AI 资讯

Many of those videos were reportedly filmed on “near-perfect copies” of the Polymarket website, while featuring trades and winnings that were not real.

Debugging authentication in web apps is painful. You need to test the same flow as five different user types — new visitor, returning user, admin, expired session, logged-out — and the easiest way is to constantly create new accounts or clear all your cookies and start over. There's a faster way. These five techniques use direct cookie manipulation to simulate any auth state without touching your database or creating dummy accounts. I use CookieJar for most of this — a free Chrome extension built natively on MV3 that gives you a proper UI for cookie editing. But I'll show you the underlying Chrome DevTools method too, so you understand what's actually happening. 1. Simulate a Logged-Out State Without Clearing Everything The naive approach: clear all cookies and reload. The problem: you just nuked your dev server session token, your local storage flags, your Stripe test mode cookie, and everything else you carefully set up. The targeted approach : identify and delete only the session/auth cookie. Most session cookies are named session , sid , auth_token , _session_id , or something close. In DevTools: Application → Cookies → [your domain] → find the session cookie → right-click → Delete With CookieJar: open the extension, search session , click the trash icon next to just that cookie. Your dev environment stays intact. The user state resets to logged-out. 2. Test the "Returning User" vs "New User" Path Without a Second Account Session cookies tell the server you're authenticated. But many apps use separate cookies to track whether a user has seen the onboarding flow, completed setup, or visited before. Look for cookies like onboarding_complete , setup_done , first_visit , or custom flags in your app code. To test the new user experience: Export your current cookies (CookieJar → Export → JSON format, or copy from DevTools) Delete the specific onboarding/first-visit flag cookie Reload and test the new user path Re-import or re-set the cookie to restore your state This

Originally published on Mohamad Alsabbagh's Blog . AI coding assistants are excellent at compressing known work into fast drafts. That speed is the preface boost : routine implementation arrives almost immediately. The hidden risk is that teams begin treating the model's first plausible answer as architecture. Because LLMs are trained and aligned around historically common patterns, they can pull engineering teams toward Generative Monoculture : less diverse solutions, narrower exploration, and fewer designs shaped by the exceptional constraints of the system in front of them. Give the same prompt to three engineers using the same assistant and you often get the same shape back: a tidy service layer, a familiar API boundary, a conventional retry wrapper, and code that looks clean enough to merge. That answer is useful. It may even be the right answer for ordinary work. The danger is what happens when ordinary work becomes the default posture for extraordinary constraints. Large Language Models are not neutral architecture engines. They are probabilistic systems trained over historical work and tuned toward answers people tend to reward. Used well, that makes them extraordinary accelerators. Used passively, it creates an optimization paradox: teams gain immediate implementation velocity while becoming anchored to a consensus baseline that may be too average for the actual system. 1. The Default Is a Local Optimum Wu, Black, and Chandrasekaran define Generative Monoculture as a narrowing of model output diversity relative to the diversity available in the training data. That matters because software architecture is rarely a search for the most common answer. It is a search for the answer that fits the exact failure modes, latency envelope, team topology, regulatory constraints, and operational reality of a system. The model's default is often a local optimum: a solution that is statistically likely, syntactically polished, and broadly acceptable. That can be excellent

Having spent over 25 years in software development and managing countless Linux environments, I've accumulated a vast collection of custom bash scripts, containers, and CLI tools. Remembering their exact paths and managing them efficiently directly from the terminal is a common challenge. To solve this, I built mytuis . mytuis is a small, attractive terminal UI for managing a personal catalogue of applications. It is built with gum and plain bash, with persistent storage in a human-readable YAML file. GITHUB REPO : https://github.com/horaciod/mytuis Why mytuis? I wanted a tool that didn't require heavy dependencies or a complex setup, but still looked great and provided a smooth user experience. Here is what mytuis brings to the terminal: CRUD operations: You can create, read, update, and delete application entries from a single menu. Quick launch: Pick an app from the filterable list and it is launched immediately. It replaces the manager process via exec, meaning no extra shell window is left behind. Smart path handling: It accepts absolute paths (like /usr/bin/firefox), relative paths (./scripts/myscript.sh), tilde paths (~/bin/foo), or plain command names looked up in your $PATH (firefox). Persistent metadata: Every entry stores its name, description, absolute path, creation date, and last-used date. Friendly TUI: You get clear menus, color-coded messages, and clean borders, all powered by gum. Under the Hood: Plain Text and Standard Utils Simplicity and standard compliance were key goals. mytuis requires bash ≥ 4 and standard Unix utilities like awk, sed, grep, date, and tput. Your catalogue is stored at ~/.mytuis.yaml. Because it is a standard YAML file, it can be inspected, edited, or backed up with any text editor. It is also completely safe to sync with a dotfiles repository or version-control. To ensure data integrity, all file operations are performed atomically by rewriting the YAML file from scratch on every change, so there is no risk of leaving the fi

I build algorithmic trading bots as a side project. Nothing fancy — just small strategies that trade US equity options automatically. The problem I kept running into wasn't the strategy logic. It was the data. Every time I wanted to pull real-time options chains, Greeks, or IV, I had two options: Pay $99+/mo to a data provider Scrape something I probably shouldn't be scraping Neither felt right for a hobbyist project. So I built Market-Options — a simple REST API for US equity options data at $20/mo. What It Does It's a plain REST API. No SDK, no special client library — just HTTP requests and JSON responses. It covers four endpoints: chain — full options chain for a given underlying contract — data for a single contract contracts — batch lookup across multiple contracts contract-overview — Greeks, IV, expiration details Coverage is the top 100 US equity underlyings, which accounts for roughly 95% of actual US options volume. If you're building a bot that trades SPY, QQQ, AAPL, TSLA, or anything in that tier — it's covered. Why Only 100 Underlyings? Because that's what most people actually trade. When I looked at my own bots, and at what most retail algo traders focus on, the top 100 covers everything practical. Exotic underlyings with low volume are also harder to get real data on reliably — so rather than promise coverage I can't deliver, I focused on doing the core well. A Simple Example curl "https://api.market-option.com/chain?symbol=SPY&expiration=2025-01-17" \ -H "Authorization: Bearer YOUR_API_KEY" Response is clean JSON: { "symbol" : "SPY" , "expiration" : "2025-01-17" , "options" : [ { "strike" : 480 , "type" : "call" , "bid" : 3.45 , "ask" : 3.50 , "iv" : 0.182 , "delta" : 0.42 , "gamma" : 0.031 , "theta" : -0.18 , "vega" : 0.29 } ] } No parsing headaches, no weird date formats. Pricing Free tier : 1,000 credits/day — enough to test and build Pro : $20/mo, unlimited within fair use Trial : New accounts get 7 days of Pro, no credit card required Who It's F

Learn how to organize React projects for scalability, maintainability, and team collaboration. Introduction As React applications grow, one challenge consistently emerges: project organization . A folder structure that works perfectly for a small side project can quickly become a nightmare when multiple developers contribute to a production-scale application. Whether you're a junior React developer preparing for interviews, a mid-level frontend engineer looking to improve code maintainability, or a technical recruiter trying to understand modern React development practices, understanding scalable React folder structures is essential. In this guide, we'll explore the most popular React folder organization strategies, their pros and cons, and the structure many modern engineering teams use to build scalable applications. Why React Folder Structure Matters A well-organized React project provides several benefits: Faster onboarding for new developers Easier code maintenance Better scalability as features grow Reduced code duplication Improved team collaboration Cleaner separation of concerns Many React applications start simple: src/ ├── App.jsx ├── Home.jsx ├── Login.jsx └── Dashboard.jsx This works initially, but as the project grows to dozens or hundreds of components, finding and maintaining files becomes increasingly difficult. Common React Folder Structure Approaches 1. Type-Based Folder Structure One of the earliest and most common approaches is organizing files by their type. src/ ├── components/ ├── pages/ ├── hooks/ ├── services/ ├── utils/ ├── assets/ └── contexts/ Advantages Easy to understand Suitable for small projects Quick setup Disadvantages Components folder can become enormous Related files are spread across multiple directories Harder to maintain in large teams For example, a user profile feature might have files located in: components/UserProfile.jsx hooks/useUser.js services/userService.js pages/ProfilePage.jsx Finding all files related to one feat

On the new episode of Equity, we discussed what actually prompted the administration's latest moves against Anthropic, and what this might mean for the AI ecosystem.

We all know the grind of working with data, even with AI tools: every experiment starts with re-explaining everything, every iteration needs you to prompt, wait, review, correct, and repeat. And the moment you close the session, everything learned is gone. It makes us the bottleneck, and this hinders human-AI collaboration... So I built 𝐎𝐩𝐞𝐧𝐃𝐚𝐭𝐚𝐒𝐜𝐢, an autonomous agent purpose-built for DS/ML, and tested it on Kaggle. I enrolled in a recent competition, ran the agent with no hints, no guidance, while ironing my shirts. In one shot, it landed AUC 0.95, a top-30% finish out of 3K+ teams and 36K+ submissions using hashtag#Anthropic's Claude Sonnet 4.6. (More on this in README) The top-1 outperformed this agent by merely 0.004, but at the cost of massive manual effort even while using popular AI tools. The needed a dozen model families, deep learning, 400-feature notebooks, AutoML sweeps across many libraries, and 186 models ensembled carefully. Essentially a few weeks worth of effort and time!! OpenDataSci abstracts away all the complexity and has so much to offer for DS/ML automation: → Owns the entire development lifecycle from EDA to final evaluation → Plans, codes, and executes autonomously in a secure local sandbox → Self-reviews and corrects before anything reaches you → Remembers your data across sessions, gets smarter each run → Runs parallel experiments and ensembles → Has advanced context management for token efficiency and quality → Ships with predefined skills for DS/ML, so it knows how to do things right → Bring your own knowledge: out-of-the-box support for custom skills → Works with any major LLM provider (hashtag#Anthropic, hashtag#OpenAI, hashtag#Bedrock, hashtag#VertexAI, hashtag#Ollama, hashtag#vLLM, and any OpenAI-compatible server). This and so much more!! You set the goal. It does the work. No data science knowledge required. 🔗 https://github.com/f4roukb/open-data-sci 📦 pip install open-data-sci Spin it up on your data and see what it achieves!

Somewhere right now a guy at a bar is making a stranger sign an NDA on a napkin. For an app idea. Just sit with that. That napkin is going in a drawer. The drawer is a graveyard. Quick tour. Exhibit A: bro we should open a bar Two beers in, you're suddenly a hospitality mogul. Picking a name. Arguing about taco night. By the time the check comes, the bar is already dead. It died of "let's talk about this again soon," which never happens. Exhibit B: bro we should start a band A guitar shows up at a party. Someone says "we should actually start something." One rehearsal happens. In a garage. A neighbor complains. The band dies before it has a name or a single original song. RIP. Exhibit C: the app idea, may it rest in your Notes app The big one. Open your Notes app, it's a cemetery. "App that reminds you to text people back." Dead. "Tinder but for gym buddies." Dead. These ideas didn't fail. They never even got born. Why none of these make it out alive The ideas aren't even bad. Some are genuinely good. The problem is ideas are free and easy to say out loud. Building one makes it real, and real things can fail in public with your name on them. Saying "we should open a bar" costs nothing. Actually opening one costs $400,000, a liquor license, and every Saturday for five years. Guess which one people actually do. Building also got way easier, which makes this worse. You don't need a technical cofounder anymore. You can describe an app to a chat box and watch a prototype show up before your coffee's cold. The wall that used to stop people is mostly gone. People are still standing where it used to be, out of habit. A small ceremony for the ones we lost HERE LIES: "the app idea I had in the shower" born: tuesday died: tuesday, when I got out of the shower HERE LIES: "our band" born: one guitar, one party died: one noise complaint HERE LIES: "the bar we were gonna open" born: 1:47am died: 1:48am, checked the bill Two graves that still have a heartbeat Here's the part nobody

An App Store rating looks like a verdict. It behaves more like a monument, built over years and slow to move. It says very little about how this month's users feel. I took the 12 most-rated Productivity apps on the US App Store, 32 million ratings between them, and split the headline star into the two numbers it hides: how far recent sentiment has fallen below the lifetime average, and whether the developer replies when users complain. How it is measured Population truth. Lifetime ratings and the star histogram come from Apple's full ratings data, every rating an app has ever received. Recent sentiment. A fixed window of the most recent reviews by date, so an app captured to a depth of thousands is not compared on a multi-year average against an app with a few hundred. Same window for everyone. Developer response. Reply share and median latency over that recent window. Complaints are bucketed with a rule-based taxonomy. It is a heuristic, not a trained classifier, and I treat it as one. What turned up The AI assistants now own this chart, and they reply to almost no one. App Lifetime Recent Reply share ChatGPT 4.8 4.18 0% Claude 4.7 3.06 0% Grok 4.9 3.77 0% Perplexity 4.8 3.60 0% Google Gemini 4.7 3.65 13% Dropbox 4.8 2.75 58% Gmail 4.7 2.40 26% Google Drive 4.8 3.90 23% Microsoft Authenticator 4.7 2.18 1% The older tools are the ones still in the trenches: Dropbox answers 58% of recent reviewers, Gmail 26%, Drive 23%. The steepest recent drops belong to Microsoft Authenticator (4.7 to 2.18), Gmail (4.7 to 2.40) and Dropbox (4.8 to 2.75). Plotted on two axes, backlash against response, every app falls into one of four archetypes: Firefighters, Ghost Ships, Complacent Giants and Resilient Leaders. Eight of the twelve are Ghost Ships, taking a recent hit in near silence. The honest limits Recent reviewers self-select toward the dissatisfied. A person who hits a bug is far more likely to leave a review than a contented one, so a low recent average blends genuine declin

Why Bohmian Mechanics, Go Programs, AI, and EBP 2.1 Could Help Reopen the Deepest Questions in Physics There is a quiet crisis in theoretical physics, and it has nothing to do with the equations. The equations are fine. Quantum mechanics predicts with staggering accuracy. General relativity bends light exactly as calculated. The Standard Model matches experiment after experiment. The mathematics is not the problem. The problem is what happens between the equations and the claims. A researcher writes a beautiful paper. The math is correct. The toy model works. A suggestive ratio appears. An analogy crystallizes. And then, in the discussion section, a modest result becomes a bold narrative: classical cosmology is recovered , the problem of time is resolved , spacetime emerges from the quantum . This is not fraud. It is not even intentional. It is the natural gravity of theoretical work — ideas fall toward overclaiming the way matter falls toward mass. Two small codebases, written in Go and governed by an epistemic protocol called Elephant Bridge Protocol v2.1 , are trying to build a tool against that gravity. They are not trying to solve quantum gravity. They are trying to make it harder to pretend you have solved quantum gravity when you haven't. One is called Bell–MIPT . It builds toy models connecting Bohmian mechanics to measurement-induced phase transitions in many-body quantum systems. The other is called BMC — Bohmian Minisuperspace Cosmology. It builds toy models of quantum cosmology using Bohmian guidance in Wheeler–DeWitt minisuperspace. They share the same philosophy. They share the same protocol. And they share the same radical commitment: no claim may be promoted until its debts are paid . What Is BMC? BMC stands for Bohmian Minisuperspace Cosmology . The name is deliberately modest. It is not "Bohmian Quantum Gravity." It is not "The Theory of Everything in Go." It is a cosmology toy model — a wind tunnel, not an airplane. The physics idea behind it is o

If you've worked with Angular Material, you know theming can be one of the trickiest parts of the library — especially after the move to Material 3. Token-based theming, custom palettes, dark mode, component-level overrides... there's a lot going on under the hood. I built a full course to break it all down, and I'm excited to announce it's now completely free . What's in the course Angular Material Theming System is a deep, practical walkthrough of Angular Material's theming API for Material 3. By the end, you'll be able to: Build and customize themes from scratch Apply themes at the application level Override and extend themes for individual components Work confidently with Angular Material's theming tokens and APIs It's 46 lessons and roughly 4.5 hours of content, all hands-on and example-driven. Where to find it 🎥 Watch on YouTube: https://www.youtube.com/playlist?list=PLOjtJUnDeEIyaeUs_jrxylnD2IxSb3Ku7 📝 Read the article version: https://angular-ui.com/courses/angular-material-theming/ 💻 Full source code on GitHub: https://github.com/Angular-UI-com/angular-material-theming If you're building with Angular Material and theming has ever felt like a black box, give it a watch. I'd love to hear your feedback in the comments. If this helped you, consider checking out Angular Material Blocks — a library of pre-built Angular Material + Tailwind components, available via a simple CLI.

Choosing a learning path is one of the most critical decisions you make as a beginner. When I set out to learn web development, I knew exactly what I needed: resources that were thorough, accessible 24/7, and completely free—both online and in print. Before settling on my 2026 learning path, I experimented with a few popular options. Here is a look at what I tried, why they didn’t quite stick, and where I ultimately landed. What Didn’t Work for Me Scrimba Scrimba offers highly interactive introductory courses in web development. However, I realized a bit too late that the platform isn't entirely free; a paywall kicks in shortly after you begin the core HTML and CSS sections. Because I was looking for fully open resources, I had to move on. Frontend Mentor Frontend Mentor is an excellent platform for practicing UI design, but it operates on a freemium model. While the basic learning paths are free, accessing project solutions, starter files, and advanced challenges requires a paid upgrade. 100Devs 100Devs is a free, self-paced, community-taught bootcamp led by Leon Noel. Originally broadcast live on Twitch, the full 30-week course repository is now available on YouTube and communitytaught.org. I actually joined the inaugural cohort in 2020 and attempted subsequent restarts. Leon is an engaging instructor, but the live-stream format presents some hurdles for self-paced learners. The videos are several hours long and include significant time spent interacting with the live chat, managing stream tangents, and breaking away from the core curriculum. Ultimately, the pacing made it difficult for me to stay focused and build momentum. (Note: I also found myself misaligned with some of the community’s culture and leadership choices over time, which made it easier to look for a fresh start elsewhere.) What did I choose? Ultimately, I chose The Odin Project (TOP) as my primary framework, and I couldn't be happier with the decision. The Odin Project checks every single box for

Originally published at woitzik.dev I assumed my homelab repo was clean. No one had ever flagged anything in review (there is no one else reviewing it), CI was green, and I generally try to use Vault and ExternalSecrets for anything sensitive. Then I ran a full-history gitleaks detect against it. It found 12 distinct secrets committed in plaintext — including the OIDC private key that signs SSO tokens for half the cluster. This is the scanning setup I put in place afterward, the baseline strategy that let me adopt secret scanning without getting blocked by my own history on every commit, and the remediation plan for the leaks themselves. View the complete homelab infrastructure source on GitHub 🐙 What Gitleaks Found gitleaks detect --no-banner -v Twelve real findings, plus one already-hashed password (lower severity but still shouldn't be hand-committed) and one false positive in ROADMAP.md (documentation text that happened to match a generic API key pattern). The real findings, by severity: File Secret Why It Matters kubernetes/apps/authelia/configmap.yml OIDC issuer private key Signs SSO tokens for ArgoCD, Vault, Grafana — highest blast radius kubernetes/apps/garage/config.yml RPC secret + admin token Storage backend for Velero/Loki/CNPG backups kubernetes/apps/garage/secrets.yml Admin token (duplicate) Same secret committed twice in two files terraform/stacks/network/local_backend.hcl Garage S3 access key This is the Terraform state backend's own credential kubernetes/system/postgres/cnpg-backup-secret.yml Garage S3 secret key Used for WAL archiving kubernetes/apps/paperless/secrets.yml Postgres password + AI API token kubernetes/apps/cloudflared/secrets.yml Cloudflare Tunnel token kubernetes/apps/headscale/config.yml OIDC client secret Must match Authelia's client config kubernetes/system/monitoring/loki.yml Minio/S3 password kubernetes/apps/mikrodash/secrets.yml Dashboard password Lowest priority — internal tool only None of these were exposed by a public repo

Siri’s AI overhaul may have grabbed the headlines at WWDC, but some of Apple’s most useful AI features are arriving elsewhere in iOS 27.

According to a Wall Street Journal investigation, Polymarket has been paying people to film themselves placing fake bets and celebrating fake wins on social media. WSJ identified over 1,100 deceptive clips and talked to creators who, despite not stating as such in their videos, confirmed the company paid them to create the clips. The videos […]