AI 资讯

The trust problem nobody scopes correctly When companies talk about trust in AI, they almost always mean trust in the model. Is the output accurate? Is it hallucinating? Can we rely on what it says? Those are valid questions but they're the wrong starting point. The trust that actually determines whether AI gets adopted or quietly abandoned inside an organization isn't about the model. It's about the system surrounding it. The four questions that determine Every team evaluating AI in a production workflow eventually runs into the same four questions. Not about model quality. About operational control. Can we understand the outputs? Not just "does the answer look right" but can someone on the team explain why this output was produced and whether it's appropriate for this specific context. An AI that generates correct-looking code or recommendations that nobody can verify is a system that runs on hope. Hope doesn't survive the first incident. Can we validate the decisions? When the AI recommends an action or generates an output that feeds into a business process, is there a way to check it against the actual requirement? Or does the team just trust the output because questioning it is harder than accepting it? The second one is more common than anyone admits. Can we intervene when needed? When something goes wrong, how fast can a human step in? Is there a kill switch? Is there a fallback path? Or does the AI output flow directly into downstream systems with no circuit breaker? The teams that skip this question are the ones that discover the answer during an incident. Can we trace what happened afterward? When an AI-generated decision produces a bad outcome, can you reconstruct the chain? What input went in, what output came out, what context was available, what wasn't? Without traceability, post-mortems hit a dead end, and the same failure happens again. Why opaque systems don't survive real operations There's a tempting argument that opacity is fine as long as the sy

I'm a bit annoyed by the feeling that we're kind of stuck when it comes to using LLMs for programming. I use Claude Code and Codex, but I haven't been able to enter flow state like I can when I hand write code. This is kind of ironic to me since AI should be a bicycle for the mind, but right now it feels like a bicycle that just brakes abruptly every couple minutes. I stop, wait, review, prompt again. Is there anyone exploring something fundamentally different than the prompt response loop we ha

If you ask any senior backend engineer or database administrator how to instantly make a slow, disk-bound application faster, their first answer is almost always: "Put it in memory." But why is memory so preferred, and how do modern architectures utilize RAM to achieve sub-millisecond latencies? We're seeing a massive revival of RAM disks and in-memory architectures. Let's explore why computer experts are increasingly treating RAM like a hard drive. 1. The Physics of Storage: Why RAM Wins To understand the shift towards in-memory architectures, we have to look at the numbers. Hard Disk Drives (HDDs): Mechanical spinning disks. Seek times are around 2-5 milliseconds . Solid State Drives (SSDs): Flash memory. Seek times are around 0.1 milliseconds (100 microseconds) . RAM (Random Access Memory): Volatile silicon. Access times are around 100 nanoseconds . RAM is roughly 1,000 times faster than an SSD and 10,000 to 50,000 times faster than an HDD. When you have a high-throughput system serving millions of requests per second, waiting for a disk to seek is an eternity. 2. In-Memory Databases: Redis and Memcached The most common implementation of this principle in modern backends is the In-Memory Database . How They Work Instead of writing every transaction to an SSD, systems like Redis and Memcached store the entire dataset directly in RAM. This bypasses the OS file system cache, disk I/O bottlenecks, and complex B-tree traversals required by traditional relational databases like PostgreSQL or MySQL. The Trade-off: Durability RAM is volatile. If the server loses power, all data is gone. So how do in-memory databases survive crashes? Snapshots (RDB in Redis): Periodically dumping the entire memory state to disk. Append-Only Files (AOF in Redis): Logging every write operation to a disk sequentially. Sequential writes to disk are significantly faster than random writes. This hybrid approach gives you the read/write speed of RAM with a "good enough" durability guarantee for

Todo projeto que envolve autenticação via telefone acaba esbarrando no mesmo problema chato: como testar isso de verdade? Você não pode ficar digitando seu próprio número toda vez que roda um fluxo de cadastro. Definitivamente não deveria pedir para os colegas de equipe cederem o deles. E a maioria dos pipelines de CI não tem uma pessoa sentada ali, pronta para ler uma mensagem de texto e digitar o código num formulário. É uma daquelas coisas que parecem pequenas até você estar três sprints dentro de um projeto com 2FA via SMS e perceber que a cobertura de teste desse fluxo inteiro é "testei uma vez, manualmente, antes do almoço". Por Que a Verificação por Telefone É Complicada de Testar A maioria dos fluxos de autenticação de um stack típico é fácil de automatizar. Verificação por e-mail, dá para interceptar com uma caixa de entrada de teste ou um serviço de captura de e-mails. Tokens de sessão, dá para mockar. Redefinição de senha, você controla o loop inteiro. O SMS quebra esse padrão porque o código precisa sair completamente do seu sistema, ser entregue por uma rede de telecomunicação real e voltar antes que o teste possa continuar. Essa ida e volta introduz vários pontos de falha que não têm nada a ver com o seu código: atrasos de operadora, filtros de spam, peculiaridades de entrega por região, limites de taxa. Se você já viu um pipeline de CI falhar numa etapa de verificação por telefone e depois passar numa nova tentativa sem nenhuma mudança de código, é quase sempre por causa disso. O instinto de muitas equipes é pegar um número público gratuito de um dos vários sites de "receber SMS online" para checagens manuais rápidas. Isso funciona bem para uma verificação pontual. Mas desmorona rápido quando você tenta automatizar, porque esses números são compartilhados potencialmente por milhares de outras pessoas usando o mesmo pool. Códigos podem se perder numa caixa de entrada lotada, o próprio número pode já estar bloqueado pela plataforma que você está testand

Laravel middleware can be perfectly written and still behave unexpectedly. You may notice authentication running too late, permission checks failing, tenant initialization not working, logging middleware missing important data, or custom middleware executing in an order you didn't expect. In many cases, the middleware code itself is not the problem. The real issue is middleware execution order. Understanding how Laravel executes middleware is critical when building secure and scalable applications because every request passes through multiple layers before reaching your controller. Common Symptoms You may encounter problems such as: Authenticated users being treated as guests Permission middleware failing unexpectedly Tenant information not being available Request logging missing user details Rate limiting triggering before authentication Redirect loops after login Middleware appearing to be ignored completely These issues are often caused by middleware running in the wrong sequence. How Laravel Processes a Request A typical Laravel request follows this flow: Browser ↓ Global Middleware ↓ Middleware Group (Web/API) ↓ Route Middleware ↓ Controller ↓ Response ↓ Browser Each middleware layer can inspect, modify, allow, or block the request before it reaches your application logic. Because of this, execution order matters. Example Problem #1 Suppose you have two middleware: Authenticate User Log User Activity Your logging middleware expects an authenticated user. $user = auth()->user(); However, the log always shows null. Why? Because the logging middleware executes before authentication. The solution is ensuring authentication middleware runs first so user information is available when logging occurs. Example Problem #2 Multi-tenant applications often initialize tenant information through middleware. TenantMiddleware If another middleware accesses the database before tenant initialization, queries may use the wrong database connection. This can lead to: Incorrect data

Actually it happened in June of 2025, but the process has completed recently, though. After Apple had announced the support of OCI-compatible containers in the June '25 it took a year to complete development and implement full support of continers. Apple had published 1.0 version of own container manager ( https://github.com/apple/container ). And Microsoft had announced native support of containerization without Docker in Windows 11 ( https://devblogs.microsoft.com/commandline/wsl-container-is-now-available-for-public-preview/ ). Now Linux is a part of any major platform: Windows, MacOS, BSD and Linux itself. Knowledge of Linux is now part of learning any of these systems, at least for developers. And now you can rely on Linux based containers running everywhere. What it is if not a win!? What's also interesting. Linux can run other Linux distros and with this Alpine Linux could become the most popular version of Linux in the World It's the biggest win for the whole open-source software and I believe it should get into history books of technological progress submitted by /u/BankApprehensive7612 [link] [留言]

I recently built a free online image processing tool that runs entirely in the browser. No uploads, no servers, no sign-ups. Here's how it works under the hood. https://img.aixiaot.com The Problem Most online image tools require uploading your photos to someone else's server. This raises privacy concerns and limits file sizes. I wanted to build something that processes everything locally. Tech Stack - Next.js for the frontend - TensorFlow.js + Real-ESRGAN for AI upscaling - @imgly/background-removal for AI background removal - Tesseract.js for OCR - Canvas API for compression, resizing, format conversion Features • AI Background Removal - one click, works for portraits, products, animals • Image Compression - reduce file size up to 96% • Format Conversion - JPG, PNG, WebP • ID Photo Maker - passport and visa photos with customizable backgrounds • AI Image Upscaler - 2x to 8x with Real-ESRGAN • OCR - extract text from images, 20+ languages • Image Resizer - enlarge or shrink Architecture All processing happens client-side using WebAssembly and the Canvas API. When you upload an image, it never leaves your device. The AI models (background removal, upscaling) run locally in your browser using TensorFlow.js and ONNX Runtime Web. Open Source The entire project is open source under AGPL v3. You can find it on GitHub: https://github.com/haizeigh/ai-image-tools Try It https://img.aixiaot.com I'd love to hear your feedback! What features would you add?

Seven days of flow. Fixed a peer identity binding issue in py-libp2p, automated my Neovim lockfile merges, and added a massive batch of notes on xv6 and Category Theory. 10 commits and a solid PR in the works. TL;DR I managed to hit a perfect seven-day streak this week, balancing some deep-dive p2p networking work with necessary maintenance on my local environment. The highlight was opening a PR in py-libp2p to tighten up how PeerRecords are handled in the Kademlia DHT. On the side, I spent time automating the annoying parts of my Neovim config and dumping a fresh batch of notes into my knowledge base. 10 commits, 204 lines added, and a much cleaner workflow to show for it. What I Built Neovim Configuration & CI I’m a firm believer that your editor should work for you, not the other way around. My nvim repo saw a lot of action this week—9 commits in total—but most of it was under-the-hood maintenance. I’ve been leaning on Lua to keep things snappy, and this week was about ensuring my plugin ecosystem doesn't rot. I pushed several updates to keep plugins at their latest versions, but the real "quality of life" improvement was adding a chore to auto-resolve lazy-lock.json merge conflicts. If you’ve ever worked on your Neovim config across multiple machines, you know the headache of the lockfile drifting. I set up a flow to prioritize incoming changes, which saves me from manually triaging JSON diffs every time I pull from dev . It’s a small tweak, but it removes a recurring friction point in my daily flow. I also spent time cleaning up the root of the config, with about 37 additions and 33 deletions—refactoring is a constant process when you live in your terminal. The Knowledge Base I also put some serious time into main-notes . I’m currently going deep on a few different subjects, and I use this repo as my "second brain." I added 167 lines of new material across 13 files, covering a pretty diverse range of topics: xv6 (the re-implementation of Unix V6), Category Theo

Spent the week deep-diving into my dev-publish tool, focusing on durability and orchestrator resilience. 21 commits across two repos, with a massive cleanup of the publishing logic and some much-needed architecture documentation. TL;DR There is a specific kind of satisfaction that comes from taking a tool you use every day and finally giving it the "production-grade" treatment it deserves. This week was exactly that. I spent most of my time in the guts of dev-publish , moving past the "it works on my machine" phase and into "it works even if the world is on fire" territory. With 21 commits and over 11,000 lines of code churn, I focused on making the publishing orchestrator resilient and the state durable. What I Built The star of the show this week was dev-publish . If you’ve ever tried to automate cross-platform technical writing, you know that the edge cases are where the real pain lives. I pushed 16 commits here, touching about 45 files. The diff was pretty wild: +6,926 additions and -4,289 deletions. That net positive tells part of the story, but the deletions represent me ripping out brittle logic that just wasn't cutting it. Hardening the Orchestrator The biggest win was a massive fix to make the publish state durable and the orchestrator resilient. In the previous iteration, if a network request to an API (like Dev.to) failed halfway through a multi-platform push, the state was... let's just say "vague." I spent a lot of time in src ensuring that the orchestrator can now pick up where it left off. I also documented the published-flag semantics and re-run resilience in the README. It sounds like a small thing, but knowing that a re-run won't accidentally double-post your article is a huge weight off my mind. I also spent some time on the "boring but important" stuff. I normalized how tags are handled to make them safer across different platforms and implemented a much stricter resolution for cover images. If a local image is required but missing, the tool now

Spanlens is an open-source (MIT) LLM observability platform that lets developers monitor every call their application makes to OpenAI, Anthropic, Gemini, Mistral, OpenRouter, Azure OpenAI, or a local Ollama model. Integration takes one line: swap your client's baseURL to the Spanlens proxy, or run "npx @spanlens /cli init" and the wizard rewrites your code automatically. From that moment, every request is recorded with its model, token counts, latency, cost, and full prompt and response body, with streaming responses reconstructed automatically. The dashboard turns that raw log into operational insight. Cost tracking breaks spend down per request, per model, and per end user, and parses prompt-cache tokens separately so you see real cache savings rather than sticker price. Agent tracing visualizes multi-step workflows as Gantt waterfalls and node-and-edge graphs, highlighting the critical path so you can find the slowest dependency chain in a fan-out. Anomaly detection flags 3-sigma deviations in latency, cost, or error rate against a rolling 7-day baseline with root-cause hints. Alerts on budget, error rate, and p95 latency are delivered to Email, Slack, or Discord. Spanlens goes beyond passive logging. A regex-based PII and prompt-injection scanner inspects request and response bodies and can block injections at the proxy. The savings engine spots calls that match a cheaper model's profile (for example, a gpt-4o call that looks like a classification task) and estimates the monthly saving from switching. Prompt versioning with A/B experiments compares versions on latency, cost, and error rate using Welch's t-test for statistical significance, and an LLM-as-judge evaluation framework (judge with OpenAI, Anthropic, or Gemini) scores outputs against rubric anchors, with human agreement measured by Pearson r or Cohen's kappa. Reusable datasets power offline evals and regression checks.

One question I get surprisingly often is: "How do you manage thousands of AI prompts without losing track of them?" The answer is simple. I don't treat prompts as conversations. I treat them as reusable software assets. Over the years, I've created prompt libraries across multiple AI projects, books, research initiatives, and client work. That means managing well over 10,000 prompts covering everything from Python development and AI agents to content generation and workflow automation. If you're still storing prompts in random ChatGPT conversations, you're making life much harder than it needs to be. Here's the system that works for me. Stop Thinking of Prompts as Temporary Most people write a prompt, get an answer, and move on. That's fine for casual use. But builders rarely solve the same problem only once. If you find yourself writing: API documentation SQL queries FastAPI endpoints Docker configurations Code reviews Git commit messages ...you're probably solving recurring problems. Recurring problems deserve reusable prompts. My Folder Structure Instead of organizing prompts by AI tool, I organize them by purpose. For example: AI-Prompts/ │ ├── Python/ │ ├── FastAPI │ ├── Django │ ├── Flask │ └── Automation │ ├── JavaScript/ │ ├── React │ ├── Node.js │ └── TypeScript │ ├── DevOps/ │ ├── Docker │ ├── Kubernetes │ └── GitHub Actions │ ├── AI/ │ ├── RAG │ ├── Agents │ ├── MCP │ └── Prompt Engineering │ └── Documentation/ This mirrors how software projects are organized. Finding a prompt takes seconds. Every Prompt Has Metadata A prompt isn't just text. It's documentation. Each prompt in my library includes: Category: Purpose: Model: Input: Expected Output: Version: Last Updated: For example: Category: FastAPI Purpose: Generate CRUD endpoints Model: GPT-4o Expected Output: Production-ready FastAPI code Six months later, I know exactly why that prompt exists. I Version My Prompts Developers version code. Why not prompts? For example: FastAPI_CRUD_v1.md FastAPI_CRUD_v

Base64 image data URIs are one of those web techniques that look like a magic shortcut the first time you use them. Instead of referencing an external file: <img src= "/logo.png" alt= "Logo" > you can put the image bytes directly in the document as text: <img src= "data:image/png;base64,iVBORw0KGgoAAAANSUhEUg..." alt= "Logo" > That can be useful. It can also make a page slower, harder to cache, and more annoying to maintain. Here is the practical rule: inline images as Base64 when self-containment matters more than caching. Keep normal image files when the browser should be able to cache, resize, lazy-load, or optimize them independently. What a Base64 image actually is An image file is binary data. Base64 rewrites that binary data as plain text using a limited character set. To make the browser treat the text as an image, you wrap it in a data URI: data:image/png;base64,iVBORw0KGgoAAAANSUhEUg... The first part tells the browser the MIME type. The second part tells it the data is Base64 encoded. The long tail is the image itself. Base64 is not compression. It is not encryption. It is just a text representation of the same bytes. When inlining an image is worth it 1. Tiny icons and UI assets For very small images, removing an extra HTTP request can be worth the extra bytes. This is especially true for small icons, logos, placeholders, simple UI sprites, or tiny transparent PNGs. Modern HTTP/2 and HTTP/3 make extra requests cheaper than they used to be, so this is not an automatic win. But for a one-off tiny asset inside a small page or widget, a data URI can still be a clean choice. 2. Single-file deliverables Sometimes the point is not raw page speed. Sometimes you need one file that carries everything with it: an HTML report an email template a CodePen or demo snippet a CMS block where you cannot upload assets a test fixture that should not depend on external hosting In those cases, Base64 is useful because the image travels with the HTML, CSS, JSON, or JavaScript.

You write the postmortem. You file the action items. Everyone nods, the doc gets archived, and life moves on. Six months later, the exact same root cause takes down the exact same service — and nobody in the room remembers the first incident, let alone that its fix never actually shipped. "We use rootly to track this automatically. It flags when incidents have the same root cause as previous ones." That's a real answer from an SRE thread about this exact problem — and it's a paid, hosted feature of a full incident-management platform. Most teams don't have rootly or incident.io. What they have is a folder of markdown postmortems that nobody diffs against each other. So I built rootecho : a zero-dependency CLI that does the one useful thing those platforms do for this — flag when a new incident's root cause echoes a past one, and show you whether that past incident's action items ever actually got finished. How it works Each postmortem is one JSON record — free-text root_cause and/or curated root_cause_tags , plus action_items with a status: { "id" : "INC-2026-014" , "title" : "Payment webhook retries exhausted" , "root_cause" : "webhook retry queue misconfigured to drop after 3 attempts, no dead-letter fallback" , "root_cause_tags" : [ "webhook" , "retry-queue" , "dead-letter" , "config" ], "action_items" : [ { "id" : "AI-1" , "description" : "Add dead-letter queue for webhook retries" , "owner" : "alice" , "status" : "open" } ] } rootecho add records it and compares against your history: $ rootecho add inc-2026-014.json ⚠ root cause echo detected for "INC-2026-014": INC-2026-003 (2026-03-15) — 100% similar root cause Payment webhook retries exhausted ✓ Add retry backoff [done] ✗ Add monitoring alert for queue depth [open] — 93d overdue → 1 action item(s) from this past incident were never finished. recorded to .rootecho/history.jsonl That's the whole point of the tool in one output: not just "you've seen this before," but "and here's the fix that never happened." r

Imagent gives AI agents the ability to generate images, video, and speech as a first-class step in their workflows, behind a single interface that hides the differences between providers and models

For decades, developers were judged by one thing: How much code they could write. The best programmers wrote faster. Debugged faster. Built faster. That era is ending. The next generation of developers won't spend most of their time writing code. They'll spend it directing AI. Welcome to the age of the AI Orchestrator. The Evolution of Software Development Software development has always evolved. First, developers wrote machine code. Then came assembly. Then high-level languages. Then frameworks. Then cloud platforms. Then DevOps. Each evolution removed repetitive work and let developers focus on bigger problems. AI is simply the next step. But this time, it isn't replacing a tool. It's becoming a teammate. Coding Is Becoming a Smaller Part of the Job Building software isn't just writing code. A typical project includes: Understanding requirements Researching documentation Designing architecture Writing code Reviewing code Debugging Testing Writing documentation Deploying applications Monitoring production Fixing incidents Only one of those is coding. Everything else is coordination and decision-making. That's where AI is changing the game. From Programmer to Orchestrator Think about how modern teams work. A tech lead rarely writes every line of code. Instead, they: Assign work. Review solutions. Provide feedback. Make architectural decisions. Remove blockers. Developers are beginning to work with AI in much the same way. Instead of writing every function, they'll: Define the goal. Provide the right context. Choose the right tools. Review AI-generated code. Run tests. Improve weak areas. Approve the final result. The value shifts from typing code to guiding its creation. What Does an AI Orchestrator Do? An AI orchestrator doesn't ask one question and accept one answer. They manage a workflow. For example: Break a large project into smaller tasks. Give each AI the context it needs. Decide when to retrieve documentation. Decide when to search the codebase. Ask AI to g

Here are my biggest gripes with AI coding assistants right now: Obsessed with reinventing the wheel. You'll often find it writing three duplicate functions for the exact same feature in a single file. Why? Because it's terrified of blowing up the context window, so it only reads a fraction of a large file and completely misses the existing functionality. Why are files so bloated in the first place? Because AI prefers adding new code over modifying existing code, and it rarely deletes anything. A

Introduction In large-scale Unity development, GC Alloc can quietly become a real problem. At first, nothing looks wrong. But as the project grows and you add more enemies, UI, master data, events, states, notifications, logs, and other systems, small allocations that happen every frame begin to pile up. LINQ is especially convenient. var aliveEnemies = enemies . Where ( x => x . IsAlive ) . OrderBy ( x => x . DistanceToPlayer ) . ToList (); It is readable. But if this kind of code runs every frame, it can become a source of both GC Alloc and CPU overhead. Unity's official documentation also recommends reducing frequent managed heap allocations as much as possible, ideally getting close to 0 bytes per frame. https://docs.unity3d.com/2022.3/Documentation/Manual/performance-garbage-collection-best-practices.html For general GC Alloc best practices, this article refers to the Unity 2022.3 documentation, because the general guidance still applies. Unity 6-specific GC behavior is covered later using the Unity 6.0 documentation. This article assumes Unity 6.0 as the minimum Unity version and explains how to choose between regular LINQ and ZLinq in production code. Unity 6.0 uses the Roslyn C# compiler, and its C# language version is C# 9.0. However, some C# 9 features, such as init-only setters, are not supported. https://docs.unity3d.com/6000.0/Documentation/Manual/csharp-compiler.html The short version The point of this article is not to ban LINQ completely. Do not use LINQ in hot paths just because it is readable. Do not assume ZLinq solves everything just because you introduced it. Those are the two main ideas. A rough guideline looks like this: Area Guideline Editor extensions, build scripts, debug code Regular LINQ is usually fine Startup, loading, initialization LINQ can be fine, but measure when data size is large Update / LateUpdate / FixedUpdate Avoid LINQ by default Code that is not per-frame but still called frequently Consider ZLinq Code that materializes res

Google added two new models to the Gemini API today: Nano Banana 2 Lite (image generation) and Gemini Omni Flash (video generation + editing). Neither is the Gemini 3.5 Pro release people have been waiting for, so it's easy to miss. Here's what's actually in them. TL;DR Nano Banana 2 Lite: gemini-3.1-flash-lite-image = text-to-image in ~4s, $0.034/1K images Gemini Omni Flash: gemini-omni-flash-preview = video gen + conversational editing, $0.10/sec Both are built to be chained: generate an image fast, then animate it into video Neither model is positioned as a quality upgrade = both are cost/speed plays Nano Banana 2 Lite Model ID: gemini-3.1-flash-lite-image Text-to-image output in about 4 seconds $0.034 per 1K-resolution image Positioned as the direct replacement for the original Nano Banana ( gemini-2.5-flash-image ) - if you're on that model, this is a drop-in upgrade Available in Google AI Studio, Gemini API, Gemini Enterprise Agent Platform, and consumer surfaces (Search AI Mode, Gemini app, Photos, NotebookLM, Flow, Google Ads) Gemini Omni Flash Model ID: gemini-omni-flash-preview Public preview in Google AI Studio and the Gemini API Conversational editing - refine a generated video using plain-language instructions instead of re-prompting from zero Multimodal referencing - combine text, image, and video inputs to keep a scene consistent $0.10 per second of video output (same rate as Veo 3.1 Fast) Known limitations right now Generations capped at 10 seconds No audio reference uploads yet No scene extension yet Video references under 3 seconds are accepted by the API schema but not correctly processed yet Character consistency across scene changes/pans still has rough edges Google says longer durations are coming. The part worth paying attention to: chaining them Generate an image with Nano Banana 2 Lite (fast, cheap) Pass that image as a reference into Omni Flash Omni Flash animates it into a video Both models are optimized for throughput and cost, not for to