AI 资讯

There are plenty of useful things a metric can reveal. There are even more it can obscure or corrupt. It took me well over a decade of tracking my own life in ever greater detail to fully appreciate this duality, which probably reveals something about both me and the nature of measurement. Like a lot…

This week, I covered the story of Casey Harrell—a man with ALS who is “the first power user” of a brain implant, according to the researchers who worked with him. Harrell is paralyzed and unable to speak coherently without the device. He has now spent almost three years using a brain-computer interface (BCI) that enables…

Most cloud systems make one authorization decision at login. Everything after runs on trust established at authentication time. For systems handling regulated data, that gap is where breaches happen. This article presents a continuous authorization architecture covering risk-tiered evaluation, behavioral baselines, privacy-preserving audit trails, and a phased and incremental rollout. By Venkata Nedunoori

A new report shows that government agencies failed to communicate and includes recommendations for stronger oversight in a bid to avert future disasters.

In a new Windows Developer Blog post titled "Windows platform security for AI agents", Microsoft positions Windows as the trustworthy operating system for autonomous agents and introduces the Microsoft Execution Containers (MXC) SDK as the core of that strategy. The post argues that containment, identity and manageability must be built into the operating system. By Matt Saunders

GitLab 19.0 extends agentic AI beyond code generation into securing credentials, reviewing and merging changes, and scanning dependencies, adding a public beta Secrets Manager, a full merge request Developer Flow, usage-based GitLab Duo billing, and generally available SBOM dependency scanning. By Mark Silvester

There's a commercial logic that cuts against the idea that ASML would risk its export license to arm a Chinese customer.

Give your AI agent live market signals Discussion | Link

Hello HN, I would like to share with you linkedrecords.com - an open source backend as a service I'm working on since some time now. You can think of it as an firebase/convex alternative with an interesting twist. In 2018 I needed to write large software requirements/architecture documents in Google Docs. While I was annoyed by the limitations of Google Docs back then (no captions on figures, no automatic heading numbering, slow when docs are bigger,...) I was still fascinated by the real time c

A London clinic owner has claimed he is treating people with stage 4 cancer by sealing them into a plastic bag while they're naked from the waist down and gassing them with chlorine dioxide.

Why Taking Feedback Positively Can Change Your Career As developers, engineers, designers, and professionals, we all want to improve. We spend countless hours learning new technologies, building projects, and gaining experience. Yet many people overlook one of the most powerful tools for growth: feedback. Unfortunately, feedback often feels personal. When someone points out mistakes in our code, resume, communication, or project, our first reaction is sometimes defensive. We feel offended, frustrated, or misunderstood. I've experienced this myself. But over time, I learned that the ability to accept feedback positively is one of the most valuable skills anyone can develop. Feedback Is Not an Attack One of the biggest misconceptions is believing that criticism is an attack on our abilities. When a senior engineer reviews your code and suggests improvements, they are not saying you're a bad developer. When a recruiter rejects your resume, they are not saying you're incapable. When users report problems in your open-source project, they are not trying to discourage you. Most of the time, people are simply showing you where improvements can be made. The sooner we separate our ego from our work, the faster we grow. Every Rejection Contains Information Many professionals view rejection as failure. I view it differently now. A rejection is data. If ten companies reject the same resume, the market is telling you something. If users consistently struggle with a feature, they're revealing a usability problem. If interviewers repeatedly point out the same weakness, they're highlighting a skill gap. The goal isn't to feel bad about the feedback. The goal is to learn from the information hidden inside it. Growth Begins Where Comfort Ends Positive feedback feels good. Constructive feedback creates growth. Nobody enjoys hearing that their architecture can be improved, their communication needs work, or their project has flaws. But those uncomfortable conversations often lead to th

Go's Type System — Structs, Interfaces, and Life Without Inheritance In part 1 of this series I talked about why I'm picking up Go after six years of Java and Kotlin, plus a recent deep dive into Rust. This time I want to get into the part that actually changed how I think about designing code: Go has no class inheritance at all. Coming from the JVM world, that sentence sounded alarming the first time I read it. No extends . No abstract classes. No polymorphism through a class hierarchy. And yet Go backends at companies running serious scale seem to do just fine without it. After a few weeks living inside Go's type system, I get why. Structs: Data, Nothing More A Go struct is just a typed bag of fields. No constructors, no access modifiers in the Java sense, no inheritance: type Order struct { ID string Customer string Amount float64 Status string } func NewOrder ( id , customer string , amount float64 ) Order { return Order { ID : id , Customer : customer , Amount : amount , Status : "pending" , } } That NewOrder function is doing the job a constructor would do in Java — it's just a plain function by convention, not a language feature. Nothing stops you from building an Order{} directly with zero values either, which takes some adjusting to if you're used to constructors enforcing invariants. Methods attach to structs separately, outside the type definition: func ( o Order ) Total () float64 { return o . Amount } func ( o * Order ) MarkPaid () { o . Status = "paid" } That (o Order) vs (o *Order) distinction is the receiver type, and it trips up a lot of newcomers. A value receiver gets a copy of the struct; a pointer receiver can mutate the original. MarkPaid has to use a pointer receiver, or the status change would vanish the moment the method returns. No Inheritance, So What Replaces It? This is the part that took the most rewiring. In Java, if PremiumOrder needed everything Order had plus more, you'd write class PremiumOrder extends Order . Go simply doesn't hav

🌿 Introduction As climate awareness grows, individuals are looking for actionable ways to reduce their personal carbon footprints. However, most carbon calculators are either too complex or offer generic, unhelpful advice. To solve this, I built CarbonWise —a production-ready Carbon Footprint Awareness Platform. It combines deterministic scientific carbon calculations with real-time, personalized AI reduction strategies using the Groq LLM API. Here is a technical deep-dive into how I built, secured, and optimized this application for the PromptWars: Virtual challenge. 🏗️ Architecture & System Design The application is designed to be lightweight, secure, and highly performant, avoiding heavy framework overhead. System Data Flow ┌──────────────────────────────────────────────────────────┐ │ User Browser │ └─────────────┬──────────────────────────────▲─────────────┘ │ HTTPS (POST / GET) │ Rendered HTML/CSS ┌─────────────▼──────────────────────────────┴─────────────┐ │ Flask App (app.py) │ └─────────────┬──────────────┬───────────────▲─────────────┘ │ │ │ ┌─────────────▼──────────┐ ┌─▼─────────────┐ │ │ SQLite DB (carbon.db) │ │Secure Session │ │ │ - Users & Logs │ │ Cookies │ │ │ - WAL Mode Enabled │ └───────────────┘ │ └────────────────────────┘ │ Structured JSON Insights ┌────────────────────────────────────────────┴─────────────┐ │ Groq API (Llama 3.1) │ │ - Model: llama-3.1-8b-instant │ └──────────────────────────────────────────────────────────┘ Backend : Flask (Python) handles routing, user session state, and database operations. Database : SQLite manages users and logs. We activated WAL (Write-Ahead Logging) mode to enable concurrent reads and writes. AI Engine : Connects to the Groq API using the ultra-fast Meta Llama 3.1 8B model ( llama-3.1-8b-instant ). Frontend : Rendered server-side with Jinja2 templates and styled with a custom dark-mode glassmorphism design system in Vanilla CSS. ⚙️ Feature Deep-Dive 1. Deterministic Carbon Calculations ( carbon_engine.p

I've been running multi-slice agent plans in the Codenames AI repo — Renovate migrations, content-pipeline skills, dependency upgrades. I split multi-PR work into slices (usually one pull request each), each backed by a markdown file with file paths, verification commands, and merge-safe acceptance criteria. You do not need Cursor to recognize the shape: any agent workflow that can open branches, push commits, or merge PRs from a written plan has the same gap. In my setup I paste each slice into a fresh agent chat as a delegation prompt — not a ticket summary, but executable instructions — and start a new chat when that PR is ready. I assumed the checklist was enough. The plan described what to build. I treated how far the agent could go as implicit. Then an agent merged a pull request I expected to review first. The merge that reframed planning The trigger was mundane. During the first slice of a Renovate migration, an agent regrouped dependency buckets in renovate.json — config-only, no version bumps, no runtime behavior. It ran lint and typecheck, opened the pull request, and merged it. The change itself was reasonable. Config-only renovate.json regrouping is exactly the kind of slice you'd want off your plate. What surprised me was the absence of a documented stop line . The migration plan described the edit, the verification commands, and the acceptance criteria. It did not say whether the executing agent should stop at "open PR" or continue to "merge after green checks." The plan was an implementation spec. The agent treated it as permission to finish the job. Implementation specs vs authority handoffs Traditional engineering plans answer: what work should happen, in what order, with what verification? Agent plans increasingly need a second answer: how much autonomy does the next actor get? Those questions diverge the moment an agent can take repository actions — create branches, push commits, open pull requests, merge — instead of only recommending diffs in c

Originally published at dragosroua.com . Last week, Anthropic released Fable 5. Three days later, the US government ordered them to shut it down — for people outside US. Anthropic said they couldn’t filter users by nationality fast enough, so they pulled the plug on the whole thing. Like any good ol’ miracle, it lasted only 3 days. That was a very much needed cold shower. When you realize someone can take away your workforce just like that, running local, private AI models, suddenly becomes the number one priority. Why You Should Run Your Own Local AI Models In no particular order (because all of them count): No one can take it away. Local AI models on your machine don’t care about export controls, government directives, or provider board decisions. No usage limits. No rate limits, no subscription tiers, no “you’ve used your monthly tokens.” Play as much as you want. Nothing leaves your machine. Your code, your documents, your client data — none of it hits a third-party server. Local AI models are private by default. Fixed cost. You pay for hardware plus electricity. No surprise price hikes mid-year. No API dependency. Your workflow doesn’t break when a provider has an outage, deprecates a model, or gets a compliance letter. You can modify it. Fine-tune, quantize, run on your own data. Build something they can’t sell you. Make your own local, private AI model factory. What It Actually Costs I hear you: but I don’t have the money to build a data center in my basement. Fair play. But here’s the thing: you don’t have to. Here are four realistic options, as of June 2026 money: MacBook Pro M4 Max (~$3,000–4,500) : 546 GB/s memory bandwidth. Runs 70B models at around 70 tokens/second with 4-bit quantization. Fast enough to feel snappy. This is the “you might already own this” option. Mac Studio M3 Ultra (~$5,000–10,000) : 800 GB/s, up to 512 GB unified memory. Runs DeepSeek R1 — a 671-billion-parameter model — at 17–18 tokens/second. That’s a model that costs real money p

What was released / announced Lore is an open source version control system designed with scalability in mind, allowing developers to efficiently manage large-scale projects. According to the official website, Lore aims to provide a more efficient and scalable alternative to traditional version control systems. This release is particularly exciting for developers and engineers working on complex projects that require robust version control. Why it matters As someone who works with large-scale AI infrastructure and cloud systems, I can attest to the importance of reliable version control. With Lore, developers can expect improved performance and reduced latency when managing massive codebases. This is especially crucial in environments where multiple teams collaborate on the same project, and version control becomes a bottleneck. I believe Lore has the potential to streamline development workflows and enhance overall productivity. How to use it To get started with Lore, you can begin by installing the command-line tool using the following command: pip install lore Once installed, you can initialize a new Lore repository using: lore init Lore also provides a REST API for integrating with other tools and services. For example, you can use the following Python code snippet to interact with the Lore API: import requests response = requests . get ( ' https://your-lore-instance.com/api/repo ' ) print ( response . json ()) You can explore more API endpoints and usage examples in the official Lore documentation. My take As an AI infrastructure engineer and DevOps architect, I'm excited about the potential of Lore to improve our development workflows. In my experience, traditional version control systems often struggle with large-scale projects, leading to performance issues and frustration. Lore's focus on scalability and performance could be a game-changer for teams working on complex AI and machine learning projects. I'm looking forward to exploring Lore further and integr

If you've ever tried to build a trading dashboard, a crypto portfolio tracker, or any financial app, you probably ran into the "charting problem" pretty quickly. The standard industry approach goes something like this: Embed a heavy <iframe> from a 3rd party provider. Realize it doesn't quite match your app's UI/theme. Struggle with limited postMessage APIs to push real-time data. Watch the UI lag when you try to render multiple charts on the same page. I got tired of fighting with iframe embeds and DOM-based SVG charts that couldn't handle thousands of real-time ticks. I needed something native, fast, and entirely under my control. So, I built one. And today, I'm fully open-sourcing the core engine. Meet Exeria Charts Exeria Charts is a source-available, high-performance financial charting library designed for self-hosted web applications. Instead of embedding external widgets, Exeria renders directly inside your application using a highly optimized Canvas architecture. Here’s a quick look at what it can do: https://exeria.dev The Tech Constraints (Why build another charting lib?) Building a financial chart isn't just about drawing boxes and lines. It’s about performance under pressure. When designing the architecture, we had a few strict requirements: Zero iframes: It had to be a native JavaScript/React module that lives in the main DOM tree, styled perfectly to match the host application. High-frequency updates: Crypto and forex markets move fast. The library needed to handle sub-millisecond tick updates without dropping frames or blocking the main UI thread. Unified runtime: I didn't want a separate library for line charts, another for candlesticks, and another for volume histograms. We needed one engine that could switch views instantly. How to use it We designed the API to be as straightforward as possible. Here is what a vanilla JS implementation looks like: import { createChart } from " @efixdata/exeria-chart " ; // 1. Grab your container const container = d

Last Tuesday at 3am, a multi-agent loop hit 12K KV writes/minute and froze. The loop was a one-line counter bug. That part was fixable. What I found while tracing it was worse. I had --dangerously-skip-permissions enabled on a Claude Code session that was running D1 migrations. I thought it was pointing at staging. It wasn't — I'd misconfigured my env file reference, loading .env.production instead of .dev.vars . Claude didn't ask. The flag told it not to. The migration was ADD COLUMN , not DROP COLUMN , so no data loss. Survivable. But only barely. The thing I got wrong: I treated --dangerously-skip-permissions as "skip the annoying confirmation popups." It's actually "remove the only moment a human sees what command is about to run." Those are very different things. Turning the flag back off helps, but it doesn't constrain what Claude attempts — it just adds a prompt you'll click through anyway at 3am. What actually worked was adding a deny rule in .claude/settings.json : { "permissions" : { "allow" : [ "Bash(wrangler d1 execute * --local*)" ], "deny" : [ "Bash(wrangler d1 execute *)" ] } } The allow rule is more specific than the deny, so --local calls go through and everything else is blocked before execution. Over 2 weeks post-fix, Claude attempted zero production DB commands. Three deny events were logged — all from ambiguous prompts I wrote during fast context-switches, not from Claude going rogue. I ended up running three layers: the settings.json allowlist, a separate git worktree for migration work that physically contains only staging credentials, and a CLAUDE.md that instructs Claude to ask before anything touching production. The CLAUDE.md approach has a real caveat though — in long sessions the instructions lose weight as context grows. Anything critical needs to be restated in the prompt itself. I wrote up the full breakdown — including the worktree setup, the exact CLAUDE.md wording, and why MCP tool permissions behave inconsistently with the deny ru

Negative Risk (NegRisk) is one of the most powerful innovations on Polymarket for builders of sophisticated Polymarket trading bots . It dramatically improves capital efficiency in multi-outcome “winner-take-all” events by mathematically linking all related conditional tokens. Why Negative Risk Matters In standard multi-outcome markets, positions are completely independent. Betting against one candidate requires buying separate “No” shares across every other outcome — tying up large amounts of capital. Negative Risk solves this with a conversion operation : Holding 1 No share on any outcome can be converted into 1 Yes share on every other outcome in the same event. This happens atomically through the NegRisk Adapter smart contract. Economically: Betting against one outcome = betting for all others. Example (3-outcome election event): You hold 1 No on “Other”. Convert → Receive 1 Yes on Trump + 1 Yes on Harris. This makes hedging and market making far more efficient, especially in political, sports, or crypto events with 3–20+ outcomes. How to Detect & Trade NegRisk Markets Use the Gamma API for discovery: { "id" : "event-123" , "title" : "Who will win the next major election?" , "negRisk" : true , "markets" : [ ... ] } When placing orders via SDK (TypeScript/Python): const order = await client . createAndPostOrder ( { tokenID : tokenId , price : 0.42 , size : 500 , side : Side . BUY }, { tickSize : " 0.01 " , negRisk : true // Critical flag } ); Augmented Negative Risk (Dynamic Outcomes) For events where new outcomes can appear mid-trading (e.g., surprise candidates): Uses placeholders + “Other” bucket. enableNegRisk: true + negRiskAugmented: true . Avoid trading the “Other” outcome directly as its definition narrows over time. Technical Integration for Trading Bots Position Tracking — Track positions at the event level, not individual markets. Use conversion math for net exposure. Inventory Skew — In Shadow Market Making or live MM, apply inventory skew across the