今日精选
HOT最新资讯
共 35652 篇Contrastive Decoding Diffing (CDD): recovering verbatim finetuning data from logits alone, no weight access needed[R]
We built a model diffing method that recovers verbatim content from narrowly finetuned LLMs using only grey-box logit access (no weights, no activations, no probe corpus). Recent work (Minder, Dumas et al., "Narrow Finetuning Leaves Clearly Readable Traces in Activation Differences") showed that finetuning leaves detectable traces in activation differences between base and finetuned models. Their method, Activation Difference Lens (ADL), steers generation using these differences, but it's whitebox (needs full weight access) and only recovers a vague, domain-level description of what the finetuning was about. We introduce Contrastive Decoding Diffing (CDD), the output-level analog. Instead of steering with activation differences, we contrast the base and finetuned model's logits directly. A single default configuration, no per-organism calibration, no layer selection, achieves a verbatim recovery score of 4+/5 on 19/20 organism x model pairs across four model families (1B to 32B params) on the SDF benchmark. ADL never exceeds 3/5 on the same benchmark, despite requiring full weight access. One unplanned finding: across four semantically unrelated finetuning domains (fake FDA drug approval, fake baking protocols, fake Roman concrete research), the same fictional persona kept showing up in the recovered text: "Dr. Elena Rodriguez." Turns out this is a name Claude Sonnet 3.6 disproportionately favors when asked to generate a fictional scientist for synthetic data generation, so it got baked into every finetune that used LLM-generated training data, and CDD pulled it back out. We wrote up this specific finding on its own a few weeks back if you want the more accessible version first: ghost couple Paper: paper Code: code submitted by /u/CebulkaZapiekana [link] [留言]
Show HN: Opbox – CRDT based sync for text files on disk
Hi! I’m one of the founders of s2.dev, and recently have been hacking on opbox, which is an open-source daemon that turns directories of text files (code, markdown, etc) into collaborative, multi-player workspaces. This started as a bit of an intellectual curiosity, to see if it was possible to do real-time sync at the filesystem level (i.e., in an editor-agnostic way). The idea is pretty simple: - Opbox workspaces are roughly analogous to git repositories (and can be used alongside existing git
Building an Enterprise-Grade Real-Time Analytics Pipeline with FastAPI and TimescaleDB
I just released v1.0.0 of an open-source, production-ready real-time analytics pipeline built with Python. Here's what it does and why you might care. The Problem Every SaaS product needs analytics — event tracking, real-time dashboards, time-series aggregations. Most teams either pay for Segment/RudderStack or build their own from scratch. This project is the "build your own" done right. Architecture Client → FastAPI → Redis Streams/Kafka → Event Processor → TimescaleDB → WebSocket → Dashboard Tech Stack Component Technology API Layer FastAPI (async, auto-docs, WebSocket native) Event Queue Redis Streams or Apache Kafka Storage TimescaleDB (PostgreSQL extension for time-series) Real-time WebSocket with JWT auth + auto-reconnect Metrics Prometheus + OpenTelemetry Logging Structured JSON with correlation IDs Deployment Docker Compose + Kubernetes Features Async Event Ingestion — REST API + batch endpoints, buffered via Redis Streams or Kafka Adaptive Sampling — configurable rate-based sampling per event type Data Retention — TTL-based policies with automatic partition management Enterprise Security — JWT auth, RBAC (admin/editor/viewer), rate limiting, security headers, correlation IDs Live Dashboards — WebSocket push with auto-reconnect Observability — Prometheus metrics, OpenTelemetry traces, structured JSON logs Production Ready — Docker multi-stage build, Kubernetes manifests, health checks Quick Start git clone https://github.com/aman179102/real-time-analytics-pipeline cd real-time-analytics-pipeline make install docker compose up -d postgres redis make migrate make run-dev Testing 150 out of 152 unit tests pass. The 2 excluded tests are pre-existing async timing issues in process_loop — zero regressions introduced. Enterprise Middleware Pipeline Every request flows through: CorrelationMiddleware → AuthMiddleware → SecurityHeadersMiddleware → RateLimitMiddleware → SizeLimiterMiddleware → Router Try It Out GitHub: https://github.com/aman179102/real-time-analytics
Open Knowledge Format (OKF): The Markdown Standard Your AI Agents Have Been Waiting For 📚
AI agents are only as smart as the context you give them. OKF is a new open specification that packages your organizational knowledge as plain markdown files so any agent can read it without custom integrations or proprietary SDKs. Every team building AI agents hits the same wall. The model is capable. The agent framework is set up. But the agent doesn't know anything about your organization. It doesn't know what your orders table means, what the churn_score metric formula is, or what the on-call runbook says to do when the pipeline breaks. That knowledge exists. It's scattered across Confluence pages, Notion wikis, data catalog entries, Slack threads, and the heads of senior engineers. Getting it into an agent means building a custom integration for every source. Every team solves this from scratch. Published on June 12, 2026, the Open Knowledge Format (OKF) is a vendor-neutral specification that solves this with the simplest possible approach: a directory of markdown files. 🎯 🏗️ What OKF Actually Is An OKF bundle is a directory of markdown files representing concepts: anything you want to capture, including tables, datasets, metrics, playbooks, runbooks, and APIs. Each concept is one file. That's the entire model. A directory of .md files with YAML frontmatter. The format is deliberately minimal: one required field ( type ), optional metadata ( title , description , resource , tags , timestamp ), and a free-form markdown body. A concept document looks like this: --- type : table title : " orders" description : " One row per customer order. Source of truth for revenue reporting." resource : " postgresql://prod-db/ecommerce/orders" tags : [ revenue , core , sla ] timestamp : 2026-06-15T10:00:00Z --- # orders The `orders` table records every purchase event. It is the join root for all revenue queries. Do not filter on `status = 'complete'` unless you specifically want to exclude in-flight orders from the count. ## Key columns - `order_id` - UUID primary key - `custom
개발 지식 없이도 외주 앱 개발 과정을 직접 점검하는 방법
개발 역량이 없어도 외주 개발사의 진행 상황을 명확하게 파악하고 피드백을 줄 수 있다. 필요한 건 기술 지식이 아니라, 올바른 협업 구조다. 이 글은 비개발자 제품 관리자가 바로 적용할 수 있는 투명한 피드백 루프와 점검 방식을 소개한다. 외주 개발에서 비개발자가 소외되는 이유는 무엇인가? 외주 개발사와 일을 시작하면 처음 며칠은 소통이 활발하다. 요구사항 정리, 계약, 착수 미팅까지는 순탄하다. 문제는 그 이후다. 개발이 시작되면 대화의 언어가 바뀐다. "API 연결 중", "백엔드 스키마 설계 단계", "프론트 컴포넌트 분리 작업"처럼 전공자가 아니면 체감하기 어려운 표현들이 보고서를 채운다. 이 상태에서 비개발자가 할 수 있는 질문은 사실상 하나뿐이다. "잘 되고 있나요?" 그리고 돌아오는 답도 하나다. "네, 잘 되고 있습니다." 이 구조는 어느 개발사가 나쁜 의도를 가져서 생기는 문제가 아니다. 개발자는 기술 언어로 사고하고, 비개발자는 결과와 흐름으로 사고한다. 이 두 언어 사이에 다리가 없을 때 소외가 생긴다. 그리고 이 소외는 감정의 문제가 아니라 실질적인 리스크다. 방향이 틀어진 채 몇 주가 흐르면, 다시 맞추는 비용은 처음보다 훨씬 커진다. 비개발자가 개발 과정을 직접 점검할 수 있는 구조가 필요한 이유가 여기 있다. 비개발자가 진행 상황을 파악할 수 있는 협업 구조란? 투명한 협업 구조는 "보고를 더 자주 받는 것"이 아니다. 받는 정보의 언어와 형식을 바꾸는 것이다. 포텐랩은 매주 진행 상황을 공유하는 주간 피드백 루프를 팀 표준으로 운영한다. 이 루프의 핵심은 세 가지다. 무엇이 완료됐는가 : 이번 주에 실제로 만들어진 것, 확인 가능한 것. 다음 주에 무엇을 만드는가 : 다음 단계에서 기대할 수 있는 결과물. 막힌 것이 있는가 : 결정이 필요하거나 확인이 필요한 사항. 이 세 가지가 매주 비개발자도 읽을 수 있는 언어로 정리된다면, 소통 구조는 이미 절반 이상 해결된 것이다. 기술 용어 없이 "로그인 화면 완성, 다음 주엔 상품 목록 화면 작업"이라고 쓸 수 있다면, 비개발자는 지금 어디쯤 왔는지 감을 잡을 수 있다. 주간 피드백 루프를 실제로 설계하는 방법 주간 루프가 형식적인 보고에 그치지 않으려면 구조가 있어야 한다. 아래는 포텐랩이 프로젝트마다 적용하는 주간 피드백 사이클의 구성이다. 1단계 — 주간 업데이트 문서 공유 매주 정해진 요일에 개발팀이 업데이트 문서를 공유한다. 이 문서에는 완료된 기능, 다음 주 작업 항목, 그리고 결정이 필요한 사항이 포함된다. 형식은 슬랙 메시지든, 노션 페이지든 팀이 합의한 채널이면 된다. 중요한 건 형식보다 주기와 언어다. 매주 같은 날, 비개발자가 읽을 수 있는 언어로. 2단계 — 화면으로 확인 가능한 결과물 공유 텍스트 보고만으로는 실제로 무엇이 만들어졌는지 체감하기 어렵다. 그래서 주간 업데이트에는 화면 캡처, 동영상 클립, 또는 테스트용 링크가 함께 제공된다. "로그인 기능 완료"라는 문장보다 실제 작동하는 화면을 보는 것이 훨씬 구체적인 판단 근거가 된다. 3단계 — 비개발자가 직접 테스트하는 시간 개발팀이 보여주는 것만 보는 게 아니라, 비개발자가 직접 써보는 단계가 필요하다. 이 과정에서 "버튼이 너무 작다", "이 순서가 직관적이지 않다" 같은 피드백이 나온다. 기술 지식이 없어도 할 수 있는 피드백이고, 이런 피드백이 제품의 방향을 바로잡는다. 4단계 — 다음 주 작업 범위 합의 이번 주 결과를 확인한 뒤, 다음 주에 무엇을 만들지 함께 정한다. 이 단계에서 비개발자는 우선순위를 조정할 수 있다. "이 기능보다 저 기능이 먼저 필요하다"는 판단을 매주 할 수 있는 구조다. 우선순위는 비개발자가 가장 잘 아는 영역이다. 비개발자가 개발 진행 상황을 점검하는 실질적인 기준은? 개발 진행 상황을 평가할 때 기술적 판단을 할 필요는 없다. 다음 세 가지 기준으로 충분히 점검할 수 있다. 점검 항목 확인 방법 좋은 신호 주의가 필요한 신호 완료 결과물 화면 또는 테스트 링크로 직접 확인 매주 눈에 보이는 결과물이 있음 텍스트 보고만 있고
OpenAI Agents SDK 0.13 to 0.17: Three Breaking Changes You Will Hit
OpenAI Agents SDK 0.13 → 0.17: Three Breaking Changes You Will Hit The OpenAI Agents SDK moved from 0.13 to 0.17 in five weeks (April 9 – May 19, 2026). That's 19 releases, including three breaking changes. Two of them are silent — they change runtime behavior without raising an error at upgrade time. If you're running agents on 0.13.x, this is the migration guide you need before you upgrade. The Three Breaks Break #1: ModelRefusalError (v0.15.0) — Silent to Loud The change: Model refusals used to return empty-string output. Now they raise an exception. What this means: If your code treated refusals as output == "" or checked for empty responses, you were silent-failing gracefully. That behavior changed. A model refusal now raises ModelRefusalError and will crash your agent run unless you handle it. What you need to do: Register a "model_refusal" error handler before upgrading past 0.15.0: from openai.agents import Agent , RunConfig def handle_refusal ( error ): print ( f " Model refused: { error . reason } " ) return " Model refused to respond. Try rephrasing. " agent = Agent ( model = " gpt-4 " , tools = [...], ) config = RunConfig ( on_error = { " model_refusal " : handle_refusal , } ) response = agent . run ( " ... " , config = config ) Without the handler, you'll see: ModelRefusalError: model declined to process this request This is an intentional change — OpenAI wants refusals to be explicit, not silent. But it means your error handling has to change. Impact: Any agent that doesn't add a refusal handler will crash on a refusal. High-risk if your agents field user input directly. Break #2: Default Model Changed (v0.16.0) — Silent Model Switch The change: The default model switched from gpt-4.1 to gpt-5.4-mini . What this means: If you created an agent without explicitly setting model= , you were running on gpt-4.1. On upgrade to 0.16.0+, that same code silently switches to gpt-5.4-mini. This isn't just a version bump — gpt-5.4-mini ships with different defaults
The browser wars aren’t about search anymore — here are the best alternatives to Chrome and Safari
We’ve compiled an overview of some of the top alternative browsers available today aiming to challenge Chrome and Safari.
The Right Way to Pair AI With Terraform Plans
terraform plan is honest about what it's going to do. The problem is it's also verbose, repetitive, and full of cosmetic changes (like recomputed tags) mixed in with real ones (like a database instance scheduled for -/+ replace ). On a 400-line plan, the dangerous changes hide. This is the kind of task AI is actually good at: skimming structured text, flagging the entries that matter, ignoring the rest. But "paste plan into Claude" is not the workflow. There's a specific shape to this that works. Why people get this wrong The natural instinct is to copy the plan output and paste it into a chat: Terraform will perform the following actions : # aws_instance.web will be updated in-place ~ resource "aws_instance" "web" { id = "i-0abc123def456" ~ instance_type = "t3.small" - > "t3.medium" ... The model will respond with a sentence about each line. You'll scroll. You'll skim. You'll miss the -/+ replace on the database because it's in the middle of 30 routine updates. This is the same failure mode as pasting a wall of logs and asking "is anything wrong?" The model is too polite to skip things. You need to tell it to. The format that actually works: JSON terraform show -json tfplan outputs a structured representation of the plan that's much easier to reason about than the text format. Two reasons: The "actions" field is explicit. Each resource_change has a change.actions array — ["create"] , ["delete"] , ["update"] , or ["delete", "create"] for replace. No ambiguity. You can filter before pasting. With jq , you can extract only the dangerous changes, drop the noise, and feed a 20-line summary into the AI instead of a 400-line plan. Try this: terraform plan -out = tfplan terraform show -json tfplan > plan.json # Get just the dangerous changes jq '[.resource_changes[] | select(.change.actions | contains(["delete"])) | {address, type, actions: .change.actions}]' plan.json That's the AI's input. Compact, unambiguous, and pre-filtered to the changes that need a human decision.
A no-math, visual intro to RAG (retrieval-augmented generation): The open book exam
submitted by /u/Critical-Ratio-3190 [link] [留言]
I Built an AI Tool That Finds Wasted Cloud Spending — And Its Carbon Footprint. Published: True
The difficulty If you’re using Google Cloud, you’re probably paying for stuff you don’t need anymore—a server someone forgot to turn off, a storage disk someone forgot to delete, or an IP address someone forgot to release. "That waste is costing us money." It consumes electricity. It generates carbon emissions. Almost nobody tracks those alongside the cost. I wanted a tool that could find both problems simultaneously, without me having to think. So I made one. Live demo: https://greenops-dashboard-845589445410.us-central1.run.app/ Code: https://github.com/raghu-putta/greenops-agent How it works: 4 AI agents in a row Imagine an assembly line in which each worker has only one job: Carbon Scout scans your Google Cloud project and reports on everything that looks like it might be unused or forgotten—idle servers, unattached storage disks, and unused reserved IP addresses. GreenOps Analyzer takes that list and adds two numbers to each item: how much it’s costing you in dollars, and how much it’s costing the planet in carbon emissions. Optimization Executor takes each finding and makes it an action: stop this server, delete this disk, release this address. It shows you the plan first; it only changes if you say go. Report Generator rolls up the entire run into a downloadable report so you (or your boss or your sustainability team) have something nice to look at. Powered by: FastAPI (the web framework), Google’s Agent Development Kit (a library for building AI agents), Gemini 2.5 Pro (the AI model doing the reasoning), and Google Cloud Run (where it’s all running). The “bug” that was not a bug: The dashboard has a terminal-style live window that shows you what each agent is doing in real time, using a technique called Server-Sent Events (basically, the server streams updates to your browser one at a time instead of making you refresh). And then at some point that window just stopped showing anything. Nothing. My backend logs told me that the updates were still being sent,
Fewer PRs done with proper prompting, review, and refinement usually win long term
Unpopulate opinion: Fewer PRs done with proper prompting, review, and refinement usually win long term. 3 thoughtful PRs a day > 40 poorly thought ones no matter how many AI agents reviewed them.
AI Code Review That Engineers Actually Trust: The Pipeline We Run on Every Pull Request
Bolting an LLM onto your pull requests is a weekend project. Building AI code review that your engineers don't disable within two weeks is the actual problem. The failure mode isn't missing bugs — it's crying wolf. Post twenty nitpicks and three hallucinations on someone's PR and they'll mute the bot forever. This is the pipeline we built on Mattrx to earn — and keep — that trust. Mattrx is our multi-tenant marketing-analytics SaaS: ~95k lines of C#, 11 engineers, and enough pull requests that senior-reviewer time was the bottleneck. We tried the naive thing first — pipe the changed file into a model, post the output — and watched the team stop reading it in nine days . TL;DR Dimension Human-only / naive AI (before) AI review pipeline (after) Coverage selective / whole-file dump every PR, diff-focused First-review latency ~6 hours (wait for a human) ~3 minutes (AI first pass) Context none / a naked file diff + call sites + conventions Reviewers one mega-prompt specialized dimensions, in parallel False positives ~35% (so it gets ignored) ~6% (adversarially verified) Merge control human, or nothing severity gate; human always decides Governance none gateway: audit, cost, secret redaction ~90 PRs/week across 11 engineers; the pipeline reviews 100%. First-pass review latency 6h → 3 min. False-positive rate ~35% → ~6% — the single number that decides whether the bot lives or dies. Escaped defects to production down ~40%; senior-reviewer time down ~30%. ~$0.05 per PR (cheap model for style, frontier only for correctness). The one mental shift: AI code review is not about finding issues — models find plenty. It's about not crying wolf . The product is trust, and trust is a false-positive-rate problem. Verify before you comment; let the AI propose and the human dispose. The naive approach — and why it collapses // BEFORE: dump the whole changed file into one prompt, post whatever comes back. foreach ( var file in pr . ChangedFiles ) { var text = await File . ReadAllTextAsyn
Tell HN: Fewer PRs done with proper prompting, review, and refinement wins
Unpopulate opinion: Fewer PRs done with proper prompting, review, and refinement usually win long term. *3 thoughtful PRs a day > 40 poorly thought ones no matter how many AI agents reviewed them.*
PWA with React + Leaflet: lessons from a 31-city map app
Notes from shipping a real-world PWA in Korea: Vite SSG is worth it. SPAs lose Korean SEO because Naver's crawler doesn't fully render JS. Leaflet > Mapbox for cost-sensitive projects. Free OSM tiles + zero cost. Firebase Hosting rewrites let you have deep URLs (/city/suwon) without a backend. KakaoTalk share is non-negotiable in Korea — 70%+ of social traffic. PWA install banner: don't auto-prompt, let the user discover. Project: https://gyeonggi-currency-map.web.app?ref=devto&utm_source=devto&utm_medium=social&utm_campaign=multi-site-bot
Cómo validar correos de reactivación de trial en un SaaS sin mezclar cohortes
Cuando un SaaS quiere recuperar usuarios de prueba que se quedaron a medio camino, casi siempre empieza por email. El problema es que una sola prueva mal hecha puede mezclar cohortes, disparar métricas falsas y dejar a marketing discutiendo con backend sobre datos que nunca fueron confiables. Ese tipo de campaña merece más cuidado del que parece. A simple vista solo hay que revisar asunto, CTA y enlace final, pero en la práctica también hay que comprobar segmentación, ventanas de tiempo, estados de cuenta y eventos analíticos. Si alguien en tu equipo busca cosas como facebook temp email para crear usuarios rápidos, en el fondo está intentando resolver eso: probar sin tocar bandejas reales ni contaminar reportes. Por qué los correos de reactivación confunden más de lo que ayudan Un correo de reactivación no se envía a cualquiera. Sale cuando una persona creó cuenta, probó algo, se quedó quieta y entra en una regla específica. Si esa regla se valida con datos sucios, el equipo termina optimizando un mensaje para usuarios equivocados. En SaaS esto pega fuerte porque marketing y producto suelen mirar la misma campaña con preguntas distintas. Marketing quiere saber si el copy reabre interés. Producto quiere saber si el usuario vuelve al flujo correcto. Backend quiere confirmar que la automatización no reenvía a quien ya convirtió. Cuando esas capas no se prueban juntas, aveces el correo “funciona” y aun así el experimento sale mal. Si ya estás ordenando tus pruebas de onboarding en SaaS , el siguiente paso natural es tratar la reactivación como un flujo distinto. Tiene otra intención, otra ventana de tiempo y otro riesgo de mezclar datos. Paso a paso para probar una campaña sin mezclar cohortes La forma más segura es preparar un escenario por cohorte. En vez de mandar varios usuarios de prueba al mismo inbox, creá un usuario, asignale una condición clara y validá un solo recorrido de punta a punta. Este proceso suele ser suficiente: Crear una cuenta de prueba que realmen