.

Let's break a small Node.js validator, watch why it explodes, and replace it with a production rule you can actually defend.

The bug hides in a perfectly reasonable test suite

Suppose an API accepts a comma-separated list of word-like tags. This pattern looks permissive and compact:

const tags = /^(\w+,?)*$/;

tags.test("node,security,regex"); // true
tags.test("node,,regex");        // false

The fixtures pass. Short invalid inputs fail instantly. A reviewer sees anchors, an allowed character class, and no suspicious .*.

Now time a failure that arrives late:

import { performance } from "node:perf_hooks";

const vulnerable = /^(\w+,?)*$/;

for (const n of [18, 20, 22, 24, 26]) {
  const input = "a".repeat(n) + "!";
  const start = performance.now();
  vulnerable.test(input);
  console.log(n, (performance.now() - start).toFixed(1), "ms");
}

On my Node 22.16 run, the last four measurements were roughly 4.6, 17.6, 67.8, and 265.4 ms. Exact timings depend on the CPU and runtime, but the shape matters: two extra a characters cost about four times as much.

The exclamation mark does the damage. Until that final character, the engine can believe it has a match. When ! violates the anchor, the engine tries all the other ways the repeated group could have consumed the same run of as.

One request can now occupy Node's event-loop thread for hundreds of milliseconds. A slightly longer value turns a validator into an availability incident.

Backtracking turns ambiguity into a search tree

JavaScript's V8 engine normally uses Irregexp, a backtracking engine. When a pattern offers several possible ways forward, it tries one. If a later token fails, it rewinds to the last choice and tries another.

That is useful. Backtracking helps implement features such as lookarounds and backreferences, and it is extremely fast for ordinary patterns. The dangerous case is overlapping choices inside repetition.

Our group can match the same aaaa in many equivalent partitions:

aaaa
aaa + a
aa + aa
aa + a + a
a + aaa
a + aa + a
...

The final ! makes every partition fail, so the engine must disprove them one by one. OWASP's canonical example shows the same doubling: ^(a+)+$ has 16 paths for aaaaX, but 65,536 paths for sixteen as followed by X.

This is why successful-input benchmarks are misleading. Node's own guidance warns that vulnerable expressions often match long valid strings quickly; the blow-up appears when a mismatch arrives after the engine has accumulated many unresolved choices.

Not every nested quantifier is slow on every runtime. Engines recognize and optimize some shapes. That is not a safety proof. If two repeated pieces can consume the same characters, treat the pattern as suspect and test it on the exact engine you deploy.

Remove the ambiguity instead of tuning it

The tag grammar has a simpler shape: one word, followed by zero or more comma-plus-word pairs.

const safeTags = /^\w+(?:,\w+)*$/;

safeTags.test("node,security,regex"); // true
safeTags.test("node,,regex");        // false

Each character now has one structural job. A comma can only begin the next pair; a word character cannot be reassigned across nested repetitions. The same hostile inputs stayed below the useful resolution of the small timing loop on my machine.

That rewrite suggests a general review technique:

Suspicious shape	Question to ask	Safer direction
`(x+)+` or `(x)`	Can inner and outer loops repartition the same text?	Collapse to one repetition
`(a	aa)+`	Do alternatives share a prefix?
`..TOKEN`	Can adjacent wildcards trade characters?	Use one bounded class or a delimiter-aware parser
Backreference on user input	Is there any worst-case guarantee?	Bound input and isolate work, or avoid the feature

Changing greedy * to lazy *? is not a general fix. In Cloudflare's postmortem, laziness improved one matching case but did nothing for the catastrophic failure variant. It changed which path the engine tried first, not how many paths existed.

The real fix is to remove overlapping interpretations.

Put more than one guardrail around untrusted regex

A safe pattern is the first layer, not the whole design.

First, cap input before matching. If a tag field is allowed to contain 200 characters, reject 20,000 bytes before the regex sees them. A length limit does not turn exponential work into linear work, but it puts a ceiling on the blast radius and protects parsers, logs, and downstream storage too.

Second, use simpler primitives when they express the rule. For literal containment, includes() or indexOf() is linear and easier to review. For comma-separated data, splitting and validating each token may be clearer:

function isTagList(value) {
  if (value.length === 0 || value.length > 200) return false;

  const parts = value.split(",");
  return parts.length <= 20 &&
    parts.every((part) => /^\w+$/.test(part));
}

Third, add adversarial tests. A good regex test suite contains long near misses: valid prefixes with one illegal suffix, missing delimiters, repeated shared prefixes, and values at the maximum permitted length. Mozilla's engineering guidance makes the same point: test large non-matching inputs and verify that they fail quickly, because happy-path correctness will not expose backtracking risk.

Finally, run a ReDoS-aware static analyzer in CI, but treat its output as a lead. Regex complexity depends on both syntax and engine behavior; a clean scan is not a runtime guarantee.

Node makes synchronous regex a shared failure

In a threaded request-per-worker server, one pathological match can consume one worker. In a normal Node process, a synchronous RegExp.test() runs on the event-loop thread. While it searches, unrelated timers, sockets, and requests wait too.

That changes the production question from “is this validation slow?” to “how many users share this stall?”

V8 has explored an escape hatch. Since V8 8.8, an experimental non-backtracking engine can provide linear time, with an optional fallback after 50,000 backtracks. But the fallback is not universal: patterns with backreferences, lookarounds, some finite repetitions, or the u and i flags are excluded. V8 also notes that the linear engine can be orders of magnitude slower for common patterns.

So do not assume the runtime will rescue an ambiguous validator. If you truly must evaluate complex or user-supplied patterns, isolate that work in a worker or separate process with a killable time budget. A Promise.race() around synchronous RegExp.test() is not a timeout—the event loop cannot fire the timer while the regex owns the thread.

In production, watch event-loop delay, CPU saturation, input sizes, and per-validator latency. Name expensive validators in traces or metrics. A generic “request took 3 seconds” span is much less useful than “username_regex took 2.9 seconds on a 41-byte rejection.”

The code-review rule worth keeping

Cloudflare's outage was not just “one bad regex.” The rule was deployed globally, CPU safeguards had gaps, and rollback took time. Still, the initiating pattern reduced to adjacent ambiguous wildcards, and the network lost around 80% of its traffic at one point.

The small version of that failure can live in any signup form, route matcher, log parser, or dependency.

When a regex touches untrusted input, review four things:

Can repeated parts consume the same characters?
Does a long near miss fail quickly?
Is input length bounded before matching?
Can one match block shared work?

If you remember one thing, test the rejection path—not just the answer. A regex that says false after 30 seconds is not correct.

What is the nastiest production regex you have had to untangle?

Stop Retry Storms: Backoff Is Not Enough Without a Budget

Luciano Menezes — Wed, 22 Jul 2026 18:48:29 +0000

A backend can safely process 10,000 requests per second. Traffic rises to 10,100. The extra 100 requests fail, so the clients immediately retry them.

One second later, the backend receives 10,200 requests. Then 10,300. Soon it spends more time rejecting retries than completing original work.

The failure was small. The recovery code turned it into an outage.

A retry is load, not a second chance

Retries are usually introduced like local error handling: catch an exception, wait, try again. But the retry executes on the system that just told you it could not complete the first attempt.

Google's SRE book walks through the 10,000 QPS scenario above. A backend overloaded by only 100 QPS begins receiving an additional 100 retry QPS every round. The feedback loop can consume CPU, memory, file descriptors, and eventually crash replicas. Google says this pattern has contributed to several real cascading failures across RPC, browser, and offline-sync clients.

10,100 original QPS
   100 fail
   100 retry  ──┐
   200 fail     │ positive feedback
   200 retry  ──┘

Dropping original traffic back to 9,000 QPS may not recover the service. If only a fraction of replicas remains healthy, or rejecting a request is expensive, retries can keep the backend above its new reduced capacity.

The first design question is not “how long should I wait?” It is “may this system afford another attempt?”

Layers turn three retries into 64 attempts

Now put the request behind a browser, frontend, API, and database adapter. Each layer sees an error and performs three retries: four total attempts per layer.

The database does not receive four attempts. It can receive:

browser × frontend × backend
   4    ×    4     ×    4    = 64 attempts

That 64-attempt example comes from Google's guidance on cascading failures. The fix is architectural: one layer owns the retry for a failing dependency. The layer immediately above that dependency usually has the best error detail and the smallest amount of duplicated work.

A browser may retry a whole checkout while the API client inside the server also retries the payment call. Even perfect exponential backoff cannot repair that ownership bug; it only spreads 64 attempts over time.

Carry attempt metadata across boundaries, such as attempt: 2 or a request ID. Then a downstream “do not retry” decision can survive the trip back up instead of being translated into a generic 500 that every layer interprets as permission.

Retry only work that is safe to repeat

Transport failure creates an uncomfortable ambiguity: the server may have committed the operation and lost the response. Retrying a read is usually harmless. Retrying POST /charges can charge twice.

RFC 9110 defines PUT, DELETE, and safe methods as idempotent. It also says clients should not automatically retry a non-idempotent request unless they know its semantics are idempotent or know the original request was never applied.

HTTP method alone is not enough. A broken DELETE handler might send a second email, while a POST protected by an idempotency key can be safe. The server needs to make the business operation repeatable:

async function createOrder(request) {
  const key = request.headers.get('Idempotency-Key');
  if (!key) return new Response('key required', { status: 400 });

  return db.transaction(async (tx) => {
    const previous = await tx.idempotency.find(key);
    if (previous) return Response.json(previous.body, { status: previous.status });

    const order = await tx.orders.insert(await request.json());
    await tx.idempotency.insert({ key, status: 201, body: order });
    return Response.json(order, { status: 201 });
  });
}

The idempotency record and side effect must commit atomically. A “check, then insert” outside one transaction has a race: two copies can both observe no record and both create an order. Give the key a unique constraint and define its scope, retention period, and response-replay behavior.

Do not retry authentication failures, validation errors, or malformed requests. No amount of waiting turns a missing field into a valid payload.

Backoff without jitter schedules the next spike

Exponential backoff increases the maximum delay after each failure. If 1,000 clients fail together and all wait exactly 100 ms, then 200 ms, then 400 ms, they remain synchronized. You have replaced one spike with a series of scheduled spikes.

AWS simulated 100 clients contending to update one object. With plain exponential backoff, calls still arrived in clusters. Adding full jitter—choosing a random delay from zero to the exponential cap—cut the call count by more than half compared with no jitter and also improved completion time.

Here is a compact policy for JavaScript:

const RETRYABLE = new Set([408, 429, 500, 502, 503, 504]);

async function fetchWithRetry(url, options = {}) {
  const maxAttempts = 3;
  const baseMs = 100;
  const capMs = 2_000;
  const deadlineMs = performance.now() + 5_000;

  for (let attempt = 0; attempt < maxAttempts; attempt++) {
    const remainingMs = deadlineMs - performance.now();
    if (remainingMs <= 0) throw new DOMException('retry deadline exceeded', 'TimeoutError');

    try {
      const response = await fetch(url, {
        ...options,
        signal: AbortSignal.timeout(Math.ceil(Math.min(1_500, remainingMs))),
      });

      if (!RETRYABLE.has(response.status) || attempt === maxAttempts - 1) {
        return response;
      }

      const retryAfter = parseRetryAfter(response.headers.get('retry-after'));
      const windowMs = Math.min(capMs, baseMs * 2 ** attempt);
      const delayMs = retryAfter ?? Math.random() * windowMs;
      if (delayMs >= deadlineMs - performance.now()) return response;
      await sleep(delayMs);
    } catch (error) {
      if (attempt === maxAttempts - 1) throw error;
      const remainingAfterFailure = deadlineMs - performance.now();
      if (remainingAfterFailure <= 0) throw error;
      const windowMs = Math.min(capMs, baseMs * 2 ** attempt);
      await sleep(Math.min(Math.random() * windowMs, remainingAfterFailure));
    }
  }
}

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

function parseRetryAfter(value) {
  if (!value) return null;
  const seconds = Number(value);
  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);
  const dateMs = Date.parse(value);
  return Number.isFinite(dateMs) ? Math.max(0, dateMs - Date.now()) : null;
}

The example is intentionally conservative, not universal. Your API must classify which failures are transient. A 500 from a deterministic bug will fail again. A connection error after sending a non-idempotent body is ambiguous. A response body or domain error can override the status-code default.

Respect server direction. RFC 9110 allows Retry-After on a 503 as either a delay in seconds or an HTTP date. Treat it as a lower bound, validate absurd values, and still enforce the caller's overall deadline. Waiting 120 seconds is not recovery when only 800 ms remains.

A retry budget breaks the feedback loop

Attempts cap the cost of one logical request. A retry budget caps the cost of all requests during a failure.

Google describes two controls working together: up to three attempts per request and a per-client retry ratio below 10%. The per-request limit alone can push worst-case traffic close to 3×. Adding the 10% ratio holds general growth to about 1.1×.

That is the difference between “every failure gets two retries” and “retries may consume at most 10% of current traffic.” When the budget is empty, fail fast. The user sees an error, but the dependency receives the quiet period it needs to recover.

AWS SDKs implement the same principle with a token bucket. Their standard mode uses full-jitter backoff and a retry quota; widespread failures drain tokens, after which calls return errors without retrying. Successful first attempts replenish the budget.

Set budgets per dependency and, where noisy neighbors matter, per tenant or operation class. A healthy inventory service should not donate its retry capacity to a failing recommendation service. Interactive reads and asynchronous jobs should not compete under one policy either.

Observe attempts, not just errors

A dashboard showing a rising 503 rate cannot tell whether retries are helping or feeding the incident. Record these dimensions together:

original request rate and retry request rate;
attempts per logical operation;
success-after-retry versus final failure;
delay chosen, including whether Retry-After won;
budget exhaustion and “do not retry” decisions;
dependency saturation: queue depth, latency percentiles, rejected work.

Alert on retry amplification: (originals + retries) / originals. A ratio of 1.02 during isolated network noise may be healthy. A ratio climbing toward 1.5 while dependency throughput falls is a feedback loop, not resilience.

During an incident, the fastest mitigation may be to disable retries, shed low-priority work, or return a clear overload response. Adding replicas can fail when cold caches and synchronized retries overwhelm each new process as soon as it starts.

The policy in one review checklist

Before approving a retry loop, demand concrete answers:

Which exact failures are transient?
Is the operation idempotent, or protected by an atomic idempotency key?
Which single layer owns the retry?
What are the attempt cap and overall deadline?
Is delay randomized with full jitter, and is Retry-After honored?
What global budget stops retries during widespread failure?
Which metric exposes amplification?

Retries spend capacity to buy another probability of success. Spend that capacity only when the failure is transient, the operation is safe, and a budget proves the system can afford it.

Which retry in your stack currently has no owner, no budget, or no idempotency guarantee?

Your Clock Can Go Backward—Use the Right One for Durations

Luciano Menezes — Tue, 21 Jul 2026 12:39:14 +0000

A request starts at 10:00:00.900 and finishes 200 ms later.

Your latency log says -800 ms.

That sounds impossible until the machine corrects its clock between the two reads. Then ordinary code turns an adjustable wall clock into a broken stopwatch.

The subtraction that works—until it does not

This is probably hiding in one of your metrics helpers:

async function timed(operation) {
  const startedAt = Date.now();
  const result = await operation();

  return {
    result,
    durationMs: Date.now() - startedAt,
  };
}

Most of the time, this reports a sensible number. That is what makes it dangerous.

Date.now() answers a calendar question: how many milliseconds have passed since the Unix epoch according to this machine? The answer must remain comparable with logs, users, and other computers, so synchronization software is allowed to correct it. A correction can change its rate, jump it forward, or move it backward.

If either correction lands between the two calls, the subtraction measures the clock adjustment as if it were work.

A timestamp is a coordinate. A duration is a distance. They need different instruments.

Your computer already has two kinds of clock

Operating systems expose several clocks, but two mental buckets cover most application code:

Question	Clock	JavaScript example
“When did this happen?”	Wall clock	`Date.now()`, `new Date()`
“How long did this take?”	Monotonic clock	`performance.now()`

A wall clock follows civil time. It has an epoch and can be serialized as an ISO timestamp. A monotonic clock starts at an arbitrary origin and promises that later readings will not be lower than earlier readings.

wall:       1000 ── 1001 ── 0998 ── 0999   clock correction
monotonic:    40 ───── 41 ───── 42 ───── 43

On Linux, CLOCK_REALTIME is settable wall time. CLOCK_MONOTONIC cannot be set and does not make discontinuous jumps backward, although gradual frequency adjustment can affect its rate. Linux even has CLOCK_BOOTTIME for a monotonic counter that includes suspended time.

Three properties are easy to confuse:

Resolution: how small a change the clock can represent.
Accuracy: how close it is to an external reference.
Monotonicity: whether readings can go backward.

A microsecond-resolution wall clock can still jump. A coarse monotonic clock can still be the correct stopwatch. MDN says browsers may expose Performance API timestamps at 5 µs in isolated contexts or coarsen them to 100 µs for privacy. Both modes remain monotonic.

A negative duration once broke DNS

At midnight UTC on January 1, 2017, a leap second exposed this exact assumption inside Cloudflare’s RRDNS service.

RRDNS measured upstream DNS resolver performance. During the leap, some elapsed values became negative. Those values entered a weighted-selection calculation and eventually reached Go’s rand.Int63n, which panics when its argument is negative.

The blast radius was small in percentage terms but enormous in context: Cloudflare reported about 0.2% of DNS queries affected at peak, under 1% of HTTP requests, across a small number of machines in 102 data centers. The worst-hit machines were patched within 90 minutes; the worldwide fix finished at 06:45 UTC.

Why did redundant machines fail together? The leap second was a correlated trigger. The same rare assumption existed in many replicas, and the external event arrived everywhere at once.

Go changed its time model after this class of failure. Its current time.Now() value may carry both wall and monotonic readings; subtraction uses the monotonic part when both operands have it. The design proposal estimated roughly 30% of time.Now calls were being used to measure elapsed time.

This was not exotic timekeeping trivia. It was an API footgun with production evidence.

Fix the stopwatch, then fix the deadline

For a duration inside one browser context or Node.js process, use performance.now():

async function timed(operation) {
  const startedAt = performance.now();
  const result = await operation();

  return {
    result,
    durationMs: performance.now() - startedAt,
  };
}

The Performance API uses a stable monotonic clock whose origin is performance.timeOrigin. Node’s implementation returns high-resolution milliseconds from process start. If you need integer nanoseconds in Node, process.hrtime.bigint() serves the same interval-measurement job.

The same rule improves timeouts. Suppose an HTTP handler has 250 ms for authentication, a database query, and an upstream request. Giving each step a fresh 250 ms timeout turns one budget into 750 ms.

Calculate one monotonic deadline and pass the remaining budget down:

async function fetchWithDeadline(url, deadlineMs) {
  const remainingMs = Math.max(0, deadlineMs - performance.now());
  if (remainingMs === 0) throw new Error('request budget exhausted');

  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), remainingMs);

  try {
    return await fetch(url, { signal: controller.signal });
  } finally {
    clearTimeout(timer);
  }
}

const deadlineMs = performance.now() + 250;
await authenticate(deadlineMs);
await queryDatabase(deadlineMs);
await fetchWithDeadline('https://inventory.internal', deadlineMs);

A timeout belongs to one operation; a deadline preserves one budget across the whole call tree.

In real code, clamp every remaining budget to zero, stop before starting work with no budget left, and record which stage consumed it. That turns “request timed out” into “database queue used 187 of 250 ms.”

The boundary: never serialize a monotonic reading

A monotonic value is meaningful only relative to its own clock origin. Process A’s 5421.3 and process B’s 5421.3 are not the same instant. A restart creates another origin. Serialization often strips monotonic information deliberately; Go’s time package does exactly that.

Use this decision table:

Need	Use
Request latency, retry delay, local timeout	Monotonic time
Log timestamp, invoice date, calendar event	Wall time
Persisted expiration such as `expires_at`	Authoritative wall time, usually server-side
Ordering events across machines	Sequence, logical clock, or database order—not client wall time
Distributed lease safety	Consensus/authority plus fencing tokens—not clock subtraction alone

Monotonic clocks also differ around suspend. Linux CLOCK_MONOTONIC excludes sleep, while CLOCK_BOOTTIME includes it; Go documents that monotonic elapsed time may exclude suspend on some systems. Ask whether “five minutes” means five minutes of active process time or five minutes experienced by a user.

NTP does not remove these choices. Leap smearing avoids a one-second step by changing clock rate over a window, but smear strategies are not universal. Google’s Go proposal describes a 20-hour smear at 99.9986% speed; Meta describes its own 17-hour smear.

Make time testable and observable

Production telemetry needs both clocks, each doing its own job:

const observedAt = new Date().toISOString();
const startedAt = performance.now();

await handleRequest();

logger.info({
observedAt,
durationMs: performance.now() - startedAt,
});


The wall timestamp lets you correlate services. The monotonic duration keeps the measurement immune to a local clock correction. Monitor host clock offset separately; do not bake it into request latency.

Wrap both clock reads behind injectable functions in business logic. Tests can then step wall time backward, jump it forward, and advance monotonic time independently. That catches expiry and timeout assumptions without changing the developer laptop’s clock.

Avoid the tempting fallback <code>Math.max(0, Date.now() - start)</code>. Cloudflare used a defensive negative check as an emergency mitigation, but clamping merely hides the wrong measurement. Use the right clock and keep guards for impossible values as alarms.

## One rule worth remembering

**Wall time tells you when. Monotonic time tells you how long.**

Use <code>Date</code> for timestamps people and systems exchange. Use <code>performance.now()</code>, <code>process.hrtime.bigint()</code>, or your runtime’s monotonic API for latency, budgets, and local deadlines. Do not send monotonic readings across a process boundary.

Which piece of your codebase still subtracts two wall-clock timestamps—and what would happen if the second one were smaller?

🎥 Why is it almost impossible to create a social media with videos - Daykeeper

Luciano Menezes — Tue, 05 Aug 2025 04:18:11 +0000

Currently, I’m a 16-year-old student, and since January 2024, I’ve been developing DayKeeper on my own — a social network with a different proposal: turning each day into a meaningful memory. Inspired by platforms like Twitter and Instagram, DayKeeper lets users make daily posts with text, images, and videos.

Over time, the idea has gone through many changes. A lot has changed: the project’s vision matured, features were redesigned, and the code… well, most of the code has been rewritten several times. One of the biggest challenges so far? Supporting video uploads in a scalable, secure, and affordable way.

DayKeeper’s Environment

To understand the problem, you first need to understand the project’s environment:

Database: MongoDB
File storage: AWS S3 (images and videos)
Content moderation: Amazon Rekognition
Video verification notifications: Amazon SNS (Simple Notification Service)

Of course, along with many other things, like nodemailer for emails, passport for third-party login, firebase for mobile app notifications, etc.

To understand what happens when a user creates a post, here’s the route:

router.post(
  "/create",
  checkTokenMW,
  multer(multerConfig("both")).array("files", 5),
  handleMulterError,
  createMediaDocsMW,
  detectInappropriateFileMW,
  postValidation,
  createPost
)

Or explained:

checkTokenMW: Makes sure the user is authenticated.
multer(...): Middleware to upload files (images or videos).
handleMulterError: Handles upload errors.
createMediaDocsMW: Creates documents in the "media" collection, separating files from the post.
detectInappropriateFileMW: Uses Rekognition to moderate files. Images are moderated instantly; videos go through asynchronous analysis.
postValidation: Validates post data.
createPost: Creates the post with references to stored files.

The Problem

1. Storage structure

Originally, images could be embedded in the post objects. But videos require asynchronous moderation. So a unified structure was created: all files (images and videos) are now stored in a separate "media" collection with fields like status: 'pending', public, or rejected.

2. Verification time

Images are analyzed in milliseconds, but videos take minutes. The system sends the video to Rekognition, waits for processing, and gets a notification via SNS when it’s done. During this time, the post stays pending.

3. Costs

This is the critical part.

Images:
- Cost: $0.001 per verified image
- 1,000 images/day ≈ $1/day = $30/month
Videos:
- Cost: $0.10 per minute
- 1,000 videos of 5 minutes ≈ $500/month
- Not counting multiple videos per post
S3 Storage:
- $0.023 per GB/month
- PNG 1080x1080 ≈ 500 KB – 5 MB
- 1080p Video (5 Mbps) ≈ 1.5 GB
- $100/month in S3 gives:
- ~4.4 million PNG images
- ~2,400 five-minute videos

Result: Supporting video content is dozens or hundreds of times more expensive than images.

Possible Solutions

1. Having funds ($$$)

The obvious but least accessible solution for solo developers. If you have investors or a big budget, you can afford full video moderation. For me, a 16-year-old student without capital, this isn’t viable.

2. Imposing limits

Strict limits might be necessary:

Max video length: 3 minutes
Size limit (e.g., 700 MB)
Automatic compression for all files
Daily upload limits per user

These reduce video costs and let you store more content in the same space. Of course, this might affect user experience, so it must be implemented carefully.

3. Trust-based moderation system

Currently on DayKeeper, not every file is automatically analyzed by Rekognition.

Trust Factor: New users have low trust and all their files are checked. If they follow rules and aren’t banned, they gain trust and can post without automatic checks.
Report System: Any file can be reported. If reported multiple times, it’s reanalyzed, even if it passed automatically.
Manual moderation: Admins can view reports, ban users, and manually moderate content.

On top of that, random moderation of unchecked files will run in the background to keep the app safe. If a malicious user tries to bypass thumbnail analysis, and the post gets many reports, a full video check is triggered and the user may be auto-banned.

4. Partial video verification

Analyzing every frame is expensive — and often unnecessary. DayKeeper only checks a few:

2 frames at the start
2 in the middle
2 at the end
2 random frames

This equals about 1 frame every 18 seconds for a 3-minute video. If a video is reported, it’s reanalyzed in full. This also varies depending on Trust Factor.

Use Queues with Redis and BullMQ

Creating and verifying thumbnails takes time, and handling thousands of simultaneous requests could overload the server. DayKeeper uses a moderation queue with BullMQ to manage tasks in a scalable and safe way.

5. Video compression

A clear way to cut storage costs is by compressing every file before uploading to the server. This lets you store more videos in less space, with little quality loss — massively reducing storage costs.

DayKeeper’s Solution

DayKeeper combines a trust-based moderation system with admins and reports, partial video verification, task queues, and file compression, all alongside clear limits on daily stories, posts, and uploaded files.

Imposing limits also opens the door for a premium subscription. While it might seem controversial in a social network, I believe it’s more acceptable than selling user data or spamming ads. If done right, it won’t hurt free users too much and can help monetize the app.

Conclusion

Building a video-friendly social network isn’t impossible — but it’s a real challenge, especially for solo developers. Costs, moderation time, and technical complexity are tough hurdles.

In DayKeeper, we’re overcoming them with:

File compression
Partial video checks
Trust and reporting systems
Human moderation

With creative solutions and scalable thinking, even a solo project can reach a professional level. The key is balancing user experience, security, and costs — all while building something you believe in.

If you want to learn more about DayKeeper, you can check the code here or visit our website.

🎆THE BEST PROGRAMMING CHALLENGES USED IN BIG TECHS FOR YOU TO TRAIN IN 2024🎆

Luciano Menezes — Thu, 28 Mar 2024 00:05:13 +0000

⭐- WHAT WILL I SHOW?

In this post, I will show you REAL programming challenges used by VARIOUS BIG TECHS in job interviews!

From simpler challenges to more complex ones, including PicPay, Google, Uber, Amazon, Netflix, and MORE!

Enjoy the post!

✅ 1 - Back-end Challenge by PicPay

This challenge, as the title says, has already been used by PicPay for a Backend position.

Your challenge? Develop a simplified system inspired by PicPay.

The system should allow two types of users, regular users, and merchants, to transfer money between them.

To see the details and solve the challenge, just go to this GitHub repository!

And if you want to see a resolution video, I highly recommend @kipperdev's on YouTube!

I HIGHLY recommend you try it out!

✅ 2 - First Missing Positive by Google

This is a hard-level challenge that has been used by GOOGLE itself.

Here, you'll receive an unordered array of INTs nums and need to return the smallest integer not present in the array.

To do this, you must implement an algorithm that runs in O(n) time and uses O(1) auxiliary space.

Sounds easy? Here's the challenge on LeetCode for you to try!

And if you want to see a resolution video, @phenpessoa's on YouTube is GREAT!

This one's good! I recommend it!

✅ 3 - Backend Challenge by Uber

Here's another challenge for BackEnds, this time from Uber!

Here, you should create a prototype of one of the following projects:

Departure Times
SF Movies
Email Service
Food Trucks

The design is up to you, and you should deploy it as if it were in production!

To see more details, just go to this GitHub repo!

And if you want to see any resolution videos, @kipperdev's is ideal!

✅ 4 - Product of Array Except Self by Amazon

This is a medium-level challenge, but still, it's interview level!

Here, you receive an array nums and need to return an array answer where answer[i] is equal to the product of the elements of nums MINUS num[i].

Additionally, the product of any prefix or suffix of nums must be a 32-bit integer.

If you want to try it yourself, just go to this LeetCode challenge!

And if you want to see a resolution video, Vamos Codar's is quick, practical, and efficient!

✅ 5 - First Unique Character in a String by Netflix

LOOK, this one is EASY level on LeetCode and has been USED IN NETFLIX!

In this challenge, you receive a string s and need to return the index of the first character that does not repeat!

If this character does not exist, just return -1.

Seriously, this is one of the EASIEST, but still, it can be a great challenge!

To try to solve it, just go to this challenge on LeetCode!

And if you want to see a resolution video, @phenpessoa's is THE BEST!

Of all on this list, this is the one I most recommend you try!

⭐- BONUS - Uber Archives

If you want to see other challenges that have been used in Uber interviews in the past, the Uber Archives repository has MANY of these challenges in an Open Source format!

I HIGHLY recommend checking it out!

😄 - THANK YOU!

Of all on this profile, without a doubt, this is one of the best in my opinion!

Took me a while to post it precisely because I researched a lot and wasn't very free, but still, I hope you liked it!

If you have any suggestions, just send me a DM on Twitter! I always want to bring the best content here.

My recent posts didn't reach many people, and even if it continues like this, I'll never stop posting!

Finally, Thank you for reading this far!

Also, check out other projects of mine on my GitHub!

Thank you!

🎆THE BEST HTML/REACT TAGS YOU SURELY DON'T KNOW FOR 2024🎆

Luciano Menezes — Mon, 25 Mar 2024 23:31:10 +0000

⭐- WHAT WILL I SHOW?

In this post, I'll showcase AMAZING HTML/REACT tags that you DEFINITELY DON'T KNOW to START USING IN 2024

If you're new, I always post programming content here! Stay tuned!

Enjoy the read!!

✅ 1 - `<picture>`

This Tag allows you to place MULTIPLE IMAGES at the same time, being able to choose which one will be shown according to the client's screen!

It's AMAZING for when you have various images of different sizes!

Learn more here!

✅ 2 - `<dialog>`

This one is simpler, but VERY USEFUL

You know when you want to show those dialog boxes on your website? This tag will save you!

I only use it now!

Learn more here!

✅ 3 - `<template>`

No more defining a variable with an ENTIRE HTML in your JavaScript!

This tag allows you to place content that can be shown or not, based on JavaScript

IMAGINE THE POSSIBILITIES!

Learn more here!

✅ 4 - `<track>`

This TAG you use along with a media element, like a video or an audio, and you can simply provide SUBTITLES for that content!

MAKES YOUR LIFE MUCH EASIER!!

Learn more here!

✅ 5 - `<object>`

This one allows you to embed external content within your HTML page!

You can put a PDF, files, videos, audios, and even handle the error if the browser doesn't support it!

simply AMAZING!

Learn more here!

⭐ BONUS - `<base>`

This one's good!
With it, you set a Base URL for ALL URLs on your page!

No more repeating the same URL all the time!

Learn more here!

😄 - THANK YOU!

This post was shorter than the others, mainly because time is a bit tighter, but I'll make the next one AMAZING!!

Thank you for reading so far! If you have any suggestions, just let me know and I'll tag you at the top!!

Also, check out my other projects:

better-format: https://github.com/luciano655dev/better-format

DayKeeper (in dev):
https://github.com/luciano655dev/daykeeper

Thank you!

🎆 THE BEST CSS PROPERTIES YOU SURELY DON'T KNOW FOR 2024 🎆

Luciano Menezes — Thu, 21 Mar 2024 00:01:17 +0000

This post is also available, originally, in a Twitter thread and in Portuguese, on Tabnews

⭐ - WHAT WILL I SHOW?

In this Post, I'll show you some AMAZING CSS PROPERTIES that you DEFINITELY don't know about!

If you're new here, I always post programming content on my Twitter! Feel free to follow and give suggestions!

✅ 1 - `mix-blend-mode`

This property allows you to control how an element blends with the content of its parent element and the background element.

With it, you can create UNIQUE overlay effects, among MANY other things!

Learn more!

✅ 2 - `shape-outside`

This one allows you to wrap content around a specific shape, like a circle, a triangle, a polygon, and MANY others.

This is GREAT for creating more interesting and creative layouts for your website.

Learn more!

✅ 3 - `backdrop-filter`

This property applies filtering effects, such as blur or color inversion, to the background of an element, including nested elements.

With this, you can create some visual effects that make the page INCREDIBLY more beautiful!

Learn more!

✅ 4 - `scroll-behavior`

You know when you want to automatically scroll to somewhere on your page? This property will save you!

With it, you can configure how the scroll will be, whether it will be fast, linear, smooth, HOWEVER you want!

Learn more!

✅ 5 - `clip-path`

With this property, you can cut elements IN ANY SHAPE YOU PREFER.

You can make a geometric shape, a star, ANYTHING, making your page UNIQUE and INCREDIBLY BEAUTIFUL.

Learn more!

✅ 6 - `object-fit`

This one's for you who CAN'T DEAL with an image!

With this property, you can place an element HOWEVER YOU WANT over another, whether by filling it, cutting it to make a mask, ANYTHING.

Learn more!

✅ 7 - `perspective`

I KNOW you often want to create some 3D effect on your Website and always end up going for some library.

With THIS property, you define the user's perspective in relation to the Z axis of the website, GREATLY IMPROVING any 3D you're going to do!

Learn more!

✅ 8 - `column-count` AND `column-gap`

These two properties allow you to divide the content of an element into a specific number of columns and define the space between these columns.

With this, everything becomes MUCH more organized, it can SAVE a website!

Learn more about column-gap!
Learn more about column-count!

✅ 9 - `image-rendering`

You know when the image is on the website, but it looks a bit weird?

THIS PROPERTY allows you to DEFINE how an image will be rendered!

Whether it'll be pixelated, with sharper edges, YOU CHOOSE.

Learn more!

✅ 10 - `word-wrap`

You know when that text of yours is ALL MESSED UP on the page, overflowing the container and everything?

Well, this property allows you to BREAK the sentence WHENEVER YOU NEED!

NO MORE MESSED UP SENTENCES, NO MORE BAD TEXTS, NEVER AGAIN!

Learn more!

⭐ BONUS - `text-overflow`

This property, just like the previous one, allows you to IMPROVE THAT MESSED UP TEXT by 100%

With it, you can put '...' at the end of a sentence that doesn't fit in the container, for example, and MUCH MORE.

THIS HAS SAVED ME A LOT

Learn more!

😄 - THANK YOU

The last thread didn't reach as many people, but even if none of my threads yield results, I WILL ALWAYS CONTINUE POSTING.

Hope you enjoyed! Remember that this post is also available on TabNews and DevTo!

My last thread: https://twitter.com/Luciano655dev/status/1769868521863835956

Also check out my other projects!

better-format: https://github.com/luciano655dev/better-format

DayKeeper (in dev): https://github.com/luciano655dev/daykeeper

THANK YOU!

🎆THE BEST GIT COMMANDS YOU PROBABLY DON'T KNOW FOR 2024 🎆

Luciano Menezes — Mon, 18 Mar 2024 23:43:03 +0000

This post is also available originally in Thread format on Twitter and in English on Dev.To!

⭐- WHAT WILL I SHOW?

In this Thread, I'll show you useful git commands that you probably haven't even heard of and believe me, they are VERY USEFUL

If you're new, I always post content here and on Twitter! Keep an eye out!

✅ 1 - `git rebase -i`

This GIT command allows you to reorganize, edit, or combine commits during a rebase

This is VERY useful for cleaning up commit history before sending a pull request, merging your changes into a main branch, etc.

See more here!

✅ 2 - `git cherry-pick`

This command basically allows you to copy a single commit from one branch to another

It's very useful when you need to add a specific change from a commit without merging the entire branch, for example

Ever since I saw it, I've been using it all the time!

See more here!

✅ 3 - `git reflog`

Reflog records ALL previous HEADs, allowing you to navigate through the change history, even after a rebase or reset

It's incredible for recovering lost commits, reversing accidental actions, among MANY other things

See more here!

✅ 4 - `git bisect`

This command is used to locate a specific commit that introduced a bug, performing a binary search between two known points

You can use it to quickly identify the cause of problems in large commit histories, for example

See more here!

✅ 5 - `git worktree`

This one allows you to work with MULTIPLE working directories from the same Git repository

It works great when you need to work on multiple branches simultaneously without switching between directories, etc...

See more here!

✅ 6 - `git submodule`

Submodules are Git repositories embedded within a main repository

They are useful for including dependencies from other repositories in your project while keeping them as separate entities

With this command, you can manage EVERYTHING from a submodule

See more here!

✅ 7 - `git clean`

This command is used to remove untracked files from the working directory

It's useful for cleaning up automatically generated files or temporary files that shouldn't be included in the repository (which has happened to me before)

This one's one of the best, I recommend it!

See more here!

✅ 8 - `git worktree prune`

Prune is used to clean up inactive working directories created by git worktree, which we saw a little while ago

This is useful for freeing up disk space and keeping the workspace always clean!

See more here!

✅ 9 - `git sparse-checkout`

This feature allows you to work only with a subset of files in a large repository

It's good for saving your time and disk space when cloning or pulling large projects, greatly improving everything

See more here!

✅ 10 - `git rerere`

This command automatically records successful conflict resolutions and reuses them in similar conflicts in the future

This is AMAZING for saving your time when dealing with recurring conflicts during merge, for example

See more here!

⭐ BONUS - `git notes`

This command attaches notes to your commits without altering the main timeline

This is GREAT for adding additional information, such as code reviews or review notes, without modifying the original commits

See more here!

😄- THANK YOU

I hope you enjoyed the post!

I always post programming content here and on my Twitter, feel free to follow and give suggestions! I always give credit at the top of the Thread!

Also, check out my other projects!

⭐ better-format: https://github.com/luciano655dev/better-format

⭐ DayKeeper (under development): https://github.com/luciano655dev/daykeeper

Thank you!

🎆HOW TO CREATE YOUR OWN PACKAGE ON NPM EASILY, QUICKLY, AND UPDATED 2024🎆

Luciano Menezes — Thu, 29 Feb 2024 22:42:11 +0000

This post is also available, originally, in Thread format on Twitter and, in Portuguese, on TabNews.

⭐- WHAT ARE WE GOING TO DO?

In this thread, I will teach you how to create your own package on NPM, in an EASY AND QUICK way, with JavaScript/TypeScript!

This thread will be based on my own package, BETTER-FORMAT, which I will use as a reference!

See more here on GitHub!

✅- WHAT IS NPM?

NPM, or Node Package Manager, is simply a package manager for Node.JS.

In other words, it's a place where anyone can create and publish packages.

Here we have both HUGE and smaller packages, all useful for something!

✅- BEFORE CREATING...

Before creating an NPM package, think about what this package will do.

Better-Format, for example, helps you format and validate some types of data, such as strings, numbers, CPF validation, card, etc...

Just have an idea and put it into practice!

✅- WHAT YOU WILL NEED

To create your first package, you just need an account on NPM and knowledge in some language, like JavaScript!

Depending on the package, you can also use other existing packages to help you, such as axios, bcrypt, etc...

✅ 1 - HOW TO GET STARTED

First, you need to initialize a package, something you've surely done before, with npm init.

Fill in as much information as possible here, as it is important.

Before that, it's also good to create a repository on GitHub to link to your project!

✅ 2 - FIRST CODE

After initializing the package, create an index.js file and put something in it, like a hello world.

Then, run the npm link command, which will start your package locally, making it ready for testing.

✅ 3 - CREATING THE PACKAGE

From here on, it's up to you and your creativity!

Create as many folders as you want, install as many dependencies as you want, and make your code work!

After that, just export everything in your index.js with module.exports = {...}!

✅ 4 - CREATING TESTS

Along with everything you do, I strongly recommend running a test for it!

To do this, just install Jest with npm i jest and create a ./tests folder, for example.

Here, you can test the functions you created! Use and abuse it!

✅ 5 - TESTING LOCALLY

Remember we ran the npm link command before? That's what allows us to test the package before it's published!

In another folder, run the command
npm i {my_package}

Then just import it with
const myPackage = require('my_package')

and test as much as you want!

✅ 6 - PUBLISHING THE PACKAGE

After developing the package, the simplest part is to publish!

Run the npm login command and enter your NPM account!

Then, check the version and run npm publish and YOU'RE DONE! YOU'VE ALREADY PUBLISHED YOUR FIRST PACKAGE!

To update, change the version and run the same command again!

✅ 7 - AFTER PUBLISHING

After publishing, promote your package!

Post it on your social networks, everything! Besides, NPM itself distributes your package when you create it!

Remember to create a good README to attract people and make everything right on GitHub!

Check Issues, PRs, create a good environment for other developers, and hopefully, your package will be a success!

⭐ - BONUS

If you want to see more content about it, there are two videos that I HIGHLY recommend you to watch!

One from WebDevSimplified that shows in detail how to create the package.

And another from Paula Santamaría, which shows how she created her own package in a VERY well-produced video!

WebDevSimplified video here

Paula Santamaría video here

😄 - THANK YOU!

Hope you enjoyed it!

It had been a while since I last did a thread, mostly due to lack of good content, but I always want to post more!

If you liked it, visit the Better-Format repository! Your contribution will always be very welcome!

Thank you!

🎆 THE BEST AND MOST USEFUL VSCODE EXTENSIONS 🎆

Luciano Menezes — Thu, 22 Feb 2024 13:13:57 +0000

This post is also avaliable on Twitter and, in portuguese, on TabNews

THE BEST AND MOST USEFUL VSCODE EXTENSIONS

⭐- WHAT WILL I SHOW?

In this Thread, I won't show you little extensions that you probably already know, like Live Server or Prettier.

I'll focus on USEFUL extensions that you probably don't have or know, but of course, I'll also go through some simple ones along the way.

✅ 1 - BETTER COMMENTS

This extension will REVOLUTIONIZE the way you comment your code!

With it, you can change the color, style, leave the comment THE WAY YOU PREFER.

I myself always use it and WON'T STOP USING IT, it helps a lot to make the code beautiful!

See more here!

✅ 2 - ERROR LENS

You know when you're writing code and need to ALWAYS COMPILE it to then LOOK FOR THE ERROR?

THAT ENDS HERE! Error Lens shows you CLEARLY where the errors are WHILE YOU WRITE THE CODE!

And I'll warn you, it also shows TypeScript alerts hahaha, I highly recommend it!

See more here!

✅ 3 - TABNINE AI AUTOCOMPLETE

You may know others like it, but I assure you, I'VE BEEN USING THIS FOR YEARS AND NEVER REGRETTED IT

Even the free version helps you A LOT to write code! It has a VERY complete system, besides being VERY reliable!

I DON'T CODE WITHOUT IT ANYMORE! I HIGHLY RECOMMEND IT!

See more here!

✅ 4 - VSCODE ANIMATIONS

This extension WILL IMPROVE YOUR VSCODE EXPERIENCE BY 1000x

It adds simple animations to VARIOUS actions, like opening a new file, terminal, etc.

And believe me! It won't bother you AT ALL! IT'S REALLY WORTH IT!

See more here!

✅ 5 - BOOKMARKS

NO MORE GETTING LOST IN CODE!

With Bookmarks, you can add markers wherever you want!
These markers can have comments, be customized, and all of them appear in a TAB JUST FOR THEM!

It's REALLY WORTH IT for large codes, I HIGHLY RECOMMEND IT!

See more here!

✅ 6 - CODE SNAP

You probably already know this one, BUT WAIT, I'LL SHOW YOU SOMETHING YOU DON'T KNOW!

With this extension, you take THE BEST PHOTOS OF YOUR CODE, it's perfect for sharing anywhere! even on Instagram to brag about your clean code! hahaha

And one thing you might not know is that it's CUSTOMIZABLE

You can change the background, color, opacity, spacing, EVERYTHING!

It's really worth it! I ALWAYS recommend it!

See more here!

✅ 7 - VSCODE PETS

I showed this one in the previous post, BUT IT'S WORTH SHOWING AGAIN!

With this extension, YOU CAN PUT PETS IN YOUR VSCODE!

There are various options for animals, scenarios, you can play with them, EVERYTHING, IT'S AMAZING!

IT'S REALLY WORTH INSTALLING OH MY GOD IT'S REALLY WORTH IT

See more here!

✅ 8 - WAKA TIME

THIS IS INNOVATIVE, YOU'LL SEE!

With this extension YOU CONTROL ALL THE TIME YOU SPENT CODING IN THE WEEK

It sends you a report about EVERYTHING in the week, with the time you spent on each project, file, IT'S AMAZING

Just sign up and make the most of it!

See more here!

✅ 9 - GIT HISTORY

If you use Git / GitHub frequently, THIS EXTENSION WILL SAVE YOU A LOT

It shows ALL Git history, from commits, pull requests, EVERYTHING YOU CAN IMAGINE

And this with the SIMPLEST AND MOST INTUITIVE design

Even though it's simpler, IT'S REALLY WORTH IT!

See more here

✅ 10 - PEACOCK

If you're a person like me, who always has MANY VSCode tabs open and always gets lost in them, THIS EXTENSION IS THE SOLUTION

With it, you can put ANY COLOR ON THE GITHUB BORDER, making it UNMISTAKABLE

(AND IT STARTED THE POST)

See more here!

⭐ BONUS - REGEX PREVIEWER

This one's for you WHO DON'T KNOW AND DON'T WANT TO KNOW REGEX (JUST LIKE ME HAHAHA)

With this extension, you preview what your RegEx expression does!

Believe me, IT WILL HELP YOU A LOT!

See more here!

😄 - THANK YOU

I hope you liked it!

If you have any questions, just DM me on Twitter! I'm always available!

My social networks:

Twitter
GitHub

My projects:

DayKeeper
Better-Format

THANK YOU!

HOW TO CUSTOMIZE YOUR VS Code AND Windows TERMINAL!

Luciano Menezes — Thu, 15 Feb 2024 00:11:38 +0000

This post is a translation of a Thread posted by me on Twitter! Feel free to see the original version here

⭐WHAT DO WE DO???

In this Post, we will go through themes, vscode settings, fonts, icons, color palette, terminal styling in Windows, EVERYTHING YOU CAN IMAGINE

🎆 - VS CODE THEME

The theme I'm using is called "Min Theme", which is very simple, but very good!

If you want to use a livelier theme, there's "Shades of Purple" which I used for a long time! In addition to "Andromeda", "Tokyo Night" and the famous "Dracula" that you already know!

Here are the links, choose the one you prefer! Everyone is amazing

Min Theme

Shades of Purple (Super Dark)

Andromeda

Tokyo Night

Dracula

🗂️- FILE ICONS

Currently, I'm using 'vscode-icons", which I really like! However, one that goes REALLY well with this theme is "Symbols", which follows the minimalist aesthetic!

These two are the ones I recommend! It's up to you to choose!

vscode-icons

Symbols

🅰️- VSCODE FONTS

This is the BEST FONT I found, called "JeiBrains Mono"!

It is a very complete font for devs, containing EVERYTHING you need, such as fontLigatures, Nerd Fonts, etc...

Another good one is Geist Mono, launched by Versel, which also contains ALL OF THIS

You choose!

JetBrains Mono

Geist Mono

⌨️ - GENERAL SETTINGS

This is where everything will change! I'll show you how to really make VSCode your own!

Press Ctrl + Shift + P in VsCode and search for "Preferences: Open User Settings (JSON)"

This is the JSON that goes into all the VS CODE configs! There's a lot to put here, so here is a link to the Rocketseat video explaining everything! (Portuguese)

If you just want to get the configs, you can look at his github repository, in the description of this video

If you want to leave it EXACTLY as mine is, just read it here, which is a simpler version that I customized, but it's not very different!

{
    "symbols.hidesExplorerArrows": false,
    "tabnine.experimentalAutoImports": true,
    "workbench.colorTheme": "Dracula",
    "workbench.iconTheme": "symbols",
    "editor.fontFamily": "JetBrains Mono",
    "vscode-pets.theme": "forest",
    "editor.fontSize": 14,
    "editor.lineHeight": 1.8,
    "workbench.startupEditor": "newUntitledFile",
    "editor.renderLineHighlight": "gutter",
    "editor.fontLigatures": true,
    "workbench.editor.labelFormat": "short",
    "explorer.compactFolders": false,
    "editor.semanticHighlighting.enabled": false,
    "breadcrumbs.enabled": false,
    "editor.minimap.enabled": false,
    "workbench.statusBar.visible": false,
    "apc.electron": {
        "titleBarStyle": "hiddenInset",
        "trafficLightPosition": { "x": 11, "y": 10 },
        "frame": false
    },
    "window.commandCenter": false,
    "apc.header": {
        "height": 36
    },
    "apc.stylesheet": {
        ".title-label > h2": "display: none",
        ".editor-actions": "display: none",
        ".nosidebar .inline-tabs-placeholder": "width: 75px",
        ".pane-header": "padding: 0 8px",
        ".pane-body": "padding: 8px",
        ".split-view-view:first-child .pane-header": "display: none !important;",
        ".monaco-list-row": "border-radius: 4px;",
        ".monaco-workbench .monaco-list:not(.element-focused):focus:before": "display: none;"
    },
    "apc.listRow": { "height": 24 },
    "explorer.fileNesting.enabled": true,
    "explorer.fileNesting.patterns": {
        "*.ts": "${capture}.js",
        "*.js": "${capture}.js.map, ${capture}.min.js, ${capture}.d.ts",
        "*.jsx": "${capture}.js",
        "*.tsx": "${capture}.ts",
        "tsconfig.json": "tsconfig.*.json",
        "package.json": "package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb"
    },
    "terminal.integrated.fontSize": 14,
    "terminal.integrated.fontFamily": "JetBrainsMono Nerd Font",
    "window.density.editorTabHeight": "compact"
}

🎲- MISCELLANEOUS IMPROVEMENTS

To improve it further, go to each panel you don't like, right-click and select "Hidden"

Do this with "Overview" in Explorer, for example, with "Problems" in the terminal, "Timeline", etc...

😺- VS CODE PETS

She adds PETS THAT STAY WITH YOU! There are several different animals, you can change the litter, play with them, play ball, EVERYTHING!!!

BEST EXTENSION EVER!
Leaves the aesthetics AMAZING!!

vscode-pets

🖥️- NOW IN TERMINALLLL

Here, I will style the WINDOWS terminal based on this video
, SORRY TO THOSE WHO USE MAC/LINUX MY BAD

If you want to watch his video, I highly recommend it! VERY good video!

🎨- TERMINAL COLOR PALETTE

To see a theme, just choose one you like in the Windows Terminal Theme

In my case, I'm using the "JetBrains Dracula" theme, but when the terminal is inside VS Code, it won't make a difference lol

INSTRUCTIONS:

When you find the theme you like on the website, click the "Get Theme" button, which will copy the theme

In the terminal, click on the arrow -> settings -> Open JSON file (last option) and look for the value "schemes"

Then, just paste the theme you had copied at the end of the Array and select it from the options! ENJOY!

🅰️- NERD FONTSSS

A "Nerd Font" is a font that contains dev symbols, such as the node symbol, etc... which REALLY improves the aesthetics of the terminal

For the terminal font, I will be using the FiraCode Nerd Font, but you can find several others here!
(If you want, you can even use the JetBrains Mono that is already installed!)

To install the font, search for it on github, download and install the font by right click + install on all of them

Then, just go to the terminal and press the arrow -> settings -> Default -> Appearance and select the font you installed!

Just restart the terminal and be happy!

🎆- TERMINAL THEMES (GOOD PART)

To put those themes in the terminal, we'll use Oh-My-Posh!

The instructions for doing everything are a little more extensive, but just read the documentation and you'll get the hang of it! Anyway, it's a shame to see the config video I posted!

It offers VARIOUS themes for your terminal! What I'm using is a simple one, called "neko", just install it and run for the hug

Make sure WinGet is installed first, otherwise just install the "App Installer" by searching for "WinGet" in the Microsoft Store

If you have any problems with initializing the theme configuration file, a post that helped me was this one, on StackOverflow!

🎲- OTHER SETTINGS

To improve the terminal a little more, you can make some general settings in the arrow -> Settings -> Appearance

Then, you can put a background image (Default->Appearance), make the navigation bar transparent (acrylic mode), put a clear theme, among MANY other things

Then it's up to you to explore!

😄- THANK YOU!

That was Thread, I hope you liked it and found it a good customization for your VS Code!

If you have any questions, just DM me on Twitter! I'm always available!

My socials:
Twitter
GitHub

My projects:
DayKeeper
better-format

Thank you!

DEV Community: Luciano Menezes

Your Distributed Lock Can Expire Correctly and Still Corrupt Data

The lock expired correctly—and data still lost

A TTL turns your mutex into a lease

Fencing gives the resource the final say

Why INCR is not automatically token 42

Production-grade means observing lease loss

Sometimes the right lock is no distributed lock

If you remember one thing

One Bad Regex Can Freeze Node.js: Here's How to Stop It

The bug hides in a perfectly reasonable test suite

Backtracking turns ambiguity into a search tree

Remove the ambiguity instead of tuning it

Put more than one guardrail around untrusted regex

Node makes synchronous regex a shared failure

The code-review rule worth keeping

Stop Retry Storms: Backoff Is Not Enough Without a Budget

A retry is load, not a second chance

Layers turn three retries into 64 attempts

Retry only work that is safe to repeat

Backoff without jitter schedules the next spike

A retry budget breaks the feedback loop

Observe attempts, not just errors

The policy in one review checklist

Your Clock Can Go Backward—Use the Right One for Durations

The subtraction that works—until it does not

Your computer already has two kinds of clock

A negative duration once broke DNS

Fix the stopwatch, then fix the deadline

The boundary: never serialize a monotonic reading

Make time testable and observable

🎥 Why is it almost impossible to create a social media with videos - Daykeeper

DayKeeper’s Environment

The Problem

1. Storage structure

2. Verification time

3. Costs

Possible Solutions

1. Having funds ($$$)

2. Imposing limits

3. Trust-based moderation system

4. Partial video verification

Use Queues with Redis and BullMQ

5. Video compression

DayKeeper’s Solution

Conclusion

🎆THE BEST PROGRAMMING CHALLENGES USED IN BIG TECHS FOR YOU TO TRAIN IN 2024🎆

⭐- WHAT WILL I SHOW?

✅ 1 - Back-end Challenge by PicPay

✅ 2 - First Missing Positive by Google

✅ 3 - Backend Challenge by Uber

✅ 4 - Product of Array Except Self by Amazon

✅ 5 - First Unique Character in a String by Netflix

⭐- BONUS - Uber Archives

😄 - THANK YOU!

Thank you!

🎆THE BEST HTML/REACT TAGS YOU SURELY DON'T KNOW FOR 2024🎆

⭐- WHAT WILL I SHOW?

✅ 1 - <picture>

✅ 2 - <dialog>

✅ 3 - <template>

✅ 4 - <track>

✅ 5 - <object>

⭐ BONUS - <base>

😄 - THANK YOU!

Thank you!

🎆 THE BEST CSS PROPERTIES YOU SURELY DON'T KNOW FOR 2024 🎆

⭐ - WHAT WILL I SHOW?

✅ 1 - mix-blend-mode

✅ 2 - shape-outside

✅ 3 - backdrop-filter

✅ 4 - scroll-behavior

✅ 5 - clip-path

✅ 6 - object-fit

✅ 7 - perspective

✅ 8 - column-count AND column-gap

✅ 9 - image-rendering

✅ 10 - word-wrap

⭐ BONUS - text-overflow

😄 - THANK YOU

Why `INCR` is not automatically token 42

✅ 1 - `<picture>`

✅ 2 - `<dialog>`

✅ 3 - `<template>`

✅ 4 - `<track>`

✅ 5 - `<object>`

⭐ BONUS - `<base>`

✅ 1 - `mix-blend-mode`

✅ 2 - `shape-outside`

✅ 3 - `backdrop-filter`

✅ 4 - `scroll-behavior`

✅ 5 - `clip-path`

✅ 6 - `object-fit`

✅ 7 - `perspective`

✅ 8 - `column-count` AND `column-gap`

✅ 9 - `image-rendering`

✅ 10 - `word-wrap`

⭐ BONUS - `text-overflow`

✅ 1 - `git rebase -i`

✅ 2 - `git cherry-pick`

✅ 3 - `git reflog`

✅ 4 - `git bisect`

✅ 5 - `git worktree`

✅ 6 - `git submodule`

✅ 7 - `git clean`

✅ 8 - `git worktree prune`

✅ 9 - `git sparse-checkout`

✅ 10 - `git rerere`

⭐ BONUS - `git notes`