AI 资讯

The MVP was a great idea that got misused. "Minimum viable product" was meant to be the smallest experiment that tests a hypothesis. In practice it became an excuse to ship something broken and call it strategy. The minimum lovable product — MLP — is the correction: the smallest release that people actually want to use, not just tolerate. Knowing which one you need is a scoping decision, not a philosophy. The difference in one line An MVP asks will they use it at all? An MLP asks will they love the part we built? The MVP tests demand with the roughest possible artifact. The MLP narrows scope but polishes what remains until it's genuinely good. Both are about doing less. They disagree on where the "less" goes — fewer features versus rougher features. Why the bar has risen When users had few alternatives, a rough MVP could win on novelty. Today almost every category is crowded, and people judge a new product against the polished tools they already use. A janky first impression doesn't read as "early" — it reads as "not for me," and they don't come back. In a saturated market, lovability is the viability test. When an MVP is still right Ship a true MVP when the core question is demand, not quality: You're genuinely unsure anyone wants this at all. The audience is early adopters who tolerate rough edges for access. You can learn what you need from a small, forgiving group. Speed to a signal matters more than the strength of the signal. Here, spending weeks polishing something nobody wants is the expensive mistake. When to reach for an MLP Choose an MLP when demand is fairly clear but the market is competitive: Users have real alternatives and will compare you to them. Your differentiation is the experience — feel, speed, design. First impressions are hard to reverse. Word of mouth depends on delight, not just function. Scope narrow, finish deep The trap with "lovable" is treating it as license to add features. It's the opposite. Pick fewer things and finish them complet

Multi-tenancy is the decision that quietly shapes your entire SaaS backend. Get it right and you scale smoothly to thousands of accounts. Get it wrong and you're rewriting your data layer under load, mid-growth, with customers watching. The good news: for most products the right answer is simpler than the internet suggests. The three models There are three canonical ways to isolate tenants, and they trade isolation against operational cost: Row-level (shared schema). Every table has a tenant_id\ column, and every query filters on it. One database, one schema, all tenants together. Schema-per-tenant. Each tenant gets its own PostgreSQL schema inside a shared database. Stronger isolation, more objects to manage. Database-per-tenant. Each tenant gets a dedicated database or instance. Maximum isolation, maximum operational weight. Why row-level wins for most SaaS For the overwhelming majority of B2B SaaS products, row-level multi-tenancy is the right default. It's the cheapest to operate, the easiest to run migrations against, and it scales further than founders expect. The objection is always "but isolation" — and Postgres has a strong answer. Row-Level Security (RLS) lets the database itself enforce that a query can only see its own tenant's rows. With Supabase , RLS is the native model: you set a policy once, and even a buggy query can't leak across tenants. Combined with a tenant_id\ on every table and an index that leads with it, this pattern comfortably serves large customer bases. One caution from hard experience: write RLS policies so helper functions run once per query, not once per row . A policy that re-evaluates a lookup for every row will quietly turn fast endpoints slow as tables grow. Wrap the check so the planner runs it as an init-plan. When to reach for stronger isolation Escalate deliberately, not reflexively: Regulatory or contractual isolation — a customer requires their data in a physically separate database. Noisy-neighbor risk — one whale tenant'

Picture a power plant burning fuel to spin a turbine. It is tempting to assume that with enough engineering — better seals, smoother bearings, cleaner combustion — the plant could be pushed toward converting nearly all its heat into useful work. It cannot. A large modern thermal power station turns only something like 40 to 45 percent of its fuel energy into electricity, and the missing majority is not lost to sloppy design. It is lost to a law of physics. That law sets a ceiling on every device that turns heat into work, from a car engine to a steam turbine to a jet. The ceiling is called the Carnot efficiency, and the remarkable thing about it is how little it depends on. Not on the working fluid, not on the mechanism, not on the cleverness of the builder — only on two temperatures. This article explains where that limit comes from, how to compute it, and why it reshapes how engineers think about efficiency. Why this calculation matters The Carnot efficiency is the benchmark against which every real engine is judged. When an engineer reports that a gas turbine runs at 38 percent efficiency, that number means little on its own. Compared against the Carnot limit for the same hot and cold temperatures, it suddenly tells you how much room is left — whether the design is already near the physical wall or still has slack worth chasing. It also redirects design effort toward the things that actually matter. Because the Carnot limit depends only on the ratio of cold to hot absolute temperatures, the single most powerful way to raise the ceiling is to raise the temperature at which heat enters the engine, or lower the temperature at which it is rejected. This is why turbine inlet temperatures have climbed for decades, pushing the limits of metallurgy and cooling. Polishing internal friction yields small gains; raising the hot-side temperature raises the ceiling itself. The core formula Sadi Carnot, in 1824, imagined an idealized engine running on a perfectly reversible cyc

How you split your code into repositories seems like a plumbing decision, but it quietly shapes how your team collaborates, ships, and reasons about the system. A monorepo keeps everything in one repository; a polyrepo gives each service or app its own. Neither is universally right, and the loudest opinions online usually ignore your actual stage and team size. Here's how to think about it clearly. What a monorepo buys you A monorepo puts your web app, mobile app, backend, and shared libraries under one roof. The advantages are real, especially for smaller teams: Atomic changes. Update a shared type and every consumer in the same pull request. No cross-repo coordination dance. One source of truth for tooling. A single lint, format, and CI config instead of drift across a dozen repos. Effortless code sharing. Shared TypeScript packages are just imports, not published versions you have to bump and reinstall everywhere. Easy refactoring. You can find and fix every caller of a function because it's all in front of you. Tools like Turborepo and Nx make this practical by caching builds and only running work for the parts that actually changed. What a monorepo costs The trade-offs show up as you grow. Build and CI times can balloon without smart caching. Access control is coarser — it's harder to give a contractor one service without the whole codebase. And a naive setup rebuilds and tests everything on every change, which gets slow fast. Good tooling mitigates all of this, but you have to invest in it deliberately. What a polyrepo buys you Separate repositories give each service hard boundaries . A team owns its repo end to end, deploys on its own schedule, and can't accidentally reach into another team's internals. Access control is naturally granular, CI for each repo is small and fast, and the blast radius of a bad change is contained. The cost is coordination. A change that spans services becomes multiple pull requests across multiple repos that must land in the right

Users judge a mobile app in the first few seconds, and they judge it harshly. A slow launch, stuttering scroll, or a device that runs hot will sink an otherwise good app faster than a missing feature. Performance isn't one metric — it's four distinct areas, each with its own causes and fixes. Here's how to keep all of them healthy. Startup time — the first impression Time from tap to usable screen is the metric users feel most. Every extra second measurably increases abandonment. The usual culprits are doing too much before the first frame: heavy synchronous work at launch, loading data you don't yet need, and oversized bundles. Fixes: Defer non-essential initialization until after the first screen renders Lazy-load features and screens instead of loading everything upfront Show a real first screen fast, then hydrate data — don't block on the network Trim your dependency footprint; every library adds to startup cost Rendering — kill the jank Smooth means hitting the device's frame budget (about 16ms per frame for 60fps). Dropped frames show up as stutter during scrolling and animation. The main causes are doing heavy work on the UI thread and rendering more than you need. Virtualize long lists so only visible rows render (FlatList, RecyclerView equivalents) Move expensive work off the main thread Avoid unnecessary re-renders — in React Native, memoize and keep render functions cheap Optimize images: right-sized, cached, and in efficient formats Memory — don't get killed The OS terminates apps that use too much memory, and users read that crash as your bug. Leaks and oversized assets are the main offenders. Watch for retained references, unbounded caches, and full-resolution images held in memory. Load and decode images at display size, release resources when screens unmount, and cap in-memory caches. Battery and network — the invisible costs Users blame the app that drains their battery even if they can't name why. The big drains are aggressive polling, chatty netwo

We’ve all been there. You click "Export Health Data" on your iPhone, wait ten minutes, and receive a massive, bloated export.xml file. If you've tracked your fitness for years, this file can easily exceed 5GB. Try opening that in Python’s ElementTree or even pandas , and your RAM will cry for mercy. This is a classic Data Engineering challenge: transforming high-volume, semi-structured XML into actionable insights without waiting an eternity. In this tutorial, we are going to build a high-performance parser using Rust performance techniques, Rayon for parallelism, and ClickHouse for lightning-fast OLAP queries. By leveraging Rust's zero-cost abstractions, we'll turn a 20-minute Python slog into a sub-30-second sprint. 🚀 The High-Level Architecture Handling 5GB of XML requires a streaming approach. We cannot load the whole file into memory. We will stream the XML, parse segments in parallel, and ship them to ClickHouse using Protocol Buffers for maximum serialization efficiency. graph TD A[Apple Health export.xml] --> B[Streaming XML Reader] B --> C{Chunking Logic} C -->|Batch 1| D[Rayon Worker 1] C -->|Batch 2| E[Rayon Worker 2] C -->|Batch N| F[Rayon Worker N] D & E & F --> G[Protobuf Serialization] G --> H[(ClickHouse DB)] H --> I[Grafana / SQL Insights] Prerequisites To follow along, you'll need: Rust (Stable) Tech Stack : quick-xml (for streaming), serde (serialization), rayon (data parallelism), and clickhouse-rs . A running ClickHouse instance. 1. Defining the Data Schema Apple Health data (specifically Record types) consists of types, dates, and values. Since we want high performance, we'll use Protocol Buffers to define our intermediate format, ensuring minimal overhead when moving data through the pipeline. // Simplified representation of a Health Record use serde ::{ Deserialize , Serialize }; #[derive(Debug, Serialize, Deserialize, Clone)] pub struct HealthRecord { #[serde(rename = "@type" )] pub record_type : String , #[serde(rename = "@startDate" )] pub

Microservices have a marketing problem: they're associated with the engineering cultures of Netflix and Amazon, so ambitious teams assume adopting them is what serious companies do. But those companies moved to microservices to solve problems of enormous scale and huge headcount — problems you almost certainly don't have yet. For most products, splitting too early is one of the most expensive mistakes you can make. Here's the honest trade-off. What a monolith actually gives you A monolith is one deployable application. That simplicity is a feature, not a limitation, especially early: One codebase, one deploy. No orchestration, no service mesh, no distributed tracing just to understand a request. Simple debugging. A stack trace crosses your whole request. You're not correlating logs across five services to find one bug. Fast local development. Run the whole app on your laptop and iterate. Easy transactions. Data consistency is a database transaction, not a distributed saga you have to design and get right. The modern version isn't a big ball of mud. A modular monolith enforces clean internal boundaries — separate modules with clear interfaces — giving you much of the organization of microservices with none of the network overhead. What microservices actually cost Splitting into services doesn't remove complexity; it moves it from your code into the network, where it's harder to see and reason about. You inherit a long list of new problems: Distributed systems failure modes — partial failures, retries, timeouts, and eventual consistency become your daily reality. Data consistency across services — no more easy transactions; you're designing sagas and compensating actions. Operational overhead — every service needs deployment, monitoring, logging, and on-call. Slower local development and debugging — reproducing a bug can mean running half your architecture. For a small team, this overhead can consume the very velocity you were trying to gain. When microservices genuin

LLM features are cheap to prototype and surprisingly expensive to run at scale. A demo that costs pennies becomes a five-figure monthly bill once real users arrive, because every request pays per token and it's easy to send far more tokens than you need. The good news: most AI bills are bloated, and a handful of tactics reliably cut them without users noticing any drop in quality. Right-size the model per task The most expensive mistake is using your biggest, smartest model for everything. Most work in a product doesn't need it. Route by difficulty: Small, fast models for classification, extraction, routing, and simple rewrites. Frontier models only for genuinely hard reasoning or high-stakes output. Implement a model router : a cheap first pass decides how hard the task is, and only the hard cases escalate to the premium model. This single change often cuts spend dramatically because the long tail of easy requests stops paying frontier prices. Cache aggressively Many requests are repeats or near-repeats. Don't pay twice: Exact-match caching — identical prompts return a stored response instantly and for free. A simple PostgreSQL or Redis lookup keyed on the request works. Prompt caching — most providers let you cache a large, stable prefix (system prompt, retrieved context) so you're only billed full price for the changing part. Semantic caching — for questions that are similar but not identical, match on embeddings and reuse an answer when confidence is high. Trim the tokens You pay for every token in and out, so waste is literal money: Compress prompts. Cut boilerplate, redundant instructions, and bloated few-shot examples. Shorter prompts that keep quality are pure savings. Retrieve less, better. In RAG, don't stuff twenty chunks in when three well-chosen ones answer the question. Re-rank and send only what's needed. Cap output. Ask for concise responses and set a max length; unbounded generations quietly inflate bills. Batch and stream For work that isn't real-t

The problem Doc references to a line number or function name break the moment code gets refactored. You write "see line 142 of foo.py " or "see calculateRefund() " in a design doc, then six months later the line has shifted or the function got renamed, and the reference just quietly points at the wrong thing (or nothing). Nobody notices until someone follows it and lands in the wrong place. The fix Anchor Pointing is a tiny text convention that swaps the location for a fixed ID. You drop an ID at the destination you want to be a durable reference target: ap.<21-char-base62-id>.E and reference it from anywhere else, docs, other code, tickets, with: ap.ref.<21-char-base62-id>.E Both are just literal strings, so resolving a reference is a plain text search: grep , ripgrep , GitHub code search, Sourcegraph, your IDE, whatever you already use. The ap.ref. prefix exists specifically so a search for the anchor itself never also matches its own references. Rules One anchor per ID (a single, unambiguous destination) Unlimited references pointing at that ID ID is 21-char base62, making collisions a non-issue with no central coordination Spec: https://github.com/nickolay-kondratyev/anchor-points/blob/main/ANCHOR_POINTS_SPEC.md Feedback welcome, especially if this already exists under another name and I've reinvented something. submitted by /u/ThorgBuilder [link] [留言]

A post on X last week: "The fact that people can't even reply to posts without AI anymore says a...

Meta might be the next company to make an always-on AI wearable. The company is working on prototype "super sensing" always-aware smart glasses that could continuously record audio and snap photos "every few seconds," according to the Financial Times. The wearer could then ask Meta AI about the captured audio and images. However, the images […]

It is been while I am learning and build around FastAPI. So there is a project where I was thinking how to add this new feature over exiting one. Like what changes I need to make in database which need to be reflected in my backend and frontend. I already lunched the web locally. Problem started When I when back to the web and reload it it shows this error: ERROR: ConnectTimeout: Unauthorized 401. I was like what? Why? I thougth there is some issue with login endpoint or refresh token function. When i did some debugging and found some new information which is: "Either Supabase's edge/pooler (or OS, or an intermediate proxy/NAT) silently kills those idle connections server-side after some timeout but client-side pool doesn't know that." As I was doing nothing in become idle state so to save the resources server side silently close that particular connection. So I came back and try to connect it give this error. First thought come it my mind after this was there should be a way to automatically check this idle state and if user was in ideal state then create a new connection. Proposed Solutions After a while I come up with these solution: Calculate the Idle time: if it is more then server connection timeout then establish new connection. Retry logic: retry once on the specific connection errors. I thought this will work but This again give me error then this new issue I faced. Cold-start connection problem There is something call dual-stack (IPv4 and IPv6) networks and Happy Eyeballs is a network mechanism which automatically move to IPv4 connection if IPv6 fails. But supabase-py uses httpx and it doesn't support Happy Eyeballs. So in first try after the connection time out it try to establish IPv6 connection which is not routeable in most Pakistani ISPs and ultimately it fails and wait for timeout. There is no way to try it again for IPv4. So we have to do it manually. So this error help me to learn many thing in process. Share your thoughts.

The National Highway Traffic Safety Administration said emergency scenes are not "edge cases."

Introduction My zsh profile is over 1000 lines at this point. A lot of that is functions I asked AI to generate for me, since it's fast, portable, and saves me a ton of typing. Here's the thing though: the shortcuts that save me the most time aren't the clever ones. They're the dumb ones. Things like clone instead of git clone && cd , or dir instead of mkdir -p && cd . Each one only saves a second or two, but I run them so often that it adds up fast. These are in no particular order, just the ones I reach for constantly. Git aliases for common commands A few one-liners I have set up as plain aliases: alias gcp = "git cherry-pick" alias git-append = "git commit --amend --no-edit -a" gcp is self-explanatory. git-append amends the last commit with your currently staged (and unstaged, thanks to -a ) changes without touching the commit message. Great for fixing up a commit you just made before you push. Create a branch or switch to it if it already exists One of my most-used functions. Normally you have to remember whether a branch exists before deciding between git checkout <branch> and git checkout -b <branch> . This just does the right thing either way: gb () { if git rev-parse --verify --quiet " $1 " > /dev/null ; then git checkout " $1 " else git checkout -b " $1 " fi } Nuke all local changes to reset the working tree When an experiment goes sideways or I just want to throw everything away and start clean, I run nah : nah () { git reset --hard git clean -df if [ -d ".git/rebase-apply" ] || [ -d ".git/rebase-merge" ] ; then git rebase --abort fi } This resets tracked changes, removes untracked files and directories. No confirmation prompt, so use it carefully. Print recent commits as ready-to-paste cherry-pick commands Useful when you need to cherry-pick a batch of commits from one branch onto another in order: logs () { if [[ -z " $1 " || " $1 " = ~ [ ^0-9] ]] ; then echo "Usage: logs <number_of_commits>" return 1 fi git log -n " $1 " --reverse --pretty = format: "g

AI cheating leads to "a failed society," professor says.

I run a local LLM agent (Hermes) on my own machine. The problem was never the model — it was the interface . I had a Telegram tab open all day just to talk to it: type a command, wait, read a wall of text back, scroll. It felt like texting a very capable stranger. So I built Ghost Vessel — a monitor-resident, video-call-style avatar that fronts the agent. The name is the whole idea: the ghost is your agent, the vessel is the body it borrows. It's not a waifu toy; it's a real agent client that happens to have a face. Here's what actually turned out to be interesting to build. The reply is a script, not a string The core idea is an output contract . Instead of treating the agent's reply as text to print, I split every reply into three planes: dialogue → spoken via local TTS data → code, logs, files → rendered as chat cards, never read aloud action → emotion beats that drive the avatar Emotion beats are inline tags the model emits in-band with its answer: [working] — the avatar puts on glasses and takes notes while a task runs [confirm] deploy to prod? — pops a human-in-the-loop approve/cancel, and the agent blocks on your keypress [happy] / [concerned] / … — fine-grained facial expressions So "run the build, and if it passes, deploy" becomes a little performance : it looks busy while working, shows you the log as a card, then leans in and asks before the irreversible step. The text you'd have skim-read becomes something you glance at. No runtime GPU for the avatar The obvious way to animate a face is live inference. I didn't want that — the GPU is busy running the actual model. Instead the avatar is ~30 pre-rendered clips , and the emotion beats just select and blend between them (blink-aligned seamless idle loops, a head-pose "settle gate" so an expression only reveals when the head is frontal). The avatar's runtime cost is basically video playback. Your GPU stays 100% on your LLM. The tradeoff: no real-time lip-sync. I decided a believable talking mouth loop + expre

OpenBSD Privilege Escalation, GitHub AI Agent Leaks, & CDN Supply Chain Risks Today's Highlights This week's top security news features a critical use-after-free vulnerability in OpenBSD, a novel prompt injection attack leading to private repo leaks from GitHub's AI agent, and an unusual case of obfuscated bash scripts delivered via a CDN on consumer products. OpenBSD has a use-after-free allowing local privilege escalation to root (Hacker News) Source: https://nvd.nist.gov/vuln/detail/cve-2026-57589 A newly disclosed vulnerability, CVE-2026-57589, impacts OpenBSD, a renowned security-focused operating system. The vulnerability is identified as a use-after-free (UAF) flaw, which typically occurs when a program attempts to use memory after it has been freed, often leading to crashes or arbitrary code execution. In this specific case, the UAF bug allows for local privilege escalation to root. This type of vulnerability is particularly critical for operating systems, as it can enable an unprivileged attacker with local access to gain complete control over the system. System administrators and users of OpenBSD are advised to monitor official channels for patches and apply them immediately to mitigate the risk of compromise. Understanding the underlying cause of such UAFs is crucial for developing more robust memory management practices and identifying similar vulnerabilities in other systems. Comment: This is a critical reminder for OpenBSD admins to patch immediately, as use-after-free exploits are a classic, dangerous route to full system compromise from local access. GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos (Hacker News) Source: https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/ Researchers have uncovered a significant AI-specific security vulnerability, dubbed 'GitLost,' demonstrating how GitHub's AI agent can be manipulated to leak sensitive information from private repositories. The attack leverag