Programming
The latest Programming headlines, aggregated and deduped from public feeds across the web. See the sources.
The latest Programming headlines, aggregated and deduped from public feeds across the web. See the sources.
Matt Mullenweg, the founder and CEO of Automattic, best known as the parent company of WordPress.com, has been put on a leave of absence by his board against his will, according to a Slack message seen by TechCrunch. Earlier Wednesday, Mullenweg posted in a Slack channel visible to all employees that the company’s Chief Financial […]
Your agent notices a failing deployment. It reads the logs, identifies the bad commit, drafts a rollback, and now wants to apply it. Should it just do it? If it asks for permission at every step, it becomes an expensive autocomplete. If it can do anything it can describe, it becomes a liability. The useful question is not “How smart is the agent?” It is: Which actions are safe to pre-authorize, which actions need explicit approval, and which actions should be impossible? That is not a prompt eng
Yesterday I open-sourced them on GitHub. This post is the story of why I why I open-sourced them at all. Most "free online tools" secretly upload your input to a server, process it Try this experiment: paste 你好世界 🌍 into the most popular online Base64 好ä¸ç•Œ — broken output that no Even when they work correctly, you're trusting that the site: won't log your input won't sell it to a third party won't get breached next year won't disappear and take your workflow with it Open source fixes all fou
Ghosts of Electricity: A look at why the oft-discussed predictions that AI will deliver double-digit GDP growth in advanced economies are extremely unlikely over the next 10-15 years — The following post represents the personal views of the author(s) and does not reflect or represent the positions of their employers.
Artificial Intelligence is evolving rapidly beyond simple prompt-based models. To truly leverage Al's potential for complex, real-time tasks, Al models were mostly used by simply feeding a prompt and generating output a lightweight interaction Often good enough for basic tasks Developers alone can build advanced solutions, but these require Use tools dynamically. Manage memory contextually. Run validation loops to improve output quality. Think of Agentic Harnessing as the key to moving beyond st
Tim Bradshaw / Financial Times: The AI boom is fueling a resurgence in VC bets in “moonshot” sectors such as BCI; Dealroom says non-AI deeptech funding has topped $150B since the start of 2024 — Tech investors are rediscovering the kind of long-shot sci-fi bets that helped build Silicon Valley.
A Japanese, more code-heavy version of this is on Zenn. I build RoamSwitch, a solo-developed network security app for Mac and Linux. It locks down the firewall and shared services the instant you're on a network you haven't approved, and on Pro it adds things like emergency network isolation when it sees ransomware-like behavior, and DNS-layer blocking of phishing/C2 domains. For the last few releases I'd been building two fairly unglamorous features, a log auditor that flags frequency anomalies
Bloomberg: Sources: Grab is in talks to buy a majority stake in Advance Intelligence Group's Singapore-based BNPL platform Atome Financial at a $2B+ valuation — Grab Holdings Ltd., the biggest ride-hailing and food-delivery firm in Southeast Asia, is in talks to buy a majority stake in Singapore-based buy …
Imagine a coating-line dashboard showing 1,200 nm for thirty seconds. The film might be consistent. Or the application might have stopped receiving measurements and kept the last value on screen. Looking at the number alone, you cannot tell. That is the software problem I want to focus on here: what needs to travel with a thin-film measurement so that an application can use it sensibly? I work on technical content for TDM Technology. Its thin-film thickness guide covers measurement conditions fo
Emmy Martin / New York Times: How Amazon's Zoox, which has ~100 AVs in its fleet, is utilizing social media influencers, community events, and ad campaigns to compete with Waymo in SF — The Amazon-owned driverless car company is a distant second to Waymo. Its pitch to riders? Wine pop-ups, festival sponsorships and a car built to be filmed.
I've seen it happen dozens of times. A developer sits down with Claude or Cursor, asks for a scalable architecture to handle some new workload, and within ten minutes, the LLM has hallucinated a sprawling mess of EKS clusters, Kinesis streams, and Aurora Global Databases. On paper, it looks impressive. To a junior dev or even a mid-level engineer, it looks "cloud-native." But to anyone who has ever stared at a massive monthly AWS bill or sat through an incident response call caused by an IAM wil
Viola Zhou / Rest of World: Chinese tech giants are hiring skilled professionals as specialized AI trainers to build high-quality datasets, mirroring efforts by US platforms like Mercor — Squeezed by a stagnant economy and state directives, China's underemployed lawyers, architects, and engineers are taking cheap gig work …
Hey DEV Community! I’m building bayar.dev, an early-stage software product company developing AI infrastructure, B2B workflow products, and multi-agent systems. The foundation starts with a simple goal: make AI applications feel immediate while keeping their data boundaries explicit. The public chat endpoint at /api/chat is stateless and streams responses token by token using Server-Sent Events (SSE). The backend connects to Azure AI infrastructure through an OpenAI-compatible interface. That ar
Maxwell Zeff / Wired: Q&A with AI researcher Jacob Coxon, who quit Anthropic, on the need for industry-wide, international coordination to limit recursive self-improvement, and more — Jacob Coxon talks to WIRED about the “mini Manhattan project” inside Anthropic, the problem with alignment …
This was the first project I've ever actually finished. Not a tutorial I followed along with, not a copy of something else — an actual thing I designed, broke, fixed, and shipped, in 72 hours, for the Hackathon Raptors Zero-Dependency Hackathon. The rule was simple to say and hard to live with: no external packages, no libraries, no shortcuts. Just the standard tools your programming language already gives you, and whatever you can build yourself on top of them. I built CampusLink — a chat tool
Reuters: Sources: Chinese AI chipmakers Huawei, Cambricon, MetaX, and Iluvatar CoreX have raised prices for current and next-gen chips by 20%-50% due to rising HBM costs — Chinese AI chipmakers including Huawei Technologies [RIC:RIC:HWT.UL] and Cambricon (688256.SS) have sharply raised prices …
Over the last year, I noticed something about the way I work with AI. I get much more done, but I also feel much more tired. Not “I need some coffee” tired. I mean completely mentally drained at the end of the workday, especially by the end of the week. The strange part is that I am not working more hours. AI lets me do in one hour what could easily take half a day before. That hour is just much more intense than it used to be. A normal developer workday was never eight hours of nonstop hard thi
Océane Herrero / Politico: Sources including French public officials detail how Mistral's rise over the past three years owes much to the privileged relationship it built with Macron — Mistral has forged unrivaled ties with the French presidency. Now, Emmanuel Macron is departing. — in Paris
...but let me say this right away: coding was never the most valuable part of software engineering. I remember when I was a junior software dev. Nothing came easily to me. Every feature felt like an uphill battle. I can't even count how many hours I spent digging through Stack Overflow. And then there was the stress of PR reviews, where I sometimes got absolutely roasted in the comments (rightfully so!) 😅 Eventually, things started getting better and better. Shipping features took me less time,
Paul Christiano / @paulfchristiano: OpenAI Foundation board member Paul Christiano says the AI industry is currently not on track to reduce the acute loss-of-control risk to an “acceptable” level — I am excited to be joining the OpenAI nonprofit board, serving on the Safety and Security Committee to support safety oversight.
Modern frontend development usually treats HTML as the final output of a much larger system. We think about: React components Then somewhere at the end, all of that becomes HTML. That makes it easy to think of markup as implementation detail. But consider everything that may need to understand your interface without looking at it the way a human does: screen readers For all of them, the DOM is effectively an interface. That means your HTML is not merely presentation. It is an API surface. And li
Bloomberg: Sources: Alibaba is set to lead a $300M round in AI model testing startup UniPat AI at a $2.5B valuation; UniPat founder Li Kuan worked at Alibaba's Tongyi Lab — Alibaba Group Holding Ltd. is slated to lead a $300 million investment in AI training and benchmarking startup UniPat AI …
A user clicks “Run agent”, your backend receives a normal HTTP request, and the agent starts doing what agents do: calling tools, reading documents, querying APIs, waiting for a human approval, retrying a flaky search, and generating a long report. Two minutes later, your load balancer returns 504 Gateway Timeout. The user sees an error. The agent, depending on where it is running, may still be alive. It may still be spending tokens. It may have already sent an email, created a ticket, or update
Annie Palmer / CNBC: Amazon names Mandiant founder Kevin Mandia to its board of directors, noting his extensive experience “combating cyber threats” in public and private sectors — Amazon said Kevin Mandia, the founder and former CEO of cybersecurity company Mandiant, is joining its board of directors.
Every "best SaaS boilerplate" list is a Next.js list with a Vue footnote. If Nuxt full-stack kits (JavaScript end to end), Vue on a (Laravel, .NET, Go), and UI templates that look Kit Family Backend Database Teams Billing i18n Licence / price supastarter for Nuxt Nuxt full-stack Nuxt 3 server + Hono API Prisma or Drizzle (PostgreSQL…) yes, orgs + seat billing Stripe, Lemon Squeezy, Polar, Creem, Dodo yes, incl. emails commercial, from €299 NuxSaaS Nuxt full-stack Nuxt (v4-ready) PostgreSQL + Dri
Mikella Schuettler / Associated Press: New Mexico, the only US state taking the Cambridge Analytica case to trial, accused Meta of failing to protect Facebook user data in its opening statements — Attorneys representing the state of New Mexico told jurors that targeted political ads, attempting to lower Democratic turnout during …
"Compress without losing quality" is a promise lossy formats can't fully keep — every step of compression trades some fidelity for bytes. The useful question isn't whether you lose quality but how much, for how many bytes saved. So we measured the trade directly. Across the 24-image Kodak reference suite — the standard set for this kind of test — we saved every photo as JPEG and WebP at qualities 20 through 95, and scored each output on SSIM (structural similarity to the original, 0 to 1) rather
Tim Fernholz / TechCrunch: Paul Christiano, an AI researcher and advisor at CAISI, is joining the OpenAI Foundation board of directors and its Safety and Security Committee — Paul Christiano, an influential AI researcher focused on keeping AI systems aligned with human interests and under human control …
Rebuilding my development foundation sounded like a step backwards at first. But after going through it, I think it might have been one of the best decisions I've made. Before the five projects I mentioned in my previous post, I've worked on countless others. An Arabic BMI calculator. A solar cost-per-use and usage calculator. 3–4 dashboards. And several other projects I can't even remember off the top of my head. I also took a course where I deliberately went back to the beginning with HTML and
Your agent connects to three MCP servers, calls tools/list, and suddenly it can search issues, query a database, send email, refund payments, and delete staging environments. The integration problem is solved. The tools are discoverable. The safety problem is not. MCP — the Model Context Protocol — did something genuinely useful: it gave AI clients and external tool servers a common language. Instead of every AI app inventing its own plugin system, a client can now ask a server what tools exist,
Lauren Goode / Wired: Kepler Computing, which claims its 3D stacking and new material can increase HBM and SRAM density without relying on EUV, emerges from stealth with $468M — Kepler Computing claims a new approach to chip design—and a proprietary material—can help end the supply bottlenecks that have sent memory prices surging.
TL;DR If you import Hls from 'hls.js', you are probably getting the ESM build, and the ESM build does not bundle the transmuxer worker. Transmuxing runs on your main thread until you set workerPath. We are going to verify which mode you are in, fix it, and add a long-task observer so you can tell main-thread stalls apart from network stalls. Two short facts before any code. hls.js 1.4 introduced the ESM build (dist/hls.mjs), and that build ships the worker as a separate file rather than inlining
Tim De Chant / TechCrunch: Massachusetts Gov. Maura Healey signs an EO requiring data centers above 25MW of peak demand to bring their own power and meet 100% of demand with clean energy — Massachusetts became the latest state to force data centers to bring their own power, but this time there's a twist.
TL;DR A fetch() upload dies when the OS suspends your app, and your JS context is recreated with no memory of it. We are going to build an upload that is a persisted record plus a state machine, hand the actual transfer to a native background session, and reconcile against the server when the app comes back. About 150 lines. Versions this was written against: Expo SDK 54 (React Native 0.81) and SDK 55 (React Native 0.83). Relevant because SDK 54 is the last release with legacy architecture suppo
New York Times: Sources: DOJ is investigating whether Nvidia tried to skirt antitrust scrutiny of its 2025 Groq deal, described by Groq as a “nonexclusive licensing agreement” — The Justice Department is examining whether the tech giant sought to sidestep antitrust scrutiny.
TL;DR Banding arguments go in circles because everyone tests on different footage. We are going to generate a synthetic gradient, encode it four ways (naive 8-bit, 8-bit debanded, 10-bit filter graph with explicit dither, and 10-bit AV1), and build a small harness so you can run it on your own ladder. Everything runs locally with FFmpeg, no assets to download. Written against FFmpeg 7.x/8.x. Check yours with ffmpeg -version. Real footage has sensor noise, and that noise dithers away banding by a
Madison Mills / Axios: AI researcher Jacob Coxon says he quit Anthropic after four months, two months before his equity would have vested; he still has equity in prior employer OpenAI — Anthropic researcher Jacob Coxon quit his job due to concerns about the safety of AI two months before his equity would have vested, he told Axios.
OWASP Cornucopia Mobile App Edition v2.0 Johan Sydseter for OWASP® Foundation Sep 10 #cybersecurity #mobile #security #software Add Comment 8 min read
Christine Mui / Politico: California Gov. Gavin Newsom signs into law two bills, backed by Anthropic and OpenAI, regulating how outside groups evaluate AI for safety — SAN FRANCISCO — California Gov. Gavin Newsom on Wednesday signed two bills regulating how outside groups evaluate AI programs for safety after warnings …
We are happy to announce the release of the OWASP Cornucopia Mobile App Edition v2.0. The latest edition is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and features 80 threats that cover all the requirements, tests, and weaknesses of the OWASP Mobile Application Security Project. At Admincontrol, the OWASP Cornucopia Mobile App Edition is used to implement mobile application security by design. Before building mobile apps and features, OWASP Cornucopia helps the team identify threats
Hartley Charlton / MacRumors: Apple unveils AppleCare One Family, extending AppleCare coverage to every eligible device in an Apple Family Sharing group of up to 6 people for $49.99/month — Apple today announced AppleCare One Family, a new option for U.S. customers that extends AppleCare coverage to every eligible device across …
I have a small Node server — Express, a WebSocket hub, about 2,000 lines. It's a MeghXL. Running npm install, npm start. That's fine for me and a wall I wanted a double-clickable app for macOS, Windows and Linux, where the user has no Electron would have been the boring answer, and boring answers are usually right. I went with Tauri for one reason: size. My finished installers are 28–41 MB. The The cost is that Tauri is Rust and uses the OS webview, so the Node server can't Tauri has a mechanism
The Information: Sources: Jeffrey Katzenberg, ex-OpenAI Sora head Bill Peebles, and ex-Dropbox CFO Sujay Jaswa plan to launch a startup to train AI video models for filmmakers — Hollywood mogul Jeffrey Katzenberg is teaming up with the former head of OpenAI's Sora app to launch a new AI startup that would train …
Adding a second agent creates a coordination problem before it creates a capability gain. Someone must define the assignment, preserve the relevant context, reconcile the result and decide whether another attempt is allowed. Those obligations exist even when the second agent produces nothing useful. The title describes that architectural asymmetry, not a universal measured growth rate: extra capability is possible, but it has to earn the machinery introduced to obtain it. Start with a working si
Sarah Perez / TechCrunch: Apple unveils a new Health app with Apple Intelligence, featuring an Insights tab, “readiness” and Health Age metrics, and more, rolling out later in 2026 — Alongside the new Apple Watch Series 12 and Ultra 4, Apple on Wednesday introduced a redesigned Apple Health app …
In February 2021, security researcher Alex Birsan published a paper describing how he had successfully deployed malicious packages to the internal build systems of Apple, Microsoft, PayPal, Shopify, and 32 other companies. He did it without hacking a single server, exploiting a single CVE, or phishing a single developer. He published packages to npm, PyPI and RubyGems with names matching internal packages those companies used — and their build systems installed his public versions automatically.
One executor, one pass, one commit - and the work can be dropped at any boundary. 👋 I'm Anton - a software engineer working mostly in PHP/Symfony and Go, currently carving a live PHP monolith into Go services. Earlier parts of this series were about what an executor must know, how small a unit of work has to get, and how to write a task with nothing left to interpret. This part is about the thing I only learned by having to stop in the middle: the unit at which work becomes droppable. Notes: gi
UOB polled business owners across the region and found something most vendors will not put on a slide: 65% of businesses have adopted AI in some form, but only 15% have reached what the study calls advanced capability. Read that again. Four out of five companies using AI are stuck somewhere between "we tried it" and "it changed how we work." The barriers the respondents named are where it gets interesting. Data and system readiness: 47%. Funding: 47%. Talent: 39%. Funding and talent are the answ
An observability-first approach for building an AI agent, and what it bought me. A couple of weeks ago I started implementing Kept, a self-hostable post-purchase support agent for e-commerce, with reliability as its core offering. Besides the product itself, my objective in building it is to delve into the depths of agentic system design, and see what it actually means to build an agent with "reliability at its core". I started from a theory my experience validated again and again throughout the
Two different logs, and teams keep shipping the first while believing it's the second. The first records that at 14:02:11 UTC, decision d_8f21 ran through model v2.3.1, took this input, produced this output, and a human approved it. Complete, timestamped, retained for six months. It satisfies most audit-trail checklists. The second proves the answer came from paragraph 4 of manual_A2131.pdf, retrieved at rank 2 with a score of 0.81, and that the sentence in the response is supported by that span
Trello is one of the simplest project management tools and its API is one of the most straightforward to call. Yet CF7 to Trello integrations fail constantly, usually for the same handful of reasons that are never clearly documented anywhere. This post covers every cause of CF7 submissions not creating Trello cards, with direct API calls you can use to verify each piece before connecting your form. Trello uses a two-part authentication system that trips up most developers on first setup. You nee
I wanted a calculator site that behaves like a document, not like a web app. Type three numbers. Get the number of paint cans to buy. No account, no dashboard, no round trip to a server, no analytics watching you type. The page, the arithmetic, and the answer. That one constraint decided almost every technical choice below, and it is also why the numbers are small enough to print in a table. Here is a cold load of wallmath.com, measured in a headless Chromium on 2026-09-10 against the live build
Virtual machines, containers, serverless. Three ways to run your code, endless articles comparing them, and yet a lot of people still cannot say clearly why you would pick one over another. The confusion comes from comparing them on the wrong axis. Here is the mental model that made it click for me: each one is a different answer to "how much of the machine do you carry with your app," and once you see them that way, when to use which becomes obvious. Think of running your code as packing for a
A year ago, adding AI to an app meant one API key and a few calls to one provider. Now most teams call several models across several providers, from several features, and the whole thing is a tangle: keys scattered in code, no idea which feature spends what, no consistent rate limits, no shared safety checks. The pattern emerging to fix this is the AI gateway, and if you are running AI in production, it is quickly becoming as standard as an API gateway or a load balancer. Here is what it actuall
There's a new visitor in your logs: the AI agent, acting on someone's behalf. Right now it "uses" your site by reading the DOM and guessing which button does what. WebMCP replaces the guessing with a contract — your page declares structured tools an in-browser agent can call directly. It's a draft W3C standard (Google + Microsoft) that shipped as an early preview in Chrome 146. Here's how to add it, step by step, with copy-paste code. A WebMCP tool is three things: a name a description the agent
The shift toward autonomous AI agents has exposed a critical gap in modern web infrastructure: the interface gap. For years, browser-based AI agents have had to navigate web pages the way humans do...parsing visual layouts, guessing CSS selectors, and attempting to mimic clicks. Connecting in-browser agent tools directly to modern cloud backends requires an architectural shift. By combining WebMCP on the frontend with Google Cloud Run on the backend, engineers can build a deterministic, resilien
Security infrastructure looks clean in architecture diagrams. Production is messier. Stale data, delayed events, service failures, and emergency exceptions all affect real access decisions. This is Part 1 of Security Infrastructure in Practice, a series about what happens when security design meets production systems. The policy looked correct. Employees in the support function could view customer cases. Contractors could view only the cases assigned to them. Unmanaged devices were blocked from
I was closing out a throwaway repo from an agent-workflow experiment. I had treated experiment repos as cheap to delete once the hypothesis felt answered. The prototype had to go because leaving both checkouts live gave later agents two competing sources of precedent. Deleting it meant deciding what had been validated, writing it down somewhere durable, and removing experiment surfaces only after that record was complete. Standing up the narrow prototype had been genuinely fast. Portable agent p
Firebase configuration embedded inside a mobile application is not the actual security boundary. The real risk begins when production services treat that configuration, an authenticated user, or the application interface as sufficient authorization. Attackers can reproduce legitimate requests outside the Android or iOS app. If Security Rules allow broad access, hidden buttons, navigation restrictions, and client-side validation cannot protect the underlying data. Checking only that request.auth
Die XZ-Backdoor: Ein Albtraum, der die Open-Source-Welt wachrüttelte Ende März 2024 hielt die Tech-Welt den Atem an. Ein Microsoft-Entwickler, Andres Freund, entdeckte durch Zufall eine der raffiniertesten und potenziell verheerendsten Backdoors, die je in einer kritischen Open-Source-Komponente gefunden wurden. Der Zielort: xz, ein unscheinbares, aber weit verbreitetes Komprimierungswerkzeug, das auf fast jedem Linux- und macOS-System zu finden ist. Der Vorfall, bekannt als CVE-2024-3094, war k
Choosing between software licensing models is one of the most consequential strategic decisions founders make when building enterprise applications in 2026. Pick the wrong contract format and you can limit your distribution reach, restrict SaaS scaling opportunities, or accidentally force yourself to share proprietary code. Founders therefore need to weigh how to protect their core intellectual property (IP) while keeping operational margins clean. This guide explores the legal structures, open-
One of the biggest changes I've experienced in software development recently is how AI changes the process of building software. At first, AI coding feels like: "Give me the code." But that isn't where the real productivity comes from. The bigger advantage is being able to use AI throughout the development lifecycle: 🧠 Brainstorming architecture The developer still needs to understand why something should be built and whether the generated solution is actually good. AI can produce code incredib
Open WebUI is one of the first tools that appeared in conjunction with Large Language Models. Initially intended as a tool for chatting with a connected local Ollama instance, it evolved to work with any OpenAI API provider and succinctly extended its features to support agentic chats. Following the setup of Open WebUI in my previous post, this article explores its core features. Learn about conversation essentials, see how notes and knowledge bases are created, and understand the different opti
Hi everyone! 👋 I’m excited to finally be part of the DEV Community. I’m a Software Engineer, WordPress Developer, and SEO Specialist with a passion for building websites that are not only functional and visually appealing, but also fast, accessible, and easy to find in search engines. I joined DEV.to because I want to connect with other people in the tech community, learn from their experiences, and share some of the things I’ve learned throughout my journey. Technology is constantly changing,
Artificial Intelligence is one of the fastest-growing skill areas in tech, but there is a problem. A lot of learners are spending more time collecting certificates than building things. They complete a Python course. Then a Machine Learning course. Then a Generative AI course. Then another prompt engineering course. At the end, they have several certificates but still struggle with a simple interview question: “What have you built?” That question matters. Because AI becomes much easier to unders
The longer I use AI, the more conversation history I accumulate. At first, that feels reassuring. More history should mean more useful context to return to later. But after enough ChatGPT, Claude, and Gemini conversations, I started noticing the opposite: the more conversations I had, the harder it became to find the moments that actually mattered. I could often remember that an important decision had happened. I just couldn't remember where. Search helped when I remembered the exact words. But
I ship a small Cloudflare Worker (a Claude Code status line that pays users a cut of disclosed sponsor revenue -- not the point of this post, just context for where the traffic pattern came from). Every install polls /line every 10-20 seconds while the user is coding. That's a lot of requests hitting one Worker. Rate limiting a Worker endpoint by install ID looks like a one-liner with KV: async function checkLineRateLimit(env, installId) { const key = `ratelimit:${installId}`; const raw = await
People think reputation The rescue. The outage you fixed at midnight. The demo that landed. It is not. It is made of the sentence "I will send you that link." "I will look at it this afternoon." "I will let you know either way Nobody writes those down. Everybody remembers them. Not consciously, He said he would, so it is handled. Or: he said he would, That second sentence You just notice, years later, The trap is that small promises They cost nothing at the moment of speaking. You say yes becaus
LeetCode problems 3870 and 3871 clearly show the transition from a simple case to a generalized one depending on the constraints. I would say this is a good example of why you should always ask about the problem constraints. The problems are very similar, but different constraints lead to completely different solutions. Both problems have the same description: You are given an integer n. total number of commas used when writing all integers from [1, n] (inclusive) in standard number formatting.
The demo is a text box. The product is the bad day. A model is a service Every rule you already hold You keep forgetting Time it out. Not the vendor default. Yours. Decide how long a user will wait Know what happens when it fails, If your answer is You have hoped. Degrade into something. The cached answer from yesterday. The dumb deterministic path An honest line saying Validate the output It is a form. It is the least predictable form Parse it, check it, reject it, Watch the money A retry loop
GPT-6 Astra shipped on September 3, and it arrived with an asterisk no model has carried before: it is the first model OpenAI has ever rated Critical for cybersecurity, because it can find zero-day vulnerabilities in hardened systems and turn them into working exploits without a human guiding it. The rest of the model is generally available. That specific capability is not, it ships gated, behind split access rather than open to everyone. That decision is a precedent, and if you defend infrastru
Ruby を書いていると必ず出てくる「ブロック」と「yield」。 「処理を渡す」「渡された処理を実行する」 だけです。 メソッドに渡す「処理のかたまり（コードの切れ端）」 のこと。 { } か do...end で囲みます。 [1, 2, 3].each { |n| puts n } # └──────────┘ これがブロック .each に「各要素で puts n してね」という指示書を渡しています。 1 2 3 { } と do...end は同じもの。長いときは do...end を使うだけです。 [1, 2, 3].each do |n| puts n end メソッドの中の「yield と書いた場所」で、渡されたブロックを実行する命令。 def あいさつ puts "こんにちは" yield # ← ここで渡されたブロックを実行 puts "さようなら" end あいさつ { puts "元気ですか？" } こんにちは 元気ですか？ ← yield の場所にブロックが差し込まれる さようなら yield は好きな場所に置け、何回でも呼べ、値も渡せます。 def 数える y
A few months back I sat in a meeting where someone said, dead serious, "we should fine-tune the RAG." Nobody blinked. Everyone just nodded, the way you nod when a doctor says a Latin word and you'd rather die than ask what it means. Thing is, that sentence didn't mean anything. Fine-tuning and RAG aren't even the same species of tool. Nobody in the room knew that. Including, I'm pretty sure, the guy who said it. That's where we're at with AI right now. Everyone's using the words. Almost nobody k
The Question That Started It All "Hey Siri." "Okay Google." "Alexa." I kept asking myself: why? Your ears don't wait to be called to hear. Your brain doesn't wait to be called to remember. So why should AI? That question became Karl. What Karl Is No wake word. No button. Just presence. What it does: Listens in the background. Always. Remembers everything. Forever. Opens apps, makes calls, sets reminders. Privacy first. Everything stays local. No cloud. The idea: Your brain is for thinking. Karl
Entering the third week of my startup adventure has been a deeply rewarding time of solidifying foundations. Things come together to form an official brand, I put together tools to help with financial discipline, and I finished off the week by practicing my own Documentation-as-a-Contract (DaaC) framework. While I have an idea that I truly believe in and know exactly the components I need to build, I have been feeling excited about this venture before starting. But one question that would keep e
The Problem with Static Blocklists Malicious ads on Google Ads rarely land directly on a known bad domain. Instead, they route through a chain of redirects that rotates domains faster than blocklists can update. When attackers register a fresh domain, let it sit for a few hours, and then point users to it via a series of 302 redirects, even legitimate ad platforms can abuse this technique. Static blocklists fail because they only check the final destination. An attacker can create a new domain,
LinkedIn is going to be one of my direct integrations, if it's possible, so that I can write an article once and publish it on my own platform and do external distribution. Who has a non-svg logo available in 2026? I don't so I need to fix it. It would be easy to use some ad-ridden page to convert my svg-logo to a png for LinkedIn's consumption, but no, we're not doing that. We're doing it the only way we should, which is via cli. 1st we encountered an esoteric err: ffmpeg -i logo.svg -width 192
A developer runs pip install. Nothing crashes. No ransomware appears. No antivirus alert fires. Thirty seconds later, a Python process makes an outbound connection to infrastructure nobody on the team recognizes. Recent 2026 incidents show how quickly this can become a compromise. Malicious PyPI packages have been downloaded and executed by real systems, proving that developer workstations, CI pipelines, and security environments can themselves become targets. Typosquatting is an attack techniqu
I corrected the same Claude Code mistake more than five times. It never stuck. Then I replaced the correction with a 46-line shell script, and the mistake has not come back once. Some background: I started freelancing in college at around ¥100,000 a month, stacked side gigs until I reached ¥600,000, got laid off and dropped to zero, and spent the next six months building an autonomous Claude Code environment that now does ¥1.2 million a month in revenue. The single strongest lesson from that who
A step-by-step guide to pairing spec-driven development with stacked pull requests — from specify init all the way to a fully merged feature. AI coding agents are fast. Dangerously fast. Point an agent at a feature request and ten minutes later you're staring at a pull request with 180 changed files. Nobody reviews that. It sits for days, goes stale, and gets merged with a LGTM and a prayer. The fix is two tools working together: Spec Kit (specify) gives the agent structure — a spec, a plan, a t
In a simple probabilistic model, posterior inference sounds straightforward: observe some data, compute the posterior distribution over hidden variables, and use it to answer the question you care about. In complex models, that computation is often the hard part. The latent space may be high-dimensional, the posterior may have a complicated shape, and expectations under that posterior may be difficult to compute analytically. The practical question becomes: If the exact posterior is difficult to
FlatBB 0.1.70 (2026-09-09) turns community points into a first-class core feature — not a bolt-on plugin. Admins get one table for what each action pays: new topic, reply, like received, like given. You set how many times a day an action can pay a member, and whether the rule is on. Plugins can add their own rows. A post pays once, no matter how often it is edited or re-liked. The user menu shows the balance and a /points page with: this month’s earnings and spending history split into All / Ear
What happens when you stop treating your portfolio as just a website and start treating it as a searchable representation of yourself? Recently, I searched Google for: “Rishikumar Yadav Portfolio” The result was interesting. My existing portfolio appeared on the first page, along with multiple pieces of my online presence: Portfolio DEV.to article documenting the portfolio rebuild LinkedIn profile Images associated with my online presence This isn't a claim that I've "mastered SEO." It's simply
A backend engineer closed a laptop lid on a crowded commuter train and expected a local coding agent to keep working. The agent had been halfway through summarizing a public GitHub issue while a .env file sat two directories away. Local inference stopped the moment the kernel suspended the GPU, and a naive webhook to a hosted model would have uploaded the entire workspace. That gap between host sleep and unfinished public work is the actual design problem, not another routing slogan. Local-first
The table says 2,431 rows. You export it and get 50. Nothing errored. This is almost always virtualisation, and it is worth ten minutes of your time Rendering thousands of rows is slow, so grids render a window: the rows you can So at any moment the page contains fifty rows. Not fifty visible out of 2,431 Paste this into the DevTools console: const g = document.querySelector('[role="grid"],[role="treegrid"],table'); console.log({ claims: g.getAttribute('aria-rowcount'), inPage: g.querySelectorAl
The hard part of sharing an HR onboarding packet is proving what left the tenant. A watermark helps a support agent recognize an external copy, but it does not prove that the bytes were rendered from the approved template. For a US/EU SaaS, I would choose a Node.js PDF endpoint only after it can produce a signed receipt, a stable output hash, and a deletion record that survives a privacy review. Short answer: make the endpoint an evidence-producing job, not a file download. Render with a pinned
A coding-agent percentage remains marketing until protocol, canaries, and a cost ledger freeze beside it. Teams still quote a lonely pass rate as if that number could travel without a suitcase of hidden choices. Prompt text, tool allowlists, sandbox images, and grader prompts often move the score more than the model does. The honest unit of publication is therefore a registered protocol rather than a percentage standing alone on a slide. The protocol resembles a flight plan much more than a souv
Short answer: use the smallest realtime surface that can moderate a participant, then make reconnect, expiry, duplicate delivery, and authorization outcomes explicit in the test. For a property-management team sharing a stock-trading watchlist, that usually means treating the room as a state machine and reconciling by stable participant and event identifiers, rather than sleeping for an arbitrary number of milliseconds. The workflow is easy to describe and surprisingly easy to test badly. A brok
Multi-channel selling sounds simple on a slide: one product, listed everywhere, more customers. In practice, it's a distributed systems problem wearing a retail costume — multiple sources of truth, eventual consistency, third-party APIs with their own rate limits and quirks, and real money on the line when it goes wrong. Here's what actually breaks, and the patterns that hold up. The moment you list the same product on your own store, Amazon, and Etsy, you have three systems that each believe th
When I joined Synapsis Medical Technologies as the founding engineer, the roadmap was daunting: we needed to build a HealthTech AI platform that integrated wearable data, handled FHIR/HL7 standards, and maintained a HIPAA-aligned RAG pipeline with 99.9% uptime. To execute this, I had to scale the engineering team from 0 to 21 engineers in just 13 months. The standard industry approach to hiring—grinding candidates through LeetCode puzzles and red-black tree inversions—was never an option. We wer
We created 5,000 independent Kooboo websites from one fully dynamic site package, placed them on a small Tencent Cloud server, and sent 90,000 HTTPS requests from a separate Alibaba Cloud server across the public Internet. The Kooboo server had 2 vCPUs and 4 GB of memory. The load generator targeted 150 request starts per second for ten minutes, visited every hostname repeatedly, downloaded each complete HTML response, and verified that every response came from the correct numbered site. The res
A green check is a local fact. Merge is a promotion. If you let an agent-written diff jump from “tests passed on my laptop” to main, you skipped three decisions you still own: what was frozen, what CI re-ran, and what you will revert if the next hour is worse than the last. Copy the path below. Do not copy a feeling. You should not merge because a required check is green. You should merge because the patch survived a promotion sequence you can replay. That sequence has four stages. Each stage wr
What happens next is the pattern that shows up on almost every team that adopted agents seriously. Review turns into skim. The reviewer reads the PR description (written by the agent), checks that CI is green (on tests written by the agent, against a spec the agent summarized from the ticket it was handed), scrolls past the longest file because it's mostly generated boilerplate and approves. It looks like review. It's a signature. I'm not saying that to shame anyone, it's rational. Reading every
আপনার tour শেষ হয়ে গেছে এবং আপনি এখন বাড়িতে আছেন। আপনি বিকালে বসে বসে একটা জিনিস ভাবতে লাগলেন যে, অনেক কিছুই তো করলাম, এর মধ্যে এই এই কাজগুলো না করলেও হতো। আমার খরচটা একটু কমে যেত। যেমন ধরুন, flight-এর ticket না কেটে bus-এ করে গেলেই হতো, খরচ কমে যেত। আবার বড় কোনো 5 star hotel-এ না উঠে, ছোটখাটো normal একটা hotel-এ উঠলেই হতো, খরচ অনেক কমে যেত। কিছু কি relate করতে পারছেন? একটু কষ্ট হচ্ছে। আসুন অন্য একটা বিষয় নিয়ে কথা বলি। আপনি যখন backend নিয়ে কাজ করছেন তখন microservice নিয়ে আপনার মোটামুটি idea হয়ে
The Problem: The Modern Internet Feels Exhausting If you spend any significant time on mainstream social platforms today, you've likely felt the fatigue. Most modern platforms are tuned around a single metric: maximizing screen time at any psychological cost. Their algorithms deliberately amplify sensationalism, outrage, and polarizing debates because rage drives engagement. Meanwhile, genuine discussions get buried under bot farms, aggressive advertising, and synthetic noise. As an independent
The most expensive bug in the game I just shipped could only fire on 1.01% of rounds. Here is the shape of it. Replay is a betting game where the final score is public before you bet — the game ended 8–5, and what you buy is which of the 1,287 orderings of those 13 points actually happened. It runs on a casino platform whose host contract caps what a game may pay out: maxAllowedPayout = escrowedStake + reservedProfit Zero slack. The game quotes its own numbers up front — quoteCaps declares how m
A mid-size Python CLI received an issue that empty HTTP_PROXY values were now being sent to child processes as blank strings. A well-meaning contributor asked a coding model for a patch and received a thirty-line rewrite of the process launcher. The pull request looked clean in the diffstat, yet it also changed timeout handling that had been stable since the v3.2.0 tag. Maintainers closed the PR after a reviewer traced the real regression to a one-line defaulting change in a logging helper. That
Short answer: send structured log events from the NestJS custom logger to a backend API asynchronously, give every event a correlation ID that survives the pricing request and its downstream work, and page only on a symptom that the team can reconstruct from those events. For a gaming price-rule rollout, the decisive test isn't whether a dashboard looks healthy; it is whether one affected purchase can be traced from flag evaluation to the price shown and the result returned. The operational reco
Emulators are one of the best things to happen to mobile development. They are fast, cheap, scriptable, and easy to reset. For a lot of development work, they are exactly what you should use first. But most mobile teams eventually hit a class of bugs where emulator-only testing stops being convincing. The failure may not be in the app logic. It may be in device state, permissions, OS behavior, screen configuration, hardware assumptions, network state, or the messy handoff between a support repor
Most "AI integration" content falls into one of two camps: breathless hype about transforming your business overnight, or dense academic papers about model architecture. Neither helps you decide whether the customer support ticket triage your team keeps complaining about is actually a good candidate for machine learning, or whether you'd be better off writing forty lines of regex. This is a framework for making that call, and for integrating ML into a system that already works without breaking i
Realtime Room Teardown Explained for Python Team Presence Sidebars in 5 Steps Use a realtime API with explicit room teardown and recovery rules for a Python team presence sidebar; the deciding constraint is presence accuracy after a disconnect, not the first successful connection. A sidebar that looks right at 10:00 can still show a departed editor at 10:05 if the client and server disagree about who owns a room. I build RAG and agent features, so I treat this like an eval problem: define the st
React 19.3 shipped on npm on September 9, 2026. It doesn't introduce a pile of brand new concepts. Mostly, it takes two features that were "experimental" for the last year and makes them official, plus adds a handful of smaller but genuinely useful fixes. View Transitions are stable: wrap something in <ViewTransition> and React animates it in, out, or across the page. Fragment Refs are stable: get a ref-like handle on a group of elements, even when there's no single wrapping element. browser():
Every popular rule in Chinese retail trading has a cousin in English: a big up day on strong volume continues; a big up day on weak volume fails. In A-shares it is usually phrased as 量价配合 — price and volume must agree. I wanted to know if it survives contact with real data. So I pulled daily bars for 584 liquid Shanghai/Shenzhen names from free public endpoints (no API key, no paid vendor), built 15,900 stock-days, and conditioned the next day's return on today's move and today's volume ratio. T
Hey everyone, I’m still a beginner and I just joined the community. I’ve been trying to learn more about AI engineering, but I’m still a little confused about what the field actually covers. I keep seeing things like RAG, LoRA, fine-tuning, LLMs, and so on. Are those basically the main areas of AI engineering, or are they just parts of a much bigger field? I figured I’d ask before I go too deep, so I’d appreciate any advice on what’s actually worth learning first. I’m also really into low-level
If you've ever built an application that integrates with multiple LLM providers (Anthropic, Google, OpenAI, DeepSeek), you already know the pain: Each provider has its own distinct Python SDK. Streaming responses using Server-Sent Events (SSE) requires divergent parser logic. Thinking / Reasoning blocks are formatted completely differently. I recently extracted the core streaming router from my platform into an open-source FastAPI template. Here is how it works. A single asynchronous endpoint: P
Disclosure: Software Sausage is our product. Agency Agents did not sponsor, review, or endorse this article. AI tools helped draft and edit it; the evidence boundary is stated below. The Agency Agents repository is difficult to ignore: 264 specialized agent definitions, broad coding-harness support, and—when I reviewed it on September 9, 2026—roughly 151,000 GitHub stars. The tempting conclusion is that a larger virtual team produces better work. The repository does not establish that. What it d
Short answer: assign the authentication team ownership of the login OTP contract, keep the marketplace team responsible for new-order messages, and compare SMS and email using verified-code outcomes rather than send or open events. That boundary keeps a seller's two-factor login safe when the order-notification copy changes, and it gives US and EU rollout decisions a measurable trail. The operational constraint is template ownership. A seller can receive an order alert and a login code within th
Quick Answer AI Orchestration for Enterprise .NET Applications: AI orchestration adds a disciplined layer to .NET apps, coordinating agents, caching, state, and compliance to reduce latency, cost, and hallucinations. In many .NET shops the first step to “add AI” is to fire a single HttpClient request from a Razor page. That works for a handful of users, but as traffic grows the pattern quickly turns into a latency, cost, and reliability nightmare. The root cause isn’t the LLM – it’s the absence
🚀 Why Traditional GitHub Trending Falls Short for AI Engineers If you build with AI coding agents (Claude Code, Cursor, Codex, Antigravity), you’ve probably noticed a major blind spot in developer tooling: discovery. GitHub's native trending feed is useful, but: It ignores velocity dynamics: A repo with 50 stars gaining 40/day is moving faster than a 100k repo gaining 5, but gets buried. No taxonomy for the Agent Ecosystem: There’s no native way to filter specifically for Model Context Protocol
When Cleanup Resets the Retry Budget A retry limiter can record an attempt correctly and still lose control before the next call. An Orca recovery-module experiment exposed the reason: display cleanup erased a terminal's recovery history while that terminal remained eligible for another remount. The useful review target is the cleanup predicate. Adapted from the complete English research article. Orca is a desktop tool for organizing terminals and Agent work. PR #19745 describes a Windows crash
Over at I-Dacs Labs, we run high-throughput telemetry pipelines on edge devices (Raspberry Pis, Advantech gateways, and embedded x86/ARM boxes). We've been using LF Edge eKuiper for local stream processing (SQL filtering, sliding windows, and MQTT/Kafka sinks), but kept hitting the classic edge computing wall: JVM engines (Apache Flink): Incredible throughput, but require >1 GB RAM and take 20+ seconds to boot. Unusable on small industrial hardware. Go engines (Upstream eKuiper, Benthos, Telegra
⚡ FlowGit: The Ultimate Visual Git Client — Full Architectural & Feature Deep Dive "Visual First – Zero Terminal Friction – No-Fear Git" Lõi Rust Native • Đồ Thị 60 FPS • Kéo Thả Rebase • Thùng Rác 48h Chống Mất Mã Nguồn For years, developers have been forced to choose between two extremes: The Terminal CLI: Infinite power, but terrifying syntax, high cognitive load, zero visual intuition, and constant fear of fat-fingering an irreversible git reset --hard. Existing GUI Clients: Either clunky, s
Many planning tools begin with sign-up, cloud storage, and collaboration features. For a moving checklist, I wanted to test a narrower idea: can a useful planning tool work without requiring an account? MovePlaybook is a browser-based moving checklist. A user starts with a move date, reviews a generated task plan, adjusts tasks when circumstances change, and can print or save the plan as a PDF. The technical constraint was privacy: the product should remain useful even when the plan is stored lo
The decision The partition function separates the array into the elements that satisfy the condition from those that do not docs. The filter function iterates over an array and applies an expression that returns matching values docs. Both scripts compute the task to split payload.records into accepted ids and rejected records with a reason, plus a retry count, by an email match. The partition once approach uses the import line import * from dw::core::Arrays. %dw 2.0 import * from dw::core::Array
Short answer: put a small, explicit quota boundary in front of every realtime connection, make reconnect and backfill consume a separate budget, and measure freshness rather than WebSocket count. For a live auction dashboard, this keeps a reconnect storm from starving the bids, typing indicators, and read receipts that operators actually need. The page that wakes the on-call engineer is usually not the page they needed. It says realtime_connections > 50,000 or reports a spike of HTTP 429 respons
A strange thing happened when fal made H3 Max faster than realtime. The obvious benchmark story was: a 5-second video can render in under 3 seconds. The more interesting story is what developers started building once generation became faster than playback. They built television. Fal engineer Rehan Sheikh connected H3 Max to a livestream inspired by the "interdimensional cable" idea from Rick and Morty. The important technical property was simple: generation time < playback time If the system can
I spent forty-eight hours convinced a worker was deadlocked, because the remote log never showed the first print. Have you ever rerun the same Python file on your laptop and watched it chatter, then watched a server swallow every line? That gap is easy to blame on locks, agents, or a hung HTTP client that never returns. The quieter explanation is that CPython block-buffers stdout whenever the stream is not attached to a TTY. The job was a small batch script, not a service, and it was supposed to
I ship a bunch of small free tools, and last week I wanted a quick way to double-check what robots.txt a site was actually serving to crawlers — not what's sitting in the repo, what's actually on the wire. Turns out those aren't always the same thing. Cloudflare has a feature called AI Crawl Control that can rewrite robots.txt at the edge — inject its own rules for AI crawlers — without touching your origin file at all. If you're only ever checking the file in your repo (or your CMS, or wherever
Deep Learning and Transformers Artificial intelligence is often introduced with phrases like: “Neural networks imitate the human brain.” That analogy can be useful, but if you come from physics, mathematics, engineering, or scientific computing, there is another way to think about modern AI that may feel much more natural. A neural network is fundamentally a parameterized mathematical transformation. Training that network is an optimization problem in a very high-dimensional space. And the atten
OpenAI Cracks a Million-Dollar Math Problem — and the Credit Fight Starts Immediately Today's biggest AI story isn't really about the breakthrough itself — it's about who gets to claim it. OpenAI announced that an unreleased internal model, one the company describes as "significantly more capable" than its just-launched flagship, has produced a proof solving Navier-Stokes, one of mathematics' seven Millennium Prize problems and the equation set that governs how fluids flow. The company says it t
AI coding giúp viết code nhanh hơn, nhưng số PR mở ra cũng nhiều hơn trong khi số người review vẫn vậy. Kết quả: review — chứ không phải viết code — mới là nút thắt cổ chai mới. Open-PR ra đời từ đó — một AI agent mã nguồn mở chuyên review Pull Request, chạy thẳng trong các agent CLI quen thuộc (Claude Code, Cursor, Codex, Gemini CLI, Antigravity) thay vì một dịch vụ SaaS hay bot account riêng: Developer mở PR → AI review vòng đầu → người review quyết định cuối cùng → merge. Đã có khá nhiều AI a
I have been running a long series of experiments on whether small models can be made to behave usefully, and one obvious thing to borrow is whatever TinyStories did. That paper trained very small transformers to write coherent children's stories, and the detail everyone remembers is the vocabulary: roughly 1,500 words. An earlier experiment of mine had already varied the domain at a fixed vocabulary, restricting a corpus to a single arXiv category, and found a real win: +3.7 points of top-1, per
Building an investing knowledge graph, part 6: if you're merging data from more than one source, you'll hit this Since part 5 went up, I've had two conversations worth writing about. One was with someone building a financial news aggregation system who wanted to know if the ER setup here would work for their case. The other was with someone doing KYC screening who asked roughly the same question. Those conversations are what prompted this final part. The financial news question had an obvious an
It's 11 PM. You've solved forty LeetCode mediums this month. Your GitHub has a shiny new Airflow project with green checkmarks all the way down. Tomorrow's interview feels like a formality. Then the interviewer shares their screen, pulls up a query that's been quietly timing out in production for three days, and says: "Walk me through how you'd find out why." Your mind goes blank. Not because you don't know SQL. Because nobody told you this was the interview. Here are the hard truths that would
Apple Pay and Google Pay have a nasty failure mode: when something breaks, the problem may not be obvious from your normal WooCommerce logs. A shopper can tap a wallet button, attempt payment, and still fail to complete an order without leaving you with an obvious explanation of what went wrong. From the store owner's side, the symptom may simply look like slightly worse conversion. I went through public WooCommerce support threads for two major gateway plugins — woocommerce-paypal-payments and
Roughly half the recurring work that owners ask me to automate is output nobody uses. Not badly-made output. Not output that needs a better format or a nicer dashboard. Output that no human being reads, acts on, or would miss if it vanished. The daily sales summary that goes to a WhatsApp group where the last reply was months ago. The weekly stock report emailed to a partner who checks the actual stock by walking into the godown. The monthly MIS deck assembled by an accountant over two full days
I spent the better part of last month debugging a scraper that had been running fine for almost a year. The symptom was familiar: requests started returning 403s, then CAPTCHAs, then nothing at all. I did what I always did. I added more IPs to the pool. I shortened the rotation interval. I swapped out the proxy provider entirely. It didn't help. That's when I realized the thing doing the blocking had changed what it was looking at. And my architecture was built for a problem that no longer exist
Deterministic Sub-Second Python and Bash Execution, Zero-Trust gVisor Isolation, and Zero Idle Cost While secure sandboxes are pivotal for running Generative AI-generated code safely, connecting Google Cloud Run Sandboxes (gVisor) directly to Google Apps Script unlocks a vastly broader horizon. Beyond executing AI-drafted scripts on the fly, this complementary architecture empowers Google Workspace with deterministic Python data science (Pandas, Seaborn) and Bash execution in 200–450 ms. With ze
Android 加固真正难的不是“能不能加密”，而是能不能让开发者放心用 很多 Android 开发者第一次选择 APK 加固工具时，关注的通常是几个关键词： DEX 加密、VMP、SO 加固、反调试、反 Hook、RASP。 但真正把加固工具放进生产环境之后，你会发现： 加固能力只是第一关，真正决定一个工具能不能长期使用的，是稳定性、性能、可控性和开发体验。 这也是我最近比较关注 XopProtector 的原因。 很多人理解的 APK 加固流程很简单： APK → 加固 → APK 但真实项目通常是： 开发 ↓ 编译 ↓ 测试 ↓ CI/CD ↓ 加固 ↓ 签名 ↓ 发布 ↓ 线上运行 如果加固工具只是“能把 APK 加密”，但每次发布都需要复杂的人工操作，那么它很难真正融入现代 Android 项目。 XopProtector 的思路比较接近一个完整的 Build-time Protection Pipeline。 它提供 JVM Packer，同时提供 CLI 和 Windows 桌面工具，可以把加固流程放到开发机或者 CI/CD 中。 这意味着加固不一定是发布前最后一步的“黑
You draw a grass tile. You draw a dirt tile. Then you try to put a dirt path on the grass and realize the two tiles do not meet: you also need every edge, every inner corner, every outer corner, the one-tile-wide path and the single island. Counted properly, that is 47 tiles per terrain pair. Draw them by hand once and you will not want to do it for the second pair. So I built a tool that generates the full set from the two source tiles: 47-Tile Terrain Autotile Maker. Free, no sign-up, and noth
BoltOS: a from-scratch 64-bit operating system I built BoltOS as a 64-bit operating system in C and x86-64 assembly, starting with the boot chain rather than an existing kernel or bootloader. It supports both legacy BIOS and UEFI boot paths—no GRUB, no Multiboot, and no external OS libraries. This is an active project with roughly 41,000 lines of first-party code. I am sharing it to get feedback from people interested in operating systems, systems programming, and bare-metal development. A custo
A user can be blocked from a sensitive column and still receive sensitive information derived from data they are allowed to access. That changes the authorization problem for enterprise data agents. Traditional access control asks: Can this user read this database object? An AI analytics system also needs to ask: Is this user allowed to receive what the system can infer from those objects? Consider a simple example. A user cannot access: employee.salary But the same user can access: department.t
For twelve days, every scheduled job fired, every commit gate passed, and the label on the front of our post queue drifted from 24 hours behind reality to 74. Nothing was broken. One field was being read two different ways, and no instrument compared the readings. Our agent posts to Bluesky five times a day from a queue file, content/posts-drafts/stock.jsonl. Each row carries a plannedFor timestamp. On 2026-09-06 the first row in that file said 2026-09-03T06:00:00+09:00, and it was 08:00 on the
Google has completed its August 2026 spam update, a global, multilingual change to the systems it uses to detect spam and filter Search results. The rollout began on August 18 at 09:28 Pacific Time and finished on August 21 at 01:49 Pacific Time, according to Google’s official incident report for the August 2026 spam update. For website owners seeing sudden visibility changes, the key point is that Google described this as a normal spam update, not a new set of spam policies. That distinction ma
Your venv is activated and IntelliSense resolves everything, but the terminal runs a different Python. Here's why VS Code tracks two separate Pythons, and the real fix. Adapted from the VS Code Essentials Companion Guide. You created a virtual environment, activated it, installed your packages — and VS Code still can't find them. Or the opposite: IntelliSense recognizes everything perfectly, but running the file in the terminal throws ModuleNotFoundError for a package you know is installed. Eith
The vanna-ai/vanna repository was archived by its owner on 29 March 2026. 23.8k stars, read-only, no pinned explanation that I could find. I'm not going to speculate about why - that's the maintainers' business, and a lot of people got real value out of it for free. What I do want to write down is what archiving actually costs you if it's in your stack, because "it still works" is true right up until it isn't. Your pinned version keeps working. Nothing breaks today. What stops is everything arou
Illustration generated for this article. Every prop is a finding: the sack of blank name badges is the Faker persona namespace, the rubber stamp is the inert tracking parameter, the three coins are the break-even, and the red yarn connects nothing because attribution failed. TL;DR — A spam comment on my article led to a TinyURL, a throwaway .store domain, and finally a legitimate SaaS product with an affiliate code stapled to it. No malware, no cloaking, no exploit. The account that posted it ha
Note: This is my first ever blog post, so my apologies in advance if it's not up to par. Also, since this is my first post, I decided to not use any AI for polishing, etc., so that the reader can get a better feel for who I am as a writer. The purpose of this blog post is to document my journey, as a current non-professional or hobbyist, into the world of Artificial Intelligence, more specifically, into Machine Learning. This journey includes a learning phase, where I both learn the concepts and
I put autoMode in .claude/settings.json, committed it, and it had no effect. The JSON was valid. Startup printed no warning. --debug said nothing. I spent that key does not apply from that file. Claude Code's settings reference has a column I had never read carefully. Every Any file 152 keys Managed 39 keys only from managed settings User or managed 23 keys ~/.claude/settings.json, or managed User, local, or managed 3 keys settings.local.json but not settings.json Global config 6 keys ~/.claude.
When Managing AI Conversations Becomes More Work Than Using AI AI is supposed to reduce busywork. But after using AI seriously for a while, I noticed something strange: I was creating a new kind of busywork just to manage my AI conversations. A useful answer appears in ChatGPT. I copy it into Notion. Claude gives me a better explanation of an important decision. I copy that too. Another conversation contains something I might need later, so I create a page for it, give it a title, choose a folde
Update — v0.2.0 released. CauterRule is now live on GitHub and PyPI. It turns repeated agent failures into permanent standing rules — extract, replay-test, promote. pip install cauterule gives you the full CLI, TUI review, observability, 7 export formats, adversarial corpora, and a bundled git rule pack. The field test report evaluated 4 models across 745 trajectories and is the source for every number in this article. Release notes · Changelog CauterRule is an open-source sidecar that learns st
A veces uno se vuelve monotemático con ciertos asuntos. Le da vueltas y vueltas al mismo tema, no porque quiera insistir por insistir, sino porque el tema mismo vuelve a aparecer una y otra vez. En mi caso, ese tema recurrente es la soberanía digital: la idea de que las empresas y los países deberían poder usar su propia inteligencia artificial, entrenada por ellos mismos, en lugar de depender siempre de los grandes laboratorios que hoy dominan el mercado. Existen ya muchos modelos de este tipo,
Green CI from an agent is not a merge signal. It is a claim: "I ran something and it exited zero." Your job is to check whether that claim covers the bug, the intent, and the failure modes you care about. I treat "tests pass" as the start of a short verification sequence — not the end of review. Open the file list first. Ignore the agent's narrative until you can answer: Which files actually changed? Do they match the human intent in one sentence? Any lockfiles, renames, config, or test fixtures
Most explanations of these concepts stop at the definition. Scope gets a rule about hoisting. Closures get a counter function that increments a number nobody would ever ship. The event loop gets a diagram. any versus unknown gets a one-line rule. Generics get a toy example with numbers and strings that never shows up in a real codebase. That's enough to answer a question in an interview. It's not enough to actually recognize these patterns when they show up in your own code, which is the thing t
AI makes it dangerously easy to build the wrong thing. I can point agents at a problem and have a mountain of code before I have proven the idea underneath it. So before I build too much, I try to kill the idea first. Not the whole project. The claim hiding inside the decision. Most decisions are secretly a bet that something is true. Name the bet out loud and you can test it. If I think we need a bigger model, that is not just a preference. It is a claim that the failure is caused by insufficie
Come to check the locks, and leave holding the keys. Slip in through the gap, take the host's seat, step by step. Make the Host and the Guest Exchange Roles Previously on this series: #3: Lena Walked Into an AI Deal. She Walked Out With Three Borrowed Knives. — Lena stopped a bad AI purchase with three borrowed knives. When it was over, a thought followed her out: what if she didn't just stop a wrong purchase? What if she chose her own opponent? She opened her notebook and wrote down a company n
E se você pudesse construir uma aplicação orientada a conteúdo sem passar horas criando um backend apenas para gerenciar alguns dados? Essa é a ideia por trás do Bando CMS. Criei o Bando como um headless CMS open source, self-hosted e TypeScript-first, pensado para developers que querem construir aplicações mais rapidamente mantendo o controle sobre seus conteúdos e infraestrutura. Imagine que você está construindo: Um blog Um site para um cliente Uma plataforma de documentação Um site instituci
The $1 Fix That Prevented Data Leakage While auditing Dify (an open-source AI platform), I found a one-line bug in the The original code: # Vulnerable: no quote escaping line = ",".join(str(cell) for cell in row) A malicious cell value like "evil","data would break out of the CSV # Fixed: use csv module for proper escaping import csv import io output = io.StringIO() writer = csv.writer(output) writer.writerow(row) line = output.getvalue() CSV injection (also called formula injection) is a common
The short version replay means four different things in our codebase. Here they are up front: # What it is Entry point Re-executes? Cost 1 Evidence replay GET /api/v1/observe/runs/{run_id}/replay No One database read 2 Catch-up after a dropped connection GET /api/v1/runs/{run_id}/stream?last_event_id=... No One database read, then resubscribe 3 Idempotent replay of a tool call Inside the tool gateway, same idempotency key arriving twice No — returns last time's result One database read 4 Actual
In the early stages of building a production AI system, developers often treat Large Language Model (LLM) tokens like an infinite resource. During the prototyping phase, a few thousand extra tokens in a prompt seem negligible. But as I transitioned systems from proof-of-concept to production environments—specifically within the rigorous demands of HealthTech—I realized that tokens are not just a billing line item. They are a hard architectural constraint, as definitive as memory limits in an emb
Hi! I made tetris with powerups that runs fully in your terminal. To try it out, just generate an SSH key ssh-keygen if you don't already have one, then ssh into the server. Your SSH key is your identity; no account is required. ssh [email protected] If you want to play offline, you can also download from GitHub Releases. It is recommended to use a Nerd Font so that all text renders correctly. Star my repo if you liked the game :D My friends challenged me to make a "text-based ga
The DevOps bootcamp · Chapter 1 of 14 · DevOps · new chapter every Thursday morning By the end of this chapter: Get an accurate map of the territory before learning any tool. If you learn the tools of DevOps without understanding the system they are trying to build, you will end up doing manual operations with more complicated software. You will write a Terraform script, then execute it manually from your laptop. You will build a Docker container, then manually SSH into a server to pull and run
I lost most of a day to a bug that never once failed. I was building a contract that pays for its own future: an access subscription that re-arms Code: github.com/edycutjong/retainer · live: retainer.edycu.dev I deployed the contract with 8 HBAR of constructor value. HashScan showed the contract holding gasReserve read zero. Money plainly there, booked nowhere. A payable constructor that receives funds and records none Hedera has two denominations for the same money: tinybar (1 HBAR = 1e8) and w
I recently built a Hotel Billing Programme in Python as part of my Python learning journey. The goal was simple: take guest information and use Python to calculate individual bills, taxes, final bills, the overall grand total, and average billing. Lists Dictionaries Lists of dictionaries for loops Dictionary access and modification Arithmetic operations Variables and assignments round() len() Accumulation and aggregation Working with floating-point values One thing I particularly liked about thi
When a setting changes unexpectedly, engineers need three answers: what changed, who changed it, and what was there before? Recent investigations and older compliance queries have different latency and cost needs. This article presents a generic design using two short-lived online tables and a long-term warehouse. The examples are fictional and the numbers illustrative. Assume a service manages project settings. The common request is “show the latest changes to this project, then let me inspect
The Hidden World of SFPU Rounding In my work on tt-metal (Tenstorrent's ML framework), I encountered a subtle but critical bug in the SFPU (SFPU = Tensor Processing Unit math unit) that caused intermediate overflow in floating-point computation chains. Here's what I found. The SFPU (StochaSTic Processing Unit, or more likely the hardware math unit) handles transcendental functions like exp, log, and softplus on Tenstorrent chips. These functions use polynomial or rational approximations because
Choosing a Mature Library Over Custom Security Code Last week I submitted a PR to pytorch/torchtitan adding SSRF protection to the image decoder URL fetcher. My initial approach was a full custom implementation — resolving DNS, validating each IP against private/loopback/link-local ranges, manually following redirects with per-hop validation, all bounded to 10 hops. It worked. But a maintainer (@shuhuayu) gave direct feedback: "titan should not re-implement these safety guards — delegate to a ma
A trafficking template copies last quarter's instream tag, changes one field to pause inventory, and ships. The VAST response validates. The buyer's filter reads plcmt=5 and playbackmethod=1 in the same <Extension> block and treats the impression as a generic instream spot with sound on, not a pause placement with its own playback semantics. Nothing throws a player error because both values are integers inside AdCOM's allowed ranges. The failure is semantic: two signals that were supposed to des
The word was qara, "black". I fed it to an off-the-shelf TTS model, hit play, and got back a soft, polite, very Turkish kara. In Crimean Tatar къ and к are two separate sounds, and къ sits inside words we say every day: yoq, qız, vaqıt, qadar. Getting it wrong is not an accent. It is the model quietly speaking a neighbouring language and hoping nobody notices. I noticed. That one syllable is why I spent the next several months building speech models for Crimean Tatar on a single consumer GPU, in
An MCP server exposes tools. It does not repair an API that leaves side effects, retries, data limits, and recovery ambiguous. Use this checklist before exposing an endpoint to an agent. Every tool should identify one effect: read, draft, state_change, or irreversible_action. The calling layer, not the model, should enforce approval for consequential effects. { "name": "cancel_delivery", "effect": "state_change", "approval_required": true, "idempotency_key_required": true, "dry_run_supported": t
A lightweight, self-hosted alternative for side projects and early-stage startups. Most early-stage products have the same blind spot: users leave, but you don’t know where they got stuck. The obvious fix is session replay-until a simple debugging tool becomes another growing SaaS bill based on traffic, seats, and recorded sessions. I built TraceUX for the stage before enterprise analytics: side projects, small teams, and startups that need answers without another huge recurring cost. TraceUX re
The pitch writes itself. You have an LLM doing risky things across your systems, so you add another LLM to watch it: a guard model reads each request, returns "safe" or "unsafe," you gate on that. Every AI security demo works this way. We built the opposite. Aggrete governs what AI assistants can do across HR, finance, Slack and code, and there is deliberately no model in the decision path. Every allow and every deny is a deterministic rule. Here is why, with the examples that settled it. A guar
OpenAI has publicly outlined Defense Factory, a continuous, agent-first security operation designed to find, validate, and fix vulnerabilities across its own systems. The initiative grew from an internal security sprint in which OpenAI says it mobilized more than 250 people across hundreds of service areas with the urgency normally associated with incident response. Its importance is not the scale alone. OpenAI is presenting security work as a repeatable operating cycle rather than a periodic re
Short answer: treat a phone verification attempt as one trace that spans send, delivery, and verify, then make every transition auditable before you tune a provider or retry policy. I build tools for developers, so my first question is usually boring: can I explain one failed attempt from a single request ID? If the answer is no, the system is not ready for an audit. A player saying “the code never arrived” is not a useful diagnostic fact. It could mean the send request was rejected, the message
À trois semaines de l'échéance du 30 septembre, beaucoup d'équipes de l'UEMOA écrivent du code de paiement dans l'urgence. La BCEAO a reporté à cette date la connexion à la plateforme PI-SPI pour les banques, les établissements de monnaie électronique et les établissements de paiement. Fin juin, 80 participants étaient connectés et 74 institutions encore en phase de test réel. Le Sénégal mène l'Union avec 20 institutions autorisées au 2 avril. PI-SPI règle l'interopérabilité entre institutions.
Three parties describe the same roof and none of them can read the others' description. The town assessor's record says asphalt shingle, average condition, year built 1962. A vision model looking at a satellite tile and a street-level photo says gable, moderate pitch, two planes, one chimney interrupting the north field. An estimator standing in the driveway says twenty-two squares, stick-framed, ring-shank sheathing nails, probably plywood over the original boards. All three are describing one
Google Analytics 4 has added a native way to identify traffic from recognized AI assistants. From May 13, 2026, GA4's Default Channel Group includes an AI Assistant channel, giving qualifying visits a dedicated medium, channel grouping and campaign value. The change makes it easier for marketers to see traffic from tools such as ChatGPT, Gemini, Deepseek, Copilot and Grok in standard acquisition reporting, rather than relying solely on custom rules. The new classification is important because AI
Microsoft published the rare thing in this space: a first-party, attributed throughput number for AI code review. PRAssistant ran across 5,000 internal repos, covered 90%+ of PRs and 600K+ pull requests a month, and measured a 10–20% median improvement in PR completion time. Then it shipped externally as GitHub Copilot code review. That's worth slowing down on, because "median PR completion time" does real work in that sentence and people keep reading past it. What that metric captures is a thro
A "45% faster PR review" number is a great headline. The question is whether it means anything, because the post announcing it gives you no way to check. Atlassian's blog says Rovo Dev, their AI code reviewer, cut PR cycle time by up to 45% internally and 32% for customers. That's it. No methodology, no baseline definition, no sample, no how-the-slices-were-chosen. Just a number and a graph. That's not a knock on the product. It's a gap in the evidence. And the gap is exactly where this claim go
You wire up a search index, add your documents, type a query you know should match... and get zero results. The document is right there. The word is right there. What gives? Nine times out of ten the answer is the analyzer — the small pipeline that decides how text becomes searchable tokens. It runs when you index and when you query, and if the two sides don't agree on what a "word" is, nothing matches. Whoosh is a pure-Python full-text search library (pip install whoosh3), and one of its quietl
If you want the Rails implementation version of this, Webhooks in Rails goes deeper on verification, durable receipt, idempotency, retries, jobs, testing, and provider-specific behavior, and includes an Agent Companion for repo-aware coding agents. Already have webhook code in an existing Rails application? The free Webhook Architecture Checkup is a repo-aware prompt for tracing the flow you already have and finding the important gaps. Webhook endpoints always seem simple when you build the firs
Moustaqim est une plateforme islamique multilingue qui rassemble l'essentiel en un seul endroit : le Coran avec ses traductions, les horaires de prière, une grande base de prénoms musulmans, une encyclopédie de hadiths et un dictionnaire islamique. La racine du site sert la version française, et un portail anglais complète l'ensemble pour les lecteurs anglophones. Le Coran : chaque sourate en arabe avec traductions, pensé pour une lecture confortable sur ordinateur comme sur mobile. Les horaires