AI 资讯

https://archive.ph/tSlDZ https://www.cnbc.com/2026/06/22/alan-greenspan-former-chairm...

In this article, the author explores data poisoning as a threat to machine learning systems, covering techniques such as label flipping, backdoors, clean-label poisoning, and gradient manipulation. The article reviews real-world incidents, discusses the challenges of detecting poisoned data, and presents practical defenses, tools, and operational practices for securing ML training pipelines. By Igor Maljkovic

Dan Fineran explores how eBPF has evolved far beyond its roots in packet filtering into a robust, safe way to extend the Linux kernel. He explains how the eBPF "verifier", the security guardrail, enables implementation of deep observability and networking without the risks of traditional kernel modules or the slow upstreaming process. By Dan Fineran

I got tired of MacOS failing to index applications (it consistently seems to prefer apps installed on my phone instead of the computer) so I've bound them to keys and have started building muscle memory for opening and switching apps. Reduces mental fatigue from constantly cmd + tabbing between apps all day

AWS made Graviton5-powered EC2 M9g and M9gd instances generally available with 192 ARM cores, formally verified VM isolation via the Nitro Isolation Engine, and DDR5-8800 memory. ClickHouse reported 36% better performance with zero code changes. Meta committed tens of millions of cores. On-demand pricing is 9% above Graviton4, translating to roughly 15% better price-performance. By Steef-Jan Wiggers

A consumer nav app tells the driver where to turn. It will not tell the dispatcher where the 11-hour driving clock runs out — and, more importantly, whether there is legal parking when it does. That second question is the one that strands a truck at 11 PM on the shoulder of an off-ramp with every nearby lot already full. Road511’s routing endpoint now answers it. Send the driver’s Hours-of-Service clock along with the route, and the response carries an hos[] array: every point on the corridor where the driver must take a break or stop driving under the selected regime, the projected time they reach it, the legal deadline, and — the part that matters operationally — the truck parking and rest areas actually reachable before that deadline. How It Works It rides the same call as everything else routing does: POST /api/v1/routing/route . You already send an origin, a destination, and a truck profile. To get the HOS projection, add an hos block inside the truck object describing the driver’s clock at departure. curl -X POST "https://api.road511.com/api/v1/routing/route" \ -H "X-API-Key: your_key" \ -H "Content-Type: application/json" \ -d '{ "origin": { "lat": 41.8781, "lng": -87.6298 }, "destination": { "lat": 39.7392, "lng": -104.9903 }, "departure_time": "2026-06-08T06:00:00Z", "truck": { "profile": "tractor", "weight_t": 36.0, "height_m": 4.2, "axles": 5, "hos": { "ruleset": "us", "drive_remaining_s": 39600, "duty_remaining_s": 50400, "since_break_s": 0 } }, "enrichment": { "include_features": ["truck_parking", "rest_areas"] } }' That’s a Chicago→Denver run for a fresh driver on US rules: 11 hours of driving left ( 39600 s), a 14-hour duty window ( 50400 s), and zero driving time since the last break. Every counter is “seconds remaining” against the named ruleset’s limit. The HOS Clock The hos object is the driver’s state, not a fixed policy. Store only the ruleset on a reusable truck profile — the per-trip counters are supplied inline on each request and merge on to

"Fractional CTO" has become the title people put on their LinkedIn profile when "senior developer" doesn't sound senior enough. I play this role for some of my clients, so I have opinions about what it actually means — and what it doesn't. The confusion isn't just semantics. If you hire the wrong thing under this label, you pay consulting rates for work that a good contractor would have done better. The Problem with the Label The term covers a surprisingly wide range of people and arrangements. At one end, you have experienced technical leaders — people who have actually run engineering organizations, made architectural decisions that constrained companies for years, hired and let go technical staff, and owned the consequences. At the other end, you have developers who decided their day rate felt more justifiable with a fancier title. Both call themselves fractional CTOs. The market hasn't sorted this out yet. The reason it matters: these are fundamentally different services with different prices, different deliverables, and different risks. Mixing them up is how companies end up paying €200/hour for someone to help them choose a JavaScript framework. What a Real Fractional CTO Actually Owns Owns is the operative word. Not "advises on." Not "contributes to." Owns. Technical architecture decisions. When you're building a system that will handle real volume, real users, and real money — the decisions made in the first few months constrain everything that follows. What database, what caching strategy, how the services are separated, where the complexity lives. A fractional CTO makes those calls and stakes their reputation on them. They're not writing a report about options. They're deciding. Tech stack and vendor selection. When a vendor pitches you something, someone needs to evaluate it who has seen enough vendors to know which ones are overselling. When a developer suggests a library, someone needs to know whether it's the right tool or just the tool that developer

Originally published at htpbe.tech . The version on htpbe.tech stays in sync with the latest detection algorithm — refer to it for the canonical text. Accounts payable teams are receiving receipts generated by ChatGPT plugins. HR platforms are seeing payslips rendered by Python scripts. Insurance claims contain repair estimates that no shop ever issued. The documents look correct. The logos match. The numbers are plausible. The question is: what can actually be detected, and what cannot? The honest answer requires separating two things that are often confused under the phrase “AI-generated document detection.” Two distinct problems called "AI-generated document detection" When people ask how to detect an AI-generated document, they usually mean one of two distinct things: Content classification asks: was the text in this document written by an AI language model? This is what tools like GPTZero and Turnitin’s AI detector do. They analyze writing style, token probability distributions, and linguistic patterns to estimate whether a human or a model produced the text. Structural forensics asks: was this PDF file generated by a real institutional system, or did it come from a headless browser, a PDF library, or a consumer tool? This is what HTPBE does. It reads the binary structure of the file — producer metadata, xref patterns, font embedding, object numbering — and checks whether those patterns match how legitimate institutional software generates documents. These are not the same problem. A document can contain AI-written text and still come from a real corporate system. A document can contain entirely human-written text and still have been rendered by Puppeteer an hour ago. The structural check and the content check answer different questions. HTPBE does structural forensics. It does not classify text. This article explains what that distinction means in practice, what the structural approach reliably catches, and where its limits are. What structural forensics detec

OpenAI introduces Patch the Planet, a Daybreak initiative helping open-source maintainers find, validate, and fix vulnerabilities with AI and expert review.

OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.

Every AI developer has been here: your app is throwing 503s, users are pinging you, and you have 12 browser tabs open — OpenAI status page, Anthropic status page, the GitHub Copilot health page, three different Discord servers — trying to figure out is this me or is it them? That's the problem we set out to solve. Prismix aggregates status from 77 AI services in one place. Six weeks of running it in production taught us some things that might save you time. The problem is worse than you think AI APIs don't fail like traditional infrastructure. They fail in weird, partial ways: Degraded performance that passes your health checks but makes your product feel broken Regional outages — OpenAI US-East is down while EU is fine, so half your users are affected Silent rate-limit cascades — the API returns 429s but their status page says "operational" for another 20 minutes Incident lag — providers often post status updates 10–30 minutes after engineers are already aware The official status pages are optimistic by design. They're customer-facing communications tools, not real-time engineering dashboards. There's nothing wrong with this — but it means you need a different mental model for "is this service down?" What 77 status pages look like in aggregate When you watch 77 AI services simultaneously, patterns emerge fast. OpenAI is the most-watched service (and has the most incidents to watch). The pattern is almost always the same: investigating → identified → monitoring → resolved , typically in 45–90 minutes. The investigating phase is where most developers panic — it looks bad but usually resolves without action on your end. Anthropic runs noticeably clean compared to its API usage growth. Incidents are rarer and shorter. When they do happen, updates arrive faster than most providers. The long tail is interesting. Services like Replicate, Runway, ElevenLabs, and Suno have incident patterns that don't correlate with OpenAI at all. If you're routing across multiple providers

A few days ago I had an idea: what if one LLM could orchestrate other LLMs as agents — not just calling them, but verifying that each agent's output was actually correct before passing it to the next? I work on NeuralBridge (an open-source self-healing SDK for LLM pipelines), so I decided to build it and test it with two real providers: KIMI (Moonshot) and Agnes AI . The Core Problem: Failover ≠ Correctover Most API gateways and LLM routers stop at "HTTP 200" — they retry or switch providers, but they never check if the output is actually correct . # What everyone else does: try : result = call_llm ( prompt ) return result # HTTP 200 = success? 🚩 except Exception : result = call_llm_fallback ( prompt ) return result # Still not verified! This is dangerous. A failover from gpt-4o to gpt-4o-mini might silently drop 3 critical fields. A KIMI response that returns "200 OK" might still be missing key entities. Correctover is the idea that switching providers isn't enough — you must verify semantic equivalence after every switch. The Architecture We built a simple DAG-based chain executor with three key capabilities: DAG orchestration — define multi-step workflows where nodes depend on each other Per-node semantic validation — every LLM output is checked against a Contract before passing to the next node Cross-provider Correctover — if validation fails, automatically retry with a different provider from neuralbridge import SelfHealingEngine , ProviderConfig , Contract from neuralbridge.chain import ChainBuilder engine = SelfHealingEngine ( providers = []) engine . add_provider ( ProviderConfig ( name = " moonshot " , base_url = " https://api.moonshot.cn/v1 " , api_key = " ... " , models = [ " moonshot-v1-8k " , " moonshot-v1-32k " ], )) engine . add_provider ( ProviderConfig ( name = " agnes " , base_url = " https://apihub.agnes-ai.com/v1 " , api_key = " ... " , models = [ " agnes-2.0-flash " ], )) chain = ( ChainBuilder ( engine ) . node ( name = " planner " , system = "

Every World Cup there's a moment. Some player nobody outside their domestic league had heard of scores an absolute screamer in a knockout match, and by the time they've finished celebrating, their follower count is climbing like a rocket. I always found that fascinating, but I could never see it happening. By the time the "X gained 3M followers!" tweets show up, the surge is already over. So this tournament I built a little tracker that snapshots player follower counts on a schedule and shows me the growth curve in near real-time. Here's how it works. The problem with doing this "properly" My first instinct was the official APIs. That died fast. Instagram's Graph API won't give you follower counts for accounts you don't own. TikTok's Research API is academics-only and takes weeks of applications. X's API now starts at $100/month and climbs steeply from there. I just wanted public follower counts — numbers anyone can see by opening the app. I didn't want a data partnership and a legal review. I ended up using the SociaVault API , which wraps public profile data from each platform behind one key. One request, one credit, JSON back. The shared client Everything runs through one tiny helper: // Node 18+ has fetch built in const API_KEY = process . env . SOCIAVAULT_API_KEY ; const BASE = " https://api.sociavault.com " ; async function sv ( path , params ) { const url = new URL ( BASE + path ); Object . entries ( params ). forEach (([ k , v ]) => url . searchParams . set ( k , v )); const res = await fetch ( url , { headers : { " X-API-Key " : API_KEY } }); if ( ! res . ok ) throw new Error ( ` ${ res . status } ${ await res . text ()} ` ); return res . json (); } Grabbing follower counts across platforms Each platform nests the count slightly differently, so I use fallback chains to stay defensive: async function instagramFollowers ( username ) { const data = await sv ( " /v1/scrape/instagram/profile " , { username }); const p = data . data ?. user ?? data . data ?? data

MCP is useful, but most of the time you do not actually need it. It gives an agent a clean way to discover tools, call APIs, and work with external systems. In practice, a skill file can describe the same usage path without dragging the whole MCP surface into context. But MCP is not free; rather than MCP itself, the real issue is the habit of loading a big MCP surface into every session, no matter what the session is actually about. Once a Claude Code or Codex run pulls in a bunch of servers, the model sees those tool definitions right away, even if the job is just writing docs or fixing a small bug. That is where the waste starts. The hidden cost of always-on MCP Every MCP server brings metadata with it: tool names, descriptions, argument schemas, nested parameters, enums, examples, and sometimes prompts or resources. While useful, this is still context. If you connect a handful of lightweight tools, the overhead is annoying but manageable. If you connect a real stack of services, the cost compounds fast. In practice, you end up paying for: tool discovery before the task starts schema text the model may never use repeated loading across unrelated sessions extra context pressure that pushes out the actual work That last point matters more than people think. Context acts as the active working set the model uses to reason. The more of it you burn on static tool catalogs, the less room you have for the user request, the repo state, prior reasoning, and the actual answer. Anthropic has already written about this problem directly in the context of MCP. Their engineering post on code execution with MCP calls out tool-definition bloat and shows how direct tool calls can consume a lot of context before the model even starts doing the real job. The tool list is not just setup noise; it is part of the session cost. Why skills are cheaper Skills take a different path. A skill file keeps the always-loaded portion tiny. Usually that means just the skill name and a short descript

Code reviews, configuration changes, and debugging sessions demand precise understanding of what changed between two versions of text. Manual comparison of large blocks of code or configuration files is error-prone, and version control diffs don’t always provide a quick, focused view for sharing or verifying changes outside a repository. What it is Diff Checker is a browser-based text comparison tool that performs line-by-line analysis of two text blocks and highlights differences with color-coded visual indicators. It processes text entirely in the browser—part of the 200+ free tools on DevTools—meaning no data is uploaded or stored, a privacy‑first design. The interface uses a split‑pane layout: original text on the left, modified text on the right. As you paste or type, the comparison engine recalculates the diff in real time, marking added, removed, and changed segments so differences are immediately clear. Several configuration options tailor the analysis. Toggling whitespace sensitivity ignores differences in indentation or blank lines, useful when comparing code from teams with different formatting conventions. Case sensitivity can be turned off for text where capitalization inconsistencies are irrelevant. A swap button reverses the comparison direction with a single click, handy when the assignment of “original” and “modified” is accidentally reversed. How to use it Paste the original text into the left panel and the modified version into the right panel. The diff view updates instantly, so you don’t need to press a button to see changes. For code, the process is straightforward. Drop a baseline function on the left: function calculateTotal ( items ) { let total = 0 ; for ( let item of items ) { total += item . price ; } return total ; } And the updated version on the right: function calculateTotal ( items , taxRate = 0 ) { let total = 0 ; for ( let item of items ) { total += item . price * ( 1 + taxRate ); } return Math . round ( total * 100 ) / 100 ; } The

Placeholder text is necessary scaffolding in web development, but ubiquitous Lorem ipsum can lead to design monotony and disconnect from project context. Developers building mockups, prototypes, or content-heavy interfaces often need filler text that matches the tone of the target application without introducing distracting Latin. What it is The Lorem Ipsum Generator is a browser-based tool that produces placeholder text in multiple styles, moving beyond classical Latin pseudo-text. It offers distinct variants: traditional Lorem ipsum, Hipster Ipsum with artisanal terminology, Corporate Speak filled with business jargon, and Pirate Ipsum with nautical themes. Each style maintains readability while providing vocabulary that aligns with the spirit of a given project. The generator is part of DevTools, a privacy-first collection of 200+ free browser tools where all processing happens locally—no signup, no tracking. Developers can configure generation parameters to specify the number of paragraphs, total word count, and whether to start with the familiar “Lorem ipsum dolor sit amet” opening. The output is plain text ready for pasting into HTML, design files, or CMS entries. How to use it The interface is a straightforward form: select a text style from the dropdown, then set the number of paragraphs or words you need. The tool generates the text instantly and provides a one-click copy button. <!-- Example output structure when pasting into HTML --> <div class= "content-area" > <p> Leverage agile frameworks to provide a robust synopsis for high level overviews... </p> <p> Iterative approaches to corporate strategy foster collaborative thinking... </p> </div> For typical workflows, 1–3 paragraphs suffice for article previews or body content. Headlines work well with 5–15 words, while navigation elements often need only 2–5 words. The quick copy functionality streamlines populating multiple content areas. Different styles suit different contexts: Corporate Speak makes busi

One Model to Command Them All Discussion | Link

Why AI Alternatives Matter AI is prone to problems affecting its output: hallucinations, incompleteness, inconsistency, and bias. AI usage is costly, and the popular free services might require expensive paid plans or downgrade to sponsored light versions at any time. Don't Hit Submit! Ethical issues aside, lazily using AI to often and too early won't make you a better coder or more creative. And AI companies don't only take your money, they're also after your data – and your time! Techniques like Rubber Duck Debugging (internal dialog development preparing questions and anticipating answers without actually asking anyone) are alternatives to AI for coding and creativity. Don't Ask Suggestive Questions If your question implies a certain answer, asking only makes sense for falsification. AI (and other people) will hopefully tell you when you're completely wrong. Only that AI often doesn't. Current models are trained for flattery and verbosity. Don't Ask Why What a waste of time! Try to ask open questions, and always prefer asking "how", not "why". Stay Skeptical Don't believe anything without a factful proof or a recent, reputable, relevant source. GEO, the AI-agent-targeting variant of search engine optimization, already succeeded to gaslight AI and poison its answers with fake sources biased towards commercial results. AI seems much more gullible than real people. Source: The Shape of Enshittification: Books That No Longer Get Read, An Internet That No Longer Gets Surfed, & The End of Social Media As We Know It.. Principle of Least Power Remember the rule of least power : don't rent a truck when you need a mini van. Don't use AI when you need autocomplete, web search, or a tutorial! I sketched a pyramid of thinking, creativity, and information retrieval again. As you can guess, AI assistants are "on top" as the most costly exception, while the broad basis should be traditional groundwork. Here's a cute AI-slop adaption: Source: Hand-Crafted Creative Counter-Culture

2026 AI Coding Agents Are Making Developers Forget How to Code: Why the Convenience Trap Threatens Innovation As AI‑driven platforms like Atoms, Devin, Windsurf, Cursor, and Warp reshape software engineering, the real cost may be a gradual erosion of core programming fundamentals. The latest MarkTechPost comparison shows AI coding agents moving from novelty to mainstream. Teams report faster feature cycles, fewer lines of manual boilerplate, and a shift toward intent‑first workflows. Yet beneath the productivity headlines lies a subtle trade‑off: every hour spent letting an agent write code is an hour not spent exercising the mental muscles that let us reason about edge cases, optimize performance, or invent novel algorithms. The Rise of Intent‑First Development Modern agents excel at turning a natural‑language description into a runnable diff. Atoms uses multimodal reasoning to interpret UI sketches; Devin can autonomously open pull requests after a high‑level prompt; Windsurf lets engineers edit across files with conversational commands. This paradigm reduces the cognitive load of syntax hunting and lets engineers focus on what the software should do, not how to type it. Measuring the Productivity‑Skill Trade‑off Data from early adopters shows a 38% cut in boilerplate typing and a 22% boost in sprint velocity. However, internal surveys reveal a 15% drop in self‑reported confidence when debugging low‑level concurrency bugs, and a 20% increase in reliance on agent‑generated explanations rather than personal code walkthroughs. The numbers suggest a growing dependency that mirrors the calculator effect seen in mathematics education. Second‑Order Shifts: From Craftsmanship to Orchestration As routine typing fades, engineers spend more time validating AI output, refining prompts, and orchestrating multi‑agent pipelines. Traditional code reviews evolve into “prompt reviews,” where the gatekeeper judges whether the AI captured the business intent. New roles—AI Interaction

From fake tickets to cloned websites, AI is magnifying World Cup scams. Can fans distinguish between what’s real and what’s not?