AI 资讯

My wife tracks her meals, and I watched her type "buckwheat, boiled, 100 g" into a calorie app for the hundredth time. Search, scroll, pick the wrong entry, fix the grams. Every meal, every day. At some point it's easier to teach a vision model to look at the plate. So I built a Telegram bot. You send a photo of your food, it identifies the dishes, estimates portion weights, and replies with a card: calories, protein, fat, carbs. Text and voice work too ("2 eggs and a toast"). The borscht incident The first version was hilariously confident about wrong answers. Borscht — a red beet soup, if you've never met one — came back as "berry compote" (a sweet berry drink). Red liquid in a bowl, what else could it be? Adding more example dishes to the prompt made it worse : the model just got magnetized to whatever was on the list. A cod fillet became "syrniki" (cottage cheese pancakes) because syrniki were mentioned and both are pale and pan-fried. What actually fixed it was making the model read the serving context before naming anything: liquid served in a deep bowl with a spoon and sour cream is soup, not a drink. Flaky texture that separates in layers is fish, not pancakes. Fried items are never served floating in liquid. A short list of physical rules beat a long list of dishes. Portion estimation works the same way — the model reasons from plate size, cutlery, how full the bowl is. My wife has been checking its gram estimates against her kitchen scale for a week and it lands closer than either of us expected. Stack, briefly Python + aiogram, a vision LLM with structured JSON output (with a fallback parser for the days the model decides to wrap JSON in prose), Pillow for rendering the result cards. Photos are analyzed on the fly and never stored. Payments are Telegram Stars, so there's no app store, no signup, no card form — the whole onboarding is "send a photo". Yesterday I also wired up inline mode: type @SnapPlateBot in any chat, describe the food, and it counts rig

Introduction: The Illusion of Productivity Metrics Traditional software development metrics—velocity charts, commit counts, bundle size—are the comfort objects of the coding world. They sit on dashboards, glowing with the promise of insight, but in reality, they’re often lagging vanity numbers . They don’t capture the narrative of a week’s work; they don’t reveal the decisions , the reversals , or the patterns that define progress. Instead, they deform the truth by oversimplifying it, much like a rubber band stretched too thin—it snaps under pressure, failing to hold the complexity of real work. Consider the mechanical process of a commit. A commit is a snapshot , a frozen moment in time. But software development isn’t a series of snapshots; it’s a sequence . When you string commits together without context, you miss the heat of decision-making—the back-and-forth, the undoing, the redoing. This is where traditional metrics fail. They don’t account for the thermal expansion of ideas, the way a decision made on Monday might cool by Friday, only to be reheated and reshaped. Without a narrative, these metrics are like a machine running without lubrication: they friction against reality, wearing down under the weight of their own inadequacy. The Mechanism of Metric Failure Let’s break down the causal chain: Impact: Developers rely on metrics like commit counts to gauge productivity. Internal Process: These metrics are lagging indicators , reflecting past actions without context. They don’t capture the why behind the numbers—the decisions, the reversals, the thought process. Observable Effect: Developers miss critical patterns, such as repeated decision reversals, leading to inefficiencies and missed opportunities for improvement. It’s like trying to diagnose a car’s engine by looking only at the speedometer—you’ll never catch the misalignment in the gears. Narrative-Driven Insights: The Optimal Solution Contrast this with a narrative-driven approach . When you narrate a

I used to deliver food on Zepto. 14-15 hours a day. Sun, rain, didn't matter. I saved up, bought a laptop, and started doing video editing for clients. That's when things got messy. I was managing clients on WhatsApp. Tracking who paid me in Google Sheets. Sending invoices as PDF attachments that nobody opened. Every new client meant another chat group, another row in my spreadsheet, another folder I'd forget about. I went looking for one tool that could handle all of this. CRM, invoicing, projects, client communication — in one place. Everything was either $200+/month (when you add up all the separate tools) or missing basic stuff like a client portal. So I started building my own. That was a month ago. What I actually built Arpixa. One dashboard for agencies and freelancers. CRM, invoicing, project boards, AI assistant, file manager, scheduling, analytics, and a client portal where your clients can view projects, pay invoices, and message you. Every agency gets a branded subdomain — youragency.arpixa.io. Your clients see your brand, not mine. I'm not going to dump the whole feature list here. You can check arpixa.io if you're curious. The hard parts nobody warns you about Subdomains are a nightmare. Giving every user their own subdomain sounds simple until you realize auth doesn't work across subdomains by default. I had to build a token handoff system where you log in on one domain and the session gets securely passed to your workspace subdomain. It took longer than I expected going in — auth is the part everyone assumes is solved and nobody explains. Two payment gateways, because one isn't enough. I integrated both Stripe and Razorpay. Stripe for international users, Razorpay for India (UPI is how everyone pays here). The app auto-detects your country and shows the right payment flow. Sounds fancy — mostly it was just a lot of logic and twice the amount of webhook handling. Security rules will humble you. I wrote database-level security rules for every single co

A cat astrologer, spec-driven and running on Amazon Bedrock A companion to A Builder in Paris: Do Devs Dream of Électrique Chats? Last month I wrote about the idea. Six rainy days in Paris, a closed laptop, and a hackathon I did not mean to enter, and somewhere between the Musée de l'Orangerie and a lot of walking, an idea arrived. Cats are inscrutable. The people who love them are obsessed with understanding them anyway. Astrology is an old framework for making the unknowable feel readable, and maybe, just maybe, it helps us understand them a little. Her name is Madame Minou , a French cat astrologer who reads your cat's stars from a café terrace. That first article was the idea . This one is the build. Vibe-coded, but on rails Was it vibe-coded? You know it! AI wrote the lines, and I said "no, not like that" more times than I can count. But it was vibe-coding on rails, and the rails were Kiro. Before a single line of app code, I wrote the requirements in EARS notation, a design doc, and a build-ordered task list, all living in .kiro/specs . Decide what "done" means before letting anyone, human or model, start building. The specs are what kept the vibes on track. Then the steering files. .kiro/steering held the enduring rules of the project: product principles, security guardrails, technical direction, and UI law. These were the thing that kept a long, multi-session build from drifting. When a new session opened, the steering files were already the shared context. "The café blue" was one token, not five guesses. Security was not optional. The garbled café sign was a deliberate easter egg, not a bug to fix. From there, the loop: Kiro implemented one approved block at a time, ran each task's PASS/FAIL QA gate on itself before moving to the next, and only stopped for my review on the two things that actually mattered. I directed and approved. Kiro proposed and built. Spec first, block by block, human in the loop. The facts are sacred Here is the part that looks like a

디지털 자산과 인공지능 분야는 핵심 기술은 다르지만, 데이터의 진실성, 규제 체계, 지정학적 함의에 대한 공통된 도전에 직면하며 점차 수렴하고 있다. 최근 일련의 사건들은 탈중앙화와 첨단 연산이 약속하는 미래가 인간의 행동, 경제적 유인, 그리고 국가적 목표라는 현실과 충돌하는 중요한 변곡점을 보여준다. 제재 대상 러시아 스테이블코인의 논란 많은 거래량 주장부터 전 미국 대통령이 약세장 속에서 거둔 전례 없는 암호화폐 수익, 그리고 선두 AI 모델을 둘러싼 당혹스러운 "너프(성능 저하)" 논쟁에 이르기까지, 이 모든 이야기는 혁신과 불투명성이 난무하는 디지털 최전선의 모습을 생생하게 그려낸다. 이 글은 겉으로는 서로 달라 보이는 이러한 현상들을 깊이 파고들어, 그 기저의 메커니즘, 기술적 복잡성, 그리고 글로벌 디지털 경제에 미치는 광범위한 영향을 탐색하고자 한다. 우리는 블록체인 분석이 불법 금융 활동 주장에 어떻게 도전하는지, 정치인들이 신생 산업에 관여하며 제기하는 윤리적 및 규제적 난제는 무엇인지, 그리고 복잡한 AI 시스템을 평가하는 미묘한 기술적 문제들을 살펴볼 것이다. 이러한 분석들을 관통하는 공통적인 실마리는 바로 강력한 검증, 투명한 거버넌스, 그리고 정교한 이해가 필수적이라는 점이다. 정보가 쉽게 조작될 수 있고, 진정한 효용성이 복잡성이나 전략적 오도 뒤에 가려지기 쉬운 생태계를 헤쳐나가기 위해서 말이다. 디지털 자산과 AI가 금융, 거버넌스, 그리고 일상생활을 계속해서 재편하는 가운데, 부풀려진 지표 속에서 진정한 활동을, 시스템적 결함 속에서 실제 역량을 식별하는 능력은 투자자, 정책 입안자, 기술자 모두에게 더없이 중요해지고 있다. 지난 10년간 암호화폐와 인공지능 분야는 폭발적인 성장을 거듭하며 각각 변혁적인 잠재력을 제시하는 동시에 새로운 도전 과제들을 안겨줬다. 예를 들어, 스테이블코인은 본래 암호화폐 시장의 변동성을 완화하기 위해 법정화폐나 다른 자산에 가치를 고정하도록 고안되었으나, 글로벌 디지털 금융 인프라의 핵심 구성 요소로 진화했다. 특히 엄격한 금융 제재를 받는 지역에서 국경 간 결제를 촉진하는 그들의 유용성은 양날의 검이 되어, 합법적인 사용자뿐 아니라 전통적인 금융 통제를 우회하려는 이들까지 끌어들이고 있다. 2022년 이후의 지정학적 환경은 경제 제재에 대한 초점을 더욱 강화했고, 제재 대상 기업들은 디지털 자산이 제공하는 대안적 금융 경로를 모색하게 되었다. 동시에 디지털 자산의 주류 금융 및 정치권으로의 통합은 가속화됐다. 한때 틈새 기술적 호기심에 불과했던 암호화폐는 이제 상당한 경제적 힘으로 자리 잡았고, 기관 투자뿐만 아니라 최근 공개된 바와 같이 유명 인사들에게도 막대한 개인 자산을 안겨주고 있다. 이러한 주류화는 필연적으로 암호화폐를 국가 규제 기관의 감시 아래 놓이게 하며, 업계의 종종 자유지상주의적 정신과 국가의 감독, 과세, 소비자 보호 요구 사이에서 긴장을 유발한다. 특히 규제 환경이 아직 형성되는 단계에서 정치인들이 이 신흥 부문에 관여하는 것은 이해 상충과 공직 내 개인적 금전 이득의 윤리적 경계에 대한 복잡한 질문들을 제기한다. 이러한 발전과 병행하여, 인공지능, 특히 대규모 언어 모델(LLM)은 불과 몇 년 전에는 상상할 수 없었던 능력을 보여주며 빠르게 발전했다. 그러나 종종 "블랙박스"처럼 작동하는 이 모델들의 복잡성은 평가, 제어, 그리고 윤리적 배포를 보장하는 데 상당한 난관을 초래한다. "너프" 또는 성능 저하를 둘러싼 논쟁은 AI 시스템의 진정한 능력을 벤치마킹하고 이해하는 데 내재된 어려움을 강조한다. 특히 안전 분류기와 같은 내부 아키텍처 구성 요소가 관찰되는 동작을 크게 바꿀 수 있기 때문이다. 제재 회피, 암호화폐의 정치경제, AI 모델 평가라는 이 세 가지 독특하지만 서로 연결된 서사는 점점 더 디지털화되고 알고리즘에 의해 움직이는 세상에서 투명성, 책임성, 그리고 정확한 평가를 위한 광범위한 노력을 강조한다. 최근의 뉴스들은 디지털 자산과 AI 생태계에 내재된 기술적 복잡성과 분석적 도전 과제들을 심층적으로 보여준다. 제

Why I'm Building the Fast Series I'm building the Fast Series because creator software has gotten too complicated. Plenty of tools are powerful, but they make you fight the software before you can make anything. You want to record a tutorial, stream a game, clip a useful moment, compress a file, or turn an idea into a short video. Instead, you're digging through settings, codecs, plugins, device permissions, export presets, and cryptic error messages. That's the problem I keep running into, and the Fast Series is my attempt to solve it: practical Windows software where each tool does one job clearly and reliably. Not everything needs to be a giant all-in-one platform. Sometimes the better product is a small tool that opens quickly, gives you sensible defaults, explains what's happening, and gets out of your way. That's the direction I'm taking with Sturm Technologies. The Problem With Creator Tools There are already great tools for recording, streaming, editing, clipping, and compressing. OBS is powerful. Professional editors are powerful. FFmpeg is powerful. There are cloud tools, browser tools, AI tools, and creator suites that promise to do everything. But power is not the same thing as clarity. Most creators don't want to become experts in capture APIs, bitrate math, encoder settings, audio routing, or export pipelines. They want to make something and publish it. The pain usually shows up in small moments. You record a video and the audio is missing. You compress a file and it still doesn't meet the upload limit. You spend more time scrubbing a long video than actually clipping it. You hit an error and the app hands you a technical dump instead of telling you what to fix. That's where I think there's room for better software. Not bigger software. Better software. Start With FastCast The first product in the series is FastCast , a Windows recording and streaming app for people who want OBS-level practicality without OBS-level setup. FastCast focuses on screen cap

TIL: Streaming Data in Go with iter and yield While building RagPack , a library that chunks files for embedding, I needed a common way to stream parsed content from multiple file formats. RagPack supports CSV, PDF, DOCX, HTML, XLSX, Markdown, JSON and more. Each format has its own parser, but the ingester that consumes them should not care which one it is talking to. I needed a shared contract. In Java I would have reached for an Iterator<T> or an InputStream , but in Go the answer turned out to be the iter package, introduced in Go 1.23. The Parser interface The iter package introduces two types. Seq[V] yields a single value at a time, and Seq2[K, V] yields a pair: type Seq [ V any ] func ( yield func ( V ) bool ) type Seq2 [ K , V any ] func ( yield func ( K , V ) bool ) Seq2 is the right fit here because each iteration naturally produces two things: a parsed unit and any read error. This matches Go's standard (value, error) convention and lets the caller handle errors inline without wrapping them in a struct. That made iter.Seq2[Unit, error] a natural return type for the Parser interface: type Parser interface { Parse ( ctx context . Context , r io . ReadCloser ) iter . Seq2 [ Unit , error ] } Every sub-parser, CSVParser , PDFParser , DocxParser , HTMLParser and so on, implements this one method. The ingester does not need to know which format it is dealing with. Implementing a parser Here is what a parser implementation looks like: func ( p * Parser ) Parse ( _ context . Context , r io . ReadCloser ) iter . Seq2 [ Unit , error ] { return func ( yield func ( Unit , error ) bool ) { defer r . Close () reader := bufio . NewReader ( r ) for { line , err := reader . ReadString ( '\n' ) if err == io . EOF { break } if err != nil { yield ( Unit {}, err ) return } if ! yield ( Unit { Text : strings . TrimRight ( line , " \n " )}, nil ) { return } } } } The if !yield(...) { return } part is the key. If the caller breaks out of the loop early, yield returns false and we

How we integrated real-time phrase translation feedback into our AI-powered book translation workflow, and what we learned about latency, context, and prompt engineering. When we launched LectuLibre, our AI-powered book translation platform, users loved the quality of full-chapter translations. But they kept asking for something else: while reading a partially translated book, they'd stumble on an untranslated phrase or an awkward auto-translation and want to quickly get a better version without leaving the page. So we built 即时翻译求助 (Instant Translation Help)—a feature that lets readers highlight any phrase and get a context-aware, human-quality translation within seconds, along with a brief explanation of tricky parts. Here's how we built it, the technical challenges we faced, and the lessons we learned about stitching LLMs into a real-time reading experience. Problem: Real-time, Context-Aware Translation Inside a Book Most web apps offer generic translation via API calls—send a sentence to Google Translate, get a result. But that doesn't work for literary texts. A phrase like "She let the cat out of the bag" needs to be translated idiomatically, and the appropriate rendering depends heavily on the surrounding paragraphs (is the tone formal? sarcastic? part of a metaphor chain?). Our existing translation pipeline processes entire chapters in bulk with carefully crafted prompts, but for instant help, we needed sub-second latency while preserving that same depth of context. Our Approach: Server‑Sent Events and a Smart Prompt Buffer We chose Server-Sent Events (SSE) over WebSockets because the communication is one-directional (server pushes translation tokens) and SSE is simpler to implement with FastAPI. The client (a React app) sends a POST request with: The phrase to translate The book ID and the exact location (chapter/paragraph index) The target language Our backend retrieves the surrounding text from PostgreSQL (we store the original book in chunks), feeds a care

Over the past week, the AI hardware news I've been tracking adds up to more than $610 billion in capital deployed globally — in just seven days. Not valuations. Not market cap. Actual capital expenditure commitments. Korea $550B, Japan $6B, Qualcomm's new accelerator, Kawasaki Heavy Industries' $1B AI infrastructure bond — this round of moves has already surpassed the wildest half-year of the 2000 dot-com bubble in scale. But this time the money isn't flowing into web pages. It's flowing into chips, memory, and power. Watching all of this over the past few days, I've been thinking: for investors and for builders like us making products on top of AI, what does this gamble actually mean? The Real Story Behind AI Training Bottlenecks: From GPU Scarcity → Memory Scarcity → Power Scarcity Honestly, everyone watches AI through the lens of models, but the real bottleneck was never the models — it's been the hardware. From 2023 to 2025, the bottleneck shifted from GPU scarcity to memory scarcity, and is now pushing toward power scarcity. When GPUs were tight, everyone scrambled for H100s and NVIDIA raked it in — but the part that actually throttled the H100 wasn't the GPU core, it was the HBM high-bandwidth memory. On the B200, the HBM3E stacked on top has its capacity locked up entirely by NVIDIA at SK Hynix, while Samsung is chasing hard but its yields can't keep up. That's why South Korea just committed $518B to build 4 memory fabs plus $52B for the central regions, totaling $550B ( TechCrunch ). This isn't just about filling upstream capacity — the key is that Samsung + SK Hynix are trying to flip themselves from being NVIDIA's downstream suppliers into becoming the dominant players in AI hardware. Why did downstream hardware investment kick off so late? Because for the past two years people were still watching and waiting to see if "this AI hype cycle would cool down again." By 2026, GPT-6, Claude 4, and Gemini 3 are all live, inference costs have come down, user numbe

If you've ever wanted an AI that doesn't just chat but actually does things — queries databases, calls APIs, makes decisions, and learns from results — you're in the right place. In this tutorial, I'll show you how to build production-ready AI agents using Solon 4.0's ReActAgent . By the end, you'll have built an agent that can reason through complex problems, use external tools, and adapt its behavior based on real-world feedback. What Makes ReActAgent Different? Traditional LLMs are great at generating text, but they hit a wall when they need to interact with the real world — checking a database, fetching live data, or performing calculations. ReActAgent (Reason + Act) breaks through that wall. It implements a cognitive loop: Thought → Action → Observation → (repeat or finish) The agent thinks about what to do next, acts by calling a tool, observes the result, and decides whether to continue or deliver the final answer. This isn't just theory. Solon's ReActAgent has been used in production for automated customer support, intelligent data analysis, and multi-step workflow automation. 1. Adding the Dependency First, add the solon-ai-agent module to your project: <dependency> <groupId> org.noear </groupId> <artifactId> solon-ai-agent </artifactId> </dependency> Note : If you're using Solon's parent POM, the version is managed automatically. Otherwise, use the latest Solon version. 2. Building a ChatModel (The Agent's Brain) Every agent needs a "brain" — a ChatModel that powers reasoning. Let's build one using the fluent API: import org.noear.solon.ai.chat.ChatModel ; ChatModel chatModel = ChatModel . of ( "https://api.moark.com/v1/chat/completions" ) . apiKey ( "your-api-key-here" ) . model ( "Qwen3-32B" ) . build (); You can also configure it via YAML and inject it: solon.ai.chat : demo : apiUrl : " http://127.0.0.1:11434/api/chat" provider : " ollama" model : " llama3.2" @Inject ( "${solon.ai.chat.demo}" ) ChatConfig chatConfig ; ChatModel chatModel = ChatModel . o

📖 Article original : GitHub Gist Un guide technique par Mohamed ben mallessa Le problème Recevoir un dossier de 500 fichiers HEIC à convertir en WebP pour un site web est une situation courante pour tout développeur. Les solutions traditionnelles ont leurs limites : ImageMagick nécessite des codecs spécifiques, les convertisseurs en ligne sont limités en taille, et le traitement manuel est exclu à cette échelle. La solution Photopea (Photoshop gratuit dans le navigateur) supporte nativement tous les formats d'image courants. En l'utilisant comme moteur de conversion piloté par script, on obtient un pipeline batch rapide et fiable. Formats supportés Entrée Sorties possibles HEIC / HEIF JPG, PNG, WebP JPEG WebP, PNG, PSD PNG JPG, WebP WebP PNG, JPG PSD PNG, JPG, WebP SVG PNG, JPG TIFF PNG, JPG, WebP Pipeline Dossier source (500 HEIC) → Photopea → Dossier sortie (500 WebP) Le script préserve la structure des sous-dossiers, applique le redimensionnement et la qualité configurés, et livre les fichiers organisés. Paramètres typiques --format webp # Format de sortie --quality 80 # Qualité (1-100) --resize 1920 # Redimensionnement (côté long) --output ./web/ # Dossier de destination Avantages Un seul outil pour tous les formats d'entrée Aucun codec à installer (Photopea gère tout nativement) Gratuit et sans abonnement Local — les fichiers ne quittent pas votre machine Structure préservée — l'arborescence est conservée Mohamed ben mallessa — Full-stack developer & solutions B2B 🔗 GitHub · LinkedIn opensource #webp #python #tutorial 💻 Vous avez un projet technique ? Développement full-stack, automatisation IA, solutions B2B sur mesure. 🔗 GitHub 💼 LinkedIn 🎨 Behance Article initialement publié sur GitHub Gist

The Problem That Wouldn't Leave Me Alone Pakistan has 220 million people. A functioning legal system. Hundreds of Acts, ordinances, and constitutional provisions that technically protect every citizen. Almost nobody can use them. The median lawyer's consultation fee in Karachi is more than what many families earn in a week. Legal aid is understaffed and geographically concentrated in major cities. And the laws themselves? Written in English — a language most of the population reads functionally at best, and doesn't speak at home at all. So when a landlord illegally locks someone out. When a factory worker gets fired without severance. When a woman wants to know her inheritance rights. When a tenant needs to understand what "Section 16 of the Rent Restriction Ordinance" actually means for their specific situation — they either find a lawyer they can't afford, ask someone who doesn't really know, or quietly give up. This isn't a knowledge problem. It's an access problem. I'm a CS student at Sukkur IBA University in interior Sindh — not Karachi, not Islamabad. The kind of city where you feel the gap between what the law says and what people actually know it says every single day. That gap is where HAQ started. HAQ is an Arabic and Urdu word. It means right — as in, what is rightfully yours. The name felt important. The Core Idea: Ask the Law, Get the Law There's a specific failure mode with AI and legal questions that drove every design decision I made, and it's worth naming clearly. Standard LLMs — any of them — will answer legal questions confidently. They'll cite "Section 144" or "the Transfer of Property Act" with total authority. They are often wrong. Sometimes subtly: the section exists but doesn't say what the model claims. Sometimes obviously: the Act doesn't apply in that province. Always uncitable: the user has no way to verify without finding the source themselves. For an accessibility tool, a confidently wrong answer isn't neutral. It's actively dangerous.

If you've ever tried integrating a large language model (LLM) into a Java application, you've probably written a lot of boilerplate: HTTP clients, JSON parsing, streaming handling, session management. Solon 4.0's ChatModel abstracts all of that away with a clean, builder-oriented API. In this guide, I'll walk through building real, working AI features using ChatModel — from a simple chat call to a streaming chatbot with conversation memory. 1. What Is ChatModel? ChatModel (package org.noear.solon.ai.chat ) is a unified LLM client in Solon's AI ecosystem. Instead of writing raw HTTP calls for different model providers, you use a single API that supports: Synchronous calls — one-shot request, full response Streaming calls — reactive streaming via Project Reactor ( Flux<ChatResponse> ) Tool/Function Calling — let the LLM invoke your Java methods Chat Sessions — automatic conversation memory Multi-modal messages — text, images, audio Dialect adaptation — works with OpenAI, Ollama, Anthropic, Gemini, DashScope, and more The best part? It uses a dialect pattern — you point it at any compatible LLM endpoint, and it adapts automatically. 2. Setting Up Add the dependency to your pom.xml (no parent POM needed — Solon works standalone): <dependency> <groupId> org.noear </groupId> <artifactId> solon-ai </artifactId> <version> ${solon.version} </version> </dependency> This pulls in all built-in dialects (OpenAI, Ollama, Gemini, Anthropic, DashScope). 3. Configuration 3.1 Via YAML (Recommended) solon.ai.chat : demo : apiUrl : " http://127.0.0.1:11434/api/chat" # Full URL, not baseUrl provider : " ollama" # Dialect identifier model : " llama3.2" # Model name headers : x-demo : " demo1" Then create a @Bean to get a ready-to-use ChatModel : import org.noear.solon.ai.chat.ChatConfig ; import org.noear.solon.ai.chat.ChatModel ; import org.noear.solon.annotation.Bean ; import org.noear.solon.annotation.Configuration ; import org.noear.solon.annotation.Inject ; @Configuration public cla

Half a year ago, I wanted to see for myself what can we currently have with local LLMs. I went down the rabbit hole, learned quite a lot in the process, and shared my results in an article . The results were pretty discouraging: even with 32 GB VRAM, the best models I could run were both too slow and too dumb. At the same time, what you could get for free from inference providers was actually decent - and much faster. I remember my conclusion: "Let's wait for the next generation of models, which looks very promising. If we can run something comparable to full-size Qwen3-Coder-480B locally, that would be year of the Linux Desktop age of fully capable local LLMs. And now this day has arrived. Models Half a year later, I'm revisiting this question. And this time, the whole situation has turned upside-down. Almost none of the providers still have free tier, and anything that's still free is barely good enough even for the simplest tasks. And is rate-limited all over. And on the local side, the next Qwen lineup is out. So, that's what I'm going to be looking at. Once again, I have two RX6800's, 16 GB each, and 64 GB RAM. On one hand, this is more VRAM than any "normal person" can have with one GPU - unless you've got something specifically for AI, like an unified-memory Mac or a DGX Spark. On the other hand, RX6800 is "pre-AI" - anything newer will have much better performance thanks to tensor processors. Qwen3.6-27B : This is a dense model, so basically you can't run it at all on anything less than 32 GB VRAM. It's the slowest one, but also the best one if you can run it. Its accuracy is claimed to be on par with Claude 4.5 Opus, and better than Qwen3.5-397B-A17B . This is what I've been waiting for. It runs reasonably fast on my setup, so it's very much usable both in terms of performance and accuracy. Qwen3.6-35B-A3B : This one is MoE, and it's pretty small, so it's the fastest one. It's good for anything that doesn't require too much (i.e. for agentic tasks that don'

GitHub said this week that Copilot CLI, when it runs inside a GitHub Actions workflow, will accept the built-in GITHUB_TOKEN for authentication. Per the July 2 changelog, the previous path required creating and storing a personal access token. The operational read is small and precise: one fewer human-owned credential to mint, rotate and inherit. The exact scope of the change The changelog covers a narrow surface. It applies to Copilot CLI when invoked from a GitHub Actions workflow, and it swaps the required credential from a PAT to the workflow's ambient GITHUB_TOKEN . GitHub does not describe changes to how Copilot CLI authenticates outside Actions, and this post will not extrapolate to those contexts. If your Copilot CLI usage lives on a developer laptop or in another CI system, nothing in this announcement moves for you. Why the PAT was the wrong credential to leave in the loop A personal access token has almost none of the properties you would want from an automation credential. It does not expire on a job boundary. It carries a person's identity, not the workflow's. It sits in Actions secrets long enough to outlive the engineer who created it. And its scopes were chosen by that engineer, at that moment, often wider than the job actually needs. GITHUB_TOKEN is the opposite shape. Actions mints it at the start of a job, scopes it through the workflow's permissions: block, and revokes it when the job ends. If the token leaks, the window for abuse is the runtime of the job, not the years until somebody remembers to rotate it. When the person who wrote the workflow leaves, the pipeline does not silently break because a token expired with their account. For scripted Copilot CLI calls that had to be wrapped in a PAT, that is the whole win. The tool authenticates against the workflow instead of against a human. Wiring it up The workflow-side pattern is the same one every GITHUB_TOKEN -consuming step already follows: declare permissions: explicitly at the job level, k

We’ve all been there. You start your morning feeling like a Productivity God, sitting straight and typing at 120 WPM. Fast forward four hours, and you've morphed into a literal shrimp, face inches away from the monitor, hunting for a missing semicolon. 🦐 In this era of remote work, real-time posture correction and computer vision for health have become more than just "cool projects"—they are spinal lifesavers. Today, we’re going to build a desktop application using MediaPipe , WebRTC , and Electron that monitors your neck angle and sends a desktop notification the moment you start slouching. By leveraging MediaPipe Pose and TensorFlow.js , we can calculate the Forward Head Posture (FHP) ratio with surgical precision directly in the browser environment. The Architecture 🏗️ Before we dive into the code, let’s look at how the data flows from your webcam to that "Sit up straight!" notification. graph TD A[Webcam Feed] -->|MediaStream| B(WebRTC API) B -->|Video Frames| C[MediaPipe Pose Model] C -->|Landmarks| D{Geometry Engine} D -->|Calculate Ear-Shoulder Angle| E{Threshold Check} E -->|Angle > 30°| F[Electron Main Process] F -->|Trigger| G[System Desktop Notification] E -->|Healthy| H[Continue Monitoring] style G fill:#f96,stroke:#333,stroke-width:2px Prerequisites 🛠️ To follow along, you'll need the following tech stack: MediaPipe Pose : For high-fidelity body tracking. WebRTC : To capture the video stream from your webcam. Electron : To wrap our logic into a desktop app that runs in the background. TensorFlow.js : The backbone for running ML models in JavaScript. Step 1: Setting up the Video Stream (WebRTC) First, we need to grab the camera feed. In a modern browser environment (or Electron's Chromium), we use navigator.mediaDevices.getUserMedia . async function setupCamera () { const videoElement = document . getElementById ( ' input_video ' ); const stream = await navigator . mediaDevices . getUserMedia ({ video : { width : 640 , height : 480 }, audio : false }); v

If you've ever built a feature that extracts text from PDFs, an Arabic-speaking user has probably filed this bug: "the words come out in reverse order." Not the letters — the words . Every line reads last-word-first. I spent the better part of a year fixing this class of bugs while building Confileo , a free PDF toolkit with first-class Arabic support. Here's what's actually going on, because almost every explanation online is wrong or incomplete. The four distinct failure modes People say "Arabic breaks" as if it's one bug. It's four: 1. Visual vs logical order (the reversed-words bug) A PDF doesn't store text the way a Word file does — it stores positioned glyph runs : "paint these shapes at these coordinates." For left-to-right scripts, the paint order happens to match the reading order, so naive extraction works by accident. Arabic is right-to-left. Many PDF generators emit the glyph runs in visual order — the order they appear on screen, left to right. A naive extractor concatenates the runs as stored and produces every line word-reversed. The text was never "reversed" in the file; your extractor just assumed paint order == reading order. Fix: reconstruct logical order using glyph positions + the Unicode Bidirectional Algorithm (UAX #9), not the content-stream order. Libraries like PyMuPDF already return text in logical order — a common mistake is "fixing" that output by reversing it again, which is how you get double-reversed text. Rule of thumb: never reverse Arabic yourself. If it looks backwards, your rendering layer lacks bidi support; the data is usually fine. 2. Disconnected letters (the ransom-note bug) Arabic letters are contextual: ع renders differently in initial, medial, final and isolated positions, and letters join. That joining is applied at render time by a shaping engine (HarfBuzz being the standard). If any step of your pipeline round-trips text through a non-shaping renderer — a canvas library, a barebones PDF writer, an image caption filter

Second in a series on using AI to review authorization — not to spray reports. Companion reference: AuthZ Smell Catalog . 1. Why AuthZ review is not vulnerability spraying The cheapest thing an AI can do in security is generate suspicion. Point a model at a codebase and it will hand you fifty "possible IDORs" before you finish your coffee. Almost all of them are wrong — guarded three lines up, scoped at the data layer, or protected at a boundary the model never saw. That flood is exactly why several bug bounty programs spent 2026 tightening or pausing: they were drowning in confident, plausible, wrong reports. So this review inverts the usual loop. The AI's job is not to find bugs — it is to over-generate hypotheses cheaply . My job is to kill them. What survives that killing is the only thing worth a human's time, and the record of what died is more useful than the record of what lived. The artifact of an honest review is therefore not a finding. It's a kill table . 2. Target and scope Target: Ory Kratos — an open-source identity and user-management server (login, registration, recovery, verification, sessions, self-service settings). Source-available, Apache-2.0. Why Kratos: it is exactly the shape where authorization goes wrong — multiple identities, a public API and an admin API, and (in Ory's hosted product) multi-tenancy. If a boundary is fragile, this is where it shows. Scope of this write-up: source reading only , on the public repository, single-tenant OSS build. No hosted target was touched. Nothing here is an undisclosed finding — the point is the method and the boundary design , and where relevant, how the design held against the hypotheses I tested. This maps to the reproduction tiers we track: everything below is repo_only , and I say so explicitly rather than implying it reaches a live product. What this review does and does not claim. In this limited, repo-only review, the hypotheses I tested were killed. This is not a claim that Kratos has no vulner