AI 资讯

Most AI tools give Australian small businesses American advice. An Aussie tradie running Xero does not need to hear about QuickBooks. A cafe owner with three casual staff has Fair Work Act obligations that no generic "automate your business" tool will surface. I built AppZ AU Business Advisor to fix this -- a free tool powered by Gemini 2.0 Flash that generates personalised automation blueprints with real Australian business context. This post covers the technical decisions, the prompt engineering approach, and why the AU-specific scaffold makes all the difference. The Problem with Generic AI Business Advice When you ask a general AI "how should I automate my business?", the training data skews heavily American. You get advice about QuickBooks, not Xero. About W-9 forms, not BAS lodgement. About 401k, not superannuation. For an Australian sole trader approaching the $75k GST registration threshold, this is not just unhelpful -- it is actively misleading. The compliance obligations are different. The software ecosystem is different. The pain points are different. The Prompt Scaffold Approach Instead of injecting "you are talking to an Australian business" as a keyword, I built a reasoning scaffold -- a structured context block the model uses as a knowledge foundation: AUSTRALIAN BUSINESS CONTEXT: - GST: 10%, mandatory registration at $75k annual turnover - BAS: lodged quarterly (or monthly for large businesses) to the ATO - Superannuation: 11.5% employer contribution, paid per payroll from July 2026 - ATO tools: STP Phase 2 mandatory for all employers - Dominant accounting platforms: Xero, MYOB, Reckon (not QuickBooks) - Fair Work Act: award rates, leave entitlements, payslip requirements - Key software by vertical: ServiceM8 (trades), Deputy (hospitality), Cliniko (health) This is not a keyword list -- it is a reasoning foundation. When a tradesperson mentions "invoicing problems", the model now reasons about Xero integrations, GST-inclusive invoicing, and BAS categ

Relativity Space—a rocket maker acquired by former Google executive chair Eric Schmidt last year after stumbling on the path to orbit—might just beat SpaceX to Mars.

Midjourney has announced its first hardware project, and it can do more than make cute AI pet photos.

AI tab manager that suspends background RAM hogs Discussion | Link

This is a submission for the June Solstice Game Jam I got flagged by Sloan. If you've been on...

submitted by /u/Successful_Bowl2564 [link] [留言]

Securely execute AI-generated & untrusted code Discussion | Link

My motorcycle has a Bluetooth instrument cluster. It pairs with the manufacturer's phone app and shows turn-by-turn navigation right on the dash, which sounds great until you actually use it. The nav is routed through a maps provider I don't love, the app is clunky, and there's no way to extend any of it. I kept thinking: it's just my bike talking to my phone over Bluetooth. How locked down can it really be? So one weekend I decided to find out, and a few weeks later I had Google Maps navigation running on the cluster through an app I wrote myself. Here's how that went. There are no docs Of course there aren't. It's a proprietary protocol, and the only reference that exists is the manufacturer's own app, in compiled form. So step one was just watching. I started with a GATT walk on the live bike, which is the Bluetooth equivalent of knocking on every door to see what's there. The cluster exposes one vendor service with two characteristics: one the phone writes to, one the bike sends notifications back on. That's the entire conversation surface. Then I captured the actual bytes going across. Android can log every Bluetooth packet through its HCI snoop log, so I paired the phone with the bike, rode around, and pulled the capture. Now I had real traffic, and absolutely no idea what any of it meant. Reading the app to read the protocol You can stare at hex forever and still guess wrong. The faster path was the app itself. I pulled the APK, ran it through JADX to decompile it, and got something close to readable source. Most of the class names weren't even obfuscated, which was a gift. From there it was cross-referencing: take a message I saw on the wire, find the code that builds it, and work out what each byte is. Frida helped a lot here. It lets you hook a running app and watch functions get called with their real arguments, so I could catch the exact moment the app turned "next turn is a left in 200m" into bytes and shipped them to the bike. Slowly the shape came out

A recall reference built from working through a 7-layer prompt-injection challenge. Focus: how each defense layer works, where it breaks, and most importantly how to defend. The one idea underneath everything LLMs have no hard boundary between instructions and data . Everything in the context window — system prompt, user message, retrieved documents — is one stream of tokens the model interprets. Prompt injection exploits exactly this: attacker-controlled data gets read as instructions . You cannot fully filter your way out of it; you manage it with defense-in-depth , knowing each individual layer is bypassable. The defense layers (and where each cracks) A progression of controls from weakest to strongest, each with the lesson it teaches. 1–2. No / weak guardrails Baseline: the model just answers. Lesson: an LLM holding secrets in its context with no controls will leak them on request. 3. Input filtering — block words in the user's message Defense: scan the incoming prompt for banned terms ("code", "secret", "reveal") and block. Weakness: keyword blocklists are trivially evaded — synonyms, misspellings, split words, leetspeak, another language, oblique references. Filtering strings doesn't filter intent . What actually helps: prefer allowlists to blocklists; classify intent semantically rather than matching keywords; treat all input as untrusted; rate-limit and log probing. 4. Output filtering — catch the secret in the response Defense: string-match the known secret in the model's output and redact. Weakness: substring matching only catches the contiguous secret. Fragmenting or transforming it (separators, per-character, encodings) means the literal string never appears, so there is nothing to match. What actually helps: don't put secrets where the model can emit them in the first place; minimize sensitive data in context; treat output filtering as a brittle last line, never a primary control. 5. Input + output filtering combined Defense: both of the above, stacked.

There is a dangerous trap in the local AI world: picking the smallest quantization that fits into your VRAM just because it "runs." We see developers doing this all the time, completely unaware that they’ve crippled their agent's ability to reason. It’s easy to look at a leaderboard, see a model rank high, and assume it’s good to go. But leaderboard scores are a poor proxy for real-world agent behavior. A model might pass a static benchmark at a lower quantization, but when you put it in an agentic loop, its tool-calling accuracy can fall off a cliff. We built the "Quant Audit" feature in QuantaMind because we were tired of this silent failure. It systematically measures the performance drop-off as you move through different compression levels. The goal shouldn’t be to find the smallest quant that loads; it should be to identify the largest quant that actually retains the reasoning integrity your app requires. Stop guessing, start measuring, and stop letting leaderboard hype dictate your architecture.

AI that gets you *and* the people in your life, together Discussion | Link

One of the challenges I faced while building my LaTeX Writer project was implementing version control and project forking in a storage-efficient way. A typical LaTeX project contains multiple files. Even a simple project usually has a "main.tex" file, bibliography files, images, style files, and other supporting documents. If I stored a complete copy of every file for every version or fork, storage requirements would grow rapidly. Imagine a project with four files and ten versions. Storing the entire project for every version would mean storing the same files repeatedly, even when only one line changed. Forking would create an even bigger problem because every fork would require another complete copy of the project. Instead of accepting this inefficiency, I started researching how large platforms solve the same problem. GitHub was the obvious inspiration. Learning from GitHub GitHub does not store a complete copy of a repository every time a change is made. Instead, it stores content separately and uses references to connect files, commits, and repositories. This idea became the foundation for my own implementation. Project Structure Whenever a new project is created, a default file called "main.tex" is generated automatically. The project itself does not directly contain file contents. Instead, it stores metadata such as: Project ID Owner ID Root Folder ID File References Each file also has its own metadata record containing: File ID File Name Blob ID Project ID Owner ID Folder ID The actual content is not stored inside the file metadata. Instead, the content lives inside a separate entity called a Blob. Loading a Project When the editor loads a project, it reconstructs the directory structure using metadata. The process works like this: Retrieve the project's Root Folder ID. Find all folders belonging to that folder hierarchy. Find all files belonging to each folder. Build the directory tree for the frontend. Because files and folders are stored independently, the

Epic Games just dropped something that could reshape how game studios handle code and assets. They've open-sourced Lore — a centralized version control system built from the ground up to solve one painful problem: managing enormous binary files alongside source code. This isn't another Git wrapper. It's a completely new VCS, written in Rust, MIT-licensed, and battle-tested behind Fortnite's UEFN (Unreal Editor for Fortnite) toolkit. Why Does the World Need Another VCS? Git is brilliant for text-based code. But game development isn't just text. It's 4K textures, uncompressed audio, rigged 3D models, animation sequences, and massive world maps. These files can be hundreds of megabytes each. Git wasn't designed for this. Git LFS (Large File Storage) helps, but it's a patch on top of a fundamentally text-oriented system. Perforce Helix Core has been the industry standard for game studios for decades — but it's proprietary, expensive, and closed-source. Epic Games looked at this landscape and said: we can do better. What Is Lore? Lore is a centralized, content-addressed version control system optimized for: Large binary assets — textures, meshes, audio, video Massive teams — hundreds of developers working simultaneously Hybrid projects — code + binaries in the same repository Sparse checkouts — developers only download what they need Think of it as Perforce's philosophy (centralized, binary-friendly) combined with Git's content-addressed storage model, wrapped in Rust's performance guarantees. How It Works Under the Hood Lore's architecture is built around a few key technical decisions: Content-Addressed Storage Every piece of data is stored and referenced by its content hash. This means: Automatic deduplication — identical content is stored once Integrity verification — any tampering changes the hash Efficient caching — content can be cached anywhere in the pipeline Merkle Trees & Immutable Revision Chain Revision hashes are cryptographically derived from parent hashes

Nếu bạn vừa nhận một chiếc laptop từ danh sách ReviewLaptop để vừa học kiến trúc vừa làm dev, việc tối ưu hóa máy là cực kỳ quan trọng. Các phần mềm như Revit hay AutoCAD vốn đã ngốn tài nguyên rất lớn, vì vậy bạn cần một môi trường lập trình 'nhẹ' và ổn định. Tối ưu hóa WSL2 và Docker cho máy Workstation Với các dòng máy như Dell Precision hay Lenovo LOQ, việc chạy WSL2 với cấu hình mặc định có thể chiếm dụng quá nhiều RAM, làm ảnh hưởng đến các ứng dụng kiến trúc đang mở. Bạn nên giới hạn tài nguyên cho WSL2 bằng file .wslconfig . Truy cập vào đường dẫn %USERPROFILE%_\.wslconfig (hoặc tạo mới) và cấu hình như sau: [wsl2] # Giới hạn RAM để dành cho Revit/AutoCAD memory = 8GB # Giới hạn số lượng nhân CPU processors = 4 # Tự động giải phóng bộ nhớ khi không sử dụng autoMemoryReclaim = true # Thiết lập swap nếu cần swap = 4GB Nếu bạn có GPU rời (như trên dòng Lenovo LOQ hay Alienware), hãy đảm bảo đã cài đặt NVIDIA Container Toolkit để thực hiện Docker GPU passthrough . Điều này giúp bạn chạy các container xử lý AI hoặc render mà không làm treo hệ điều hành chính. Quản lý nhiệt độ và giới hạn phần cứng Một giới hạn thực tế quan trọng khi dùng laptop workstation là VRAM ceiling . Các dòng máy tầm trung thường có VRAM hạn chế, nếu bạn chạy Docker image nặng hoặc render cùng lúc, máy sẽ bị giật lag do tràn bộ nhớ đồ họa. Lời khuyên về Thermal Mode: Khi Code/Làm việc nhẹ: Hãy để ở chế độ Balanced hoặc Quiet . Việc này giúp giảm tiếng ồn của quạt (fan noise) và kéo dài tuổi thọ linh kiện. Khi Build Project/Render: Chuyển sang chế độ Performance hoặc Turbo . Lúc này, ưu tiên là đẩy hết nhiệt lượng ra ngoài để duy trì xung nhịp CPU cao nhất có thể. Việc cân bằng giữa sức mạnh phần cứng cho đồ án kiến trúc và sự ổn định cho môi trường dev sẽ giúp bạn làm việc hiệu quả hơn rất nhiều.

We're building an AI marketing operation in public, and early on we hit a question we couldn't skip: how aggressive can you be about growth before you've crossed into something you'll regret? "Be ethical" is easy to say and useless under pressure. Every real decision is messier than that. Is using a VPN cheating? Is running more than one channel a trick? Is bending a platform's rules the same as lying? We needed a line we could actually hold at 2am when a shortcut looks tempting. Here's the one we found — and it turned out to be simpler and sturdier than "follow all the rules." The line isn't rule-breaking. It's deception. The cleanest test we landed on: the line is deception, not rule-breaking. Breaking a rule is a fight you can have in the open. You can announce it, defend it, and accept what comes. Deception is different — it works by making someone believe something false, which strips away their ability to respond honestly, because they don't even know what's real. That's the move that does the damage. So the question to ask about any tactic isn't "did this break a rule?" It's: "does this work by causing a real person to believe something that isn't true?" If yes, that's the line. If no, you're probably fine even if you're being bold. The daylight test Here's how to apply it fast. Ask: would this tactic still work if everyone could see exactly what I was doing? If yes — it survives daylight. People are choosing freely with full information. That's honest, even when it's aggressive. If it only works in the dark — the concealment itself has become the product. Something only works hidden because someone is acting on a false belief you planted. That's the part to cut. A poker bluff survives daylight (everyone knows bluffing is part of poker). A magician's trick survives daylight (the audience knows it's a trick and enjoys it). A fake testimonial does not. A sock-puppet account vouching for you does not. Run every growth idea through the daylight test and most hard

A unified control plane for Magento with Claude Code web Discussion | Link

Midjourney CEO David Holz just showed off the company's first hardware product and plans to build a San Francisco spa, which he admitted is a bit different from the "cat pictures" produced by its AI image generator. Dubbed The Midjourney Scanner, it's an ultrasound-based full-body scanner that uses a ring of sensors to capture vertical […]

The Cryptographic Trust Problem (Why Webhooks Are Unforgiving) Webhooks are the nervous system of modern production apps. Whether you are processing a payment on Stripe, tracking a subscription on Lemon Squeezy, or fulfilling an order via Shopify, webhooks are how external platforms tell your backend: "Hey, something important just happened". Because these webhook endpoints have to be publicly accessible, they are prime targets for malicious actors. To prevent this, platforms use cryptographic signature verification . The Golden Rule of Verification When a provider sends a webhook, they take the HTTP request body and hash it with a shared secret key using HMAC-SHA256 . They pass this resulting signature in the request headers (like Stripe-Signature). When the request hits your server, your code has to do the exact same math: Grab the shared secret. Grab the exact raw bytes of the incoming request body. Hash them together and compare your result with the signature in the header. This process is completely binary and zero-tolerance. If your backend framework alters even a single byte—adding a trailing newline, stripping a whitespace, or reordering a JSON key during parsing—the math changes entirely. The signatures won't match, and the verification will fail. This brings us to our fundamental architectural bottleneck: to verify a webhook, you must intercept the request before your framework touches it. Why Python/Werkzeug Struggles If you build a Cloud Function in Python using the Firebase Functions SDK, you are working on top of Flask, which relies on Werkzeug to handle the underlying web server mechanics. Werkzeug is fantastic for standard web apps, but it has a specific architectural design that makes webhook verification a nightmare: it treats the incoming request body as a one-time, sequential input stream. The Single-Consumption Stream Under the WSGI (Web Server Gateway Interface) standard that powers Python web frameworks, the network payload arrives as an activ