AI 资讯

We’re finally getting Grand Theft Auto VI, poised to be one of the largest gaming releases in history.

Spencer Judge discusses the architectural pattern of building a shared core in Rust with language-specific layers on top. Drawing from his work on Temporal's SDKs, he shares lessons on navigating FFI boundaries, bridging async concepts, and managing memory safely. He explains the limitations of native extensions and how emerging tech like WebAssembly can streamline cross-language architecture. By Spencer Judge

Most people assume Redis is fast because of some complex multi-threaded. Turns out it's the opposite — it runs on a single thread and still beats most databases. The reason comes down to how it handles I/O at the OS level and why memory access patterns matter more than thread count. Here's a animated breakdown of the internals if anyone's curious. submitted by /u/lonely_geek_ [link] [留言]

IBM’s nanostack transistors could boost chip performance or energy efficiency.

Security researchers found evidence that Russian authorities hacked the iPhone of a political opponent using a phone-unlocking device made by Cellebrite, even after the company said it would stop selling to Putin’s government.

It’s been hard to look away from headlines about the European heat wave this week. Temperatures are breaking records across the continent, and the weather is threatening lives, shutting down schools, and in one particularly ironic case, forcing the cancellation of a London Climate Action Week event about extreme heat. As the summer ramps up…

IBM has built a new prototype chip with around 100 billion transistors on an area the size of a fingernail, which is twice the density of the company’s previous state-of-the-art technology announced in 2021. The design could pave the way for faster and more energy efficient computers for years to come. For more than half…

As UK police embrace the AI revolution, a WIRED investigation reveals the messy inside story of one region’s experiment with predictive analytics.

kreuzcrawl began as a Rust core with bindings for ten languages. v0.3.0 ships fourteen, adds a tiered WAF-aware dispatch engine, cuts peak streaming memory from ~2.5 GB to ~20 MB, and enables SSRF defense across every outbound call path by default. It is the first release we consider API-stable. This post covers what changed, why each decision was made, and what the harder engineering problems looked like from the inside. At a glance Area v0.2.0 v0.3.0 Language bindings 10 14 (+Dart, Kotlin/Android, Swift, Zig) Peak streaming memory ~2.5 GB ~20 MB SSRF protection opt-in on by default Dispatch model static HTTP / bypass / browser tiered, signal-driven escalation WAF fingerprints — 35 across 8 vendors Fingerprint hot-reload — lock-free ( ArcSwap ), 500 ms debounce MCP tools partial 1:1 with CLI, safety-annotated CLI subcommands scrape, crawl + batch-scrape, batch-crawl, download, citations Robots / sitemap parsers engine-internal public modules API stability preview stable Four new language bindings v0.2.0 shipped Rust, Python, Node.js, Ruby, Go, Java, C#, PHP, Elixir, and WebAssembly. v0.3.0 adds Dart , Kotlin/Android , Swift , and Zig — bringing the total to fourteen. None of the per-language glue is written by hand. Every binding is generated from the Rust core by alef , our polyglot binding generator. The Dart and Kotlin/Android packages bind through the C FFI layer ( kreuzcrawl-ffi ) via dart:ffi and JNI respectively. Swift binds through clang. Zig uses @cImport against the same C header. The generation pipeline also hardened in this release: the Docker publish matrix now builds each architecture natively rather than via QEMU emulation, the Dart build no longer requires the Flutter SDK for pub.dev publishes, Swift artifactbundle checksums are injected automatically, and the Elixir/PHP/Ruby releases preserve their lock files through the source-publish step. === "Python" ```sh pip install kreuzcrawl ``` === "Node.js" ```sh npm install @xberg/kreuzcrawl ``` === "Rus

Last year I was doing a code review for a startup. Everything looked fine on the surface, clean code, good structure, tests passing. Then I noticed this: const query = `SELECT * FROM users WHERE email = ' ${ req . body . email } '` That's it. That's the bug. SQL injection, sitting right there in a startup that had been in production for 8 months. Nobody caught it. Not the developer, not the reviewer, not the CTO. Here's the thing, it's not that developers are careless. It's that this kind of bug is invisible until it isn't. The code works perfectly. Tests pass. Users are happy. Until someone types ' OR '1'='1 in the email field and walks straight into your database. The bugs I see most often 1. Raw SQL with user input // 🚨 This is everywhere const query = `SELECT * FROM users WHERE email = ' ${ email } '` // ✅ Use parameterized queries const query = ' SELECT * FROM users WHERE email = $1 ' db . query ( query , [ email ]) 2. Secrets in environment variables... committed to git # .env DATABASE_URL = postgres://user:actualpassword@prod-db.company.com/mydb STRIPE_SECRET = sk_live_... Then .env ends up in the repo because someone forgot to add it to .gitignore . I've seen this more times than I want to admit. GitHub's secret scanning catches some of these, but not always before someone has already cloned the repo. 3. JWT tokens that are never actually verified // 🚨 Decoding is not the same as verifying const user = jwt . decode ( token ) // ✅ Always verify const user = jwt . verify ( token , process . env . JWT_SECRET ) jwt.decode just reads the token. Anyone can forge it. jwt.verify actually checks the signature. The names are confusingly similar and the wrong one silently works in development. 4. No rate limiting on auth endpoints // 🚨 Anyone can try a million passwords app . post ( ' /login ' , async ( req , res ) => { const user = await db . findUser ( req . body . email ) // ... }) // ✅ Add rate limiting const authLimiter = rateLimit ({ windowMs : 15 * 60 * 1000 , m

A Florida Republican denies claims her team used AI to work on draft legislation, saying Claude was only used as spelling and grammar checker.

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Most people lose hours pretending to work or study. I was one of them. I kept setting Pomodoro timers and ending up scrolling Twitter during breaks. That's not rest. That's just a different kind of distraction. So I built Mognota — a free wellness companion for screen workers. The Problem You don't have a discipline problem. You have a system problem. Your brain has a hard biological limit. Sustained attention peaks at 20-45 minutes before quality drops sharply. Long unfocused hours are not work — they are the feeling of work. The solution isn't more willpower. It's intentional recovery. What I Built Mognota pairs a Pomodoro timer with 50+ guided wellness activities: 👁️ 20-20-20 eye break reminders 🫁 Guided breathing & 7 pranayama techniques 🧘 Desk yoga, HIIT, Tai Chi, stretches 🎵 Binaural beats & ambient soundscapes 🧠 Meditation & NSDR protocols 📓 Gratitude journal, mood tracker, brain dump 🎮 Sudoku, sliding puzzle, fractal explorer The Technical Part This is what dev.to might find interesting: Pure HTML, CSS, vanilla JS — zero frameworks Everything in a single HTML file All 8 notification sounds synthesized with Web Audio API localStorage only — nothing leaves your device Works offline once loaded 109+ languages supported No npm. No build step. No dependencies. Just open and use. Try It 👉 https://mognota.com/ Completely free. No account. No ads. Forever. Would love brutal honest feedback from this community.

Let AI block distractions for you when you need to lock in Discussion | Link

Adding an AI feature looks deceptively easy. You sign up for an API key, paste in a prompt, and within an hour you've got a working demo that makes the whole team lean over your shoulder. Then you ship it, traffic arrives, and two things happen at once: your latency graph develops a long, ugly tail, and your monthly bill arrives with a number that makes finance schedule a meeting. The gap between "impressive demo" and "production feature" is almost entirely about cost and latency engineering. The model is the easy part. Here's how to cross that gap. First, understand what you're actually paying for Most LLM APIs bill by tokens — roughly ¾ of a word each — and they bill both directions: the tokens you send (input) and the tokens the model generates (output). Output tokens are usually several times more expensive than input tokens, which has a non-obvious consequence: a verbose prompt is cheaper than a verbose answer. This reframes optimization. People obsess over trimming their prompts while letting the model ramble for 800 tokens when 80 would do. If you want to cut cost, the highest-leverage move is almost always constraining the output : ask for JSON, ask for a single sentence, set a max_tokens ceiling, and tell the model explicitly to be terse. Latency follows the same logic. Generation is sequential — the model produces one token at a time — so output length is the single biggest driver of how long a request takes. A 50-token answer is fast almost regardless of model. A 2,000-token answer is slow even on the fastest infrastructure. Lever 1: Don't call the model when you don't have to The cheapest, fastest LLM call is the one you never make. Two techniques eliminate a startling share of traffic. Caching identical and near-identical requests. Many real-world prompts repeat — the same FAQ-style question, the same document summarized twice, the same classification of similar inputs. A cache keyed on the normalized prompt turns a repeat request into a sub-millisecond

Building a unified market intelligence platform for traders, analysts, researchers, and developers. After months of development, Jungletrade is now publicly available. The idea behind Jungletrade is simple: modern market analysis has become fragmented. Market data, indicators, analytical models, and trading signals are often distributed across multiple platforms, forcing users to maintain several subscriptions, workflows, and dashboards just to build a complete market view. We wanted to explore a different approach. 📊 The Problem Most market platforms focus on a specific layer of the analytical stack: Raw data Technical indicators Quantitative models Trading signals Each layer provides value, but users are frequently required to move between multiple tools to connect the pieces. Our goal was to create a modular ecosystem where these layers can coexist within a single platform. 🧭 The Jungletrade Ecosystem Today, JungleTrade provides four product categories: 📦 Data Structured datasets for market research and discovery. 🧠 Models Analytical frameworks designed to identify patterns and relationships within market data. 📈 Indicators Tools that transform raw information into actionable insights. ⚡ Triggers Event-driven signals designed to highlight potential market opportunities. 🔍 Built for Transparency One design decision was particularly important to us: every product should explain itself. Each product includes: Product description Key features Use cases Interpretation guidelines Methodology overview The objective is not simply to provide charts but to explain the problem being solved and how the underlying analysis works. 🔌 API First All products available through the platform are also accessible through API endpoints. Developers interested in integrating JungleTrade data into their own applications, dashboards, or research pipelines can request a demo API key through the platform. 🏗️ Architecture JungleTrade is built using a modular, service-oriented architecture des

If a regulator asks how you would move off your current cloud provider tomorrow, "we would figure it out" is no longer an acceptable answer. Most modern cloud deployments are deeply tied to provider-specific services, creating invisible dependencies that make true portability feel out of reach. Multi-cloud runtime approaches are expensive and complex, requiring duplicated infrastructure and operational teams. What you actually need is standardized portability. Here is how you can tackle it: Define your entire application environment using a single configuration file. Keep your infrastructure definition provider-agnostic, versioned, and auditable right inside your Git repository. Recreate the environment on another infrastructure provider without redesigning the deployment model or rewriting code. By decoupling your application from specific cloud consoles, you eliminate infrastructure re-architecture and give compliance teams a concrete blueprint. Check out our full technical write-up to see how to build an actionable exit strategy: Portable cloud architecture for DORA compliance | Upsun Discover how financial institutions can meet DORA exit strategy requirements by avoiding vendor lock-in with a portable cloud architecture. upsun.com

Dai metadati in una lingua a 20 localizzazioni senza impazzire tra click e schermate: un flusso pratico per indie e piccoli team. Localizzare un’app non significa solo tradurre le stringhe dell’interfaccia. Una buona parte dell’acquisizione organica passa dai metadati su App Store Connect : titolo, sottotitolo, descrizione e keyword. Il problema è che, quando provi a farlo “a mano” dal pannello web, diventa subito un lavoro di pura resistenza: apri la scheda, cambi lingua, compili i campi, salvi, ripeti. Ora moltiplica per 10–20 lingue. Per molti indie (e in generale per chi ha poco tempo e zero voglia di click ripetitivi) il punto di svolta è usare ASC CLI per rendere questa attività automatizzabile, ripetibile e verificabile . Perché la localizzazione dei metadati è un caso d’uso perfetto per una CLI Dal punto di vista del flusso di lavoro, i metadati App Store hanno tre caratteristiche che li rendono ideali per l’automazione: Sono campi strutturati (title, subtitle, description, keywords): non stai “inventando” contenuti ogni volta, stai trasformando contenuti. Sono ripetitivi per lingua : la sequenza di operazioni è identica, cambia solo la locale. Sono tanti : più lingue aggiungi, più l’approccio manuale scala male (tempo, errori, incoerenze). Con una CLI, invece, il lavoro si sposta dal “fare cose” al definire un processo : prendi i metadati di partenza, generi le varianti linguistiche, applichi l’update in batch. Cosa conviene localizzare (e cosa no) In genere ha senso includere in un passaggio di localizzazione “massiva”: App name / title (attenzione ai limiti e ai trademark) Subtitle (spesso è la parte più ASO-oriented) Description (qui conta più la leggibilità che la traduzione letterale) Keywords (campo delicato: va adattato, non tradotto alla cieca) Al contrario, è meglio trattare con più cautela: Claim e frasi marketing molto creative : in alcune lingue risultano innaturali se tradotte letteralmente Keyword strategy : la ricerca utenti cambia per mercat

n8n is the kind of tool you start using lightly and then quietly route half your operations through. At which point "it's running on someone's cloud seat, metered per execution, with my API keys living on their servers" starts to feel less great. Self-hosting fixes all three — flat cost, no execution cap, and your keys stay on a box you own. With Docker it's a fifteen-minute job. How much server it actually needs Honest numbers first, so you don't over- or under-buy: ~2 GB RAM is the sweet spot — n8n plus its Postgres database plus normal workflows sit comfortably here. 1 GB works if your workflows are light, but you'll notice it on bigger runs. 4 GB if you do heavy parallel executions or push large payloads through. n8n isn't CPU-hungry at rest; it spikes during runs. A 2-core box is fine for most setups. (More on matching specs to workload in the sizing guide .) The Docker setup On a fresh Ubuntu/Debian box, install Docker: curl -fsSL https://get.docker.com | sudo sh Make a folder and a docker-compose.yml — n8n with a persistent volume and Postgres: services : n8n : image : docker.n8n.io/n8nio/n8n restart : always ports : - " 127.0.0.1:5678:5678" environment : - N8N_HOST=n8n.yourdomain.com - N8N_PROTOCOL=https - WEBHOOK_URL=https://n8n.yourdomain.com/ - DB_TYPE=postgresdb - DB_POSTGRESDB_HOST=db - DB_POSTGRESDB_PASSWORD=change-me volumes : - ./n8n-data:/home/node/.n8n depends_on : [ db ] db : image : postgres:16 restart : always environment : - POSTGRES_PASSWORD=change-me - POSTGRES_DB=n8n volumes : - ./db-data:/var/lib/postgresql/data sudo docker compose up -d Two things worth pointing out: the volumes ( n8n-data , db-data ) are what keep your workflows alive across restarts and upgrades — don't skip them. And n8n is bound to 127.0.0.1 , not 0.0.0.0 — it's not exposed to the internet directly. That's deliberate; the next step handles access safely. Access: HTTPS or a tunnel Public URL (needed for OAuth nodes and webhooks): point a subdomain at the server and run

Most people who search for the AWS CLF-C02 exam fall into one of two groups: total beginners who want a credential proving they understand AWS, or people already working alongside AWS systems who are tired of nodding along in meetings without really knowing the answer. Both groups tend to underestimate this exam. The AWS Certified Cloud Practitioner is one of the more approachable certifications AWS offers, but approachable doesn't mean casual. It tests real terminology, real service boundaries, and scenario-based reasoning — not just buzzwords. Candidates who treat it like a marketing overview of "what is the cloud" are often the ones retaking it three months later. This guide covers what the exam measures, how to structure your study time, the mistakes that quietly sink first-time candidates, and how to know when you're genuinely ready to book a seat. Table of Contents What the CLF-C02 Exam Actually Measures Exam Domains and Their Weight Percentages The 4-Week AWS Certification Roadmap for CLF-C02 Practical Study Tips That Actually Move the Needle Common Mistakes Candidates Make Recommended AWS Free Resources The Role of Practice Exams Exam Day: What to Expect FAQ Conclusion: Your Next Steps What the CLF-C02 Exam Actually Measures The Cloud Practitioner certification isn't built around a job title — it's built around a simple question: can you hold an accurate conversation about the AWS Cloud, its value proposition, the shared responsibility model, core services, and billing? Per AWS's official exam guide, CLF-C02 validates your ability to: Explain the value of the AWS Cloud Understand and explain the AWS shared responsibility model Understand the AWS Well-Architected Framework Apply foundational security best practices Understand AWS Cloud costs, economics, and billing practices Describe and position core services across compute, networking, databases, and storage Identify the right AWS service for a given use case What's missing matters just as much: writing cod