This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . Project Overview I am building a browser-based text removal workspace where a user uploads an image, paints over unwanted text or objects, and sends the resulting mask to an image-editing pipeline. The mask editor uses three stacked <canvas> elements: a base canvas for the uploaded image; an overlay canvas for the painted mask; a cursor canvas for the brush preview and pointer events. All three canvases must have identical dimensions. The pointer coordinates must also map back to the same bitmap coordinate system, or the generated mask will not match the part of the image the user selected. Bug Fix On desktop, the editor had plenty of horizontal space but the uploaded image appeared inside a narrow strip surrounded by a large empty area. The result preview used the available width correctly, so the two sides of the same workspace looked unrelated. The visible symptom was a tiny image editor. The actual failure started before the image was drawn. The initialization code measured the width of the canvas wrapper: const container = canvas . parentElement if ( ! container ) return const containerWidth = container . clientWidth || 1 const containerHeight = 600 It then calculated the largest canvas size that would preserve the uploaded image's aspect ratio: const imgAspectRatio = img . width / img . height const containerAspectRatio = containerWidth / containerHeight let canvasWidth : number let canvasHeight : number if ( imgAspectRatio > containerAspectRatio ) { canvasWidth = containerWidth canvasHeight = containerWidth / imgAspectRatio } else { canvasHeight = containerHeight canvasWidth = containerHeight * imgAspectRatio } The aspect-ratio calculation was correct. The measurement it received was not. Root Cause: The Canvas Measured Itself The wrapper was a relatively positioned element with no declared width: < div className = "relative transition-all duration-500 ease-out" style = { {

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. A fundamental flaw leaves LLMs strikingly vulnerable to attack It is impossible to make large language models fully secure against hacks because of a fundamental flaw in how they work, a…

I recently read an article by the main maintainer of InversifyJS describing the journey of rebuilding its dependency resolution algorithm . What caught my attention wasn't the performance improvements or the technical details. It was something much more familiar. As I was reading, I realized they were experiencing the exact same phenomenon I had experienced years ago while creating InversifyJS. It reminded me of something that, until now, I had never really put into words. The temptation to solve the hardest problem first Every engineer has experienced it. You're implementing a feature when you encounter a design problem that feels wrong. You know the current approach won't scale, and you know there must be a beautiful abstraction somewhere, so you stop writing code and start designing. Sometimes that's the right thing to do. Many times it isn't. While building InversifyJS, I eventually adopted a different habit. Whenever I found myself thinking, "This feels too complicated, and I can't find a simple, elegant solution right now," I decided to wait. Not because I ignored the problem, but because I didn't think I understood it well enough yet. Instead, I focused on features where I had a reasonable level of confidence. I kept improving the parts of the system that felt obvious, leaving the difficult problems untouched. At first, this almost felt irresponsible. Over time, it became one of the most valuable engineering lessons I have learned. The magic wasn't finding the solution The interesting part is that I rarely came back later with a better idea. Something stranger happened. Implementing those simpler features changed the system itself. New abstractions naturally appeared. Responsibilities became clearer. Concepts that previously seemed unrelated suddenly fit together. Eventually, I would return to the "hard" problem only to discover it wasn't hard anymore. Not because I had become smarter or because inspiration had struck overnight. The problem itself had changed

Use one key prefix per user, delete from the application every key you can name, and leave lifecycle rules to sweep the old temporary images nobody will ever ask for again. That's the whole design, and I've watched teams get it wrong in the same two ways for years: they either try to make the storage layer clever enough to know what a user is, or they hand the entire deletion problem to a lifecycle policy and then wonder why an account-deletion request took nine days to actually remove anything. I design data layers for a living, so I'm going to be blunt about the durability and consistency side of this rather than the upload-a-file-in-five-minutes side. Why the key layout matters more than the backend you pick Object storage has no folders. There's a flat keyspace and a delimiter convention, and every "folder" you see in a console is the UI grouping keys that share a prefix — which is good news, because it means the layout is yours to design and costs nothing to enforce. The layout I keep landing on is users/{userId}/generations/{yyyy-mm}/{uuid}.png , with a sibling users/{userId}/scratch/ prefix for renders that only exist so the browser can show a preview. Four properties come out of that shape, and they're the reason I don't get creative here. Listing a tenant's images is a single prefix query rather than a metadata scan, which matters because object stores generally don't let you search metadata server-side — you filter by prefix or you keep an index in your own database. Deleting an account becomes "enumerate one prefix, delete what's under it," so the compliance clock is something you control. The month segment keeps any single listing page from growing without bound, and it gives you a cheap way to write an age-based rule later. And the opaque UUID means the key never leaks a filename, a prompt, or an email address into a URL that might end up in a log or a referrer header. One thing I'd push back on if I saw it in review: don't put the user's email or usern

You ask an AI a question. It answers in fluent, confident prose — complete with a study, a percentage, and a name. Some of it is wrong, and nothing about the wording tells you which part. That's the whole problem with hallucinations: the errors wear the same suit as the facts. The fix is not "trust it less" in some vague way. The fix is a repeatable audit step between AI wrote it and I used it . Below is a short hallucination checker prompt you can copy right now, a test run showing what it catches and what slips past it, and an honest account of where a one-liner stops being enough. What counts as an AI hallucination? Not every mistake is a hallucination. A useful working definition: a hallucination is a claim the model states as fact that has no grounding in reality or in your source material. The common shapes: Fabricated citations — a named study, expert, or paper that doesn't exist. Often dressed with a year and an institution. Plausible-but-wrong specifics — dates, version numbers, statistics that are almost right, which makes them worse. Confident category errors — mixing up two similar things (a library and a framework, one company's product and another's). Invented consensus — "experts widely agree that…" with no experts attached. The dangerous ones are the middle two. Obvious nonsense filters itself; a wrong year in a fluent paragraph does not. The copy-paste hallucination checker prompt Here is the short version, free, no strings. It works on ChatGPT, Claude, or any capable model — paste it into a fresh chat, then paste the answer you want audited: Audit the text below for hallucinations. Do not add new information. 1. Extract every factual claim as a separate numbered line. 2. Label each claim: VERIFIABLE (state how to check it), SUSPECT (state what makes it doubtful), or FABRICATION-PATTERN (named source/study/number with no citation). 3. Flag every name, number, date, and citation for manual checking. 4. Finish with the 3 claims most likely to be wrong

10 paper AI nổi bật nhất trên Hugging Face hôm nay: robot thời gian thực, agentic search, coding agents và học tăng cường thế hệ mới Hôm nay, top paper được upvote cao trên Hugging Face cho thấy một bức tranh rất rõ về hướng đi của AI hiện tại: AI đang rời khỏi các benchmark tĩnh để tiến vào thế giới hành động thực tế — robot phải chạy nhanh hơn, agent phải tìm tài liệu tốt hơn, coding assistant phải hiểu cả repository, còn mô hình huấn luyện phải học được từ phản hồi tinh vi hơn là chỉ đúng/sai. Dưới đây là phần phân tích 10 paper nổi bật, tập trung vào 4 câu hỏi cho mỗi bài: bài toán là gì, ý tưởng chính, điểm mới, và ứng dụng thực tế . 1) HiFi-UMI: Learning Deployable Manipulation Policies from High-Fidelity UMI Data Alone Bài toán: Trong robot manipulation, dữ liệu demo từ con người thường dễ thu thập nhưng chất lượng không đủ ổn định để triển khai thật. Nhiều hệ thống vẫn phải dựa vào dữ liệu bổ sung, tinh chỉnh trên robot, hoặc pipeline phức tạp mới đủ dùng ngoài đời. Ý tưởng: HiFi-UMI hướng tới việc học policy thao tác chỉ từ dữ liệu UMI độ trung thực cao . Tức là thay vì bù đắp bằng nhiều nguồn dữ liệu hỗn hợp, tác giả tập trung nâng chất lượng dữ liệu gốc và thiết kế cách học để policy có thể triển khai trực tiếp. Điểm mới: Điểm đáng chú ý là triết lý “ high-fidelity data alone ”. Đây là một phản đề thú vị với xu hướng “càng nhiều dữ liệu càng tốt”. Bài báo ngụ ý rằng với dữ liệu đủ chuẩn, ta có thể giảm đáng kể phụ thuộc vào fine-tuning tốn kém hoặc domain adaptation phức tạp. Ứng dụng thực tế: Các tác vụ như gắp đặt vật thể, lắp ráp đơn giản, thao tác trong môi trường gia dụng hoặc kho vận. Nếu cách tiếp cận này thực sự bền vững, nó có thể giúp doanh nghiệp triển khai robot nhanh hơn vì giảm chi phí thu thập và hợp nhất dữ liệu đa nguồn. 2) TurboVLA: Real-Time Vision-Language-Action Model at 32 Hz on an RTX 4090 with <1 GB VRAM Bài toán: Vision-Language-Action (VLA) rất hứa hẹn cho robot, nhưng thường quá nặng để chạy real-time. Muốn robot phản ứng mượt,

Article URL: https://www.ycombinator.com/companies/mbodi-ai/jobs Comments URL: https://news.ycombinator.com/item?id=49108840 Points: 0 # Comments: 0

Originally published on tamiz.pro . The rise of "vibe coding" has democratized software development, allowing developers to build complex applications using natural language prompts. However, this same flexibility introduces a fundamental challenge for enterprise-grade AI agents: non-determinism. When you ask an LLM to "handle this customer support ticket," the model might draft an email, query a database, or call an external API—depending on the temperature, the context window, and the whims of the weights. For simple chatbots, this is fine. For agents that interact with bank accounts, manage server infrastructure, or coordinate multi-step business logic, this unpredictability is a liability. To bridge the gap between the creative, probabilistic nature of Large Language Models (LLMs) and the rigid reliability required by production systems, engineers must introduce structure. The most robust pattern for this is the Finite State Machine (FSM). By decoupling the decision logic from the execution logic , you create agents that are not only smarter but also predictable, auditable, and debuggable. This deep dive explores the architecture of FSM-driven AI agents, why they are essential for moving beyond prototypes, and how to implement them effectively using modern TypeScript libraries like XState and LangGraph. The Problem with Linear Chains In the early days of agentic AI, the dominant pattern was the linear chain: a sequence of LLM calls where the output of one becomes the input of the next. While simple to implement, this architecture suffers from several critical flaws that become apparent at scale: Lack of Error Recovery : If an LLM call fails or returns malformed JSON, the entire chain collapses. There is no defined "state" to revert to, no way to retry a specific step, and no way to pause for human intervention. No Global Context : Each step in a linear chain is often isolated. The second LLM call may not have access to the full history of decisions made in the f

Build a Local LLM Chatbot with Ollama and Python tags: python, ai, llm, tutorial tags: python, ai, llm, tutorial Build a Local LLM Chatbot with Ollama and Python Imagine typing a question into your chatbot and getting a response in milliseconds, completely offline, with zero data leaving your machine. No API keys, no monthly subscription fees, and no privacy concerns about your data being sent to a cloud server. This isn’t a futuristic dream—it’s the reality of running a Local Large Language Model (LLM) on your own computer. With the rise of tools like Ollama , building a private AI chatbot in Python has become as simple as installing a few packages and writing a short script. Let’s dive in and build one together. Why Go Local? Before we write any code, it’s worth understanding why running an LLM locally is a game-changer. Cloud-based AI services like OpenAI or Anthropic are powerful, but they come with trade-offs: you pay per token, your data is processed on their servers, and you’re dependent on their uptime. A local LLM flips this model. You download the model once, run it on your hardware, and you have full control. Ollama is the engine that makes this accessible. It’s a lightweight, open-source tool that simplifies running LLMs like Llama 3, Phi 3, or Mistral on macOS, Linux, and Windows. It handles model downloads, memory management, and inference, exposing a simple API that Python can easily interact with [1][2]. Step 1: Install Ollama and Pull a Model The first step is getting Ollama on your machine. Visit ollama.com , click Download , and install the version for your operating system [2]. Once installed, verify it’s working by opening your terminal or Command Prompt and running: ollama --version If you see a version number, you’re ready to go. Next, you need a model. Ollama supports dozens of open-source models, but for a beginner-friendly chatbot, Llama 3.2 is a great choice. It’s small, fast, and surprisingly capable. To download it, run: ollama pull llam

Looking for all our top recommended vacuums? Here are our favorites in every category, from cordless models to robot vacs.

How to Earn $10k+/Year from Bug Bounties tags: security, bugbounty, money, hacking How to Earn $10k+/Year from Bug Bounties: A Practical Roadmap You’ve seen the headlines: hackers finding critical flaws in billion-dollar companies and getting paid $50,000 for a single report. It looks like a magic trick, but it’s actually a skill you can build. The truth is, earning $10,000+ per year from bug bounties isn’t about being a genius coder; it’s about being consistent , strategic , and actionable . If you’re willing to treat this like a part-time job rather than a lucky gamble, hitting that $10k mark is a realistic goal within 12–18 months. Let’s cut through the noise and build a roadmap that works in 2026. The Math Behind $10k/Year Before you hunt, understand the numbers. Most beginners expect to find a critical bug worth $10,000 in their first month. That rarely happens. Instead, focus on the volume of valid findings . Low severity bugs : $100–$500 each [5] Medium severity bugs : $500–$2,000 each [5][7] High/Critical bugs : $5,000–$50,000+ [5] To hit $10,000/year , you don’t need a single critical find. You could: Find 20 medium bugs at $500 each Find 10 medium bugs ($500) + 2 critical bugs ($2,500 each) Find 40 low bugs at $250 each The key is consistency . A researcher with one year of focused hunting can realistically earn several thousand dollars annually, potentially matching a part-time income [5]. The ceiling rises steeply as you gain access to private programs , which offer higher payouts and less competition [5]. Build Your Foundation (Weeks 1–4) Don’t jump into hunting yet. You need to understand how the web actually works. Master Web Fundamentals Learn HTTP/HTTPS protocols : request/response structure, headers, cookies, session management [1] Understand client-side tech : HTML, CSS, JavaScript basics [1] Study common vulnerabilities : SQL injection, XSS, IDOR, CSRF, SSRF [1][6] Start with Free Learning Resources HackTheBox Academy (free modules) [1] TryHackMe

Build a Dependency Vulnerability Scanner with Python tags: python, security, devops, tools tags: python, security, devops, tools Build a Dependency Vulnerability Scanner with Python Your requirements.txt looks clean, but one of those dependencies might be a ticking time bomb waiting to expose your users to a data breach. You don’t need to wait for a security audit to find out—you can build your own lightweight vulnerability scanner in Python today and integrate it directly into your workflow. Security isn’t just about writing secure code; it’s about knowing what’s running in your environment. With thousands of Python packages available, the odds that you’re using a library with a known CVE (Common Vulnerabilities and Exposures) are high. Instead of relying solely on third-party tools like pip-audit or safety (which are excellent, but sometimes opaque), building your own scanner gives you full control over how vulnerabilities are detected, reported, and acted upon. Let’s build a practical, working dependency vulnerability scanner from scratch. Why Build Your Own Scanner? Existing tools like pip-audit [13], safety [10], and PySentry [4] are powerful, but they come with limitations: They may not support your specific output format (e.g., custom JSON for CI). They might not integrate cleanly with your private PyPI registry. You can’t easily tweak the logic to match your team’s risk tolerance. Building your own scanner lets you: Query the NVD (National Vulnerability Database) API directly. Parse requirements.txt , pyproject.toml , or poetry.lock files flexibly. Generate reports in any format you need (Markdown, JSON, SARIF). Fail your CI pipeline automatically when critical CVEs are found. Plus, it’s a great learning exercise in cybersecurity, API integration, and Python parsing. Step 1: Set Up Your Environment Before writing code, prepare a clean virtual environment to avoid false positives from global packages: python3 -m venv scanner-env source scanner-env/bin/activat

Python Itertools: 10 Tricks for Cleaner Code tags: python, programming, tips, tutorial tags: python, programming, tips, tutorial Python Itertools: 10 Tricks for Cleaner Code You’ve probably written a loop that felt like it was dragging your code into the mud. Maybe you concatenated lists with + , zipped mismatched iterables and lost data, or manually tracked indices to count items. Before you add another for loop to your script, consider this: Python’s itertools module is a hidden superpower that can turn messy iteration logic into elegant, memory-efficient, and readable one-liners. Mastering itertools doesn’t just make your code cleaner—it makes it faster, especially when working with large datasets or infinite sequences. Let’s dive into 10 practical tricks you can use today to write better Python code. 1. Chain Multiple Lists Without Copying Memory When you need to merge several lists, the + operator creates a new list in memory. That’s wasteful for large datasets. Instead, use itertools.chain() , which yields items lazily—only when you need them. from itertools import chain list1 = [ 1 , 2 , 3 ] list2 = [ 4 , 5 ] list3 = [ 6 ] merged = chain ( list1 , list2 , list3 ) for item in merged : print ( item ) # 1, 2, 3, 4, 5, 6 This approach is memory-efficient and ideal for streaming or processing huge collections [6]. 2. Zip Uneven Lists Without Losing Data The built-in zip() stops when the shortest iterable ends. But what if you want to keep going and fill in missing values? Use itertools.zip_longest() with a fillvalue . from itertools import zip_longest names = [ " Alice " , " Bob " ] ids = [ 101 , 102 , 103 ] for name , id in zip_longest ( names , ids , fillvalue = " Unknown " ): print ( f " { name } : { id } " ) Output: Alice: 101 Bob: 102 Unknown: 103 This is perfect for aligning mismatched data streams [3]. 3. Generate Infinite Counters Gracefully Need a counter that never stops? itertools.count() gives you an infinite iterator starting from a specified value. A

The OG gimbal camera goes "pro" with two lenses, class-leading dynamic range and optical zoom.

DJI's Osmo Pocket 4P is a pretty simple proposition: an Osmo Pocket 4 with a second camera lens slapped inside. But is that extra lens worth the added size, weight, and cost relative to the regular Pocket 4? And how does it compare to the only rival on the market, Insta360's dual-lens Luna Ultra? It […]