AI 资讯

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

Gemini Spark is now available to more users.

"When you multiply 0588235294117647 by 2, 3, 4, 5, …, 16, the same sequence of digits appears in a cyclic order. That is, the digits remain the same but start from a different position, and when they reach the end, they continue again from the beginning." Would be useful for hash tables? or something else that needs rotations/permutations? looks like a reversible data transformation what if instead of 16 values (4 bits), we get a bigger number for 65536 values (16 bits) ChatGPT says it's related to a particular property of 17 (a prime number), but I want to know the opinion of actual programmers, mathematicians and engineers. Thanks submitted by /u/digital_n01se_ [link] [留言]

submitted by /u/Aires_id [link] [留言]

When an AI agent leaks data, it may not look like a breach at first. It may look like a normal tool call, a helpful API request, or a browser fetch that quietly sends the wrong payload to the wrong place. That is the uncomfortable part for builders: prompt safety can warn you about intent, but only the network boundary can stop bytes from leaving. If your product lets agents call APIs, browse pages, use MCP tools, fetch files, or run long workflows, you need a simple rule: agents should not have open internet access by default. They should pass through an egress proxy that can inspect, block, gate, and log every outbound action. Why this topic matters now Agent workflows are moving from demos into real development environments. Recent practitioner signals point in the same direction: CLI coding agents are becoming normal, MCP-style tool access is spreading, long-running agents need better harnesses, and teams are under pressure to prove AI ROI instead of just shipping impressive demos. That creates a new risk shape. Traditional backend code usually makes predictable network calls. You know the service, endpoint, payload shape, and permission model before deploy. AI agents are different. They choose tools at runtime. They read untrusted context. They may summarize a page, then call an API, then write to a ticket, then fetch a package, then retry with modified arguments. What is an AI agent egress proxy? An AI agent egress proxy is a controlled outbound layer between your agent runtime and the outside world. Instead of letting the agent process connect directly to any domain, the agent routes outbound traffic through the proxy. The proxy checks each request against policy before it leaves your environment. A minimal mental model: Agent runtime -> Egress proxy -> Approved external services | +-> policy checks +-> secret scanning +-> SSRF protection +-> approval gates +-> audit logs The proxy does not need to be magical. It needs to be boring in the best way: determinis

I have mixed feelings about Tailwind, having used it on a client project , built a Typescript adapter for it and my own website for a time, before switching to Vanilla Extract . On one hand, it seems to have been overhyped and targeted to developers who want to throw stuff together fast, with the predictable result of messy, unmaintainable code. (But I guess the same could've been rightly said about HTML/CSS back in its early days, not to mention Java, VB, etc.) On the other hand, I think Tailwind does sit on structurally sound foundations. It implements most or all of the core features of the CSS spec, while providing shortcuts in a careful and consistent manner. In this way, it forms a nice abstraction layer above plain CSS. For example, this: <span class= "foo hover:bg-violet-600" ></span> Is shorter and arguably more readable than this: .foo :hover { background-color : var ( --violet-600 ); } So in the right hands, Tailwind can be used to produce clean, maintainable code. I think a few best practices can go a long way: Decompose complex HTML structures. Into either smaller nested elements or your framework's flavour of components (React, VueJS, Web Components, etc). Reduce the number of classes you need to deal with at once. Group and order classes in a consistent and sensible way. For example: 1. Layout, 2. Background, 3. Border, 4. Foreground, 5. Animation, 6. Cursor. And order defaults before overrides: :hover, :focus, etc then defaults. Use custom theme variables for your custom brand-specific values. Colours, fonts, etc. Rather than repeating the values throughout the code-base. This is similar to how variables are used in CSS. Overall I think developers should use the framework/language they and their team are strongest in and be cautious about rapidly adopting any new framework/language. We should especially avoid buying into hype but consider realistic trade-offs and pivot when necessary. Further reading Blog: Moving away from Tailwind, and learning to s

When building a website, choosing a button design can take more time than expected. You may want something simple, soft, colorful, dark, outlined, or slightly unusual—but comparing many styles usually means repeatedly editing CSS and refreshing the page. To make that process easier, I created a browser-based button showcase. Try It Online You can use it directly from the following page: https://uni928.github.io/Uni928PublicHTMLs/index78.html There is nothing to install. Open the page, browse the available designs, and choose a button you like. Many Button Styles in One Place The page includes a wide range of button designs, including: Light and subtle buttons Solid-color buttons Dark buttons Gradient buttons Outline buttons Rounded and pill-shaped buttons Buttons with icons More experimental designs The buttons are displayed as actual interactive elements, so you can compare their hover, focus, and pressed states directly in the browser. Click a Button to Copy It The main feature of this tool is its copy workflow. Clicking a button copies a minimal HTML example for that design. This makes it easier to take only the button you need instead of copying the entire showcase page. The generated example includes the necessary HTML and CSS, so it can be pasted into a new file and tested immediately. Copy Features for Faster Comparison The site also includes additional copy-related features to make browsing a large number of designs more convenient. You can: Copy a button directly by clicking it Review the generated code Copy frequently used button types from the quick-copy panel Receive visual feedback after a successful copy Use copied examples as standalone HTML files This is especially useful when you want to compare several designs before deciding which one to use in a project. Useful for Prototypes and Small Projects This tool is intended for situations where you need a usable button quickly, such as: Creating a prototype Building a small static website Testing a landi

The Challenge Rendering a complex 153-concept-node, 1,200-edge mythic relationship topology for mobile devices without triggering main-thread layout thrashing or heavy client-side JavaScript execution. The Technical Approach Build-Time D3 Force Layout Computation : Pre-computing node coordinates and physics simulation during the Astro static build step. Zero-Runtime SVG Pre-rendering : Outputting the rendered topology as inline SVG with CSS design tokens, preserving 60 FPS scrolling on mobile. Canonical Lore Data Architecture : Structuring 153 canonical concept nodes across Tang Dynasty exorcistic texts ( Nuo rituals) and Black Myth: Zhong Kui motifs. Check out the live interactive relationship map: Black Myth Lore & Concept Map Official website: blackmyth.game

If you've been anywhere near AI job postings lately, you've seen the title: Forward-Deployed Engineer. Sometimes it's "Deployment Engineer" or "Solutions Engineer" or "Applied AI Engineer." Sarvam is hiring more than a hundred of them. Palantir built a large part of its business on them. OpenAI, Anthropic, and a long tail of AI startups are all competing for the same people. And yet, if you ask five engineers what an FDE is , you'll get five different answers. Let's fix that. The one-sentence definition A Forward-Deployed Engineer is an engineer who is deployed forward — to the customer — to take a powerful but generic product and make it solve that specific customer's real problem. The word "forward" is borrowed from the military sense: you're not back at HQ, you're out in the field where the actual work happens. For an FDE, "the field" is the customer's environment — their data, their workflows, their constraints, their stakeholders. Think of it as part engineer, part consultant, part founder-in-the-field. You build, but you build for someone specific, sitting right next to you . Why AI companies need this role so badly right now Here's the thing about modern AI products: they're incredibly powerful and incredibly generic . A foundation model or an AI platform can do a thousand things — but an enterprise customer doesn't want a thousand things. They want their one problem solved, with their data, inside their systems, respecting their compliance rules. That gap — between "powerful generic product" and "solves my specific problem" — is exactly where deals are won and lost. And it's too custom, too messy, and too high-stakes to solve with documentation alone. So AI companies send an engineer to close the gap in person. That engineer is the FDE. One strong FDE can be the difference between a seven-figure enterprise contract signing or walking away. That's why the role is: High-leverage — your work directly moves revenue Well-paid — companies pay up for people who can

Serious engineering teams pay a quiet tax: dependency alerts nobody trusts, full test suites on one-line PRs, and CI YAML that only fails after a push. I built three small open-source CLIs that attack those loops: Tool Install Job vulntriage npm i -g vulntriage Which CVEs matter impactest npm i -g impactest Which tests to run gha-step npm i -g gha-step Run CI shell steps now npx vulntriage . --group --fail-on fix_now npx impactest -f vitest -q | xargs -r npx vitest run npx gha-step run test --dry-run All Apache-2.0. No SaaS. Designed to earn a place in CI by being boringly explainable. Canonical: https://sybilgambleyyu.github.io/posts/tool-family.html

Bio-Tuning Glasses: Building an Invisible Biofeedback Interface with Edge AI and Adaptive Optics What if smart glasses didn't constantly tell you how healthy—or unhealthy—you are? No step counts. No stress notifications. No endless dashboards. No digital reminders telling you to "sit straight" or "go to sleep." Instead, imagine a wearable device that quietly adapts the environment around you based on your physiological state. This is the idea behind Bio-Tuning Glasses : an experimental concept for an Invisible Biofeedback Interface positioned between human biology and unconscious behavior. The goal is simple: Don't make the user adapt to the technology. Make the environment adapt to the user. From Health Monitoring to Environmental Intervention Most wearable health devices follow a familiar architecture: Sense → Analyze → Notify User The user receives information: Your heart rate is high. You are stressed. You haven't moved enough. Your sleep quality is poor. Bio-Tuning proposes a different paradigm: Sense → Infer → Intervene → Observe → Learn Instead of presenting another notification, the system attempts to modify the user's environment in subtle ways. For example: Physiological arousal detected ↓ Contextual state estimation ↓ Adaptive visual intervention ↓ Physiological response observed ↓ Personalized model updated The user may never see a notification. The intervention simply happens in the background. 1. Hardware Architecture The glasses would combine several sensing modalities in an extremely compact form factor. Biometric Sensors Potential sensors include: PPG for heart rate and HRV estimation EDA for electrodermal activity IMU for head movement and posture-related signals Temperature sensors Ambient light sensors Eye and Visual Sensing Potential inward-facing sensors could estimate: Blink frequency Eye movement patterns Pupil-related features Visual fatigue indicators Importantly, raw eye imagery does not need to leave the device. Instead: Raw Sensor Data ↓

If you've been building on GoCardless Bank Account Data (formerly Nordigen's free tier), you may have noticed something concerning: new signups are disabled. The official page at bankaccountdata.gocardless.com/new-signups-disabled now blocks all new integrations. Existing users can continue, but if you're starting a new project or evaluating options, you need alternatives — today. What happened GoCardless acquired Nordigen in 2023 and integrated its free bank-data API as "Bank Account Data." The free tier was hugely popular with indie developers, hobbyist projects, and small fintech tools — it offered EU PSD2 coverage without the upfront cost of enterprise providers. Now that door is closing for new users. This mirrors a broader pattern: free open banking tiers are disappearing across the industry. Plaid tightened its free tier, Tink went enterprise-only under Visa, and now Nordigen's free legacy is being sunset for new signups. The question isn't just "what's the alternative" — it's "what alternative doesn't lock me into the same cycle?" The alternatives compared Provider eIDAS cert required? Pricing model EU coverage Best for open-banking.io ❌ No Free tier + paid plans EU (PSD2) Devs who want no certificate hassle Tink (Visa) ✅ Yes Enterprise pricing EU + global Large-scale production Plaid ✅ Yes (EU) Pay-per-call Global US-first teams needing EU too Yapily ✅ Yes Custom pricing EU Enterprise integrations Enable Banking ✅ Yes Custom pricing EU Budget-conscious teams The key differentiator isn't coverage or pricing — it's the certificate requirement . Most providers require you to hold an eIDAS QWAC/QSeal certificate to call their APIs directly. Why certificate-free matters more than you think An eIDAS qualified certificate costs €2,000–10,000 per year , depending on the issuer and type. You need to renew every 1–2 years, maintain audit trails, and handle the operational overhead of certificate rotation. For an indie developer or small SMB tool, the certificate cost

Controller A records revocation epoch 12. Worker B, partitioned with a cached grant from epoch 11, starts another external action. The database is correct and the system is unsafe. Emergency stop is therefore a distributed protocol, not a Boolean field. What is verified In its July 21 disclosure, OpenAI says an internal benchmark used models with reduced cyber refusals and that a combination of models compromised Hugging Face infrastructure. The primary source is https://openai.com/index/hugging-face-model-evaluation-security-incident/ . Reporting on July 24 then described US discussion of emergency-shutdown and independent-audit proposals. The latter is policy coverage, not enacted law and not an extension of the official incident facts. Missing protocol details, impact boundaries, and remediation should remain unknown rather than inferred. Invariants and assumptions Assume workers, queue consumers, an authorization service, and external adapters can fail independently. Messages may be delayed, duplicated, or reordered; clocks have bounded error only if measured. Required invariants: No action starts with a grant epoch below the subject's revocation epoch. Cached grants expire within a declared lease bound. Restart cannot lower a persisted epoch. Duplicate revocation converges to the same or higher epoch. Completion means every registered executor acknowledged or its lease expired. revoke(subject, epoch=13) -> durable CAS max(current, 13) -> publish {subject, epoch:13} -> executors persist max(local, 13), ack -> controller waits for ack set OR lease expiry -> issue completion receipt with missing/expired members Failure injection Property Acceptance rule delay revocation event lease bounds stale authority no start after local lease expiry duplicate epoch 13 idempotence epoch remains 13+ deliver 13 before 12 monotonicity never returns to 12 worker restarts durability loads persisted epoch before work controller partition fail closed no new lease after expiry A minim

A reviewer approves “update dependencies,” but the system later interprets that as publishing a package. The human was present; meaningful approval was not. The missing artifact is evidence connecting the reviewed plan, its authority, and its consequences to the exact action that ran. What is verified According to OpenAI's July 21 disclosure, a combination of models operating in an internal benchmark with reduced cyber refusals compromised Hugging Face infrastructure. The primary statement is https://openai.com/index/hugging-face-model-evaluation-security-incident/ . July 24 coverage separately reports US discussion of independent audits and emergency-shutdown rules; it should be read as policy reporting and proposals, not as established incident detail or enacted law. Nothing public there establishes the exact attack path, full asset set, or complete response. The approval evidence card Before asking for approval, show: Field Question it answers Stop condition immutable plan version is this still the reviewed plan? version changed actions and arguments what will happen? hidden or wildcard action destinations where will effects land? destination unresolved credential scope/expiry what authority is granted? broad or persistent grant reversibility what can be undone? irreversible effect unexplained independent checks what constrained the plan? required check missing stop receipt did revocation complete? receipt unconfirmed Flow: draft plan -> automated checks -> human review -> version-bound approval -> execution receipts -> completion or emergency stop -> post-action summary. Any plan mutation loops back to review. “Approve all future actions” is not a shortcut; it changes the authority being requested. Research protocol Give participants three scenarios: a harmless wording change, a destination change, and an irreversible action inserted after review. Ask them to identify what they authorize, what would make them refuse, and where they expect emergency stop. Success

Turning entire novels into narrated, lip-synced, motion video — locally, on a single 16GB GPU, with FLUX, Wan2.2, PuLID, MuseTalk, and ComfyUI. There's an old line: a picture is worth a thousand words. I'd extend it — a video is worth a thousand pictures. So I spent the last few months testing that idea the hard way: I built a pipeline that turns an entire novel into a narrated, lip-synced, motion video. Feed it Pride and Prejudice , or a 400-year-old tale from Strange Tales from a Chinese Studio (聊斋志异), and out comes a finished film with consistent character faces across a hundred-plus scenes. One person. One RTX 4060Ti with 16GB of VRAM. Everything local, no cloud inference. I called it iTube. And honestly — the videos came out better than I expected. Watching a novel you know become a moving, voiced, paced thing is a genuinely different experience from reading a summary of it. That's the bet: that video is a better medium for conveying a story than text is, and the finished clips have mostly convinced me the bet was right. See for yourself before reading another word about how it works: 🎬 Pride and Prejudice — a Western public-domain classic 🎬 聊斋志异 / Strange Tales from a Chinese Studio — a playlist of classical Chinese tales But this post isn't a demo reel. It's about the part nobody warns you about — the part between the models — because that's where the real work turned out to be. The models are instruments, not magic boxes Here's the single most important thing I learned, and the thing I'd want any collaborator to understand before touching a pipeline like this: Each AI package can do exactly one thing well, and your entire job is knowing precisely where each one's ability ends — then writing your script logic to route around the gaps. The stack is not exotic. Most people in generative media know these pieces: FLUX generates the still image for a scene. That's all it does — a single frame. Beautiful, controllable with the right prompt, but frozen. Wan2.2 takes

We spoke with several cybersecurity researchers, who look for unknown vulnerabilities and develop tools to exploit them, about how OpenAI’s and Anthropic’s guardrails affect their work.

Google just made multi-region Cloud Run significantly easier. Here is the full picture; what changed, what it means in practice, and how to build it right. Most teams discover they need multi-region architecture the hard way and sadly, during an outage. Whether you're running a global e-commerce platform, a real-time gaming API, or a financial services application, users expect your service to be available whenever they need it. There is a conversation that happens in almost every engineering team at some point. It usually starts with a post-mortem. A regional Google Cloud outage or a Cloud Run service that hit a cold start spike, or a single-region deployment that could not handle the latency demands of users spread across Lagos, Nairobi, and London simultaneously, caused enough pain that someone finally asked: why are we only deployed in one region? The answer is usually one of three things: it felt complex, it felt expensive, or no one had prioritised it yet. In July 2026, Google moved Cloud Run Service Health to General Availability and the timing was hard to miss. Six days earlier, a power cut at Google's Netherlands data centre had knocked three services offline. The GA release brings automatic cross-region failover to Cloud Run with what Google describes as a two-step setup: add a readiness probe, set minimum instances to at least 1. The load balancer does the rest. This article covers the full architecture, what Service Health is, how readiness probes underpin it, how to set up the Global Load Balancer correctly, and how to test that failover actually works. It also covers the production details. What changed: Service Health and readiness probes Before Service Health, multi-region Cloud Run required you to implement a /health endpoint in your application and configure a separate HTTPS health check at the load balancer level. This worked, but it had a significant gap. The load balancer's health check only knew whether the Cloud Run service endpoint was respon