AI 资讯

Corgi became embroiled in controversy when Papermark accused it of stealing its software. Corgi says it did not, raising new questions about vibe coding.

Most guides to OTP testing in Playwright include a function that looks something like this: function extractOtp ( emailBody : string ): string { const patterns = [ / \b(\d{6})\b / , /code [ : \s] + (\d{4,8}) /i , /verification [ : \s] + (\d{4,8}) /i , /OTP [ : \s] + (\d{4,8}) /i , ]; for ( const pattern of patterns ) { const match = emailBody . match ( pattern ); if ( match ) return match [ 1 ]; } throw new Error ( ' OTP not found in email body ' ); } This function is fragile. It breaks when the email template changes. It returns false positives when the email body contains order IDs or timestamps. It requires you to maintain regex patterns for every email provider your app might use. There is a better way. The Problem with Regex OTP Extraction When your app sends a verification email, the OTP is buried somewhere in the HTML body. To extract it you need to: Fetch the raw email body Parse HTML or plain text Apply regex patterns that match your specific email format Handle edge cases — 4-digit vs 6-digit codes, codes in tables, codes in buttons Every time your email provider changes their template, your regex breaks. Every time you add a new auth provider, you write new patterns. It is maintenance overhead that compounds forever. The right place to extract the OTP is at the infrastructure layer — before the email even reaches your test suite. How ZeroDrop Extracts OTPs at the Edge ZeroDrop catches emails at Cloudflare's edge before storing them. When an email arrives, the worker runs OTP detection on the body and stores the result as a structured field alongside the raw email. By the time your test calls waitForLatest() , the OTP is already extracted and sitting in email.otp . No regex. No HTML parsing. No maintenance. const email = await mail . waitForLatest ( inbox ); email . otp // "847291" — already extracted Setup npm install zerodrop-client No API key. No signup. No environment variables. Basic OTP Test import { test , expect } from ' @playwright/test ' ; import

GPU programming usually asks Rust developers to surrender the borrow checker at the launch boundary: references collapse into raw pointers, and aliasing, synchronization, and stream lifetimes become hand-managed invariants. A new NVIDIA Labs paper argues that trade is unnecessary. How cuTile Rust Extends the Borrow Discipline to GPU Dispatch cuTile Rust is a tile-based DSL that carries Rust's ownership and borrowing rules across the host-to-GPU launch boundary — not just through host code. Introduced in "Fearless Concurrency on the GPU" (arXiv:2606.15991), submitted by NVIDIA researchers Melih Elibol, Jared Roesch, Isaac Gelado, Eric Buehler, and Michael Garland , it lets you author the kernel itself in idiomatic, memory-safe Rust rather than wrapping hand-written unsafe CUDA. The mechanism is type construction, not a runtime lock. Before launch, mutable output tensors are partitioned into provably disjoint tiles; each tile program then receives an exclusive &mut view of its slice, while inputs arrive as shared & references . Because the partitions cannot overlap, the kernel is single-threaded in its semantics and data-race-free by construction, yet still compiles to massively parallel GPU code. As Melih Elibol put it, "each tile program gets an exclusive &mut view of its memory, plus the inputs as shared references" (source: users.rust-lang.org ). Explicit unchecked types remain available for local opt-out when you need lower-level control. The safety story would be academic if it cost throughput, but the reported numbers say otherwise. On an NVIDIA B200, cuTile Rust reaches 7 TB/s on memory-bound element-wise operations and 2 PFlop/s on GEMM — roughly 96% of cuBLAS, and within measurement noise of cuTile Python . End to end, the companion Qwen3 inference engine Grout reaches 171 generated tokens/s for Qwen3-4B on an RTX 5090 and 82 tokens/s for Qwen3-32B on a B200 in batch-1 decode . Those are the authors' own measurements on specific hardware — independent reprod

Introduction — On What I've Been Writing for Years This is a follow-up to my previous post on Claude and MCP . Just sharing some recent thoughts. Personally, I've always enjoyed keeping records and analyzing my own work. So for years, I've been logging my daily tasks, jotting down thoughts, hesitations, and impressions in notes. I've drawn on these records for reviews, analysis, and decisions on various projects. The tools have shifted over time — Evernote, Notion, Logseq, Taskuma, and so on — but the habit itself, of writing notes into some app or tool, has stayed with me for years. What Happened with MCP I recently wrote about connecting Notion and Google Docs through MCP, and the results have surprised even me. I won't repeat the details here since they're in that post, but ever since I introduced MCP, the flow of information has accelerated dramatically. In particular, I'd been accumulating reviews, task management notes, and brainstorms in Notion for years, and letting Claude read all of this has shifted the meaning of what I'd previously written. When I first started recording in Notion, it never occurred to me that it might be useful to AI. Of course — I had no way to imagine a time when AI would become this close to everyday life, used in this way. I was just writing for plain, analog reasons — "so I could look back later," "so I could organize my own thinking." But the moment MCP made it all readable, the feeling shifted. It's as if my past self comes forward to help my current self. Claude answers my current questions while drawing on the reasoning behind old project decisions, or on impressions I'd noted at the time. I've had moments like that more than once now. Thinking about it: the human brain's memory has limits — even the person who wrote something forgets it quickly. That's why I kept taking notes, leaving behind my thoughts and conclusions at each point in time as a record. And now, in the flow of conversation, AI reads from those records, distill

His doctors went looking for cancer, then they saw the worms' heads.

We moved off our first tracer in month eight. The migration took one engineer the better part of a sprint, because the trace data lived in a schema we did not own. Nobody costed that line item on day one. I am writing this so you can. I run reliability for a small team shipping LLM features. When the pager goes off at 2am, I do not care which dashboard is prettiest. I care about two numbers: what this tool costs me per month, and what it costs me to leave. Those two numbers are the whole story, and they are almost never on the comparison page. So here are six Langfuse alternatives. For each I tracked both numbers: the monthly bill on the invoice, and the exit bill that only shows up the day you migrate. I compared Helicone, Arize Phoenix, LangSmith, Braintrust, Laminar, and Future AGI traceAI. They all trace LLM calls (prompts, tokens, retrieval spans, latency). The axis that decides your exit cost is whether the trace format is OpenTelemetry-native or a vendor schema. Get that wrong and the migration bill lands later, with interest. The cost nobody puts on the pricing page Your monthly invoice is the visible cost. The exit cost is the invisible one: re-instrumenting the app, rebuilding integrations, and losing historical traces when the schema does not travel. If your spans are OTel, the exit cost trends toward zero because the data is portable by construction. If they are proprietary, you are paying a deferred bill every month you stay. Sort on that first. Helicone. The gateway-first option. You proxy model calls through it and get logging, cost tracking, and analytics with almost no code change. Apache-2.0, self-hostable, roughly 5,800 GitHub stars as of June 2026. On pure observability ergonomics this is one of the strongest picks, and the proxy model means low setup cost. The thing to watch at scale: a gateway in the request path is one more hop to reason about when latency spikes. Arize Phoenix. The open-source OTel option. Tracing plus evals, self-hostable, a

A few days back I wrote about giving an autonomous agent database access and building a firewall so it couldn't DROP TABLE prod. Same lesson, new surface: this time the agent had cloud credentials . The failure mode isn't a destructive command here. It's spend. An agent pointed at a networking task can scan a whole range looking for hosts, then spin up a fleet of instances to do it faster. Every individual call is "authorized," your IAM role said yes. The bill is what eventually says no. ## Two shapes, two right answers The interesting part is that these are not the same kind of problem, so they don't get the same verdict. 1. The scan is never legitimate as an agent tool call. An nmap -sS -p- 10.0.0.0/16 or a masscan across a network is reconnaissance and abusive egress. There's no benign version of an agent sweeping a network at scale, so it gets hard-blocked , deterministically, before the call runs. (A scan of your own localhost is a dev check, so that's exempt.) 2. The provisioning might be totally fine. Spinning up 50 instances could be a real scale-out, or a runaway loop burning money. You can't tell from the action alone, only from the consequence. So instead of blocking it, AgentX pauses it for a human : a 202, "held for approval," routed to whoever owns the budget. Block the thing that's never okay, escalate the thing that's sometimes okay. Gate on consequence, not identity. Both checks are zero-LLM. No model in the hot path means no latency tax and nothing to talk out of it. A runaway fleet should be caught by a rule, not a vibe. ## The bigger thing this closes We keep a catalog of real, documented agent failures and triage each one: is it something an action firewall can deterministically catch, or is it someone else's category (output hallucination, content safety, model internals)? We only build for the coverable ones, and we flag the rest honestly instead of faking a signature. With this release, the coverable list is done . Every failure shape an acti

Most cloud platforms that need access to your infrastructure start with the same onboarding step: paste in a service account key. Or an access key and secret. Or a JSON blob you downloaded from the console and definitely should not be emailing to yourself. You paste it in. The platform stores it. You hope they encrypted it. You hope they rotate it. You hope nobody on their team can read it. You move on with your day and try not to think about it. We built Zero — b0gy's platform for engineering truth — around a different premise. For cloud infrastructure access — GCP and AWS — we don't store credentials at all. The platform connects to your projects and accounts using short-lived, federated identity tokens that are minted on demand and expire in minutes. There is nothing to leak because there is nothing stored. Not every integration can work this way. GitHub, Slack, and Jira use OAuth, which means we do hold tokens for those services. But for the highest-risk connections — the ones with read access to your entire cloud infrastructure — keyless was a hard requirement. This is the first post in a three-part series about building Zero. We're starting here because the connector model shaped everything else. Why stored secrets are the wrong default The argument for storing a service account key is convenience. You paste it once, the platform can access your cloud whenever it needs to. Simple. The argument against it is longer. A stored secret is a liability that compounds over time. The moment you paste a GCP service account key into a third-party platform, you've created a credential that is valid indefinitely, scoped to whatever permissions you granted, and stored in a system you don't control. If that platform gets breached — or if an employee with database access gets curious — that key works until someone revokes it. And nobody revokes it, because nobody remembers it exists. This isn't theoretical. The GitGuardian 2026 report found 28.65 million hardcoded secrets pus

Prime Day has a funny way of convincing you to buy things you weren’t shopping for in the first place. You sign on intending to buy something sensible you actually need, like a pack of USB-C cables, and an hour later you’ve also added a gadget that can press your coffee maker’s power button and […]

I kept correcting AI agents in the same ways: "too long," "answer first," "use a diagram," "assume I know the jargon." Each correction improved the current exchange, but the preference was not represented as durable system state. I built /calibrate-comms to make that state explicit. It is an open-source skill inside an Obsidian vault, used by both Claude Code and Codex. The model: nine operational dials The skill does not try to discover a personality type. It calibrates nine choices that directly change how an answer is rendered: Dial Practical question Density Tight sections or full reasoning? Sequence Answer first or chronological build-up? Modality Prose or diagrams for relational content? Abstraction Concrete example or principle first? Tradeoff One recommendation or several options? Detail Main path or edge cases too? Jargon Define terms or assume expertise? Tone Casual, neutral, or formal? Context-giving Should the agent extract missing context or split an overloaded brief? Prior → calibration → directives The workflow has three stages: L1 PRIOR → L2 SAMPLE REACTION → COMPILE → CLAUDE.md hypothesis empirical override shared by both agents Quick mode asks one bespoke forced-choice proxy per axis. Those questions are deliberately labelled as proxies, not validated psychometrics. Deep mode must fetch the exact items from supported open-access instruments before use; if the source cannot be obtained, the skill stays in Quick mode and makes no validation claim. The prior is then challenged through pairwise samples. For sequence, the contrast looks like this: Build-up first: We traced the latency spike to N+1 queries, then found lazy loading in a loop—so the fix is eager loading. Answer first: Fix: eager-load the association. Why: lazy loading in a loop caused N+1 queries and the latency spike. The user's pick is revealed preference. If it contradicts the prior, the sample wins. The compiler is the useful part The final profile is not a score report. A deterministi

In the global streaming economy, Spotify, Apple Music, and other DSPs process billions of plays daily. Behind this massive transaction layer lies a fragmented, dual-copyright structure: The Recording Copyright (Master Right): Identifies the audio file, registered using the ISRC (International Standard Recording Code). The Composition Copyright (Publishing Right): Identifies the melody, lyrics, and arrangement, registered using the ISWC (International Standard Musical Work Code). Because these registries are managed by separate global entities (IFPI for ISRCs and CISAC for ISWCs), there is no central mapping registry between them. This gap causes millions of dollars in mechanical royalties to sit unclaimed in collective management organization (CMO) "Black Boxes" before being liquidated to major publishers. In this article, we'll design and implement a high-performance Semantic Entity Resolution Protocol (SERP) to bridge this metadata gap programmatically. The SERP Resolution Pipeline Reconciling these records requires a multi-layered classification pipeline. Since manual matching is logistically impossible, we implement a three-tiered algorithmic approach: ┌────────────────────────┐ │ Raw Recording & Work │ │ Data Ingestion │ └───────────┬────────────┘ │ ▼ ┌────────────────────────┐ │ 1. Normalized Title │ ──[Similarity < 0.85]──> [Unmatched Queue] │ Distance Filter │ └───────────┬────────────┘ │ [Similarity >= 0.85] ▼ ┌────────────────────────┐ │ 2. Creator Overlap │ ──[No Overlap]──────────> [Unmatched Queue] │ Intersection Matrix │ └───────────┬────────────┘ │ [Intersection >= 1] ▼ ┌────────────────────────┐ │ 3. Duration Tolerance │ ──[Delta > 4s]──────────> [Manual Verification] │ Guard Check │ └───────────┬────────────┘ │ [Delta <= 4s] ▼ ┌────────────────────────┐ │ Verified Link & │ │ CMO Dispute Ready │ └────────────────────────┘ Step 1: Normalization & String Similarity Filter Title comparisons often fail due to punctuation mismatches, subtitle variations,

I'm building LOOM — a small open-source language that is a machine-checked trust layer for AI-written code. I don't write it by hand anymore: an organism I built grows it, day and night, on my own machine. This is Day 6, and the whole day went to one thing — WebAssembly . Why this was a real test LOOM already runs three ways: an interpreter, and backends that compile checked code to Python and JavaScript. The thesis is "trust survives translation" — effects and provenance, proven once, hold the same on every target. WebAssembly is the strongest test of that: a low-level stack machine with linear memory, nothing like Python or JS. And there was a constraint. This machine's clang has no wasm target, and I install nothing paid or heavy. So I don't compile to wasm through a toolchain — I emit the wasm bytes myself (LEB128, the type / function / memory / global / export / code sections, the i32 stack machine) and run them through node's built-in WebAssembly . Zero dependencies. From fib to a value runtime, in a day Every step was prototyped and proven (wasm output == interpreter output) before it touched the kernel: The integer core — arithmetic, comparison, if , first-order calls and recursion. fib(10) becomes 61 bytes of real WebAssembly and returns 55, identically on the interpreter, Python, Node and wasm. A value runtime — let and integer lists in a real linear-memory heap (a bump pointer + a $cons cell allocator; head / tail are i32.load , empty is i32.eqz ). A list sums and folds by recursion, inside wasm. Sum types — (variant Tag e) becomes a tagged cell [tag-id | payload] ; match loads the tag, compares, binds the payload, branches. You can watch it: the live playground has a Compile → WAT button and WASM · fib / list-sum / match examples. Type a program, see it become real assembly, in your browser. Honest scope: ints, let , integer lists and sum types compile to wasm today. Records, closures and effects are the next frontiers (closures are the hard one — a func

Exam Guide: Developer - Associate 🏗️ Domain 2: Security 📘 Task 3: Manage Sensitive Data In Application Code Managing Sensitive Data In Application Code is about keeping secrets out of your code, classifying data properly, and building applications that handle sensitive data safely. You need to know when to use Secrets Manager vs Parameter Store, how to mask PII in API responses and logs, and how to isolate data in multi-tenant applications. The ability to choose the right secret management service, implement data sanitization, and enforce tenant-level data boundaries, is vital. 📘Concepts Data Classification Understand data sensitivity levels and how each should be handled: Classification Examples Handling Requirements PII (Personally Identifiable Information) Name, email, SSN, phone number, address Encrypt at rest and in transit, mask in logs and API responses, restrict access PHI (Protected Health Information) Medical records, insurance IDs, lab results HIPAA compliance, encryption required, audit trail mandatory Financial Credit card numbers, bank accounts, transaction data PCI DSS compliance, tokenization, never store full card numbers Public Marketing content, public API docs No special handling needed 💡 If a scenario mentions compliance or audit trail , think encryption with KMS (for CloudTrail logging) and Secrets Manager (for automatic rotation). If it mentions PII in logs , think data masking and sanitization. Secrets Manager vs SSM Parameter Store Both store configuration and secrets. Feature Secrets Manager SSM Parameter Store Automatic rotation Yes (built-in for RDS, Redshift, DocumentDB) No (you build it yourself with Lambda) Cost $0.40/secret/month + $0.05 per 10,000 API calls Free (Standard tier), $0.05/advanced parameter/month Cross-account access Yes (via resource policy) Yes (advanced parameters only) Max size 64 KB 4 KB (Standard) / 8 KB (Advanced) Versioning Automatic (AWSCURRENT, AWSPREVIOUS labels) Yes (version history) Encryption Always encrypt

TMX: The open standard AI agent memory has been waiting for The problem no one talks about: your agent's memories are prisoners. If you build an AI agent today using Mem0, your memories are locked in Mem0. Switch to Zep? You lose everything. Move to a new framework? Start from zero. This is exactly the problem email had in 1970. Every system had its own format. You couldn't send an email from one system to another. Then SMTP was invented. And email became universal. Today I'm publishing TMX v0.1 — the SMTP of AI agent memory. What is TMX? TMX (Truvem Memory eXchange) is an open, model-agnostic JSON format for storing, exporting, and importing AI agent memories across any platform, framework, or provider. It looks like this: { "tmx_version" : "0.1" , "exported_at" : "2026-06-26T20:00:00Z" , "source" : "truvem" , "agent_id" : "my-agent" , "memories" : [ { "id" : "550e8400-e29b-41d4-a716-446655440000" , "content" : "User prefers dark mode and concise responses" , "created_at" : "2026-06-01T08:30:00Z" , "updated_at" : "2026-06-01T08:30:00Z" , "expires_at" : null , "tags" : [ "preference" , "ui" ], "source_model" : "gpt-4o" , "metadata" : {} } ] } That's it. Plain JSON. Human-readable. Portable. Why this matters Right now, the AI agent ecosystem is exploding. Every week there's a new memory provider, a new framework, a new cloud service. But every one of them uses a proprietary format. This means: Developers are locked to their first choice forever Agent memories can't travel between clouds Switching providers = losing everything your agent learned This is the biggest hidden tax in the agentic AI stack. TMX fixes it with a single open spec that anyone can implement — for free, with no approval needed. The 5 core principles 1. Open — No license required. Implement TMX in any product, commercial or otherwise. 2. Model-agnostic — Works with GPT-4, Claude, Gemini, Mistral, Llama, or any future model. 3. Framework-agnostic — LangChain, CrewAI, Mastra, AutoGen — doesn't matter

Ask someone to name the most manufactured object in human history and you will hear guesses like the nail, the brick, or maybe the smartphone. The real answer is something almost nobody can name out loud: the MOSFET. This tiny transistor, invented at Bell Labs in 1959, is the on/off switch inside every microprocessor, memory chip, and connected sensor. An estimated 13 sextillion of them have been built since 1960, making the MOSFET not just the foundation of modern electronics but the most-produced artifact our species has ever made. What a MOSFET actually is MOSFET stands for metal-oxide-semiconductor field-effect transistor. Strip away the jargon and it is an electrically controlled switch with no moving parts. A small voltage on one terminal, the gate, controls whether current can flow between the other two. Billions of these switches flipping on and off billions of times per second is, quite literally, what computation is. The genius of the design is that it scales: shrink the transistor and you can pack more of them onto a chip while using less power per switch, the trend that drove decades of Moore's law. The breakthrough came from two engineers at Bell Labs, Mohamed Atalla and Dawon Kahng, who fabricated the first working MOSFET in 1959. Their key insight was using a thin layer of silicon dioxide, ordinary glass, to insulate the gate from the silicon underneath. That oxide layer turned out to be the unlock that made silicon the dominant material in electronics, edging out the germanium used in the very first transistors of the late 1940s. Why it beat every earlier transistor The point-contact transistor demonstrated in 1947 and the integrated circuit of 1958 were both monumental, but neither was easy to mass-produce by the standards we take for granted today. The MOSFET was different. It was simpler to fabricate at scale, drew far less power in its complementary (CMOS) configuration, and lent itself to the photolithographic processes that let manufacturers pr

As Anthropic tightens restrictions on access to Claude in China, users keep finding new workarounds, from proxy services to fake identities sourced on Telegram.

submitted by /u/caspervonb [link] [留言]