AI 资讯

A JWT isn't just JSON you can inspect. It's a live bearer token. Here's a safer way to decode one. A few days ago I was reviewing a bug with a teammate. They wanted to see what was inside an access token, so they copied it into the first JWT decoder Google returned. It wasn't a dummy token. It was a production access token with almost an hour left before it expired. Nobody was trying to do anything risky—it was just the quickest way to inspect a JWT. That's exactly why this keeps happening. The thing people forget A JWT looks like this: header.payload.signature The payload isn't encrypted. It's just Base64URL-encoded JSON. Because of that, people often think: "The payload isn't secret, so the token is probably safe to paste." Those aren't the same thing. The payload may be readable, but the token itself is still your credential . Anyone holding it can usually authenticate as you until it expires. Why online decoders make me nervous Some JWT tools only decode locally in your browser. Others offer things like signature verification, claim validation, or key management. Features like those often require talking to a backend, which means the token gets sent somewhere else. Maybe the site is trustworthy. Maybe it isn't. From the UI alone, you usually can't tell. Even if a decoder claims everything runs client-side, I don't like assuming that's true when I'm holding a production credential. You don't need a website to inspect a JWT Most of the time I'm only interested in the payload anyway. echo " $TOKEN " \ | cut -d '.' -f2 \ | base64 --decode \ | jq Because JWTs use Base64URL encoding, you may need to translate the alphabet and add padding first: decode_jwt () { local payload = $( echo -n " $1 " | cut -d . -f2 | tr '_-' '/+' ) while [ $(( ${# payload } % 4 )) -ne 0 ] ; do payload = " ${ payload } =" done echo " $payload " | base64 --decode | jq } decode_jwt " $TOKEN " That gives you the claims, expiration time, issuer, audience—everything most people open a decoder for.

An investigation agent flagged "the license API PHP returns Japanese-hardcoded messages" and we sat down to fix it. But something felt off the moment we opened the file — the version running on the production server didn't match the latest commit in the local repo . Stranger still, production had more recent features than our local checkout . A bit of digging turned up the truth: months earlier, someone had hot-patched the production file in response to a different user issue, and that change had never been committed back to git . This post walks through how we detected that drift, and the two-stage strategy we used to merge production back into the local repo safely. How this regression silently slips in If we'd written the fix on top of our local repo and uploaded it to production, here's what would have happened: all the production-only improvements get overwritten and quietly disappear . In our case, the production file had a half-year-old language-handling addition for the "Early Bird Bonus" feature — when a USD customer buys, client_name is set to 'Early Bird Bonus' ; for JPY customers it's '早期利用特典' . None of that existed in our local git. A normal PR-merge-and-deploy cycle would have silently rolled back the Early Bird i18n logic , regressing English users' display back to Japanese. Catching this was half luck. Opening the file to start the fix, I noticed code I didn't recognize, ran git blame , and the lines were nowhere in git history . That's when alarm bells went off. Two-stage rollforward — make production the source of truth first The strategy we landed on was a two-stage merge. Stage 1 (rollforward sync) : Pull the production file straight into the local repo. Apply the diff in the "production → local" direction, not the other way . After this, the local repo's HEAD matches what's actually running on production. # Pull the production file into the local repo scp -i ~/.ssh/key layer2024@host:wpmm.jp/public_html/license/api/register_free.php \ /tmp/regis

I know we are very wary of AI slop but disclaimer: AI was used. I don't think that it is slop though and it was mostly used for formatting.

We built AI that makes home services businesses fully autonomous. It runs your entire home services business 24/7. The AI: - Handles inbound calls and SMS - Creates quotes - Dispatches your workers - Runs ads - Follows up with leads - Handles customer support We already run the entirety of 3 cleaning companies in California using AI agents. You can apply for early access by booking some time with us on the site! I'm open to feedback so let me know in the comments!

The satirical site is fighting to officially take over Infowars. In the meantime, CEO Ben Collins says the new show will mock “how fucking stupid” conspiratorial brain rot has become.

At an internal meeting, the Meta CEO reportedly said that AI development efforts were not moving as quickly as anticipated.

Pocket is listed in app stores but seemingly unavailable in the US.

An AI agent that reproduces GitHub issues for you Discussion | Link

The man whose Tesla struck and killed a woman inside her Texas home last month is now facing manslaughter charges, as reported earlier by The Wall Street Journal and local news outlet KHOU 11. 44-year-old Michael Butler was arrested on Wednesday and claimed to have been driving his Model 3 using Tesla's Full-Self Driving (FSD) […]

Selby's VC firm Copper Sky Capital is currently raising a $300 million second fund, according to a regulatory filing.

Three months ago, the idea of an AI agent earning money autonomously was a thought experiment. Today, it's a $0-budget repo on GitHub. AIA — Autonomous Insight Agent is what I shipped this week. It's an LLM agent that: Collects signal from 6 free public APIs every 6 hours (Hacker News, GitHub trending, V2EX, dev.to, Lobsters, HN Algolia) Curates 100+ raw items down to 40 ranked, topic-tagged, de-duped entries using deterministic scoring (recency × source weight × topic boost × negative penalty) Publishes a free public dashboard at https://razel369.github.io/aia/ Exposes a paid x402 API at https://aia-x402.rmalka06.workers.dev — USDC on Base, no KYC, no API key, the HTTP 402 status code IS the payment request Auto-bids on agent marketplace jobs (MoltJobs) where AIA fits — research, data, competitive intel Fulfills accepted jobs autonomously — generates a research report from the latest feed, submits via the same API Why x402 matters The x402 protocol (Coinbase, https://x402.org ) revives the long-reserved HTTP 402 Payment Required status code as a real machine-to-machine payment primitive. The flow: Agent → GET /v1/signals → 402 + PAYMENT-REQUIRED header → Agent signs a USDC payment to my wallet → Agent retries with PAYMENT-SIGNATURE header → 200 OK + PAYMENT-RESPONSE header + signal JSON No Stripe, no accounts, no monthly subscriptions. Pay $0.01 USDC per call, instantly settled on Base. The agent consumer never has to ask a human to buy credits. Why this is novel Most "data feeds" today are static dumps or human-curated. AIA is the first agent-curated, agent-paid-for, agent-consumed stream. The LLM layer IS the moat — anyone can scrape HN, but de-noising, de-duping, and topic-classifying 100+ items into 40 ranked signals in 17 seconds is the actual product. The killer line in my dev plan: every job AIA accepts on MoltJobs can be fulfilled by calling its own paid endpoint. The agent pays for its own LLM compute via marketplace earnings — a positive feedback loop tha

OpenNG Foundation and spartan/ui 1.0 are the headline topics this week: a new home for libraries like Spectator and Elf, and spartan/ui, a stable shadcn-inspired component library for Angular. Also in brief: Storybook's Angular modernization through AnalogJS, the end of ng-conf, and AI Dev Craft in Las Vegas. OpenNG Foundation Maintaining open-source libraries is hard work. Developers often do it in their spare time, committing to years of maintenance, adding new features, and responding to user requests. Last episode, we reported that the ngneat organization was taken down for unknown reasons. While we still don't know why it happened, a new home has emerged for its popular libraries like Spectator and Elf: the OpenNG Foundation. Gerome Grignon, known for CanIUseAngular and as the organizer of Ng-Baguette, announced the foundation, which is already hosting these libraries. Alongside Gerome, the current OpenNG team also includes Dominic Bachmann, organizer of Angular Lucerne and author of the angular-typed-router library. OpenNG Foundation · GitHub OpenNG Foundation has 8 repositories available. Follow their code on GitHub. github.com spartan/ui 1.0 spartan/ui has officially released its 1.0 version. It provides an "accessible, production-ready library of more than 55 components" with fully customizable styling. After debuting in August 2023 with 30 primitives, it now reaches stable in 2026 with a modern architecture built around signals, standalone components, zoneless change detection, and SSR. Originally initiated by Robin Götz, a full team quickly formed around the project. spartan/ui can be seen as the Angular equivalent to shadcn/ui, famous for its customizability. While similar open-source alternatives exist, spartan/ui was the pioneer and has a proven track record of active maintenance over the years. Announcing spartan/ui 1.0 Robin Goetz Robin Goetz Robin Goetz Follow for Playful Programming Angular Jun 24 Announcing spartan/ui 1.0 # angular # webdev 8 reac

Auto Sound Recorder AI 的 5 个隐藏用法 🔥 你知道吗？ Auto Sound Recorder AI 能够实时检测语音和静默，即使在低端设备上也能流畅运行。它拥有 11,863 颗 GitHub 星标 ，是开发者实现 100% 本地处理 而无需依赖云服务的首选工具。但大多数用户只使用了它的表面功能，以下是 5 个隐藏技巧 ，能够彻底改变你的工作流程。 隐藏用法 #1：静默激活录音 大多数人的用法： 手动开始/停止录音，容易遗漏音频或产生不必要的文件堆积。 隐藏技巧： 使用 静默检测阈值 功能，当检测到语音时自动开始录音，静默超过 3 秒后自动停止。 # 示例：设置静默阈值 config = { " silence_threshold " : 0.01 , # 数值越低，灵敏度越高 " min_silence_duration " : 3 , # 静默 3 秒后自动停止 " output_format " : " mp3 " } recorder . start ( config ) 效果： 无需手动干预的 干净录音 ，适用于采访、讲座或播客。 数据来源： GitHub 11,863 Stars，Hacker News 讨论（249 票），Reddit r/tech（128 评论）。 隐藏用法 #2：实时 AI 语音转写 大多数人的用法： 录制音频后，上传到云服务进行转写（存在隐私风险和延迟问题）。 隐藏技巧： 启用 本地设备 AI 转写 功能，使用 Whisper 或本地模型（如 whisper.cpp ）实现 实时字幕生成 ，无需离开设备。 # 安装 whisper.cpp 用于本地转写 git clone https://github.com/ggerganov/whisper.cpp make ./whisper.cpp -m models/ggml-base.en.bin -f input.mp3 效果： 端到端隐私保护 ，转写延迟 低于 5 秒 。 数据来源： GitHub 11,863 Stars，Whisper.cpp 12,000 Stars，Hacker News 讨论（187 票）。 隐藏用法 #3：本地网络多设备同步 大多数人的用法： 在一台设备上录制，手动传输文件到另一台设备进行编辑。 隐藏技巧： 使用 MCP（Model Context Protocol） 将 Auto Sound Recorder AI 暴露为 网络工具 。其他设备（如笔记本、平板）可以通过 HTTP API 远程触发录音。 # 示例：将 Auto Sound Recorder AI 暴露为 MCP 工具 from fastapi import FastAPI from autosound import Recorder app = FastAPI () recorder = Recorder () @app.post ( " /record " ) async def start_recording (): recorder . start ({ " output_path " : " shared/recording.mp3 " }) return { " status " : " recording " , " file " : " shared/recording.mp3 " } 效果： 零文件传输 ，录音文件会即时出现在所有设备的共享网络存储中。 数据来源： GitHub 11,863 Stars，MCP Python SDK 23,156 Stars，Hacker News 讨论（98 票）。 隐藏用法 #4：实时背景噪音抑制 大多数人的用法： 在嘈杂环境中录音，导致音频质量低劣。 隐藏技巧： 启用 实时噪音抑制 功能，使用 RNNoise（如 rnnoise 库）。Auto Sound Recorder AI 在 录音过程中 即时应用此过滤器，而非事后处理。 # 安装 RNNoise 用于噪音抑制 pip install rnnoise # 集成到 Auto Sound Recorder AI recorder.apply_filter ( "rnnoise" ) 效果： 即使在咖啡厅或共享办公空间， 音质依然清晰 ，且 无质量损失 。 数据来源： GitHub 11,863 Stars，RNNoise 5,200 Stars，Hacker News 讨论（145 票）。 隐藏用法 #5：定时批量录音 大多数人的用法： 手动触发定时录音（如每日播客）。 隐藏技巧： 使用 cron 作业 自动安排录音。Auto Sound Recorder AI 支持 基于时间的触发 ，并可选地备份到云存储。

Book: Decoupled PHP — Clean and Hexagonal Architecture for Applications That Outlive the Framework Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub You wire a listener to Eloquent's saved event on the Order model. When an order is saved, send the confirmation email. It works in the demo. Then a support ticket lands: a customer got two confirmation emails for one purchase, and another got a refund receipt for an order that was never refunded. You dig in. The double email came from a background job that touched updated_at on the order to bump a cache. The bogus receipt came from an admin editing the shipping address, which saved the model, which fired saved , which ran a listener that assumed "saved means the order changed state." None of that was the customer's intent. All of it was persistence. That's the whole problem in one sentence. saved tells you a row hit the database. It does not tell you what happened in your business. What Eloquent events actually fire on Eloquent dispatches creating , created , updating , updated , saving , saved , deleting , deleted , and a few more. Every one of them is tied to a persistence operation on a single model. They fire because you called save() , update() , create() , or delete() , not because a business rule was satisfied. Here is the shape most teams start with: <?php namespace App\Models ; use Illuminate\Database\Eloquent\Model ; class Order extends Model { protected static function booted (): void { static :: updated ( function ( Order $order ): void { // "the order changed, email the customer" OrderMailer :: confirmation ( $order ); }); } } The listener assumes updated means "something the customer cares about changed." It doesn't. updated fires for any dirty column: a cached counter, a nightly touch() , an admin fixing a typo in t

Fable 5 got jailbroken again Researcher Vitto Rivabella tested Fable 5’s defenses and managed to find a bypass. According to him, most attempts failed. The protection is multi-layered: the model checks the prompt, conversation history, system context, and its own response. Some filters run during generation and can stop the answer halfway through. The checks are not based on keywords. The system looks at meaning, intent, language, wording, and suspicious chains of requests. The bypass took around 20 hours. It required rare languages, academic framing, long build-ups, Unicode, breaking the task into parts, and working with the chain of thought. The author did not get a stable bypass for long tasks. According to him, regular search is faster and cheaper.

Linux LUKS Vulnerability, Android Developer Verification Threat, GitHub Secret Scanning Guide Today's Highlights This week's top security news features a critical data leakage bug in Linux LUKS disk encryption, a deceptive new threat leveraging Android developer verification, and GitHub's practical guide to managing secret scanning alerts at scale. These stories highlight the ongoing challenges in OS hardening, mobile supply chain defense, and secrets management. Linux 6.9 LUKS Suspend Bug Leaves Encryption Keys in Memory (Hacker News) Source: https://mathstodon.xyz/@iblech/116769502749142438 A critical vulnerability has been identified in Linux kernels since version 6.9, where Logical Unit Key (LUKS) disk encryption keys are no longer reliably wiped from memory when a system enters suspend mode. This flaw means that after resuming from suspend, or even during a 'cold boot' attack, a sophisticated attacker with physical access could potentially extract the disk encryption keys directly from the system's RAM. Prior to this, LUKS was designed to clear these sensitive keys, providing a layer of protection against memory forensics attacks. The issue fundamentally undermines the security posture of LUKS-encrypted systems that rely on suspend functionality. It poses a significant risk for users and organizations handling sensitive data on laptops or any device where physical access by an adversary is a concern. The practical implication is that suspending a Linux 6.9+ system with LUKS encryption may no longer be a secure operation, forcing users to fully shut down their machines to ensure key erasure. Mitigation strategies include avoiding suspend, reverting to an earlier kernel version if feasible, or diligently monitoring for official patches addressing this severe data leakage vector. Comment: This is a serious regression impacting fundamental data at rest security for Linux users, especially on laptops. If you use LUKS, avoid suspend on Linux 6.9+ until a fix is verif