AI 资讯

At least one malware developer is adding text about nuclear and biological weapons to their spyware, in an effort to stop automatic AI analysis. Details : The _index.js payload begins with a large JavaScript block comment containing fake system instructions and policy-triggering content. Because it is inside a comment, it does not affect JavaScript execution. The runtime skips it. The real malware begins after the comment with a try{eval(…)} wrapper around a large character-code array and a ROT-style substitution function. This header appears designed for AI-mediated analysis, not for Node, Bun, or Python. It attempts to derail scanners or analyst copilots that feed the beginning of a file to a language model without clearly isolating the content as untrusted data. In weak pipelines, this can cause refusal behavior, prompt confusion, context pollution, or premature classification before the scanner reaches the actual malware...

These goggles have an excellent display, solid metric tracking, and an open-water “SwimStraight” feature. But the real smart tech requires a subscription.

From AirPods to on-ears, we’ve tested hundreds of pairs of headphones. Here are the best deals from Amazon’s biggest sale event.

Bob Iger's tenure as CEO of Disney came to an end a few months ago, after two decades of leading the entertainment giant through some of its most pivotal transformations and acquisitions. Iger, in an exit interview with The Financial Times, has now confirmed some significant efforts that didn't pan out, such as walking away […]

mqttkit: Elysia-style application framework for MQTT An ordered middleware pipeline, typed topic routes, MQTT 5 RPC, and auto-generated AsyncAPI docs — sitting on top of any MQTT broker. If you've ever built a serious MQTT backend in Node, you've probably written this code at least once: client . on ( ' message ' , ( topic , payload ) => { if ( topic . startsWith ( ' devices/ ' ) && topic . endsWith ( ' /events ' )) { const uid = topic . split ( ' / ' )[ 1 ] // ad-hoc auth check // ad-hoc JSON.parse + validation // ad-hoc error handling // ad-hoc metrics // ... } else if ( topic . startsWith ( ' server/ ' )) { // ... } }) That's the MQTT equivalent of writing an HTTP server with http.createServer((req, res) => { if (req.url === '/users') ... }) . We solved that pattern for HTTP a decade ago with Express, Koa, Fastify, and more recently Hono and Elysia. For MQTT, we haven't. That's the gap mqttkit is filling. The design choice: don't reimplement the protocol There are already excellent MQTT brokers in the Node ecosystem — most notably Aedes , which handles CONNECT, SUBSCRIBE, PUBLISH, QoS, retain, sessions, persistence, and MQTT-over-WebSocket. EMQX and Mosquitto cover production scale. None of these need replacing. What's missing is the application layer — the part where you ask: How do I declaratively say "this topic requires this auth check"? How do I validate payloads with the same schema I already use for HTTP? How do I do MQTT 5 request/response without writing correlation-id bookkeeping? How do I get AsyncAPI docs for free? How do I attach Prometheus / OpenTelemetry without lifting broker internals? mqttkit is purely that layer. It plugs into Aedes via @mqttkit/aedes , but the broker is just an adapter — you can write your own for EMQX, NanoMQ, or any other broker. What the code looks like import { aedes } from ' @mqttkit/aedes ' import { MqttApp , router } from ' @mqttkit/core ' import { z } from ' zod ' const app = new MqttApp < { principal ?: { uid : string

submitted by /u/nephrenka [link] [留言]

Why I Stopped Picking AI Models by Hype and Started Picking by Speed Three months ago I almost lost a $14,000 retainer because my chatbot felt sluggish. The client didn't say "your TTFT is too high." They said "it feels dumb." That's freelancer code for "users are bouncing and I'm about to find someone else." I rebuilt that bot in a weekend using a model I'd never even heard of six weeks earlier, dropped average response time from 1.4 seconds to under 300ms, and the client renewed for another six months. That single pivot paid for my rent. So I went down a rabbit hole. I ran the same speed test on every model I could get my hands on through Global API's unified endpoint. Fifteen models. Same prompt. Same regions. Ten iterations each. I'm writing this up because if you're billing by the hour or running a side hustle on a shoestring, speed isn't a vanity metric — it's a profit metric. Let me show you what I found. The Setup (How I Actually Ran the Tests) I'm not a researcher with a rack of GPUs. I'm a guy with a M2 MacBook, a $19/mo Hetzner box, and a stopwatch in the form of Python's time.perf_counter() . Here's how I kept it honest. Date window: All tests run on May 20, 2026 Regions tested: US East (Ohio) and Asia (Singapore) Prompt used: "Explain recursion in 200 words" — boring on purpose, because boring prompts are where most apps actually live Output length: Roughly 150 tokens per run Iterations: 10 runs per model per region, average recorded Streaming: Yes, SSE throughout Endpoint: Global API at https://global-apis.com/v1 I measured two things: TTFT (time to first token — the lag before the user sees anything move) and sustained tokens per second (how fast the words actually arrive after that). Both matter. TTFT is the "is this thing broken?" feeling. Tokens per second is the "is this thing fast?" feeling. Here's the script I used, stripped down to the essentials: import time import requests from statistics import mean API_KEY = " your-global-api-key " BASE_URL

Building point-in-time correct, production-grade feature pipelines — from raw Kafka events to online feature serving in milliseconds, using Spark Structured Streaming and the Databricks Feature Store. Table of Contents The Feature Engineering Problem Architecture Overview Feature Store Concepts: ERD Environment Setup Streaming Feature Pipeline Point-in-Time Correct Training Dataset Generation Writing Features to the Online Store Serving Features at Inference Time Feature Table Reference References The Feature Engineering Problem Feature engineering is where most ML projects silently fail in production. Not because the model is wrong — but because the features the model sees at training time are different from the features it sees at inference time . This is called training-serving skew , and it's the #1 silent killer of ML systems. Three specific failure modes cause it: Online/offline inconsistency — the batch pipeline that computes training features uses different logic than the real-time service that computes inference features Data leakage — training features accidentally include information from the future (e.g. joining on a label that was created after the event) Feature staleness — a model trained on 30-day rolling averages is served features that are 6 hours stale because the pipeline backfills are slow The Databricks Feature Store — now part of Unity Catalog as Feature Engineering in Unity Catalog — solves all three by: Storing feature computation logic alongside the data (no drift between training and serving) Enforcing point-in-time lookups during training dataset creation Providing a unified API for both batch offline reads and low-latency online reads Architecture Overview Feature Store Concepts: ERD Understanding the data model behind the Feature Store is essential for designing correct pipelines. Here's how the entities relate: The critical relationship: a Model Version is bound to a Training Set , which records exactly which feature tables and which p

Model Context Protocol (MCP) is an open standard for connecting AI apps to tools and data sources. A useful way to think about it is as a USB-C port for AI: one standard interface that lets different models plug into different capabilities without custom glue code for every integration. In this project, we combine MCP, Spring AI, and Google Gemini to build a chat app that can answer weather questions using real tools instead of hallucinating. The system has three parts: MCP tool server - a Spring Boot service that exposes weather and geocoding tools AI chat agent - a Spring Boot service that uses Spring AI + Gemini and calls MCP tools when needed React chat UI - a lightweight frontend for sending messages and rendering replies The result is a small but realistic architecture you can extend into a production assistant. Architecture User (Browser:3000) | POST /api/chat v AI Agent (Spring:7171) -- MCP / Streamable HTTP --> MCP Server (Spring:7170) | | | Google Gemini | Bright Sky API (weather) | | OpenStreetMap Nominatim (geocoding) v v Chat response Tool execution The full source code is available on GitHub . 1. The MCP Tool Server The tool server is a Spring Boot application that exposes MCP tools through Spring AI's annotation scanner. It runs on port 7170 and uses Streamable HTTP for transport. Dependencies <dependency> <groupId> org.springframework.ai </groupId> <artifactId> spring-ai-starter-mcp-server-webmvc </artifactId> </dependency> <dependency> <groupId> org.springframework.boot </groupId> <artifactId> spring-boot-starter-web </artifactId> </dependency> Defining tools With Spring AI, a tool is just a Spring bean method annotated with @McpTool : @Component public class WeatherTool { private final WeatherToolService weatherToolService ; public WeatherTool ( WeatherToolService weatherToolService ) { this . weatherToolService = weatherToolService ; } @McpTool ( name = "get_current_weather" , description = "Get current weather by dwd_station_id or by lat/lon" ) p

Every quarterly earnings number for every US public company going back to 2009 is sitting in a free, well-documented JSON API run by the US government. No API key. No rate limit for normal use. No paywall. Almost nobody in the dev community seems to know it exists. It's at data.sec.gov , and it's the same data Bloomberg charges $24k/year for. What's in it The SEC requires all US-listed companies to file financial reports in XBRL — a structured XML format where every number is tagged with a standardised concept name. The EDGAR system has been collecting these since around 2009. The companyfacts endpoint exposes all of it as clean JSON: GET https://data.sec.gov/api/xbrl/companyfacts/CIK{cik}.json Where CIK is the company's SEC identifier (10 digits, zero-padded). For Apple, that's 0000320193 . The response is a large JSON object with every concept the company has ever reported, broken down by period. The other endpoint you need is the ticker-to-CIK map: GET https://www.sec.gov/files/company_tickers.json This gives you a flat list of all US-listed companies with their CIK, ticker, and name. Load it once and cache it. One gotcha: concept names vary by company Companies don't all use the same GAAP concept names to report the same thing. Apple reports revenue as RevenueFromContractWithCustomerExcludingAssessedTax . Older companies use Revenues . Some use SalesRevenueNet . If you just look up one concept name, you'll get blanks for most companies. The fix is a concept alias map: try each name in order, use the first one that has data. const CONCEPT_MAP : Record < string , string [] > = { revenue : [ ' Revenues ' , ' RevenueFromContractWithCustomerExcludingAssessedTax ' , ' RevenueFromContractWithCustomerIncludingAssessedTax ' , ' SalesRevenueNet ' , ' SalesRevenueGoodsNet ' , ], netIncome : [ ' NetIncomeLoss ' , ' NetIncomeLossAvailableToCommonStockholdersBasic ' , ' ProfitLoss ' , ], operatingCashFlow : [ ' NetCashProvidedByUsedInOperatingActivities ' , ' NetCashProvidedB

While working on a MERN project, I came across these indexes: transactionSchema . index ({ user : 1 , date : - 1 }); transactionSchema . index ({ user : 1 , type : - 1 }); transactionSchema . index ({ user : 1 , category : - 1 }); My first reaction was: "Why are we creating 3 different indexes for the same schema? Isn't one index enough?" At that time, my understanding was: "Indexes help MongoDB find records faster." Which is true, but it wasn't enough to explain why multiple indexes existed for the same collection. That simple doubt led me down a rabbit hole of learning about indexes, compound indexes, how MongoDB stores them, and the famous Prefix Rule. Here's what I learned. What is an Index? Imagine a collection with millions of transactions. db . transactions . find ({ user : " Aarthi " }); Without an index, MongoDB may need to inspect every document until it finds the matching records. This is called a Collection Scan . Think of it like searching for a chapter in a book without a table of contents. You'd have to flip through page after page until you find it. An index works like a book's table of contents. Instead of scanning every document, MongoDB can jump directly to the relevant records. Example: db . transactions . createIndex ({ user : 1 }); Now MongoDB can quickly locate all transactions belonging to a specific user. What is a Compound Index? A compound index contains multiple fields. Example: db . transactions . createIndex ({ user : 1 , date : - 1 }); This means MongoDB organizes the index by: user └── date Conceptually, it looks something like: Aarthi 2025-08-10 2025-08-09 2025-08-08 John 2025-08-10 2025-08-05 The data is first grouped by user , and within each user, it is ordered by date . Now queries like: db . transactions . find ({ user : " Aarthi " }). sort ({ date : - 1 }); become very efficient. MongoDB can jump directly to Aarthi's records and retrieve them in date order. The Prefix Rule: The Concept That Finally Made It Click Consider this i

What is an Array in Go? In Go, an array is a fixed-size, ordered set of values with the same type. Imagine an array as a 12 egg tray; the minimum number of eggs which can fit into an array is 12; the maximum number of eggs which can fit into an array is 12. That is the exact behaviour of a Go array. package main ​ import "fmt" ​ func main() { var groceries [3]string// Step 1: Create an array that holds 3 strings groceries[0] = "Bread"// Step 2: Put "Bread" in slot 0 groceries[1] = "Milk"// Step 3: Put "Milk" in slot 1 groceries[2] = "Eggs"// Step 4: Put "Eggs" in slot 2 fmt.Println(groceries)// Step 5: Print the whole array } Expected output: [Bread Milk Eggs] Zero Values In Go, you create an array by using the var keyword, and each of the slots receives the safe code Zero value, given that no elements are explicitly set. This means that your array will never be in an unsafe state of being uninitialized. It will be valid on every slot, even before set. The same thing is a safety feature in Go intentionally. var prices [3]float64 fmt.Println(prices) // Output: [0 0 0] - Go fills all the values with zeros automatically Declaring an Array In Go, you can declare an array in a few different ways, and you will learn about each of them in turn. Using the var Declaration var groceries [3]string groceries[0] = "Bread" groceries[1] = "Milk" groceries[2] = "Eggs" If you want to initialise an array of a specific size and use it later, then this is the best method to achieve this. Array Literals If you are already aware of all the values at the time you write the code, then you can use the literal syntax: package main import "fmt" func main() { groceries := [3]string{"Bread", "Milk", "Eggs"} fmt.Println(groceries) } Expected output: [Bread Milk Eggs] The actual syntax is: [size]type{value1, value2, value3} This method is used when we know the values which we want to store in an array. Let the Compiler count for you — The ... trick When using literal syntax, and you find that you

TL;DR An AI gateway is a middleware layer between your application code and your LLM providers - it centralises routing, auth, rate limiting, cost tracking, and guardrails in one place You probably don't think you need one until something specific breaks: a runaway cost spike, a failed model causing silent errors, a security audit you can't pass We went from scattered SDKs and shared API keys to a gateway-first setup over about three months - this post covers what changed and what we'd do differently Six months ago we had what I'd describe as a functional mess. We were running three LLM providers - OpenAI for our customer-facing chat, Anthropic for internal document summarisation, and a self-hosted Llama model for batch classification jobs. Each had its own SDK. Each had its own API key, living in .env files on whoever's machine had last run that service. Each had its own rate limiting logic, copy-pasted between services with slight variations. It worked, in the way that things work when nobody has had a bad enough incident yet. The incident arrived on a Tuesday. A background job that was supposed to run once a week got accidentally scheduled to run every minute. It was calling GPT-4o. We noticed when the Slack alert fired at 2am about an unusual credit card charge. By the time someone killed the job, we'd burned through $340 in about four hours. The API key had no spending limit. There was no alerting on token usage. The job had no rate limiting. All three of those gaps were things we knew about and hadn't prioritised. That week, we started properly looking at AI gateways. What an AI gateway actually is? The simplest definition: an AI gateway is a middleware layer that sits between your application code and your LLM providers. All your LLM requests go through it, and it handles the cross-cutting concerns that you'd otherwise have to re-implement in every service: routing, authentication, rate limiting, cost tracking, caching, fallbacks, guardrails. The analogy that

The Complete Guide to OpenAI-Compatible APIs for Chinese LLMs One of the smartest decisions OpenAI made was making their API the de facto standard for LLM interaction. The openai Python package, the ChatCompletion interface, and the message format have become the HTTP of AI — nearly every major model provider now supports some form of OpenAI compatibility. This means you can swap models without changing your code. Here's how to use that to access China's best LLMs. The OpenAI SDK Pattern If you've used OpenAI's API, you already know the pattern: from openai import OpenAI client = OpenAI ( api_key = " sk-... " ) response = client . chat . completions . create ( model = " gpt-4o " , messages = [{ " role " : " user " , " content " : " Hello! " }] ) To access Chinese models through an OpenAI-compatible gateway, you change exactly two things : client = OpenAI ( base_url = " https://api.tokenmaster.com/v1 " , # ← Changed api_key = " tm-... " # ← Changed ) Everything else stays the same. The same SDK, the same method calls, the same message format. What This Unlocks By switching to an OpenAI-compatible gateway for Chinese models, you gain access to: Model Family Top Models Competitive Advantage OpenAI-Compatible DeepSeek V4-Pro, V4 Flash, Coder Coding, math, reasoning ✅ Qwen (Alibaba) 3.7-Max, 3.5-Flash Long context (256K), multilingual ✅ GLM (ZhipuAI) 4.5, 4-Flash Reasoning, structured output ✅ Baichuan Baichuan 4 Chinese content generation ✅ All accessible through the same SDK, the same API key, the same base URL. Migration Guide Step 1: Get Your Gateway Key Sign up at an OpenAI-compatible gateway for Chinese models. Most offer free trial credits: # I use TokenMaster # Sign up at https://api.tokenmaster.com # Get your API key from the dashboard Step 2: Update Your Client Instantiation Python: # Before: OpenAI only import os from openai import OpenAI client = OpenAI ( api_key = os . getenv ( " OPENAI_API_KEY " )) # After: Multi-model access TM_KEY = os . getenv ( " TOKENM

How to Use Chinese LLMs Without a Chinese Phone Number If you've tried signing up for any Chinese AI service, you've seen the same message: Please enter your phone number (+86) to receive a verification code. This single requirement blocks most overseas developers from accessing some of the best-performing and most cost-effective LLMs on the market. This guide covers every workaround I've found — from least to most practical. The Problem China's major AI labs produce world-class models: DeepSeek — DeepSeek V4-Pro matches GPT-4o within 3-5% on coding benchmarks Qwen (Alibaba) — Qwen 3.7-Max beats GPT-4o on long-context tasks (256K tokens) GLM (ZhipuAI) — GLM-4.5 is competitive with Claude for reasoning tasks Baichuan — Strong for Chinese-language generation But every single one requires: A +86 Chinese phone number for registration Alipay or WeChat Pay for billing Chinese-language documentation Method 1: Virtual Chinese Phone Numbers (Fragile) Services like SMS-activate and 5sim offer temporary Chinese phone numbers for ~$1-2. The problem: Chinese providers have gotten aggressive about flagging virtual numbers. Your account gets banned within days. You lose any balance you've added. ❌ Not recommended — too unreliable for production use. Method 2: Third-Party Gateway Services (Recommended) The most practical solution is a gateway that handles the China-side complexity for you. These services: Maintain their own Chinese accounts and infrastructure Register with real Chinese business entities Handle Alipay/WeChat billing on their end Expose everything through a standard OpenAI-compatible API What this means for you: Sign up with email (no phone number needed) Pay via Stripe or PayPal Get a standard API key Use the OpenAI Python/Node.js SDK as-is Migration example (Python): # Before — can't access Chinese models at all # client = OpenAI(api_key="...") # Only works for OpenAI # After — full access to Chinese models client = OpenAI ( base_url = " https://api.tokenmaster.com

A deep dive into how Spark transforms your SQL into a physical execution plan — and how Databricks layers Adaptive Query Execution and the Photon vectorized engine on top to squeeze out maximum performance. Table of Contents Why Query Optimization Matters The Catalyst Optimizer Pipeline Stage 1: Parsing — From SQL to Unresolved Logical Plan Stage 2: Analysis — Binding to the Catalog Stage 3: Logical Optimization — Rule-Based Rewrites Stage 4: Physical Planning — Strategies and Cost Models Adaptive Query Execution (AQE) The Photon Engine Reading Explain Plans Tuning Reference Table References Why Query Optimization Matters A Spark query written by a human and a Spark query executed by the engine are often very different things. The gap between them — the optimization — is what separates a job that runs in 3 minutes from one that runs in 3 hours on identical hardware. Databricks compounds Spark's native Catalyst optimizer with two additional layers: Adaptive Query Execution (AQE) — re-optimizes the query at runtime using actual statistics collected mid-job Photon — a C++ vectorized execution engine that replaces the JVM-based Spark executor for eligible operators Understanding all three lets you write queries that cooperate with the engine rather than fight it. The Catalyst Optimizer Pipeline Catalyst is Spark's rule-based and cost-based query optimizer. Every query — whether written in SQL, DataFrame API, or Dataset API — passes through the same four-stage pipeline before a single byte of data is read. Stage 1: Parsing — From SQL to Unresolved Logical Plan # ── Catalyst Stage 1: Parsing ───────────────────────────────────────────────── # Spark uses ANTLR4 to parse SQL into an Abstract Syntax Tree (AST). # At this point column names are NOT validated — the plan is "unresolved". from pyspark.sql import SparkSession spark = SparkSession . builder . appName ( " catalyst-demo " ). getOrCreate () # Both of these produce identical internal representations df_api = ( spark .

How to Access DeepSeek API from Outside China (2026 Guide) DeepSeek has quietly become one of the best open-weight LLM families available. Their V4-Pro model matches GPT-4o within 3-5% on coding benchmarks (HumanEval, MBPP) while costing roughly 90% less per token. The problem? Actually getting access as an overseas developer. The Registration Wall If you try to sign up for DeepSeek's official API directly, you'll hit this: ✕ +86 phone number required for SMS verification ✕ Alipay or WeChat Pay only — no Stripe, no PayPal ✕ Documentation is primarily in Chinese ✕ VPN required and it drops mid-request ✕ Different auth system than OpenAI This isn't a minor inconvenience — it's a hard blocker for most overseas developers. I spent a full weekend trying to work around it before finding a solution that actually worked for production use. Option 1: DIY Proxy (Not Recommended) You could technically set up a Chinese VPS as a relay, register through a Chinese friend's number, and proxy requests. I tried this approach. Problems: Your Chinese VPS adds 100-300ms latency You're responsible for keeping the integration working If your Chinese friend's number gets flagged, you're locked out No SLA, no support, no monitoring Payment still requires Alipay — you need a Chinese bank account or a friend After a weekend of futzing with this, I abandoned it. Not production-ready. Option 2: Third-Party Gateway (What I Use) There are now services that handle the China-side complexity and expose DeepSeek through a standard OpenAI-compatible API. They handle: Chinese phone number verification Alipay/WeChat payment (you pay via Stripe instead) API routing with global edge caching Load balancing across multiple Chinese providers Setup is literally two lines: # Before: Direct OpenAI client = OpenAI ( base_url = " https://api.openai.com/v1 " , api_key = OPENAI_KEY ) # After: Via gateway client = OpenAI ( base_url = " https://api.tokenmaster.com/v1 " , api_key = TM_KEY ) That's it. Same SDK, same i

An AI agent that's flawless in the demo can still fall apart the first time a tool fails in production: a timeout, a network error, a response that comes back corrupted. The fix isn't a smarter model. It's testing the agent against those failures on purpose, before your users do, and hardening it one failure type at a time.