AI 资讯

Midjourney has announced its first hardware project, and it can do more than make cute AI pet photos.

AI tab manager that suspends background RAM hogs Discussion | Link

This is a submission for the June Solstice Game Jam I got flagged by Sloan. If you've been on...

submitted by /u/Successful_Bowl2564 [link] [留言]

Securely execute AI-generated & untrusted code Discussion | Link

My motorcycle has a Bluetooth instrument cluster. It pairs with the manufacturer's phone app and shows turn-by-turn navigation right on the dash, which sounds great until you actually use it. The nav is routed through a maps provider I don't love, the app is clunky, and there's no way to extend any of it. I kept thinking: it's just my bike talking to my phone over Bluetooth. How locked down can it really be? So one weekend I decided to find out, and a few weeks later I had Google Maps navigation running on the cluster through an app I wrote myself. Here's how that went. There are no docs Of course there aren't. It's a proprietary protocol, and the only reference that exists is the manufacturer's own app, in compiled form. So step one was just watching. I started with a GATT walk on the live bike, which is the Bluetooth equivalent of knocking on every door to see what's there. The cluster exposes one vendor service with two characteristics: one the phone writes to, one the bike sends notifications back on. That's the entire conversation surface. Then I captured the actual bytes going across. Android can log every Bluetooth packet through its HCI snoop log, so I paired the phone with the bike, rode around, and pulled the capture. Now I had real traffic, and absolutely no idea what any of it meant. Reading the app to read the protocol You can stare at hex forever and still guess wrong. The faster path was the app itself. I pulled the APK, ran it through JADX to decompile it, and got something close to readable source. Most of the class names weren't even obfuscated, which was a gift. From there it was cross-referencing: take a message I saw on the wire, find the code that builds it, and work out what each byte is. Frida helped a lot here. It lets you hook a running app and watch functions get called with their real arguments, so I could catch the exact moment the app turned "next turn is a left in 200m" into bytes and shipped them to the bike. Slowly the shape came out

A recall reference built from working through a 7-layer prompt-injection challenge. Focus: how each defense layer works, where it breaks, and most importantly how to defend. The one idea underneath everything LLMs have no hard boundary between instructions and data . Everything in the context window — system prompt, user message, retrieved documents — is one stream of tokens the model interprets. Prompt injection exploits exactly this: attacker-controlled data gets read as instructions . You cannot fully filter your way out of it; you manage it with defense-in-depth , knowing each individual layer is bypassable. The defense layers (and where each cracks) A progression of controls from weakest to strongest, each with the lesson it teaches. 1–2. No / weak guardrails Baseline: the model just answers. Lesson: an LLM holding secrets in its context with no controls will leak them on request. 3. Input filtering — block words in the user's message Defense: scan the incoming prompt for banned terms ("code", "secret", "reveal") and block. Weakness: keyword blocklists are trivially evaded — synonyms, misspellings, split words, leetspeak, another language, oblique references. Filtering strings doesn't filter intent . What actually helps: prefer allowlists to blocklists; classify intent semantically rather than matching keywords; treat all input as untrusted; rate-limit and log probing. 4. Output filtering — catch the secret in the response Defense: string-match the known secret in the model's output and redact. Weakness: substring matching only catches the contiguous secret. Fragmenting or transforming it (separators, per-character, encodings) means the literal string never appears, so there is nothing to match. What actually helps: don't put secrets where the model can emit them in the first place; minimize sensitive data in context; treat output filtering as a brittle last line, never a primary control. 5. Input + output filtering combined Defense: both of the above, stacked.

There is a dangerous trap in the local AI world: picking the smallest quantization that fits into your VRAM just because it "runs." We see developers doing this all the time, completely unaware that they’ve crippled their agent's ability to reason. It’s easy to look at a leaderboard, see a model rank high, and assume it’s good to go. But leaderboard scores are a poor proxy for real-world agent behavior. A model might pass a static benchmark at a lower quantization, but when you put it in an agentic loop, its tool-calling accuracy can fall off a cliff. We built the "Quant Audit" feature in QuantaMind because we were tired of this silent failure. It systematically measures the performance drop-off as you move through different compression levels. The goal shouldn’t be to find the smallest quant that loads; it should be to identify the largest quant that actually retains the reasoning integrity your app requires. Stop guessing, start measuring, and stop letting leaderboard hype dictate your architecture.

AI that gets you *and* the people in your life, together Discussion | Link

One of the challenges I faced while building my LaTeX Writer project was implementing version control and project forking in a storage-efficient way. A typical LaTeX project contains multiple files. Even a simple project usually has a "main.tex" file, bibliography files, images, style files, and other supporting documents. If I stored a complete copy of every file for every version or fork, storage requirements would grow rapidly. Imagine a project with four files and ten versions. Storing the entire project for every version would mean storing the same files repeatedly, even when only one line changed. Forking would create an even bigger problem because every fork would require another complete copy of the project. Instead of accepting this inefficiency, I started researching how large platforms solve the same problem. GitHub was the obvious inspiration. Learning from GitHub GitHub does not store a complete copy of a repository every time a change is made. Instead, it stores content separately and uses references to connect files, commits, and repositories. This idea became the foundation for my own implementation. Project Structure Whenever a new project is created, a default file called "main.tex" is generated automatically. The project itself does not directly contain file contents. Instead, it stores metadata such as: Project ID Owner ID Root Folder ID File References Each file also has its own metadata record containing: File ID File Name Blob ID Project ID Owner ID Folder ID The actual content is not stored inside the file metadata. Instead, the content lives inside a separate entity called a Blob. Loading a Project When the editor loads a project, it reconstructs the directory structure using metadata. The process works like this: Retrieve the project's Root Folder ID. Find all folders belonging to that folder hierarchy. Find all files belonging to each folder. Build the directory tree for the frontend. Because files and folders are stored independently, the

Epic Games just dropped something that could reshape how game studios handle code and assets. They've open-sourced Lore — a centralized version control system built from the ground up to solve one painful problem: managing enormous binary files alongside source code. This isn't another Git wrapper. It's a completely new VCS, written in Rust, MIT-licensed, and battle-tested behind Fortnite's UEFN (Unreal Editor for Fortnite) toolkit. Why Does the World Need Another VCS? Git is brilliant for text-based code. But game development isn't just text. It's 4K textures, uncompressed audio, rigged 3D models, animation sequences, and massive world maps. These files can be hundreds of megabytes each. Git wasn't designed for this. Git LFS (Large File Storage) helps, but it's a patch on top of a fundamentally text-oriented system. Perforce Helix Core has been the industry standard for game studios for decades — but it's proprietary, expensive, and closed-source. Epic Games looked at this landscape and said: we can do better. What Is Lore? Lore is a centralized, content-addressed version control system optimized for: Large binary assets — textures, meshes, audio, video Massive teams — hundreds of developers working simultaneously Hybrid projects — code + binaries in the same repository Sparse checkouts — developers only download what they need Think of it as Perforce's philosophy (centralized, binary-friendly) combined with Git's content-addressed storage model, wrapped in Rust's performance guarantees. How It Works Under the Hood Lore's architecture is built around a few key technical decisions: Content-Addressed Storage Every piece of data is stored and referenced by its content hash. This means: Automatic deduplication — identical content is stored once Integrity verification — any tampering changes the hash Efficient caching — content can be cached anywhere in the pipeline Merkle Trees & Immutable Revision Chain Revision hashes are cryptographically derived from parent hashes

Nếu bạn vừa nhận một chiếc laptop từ danh sách ReviewLaptop để vừa học kiến trúc vừa làm dev, việc tối ưu hóa máy là cực kỳ quan trọng. Các phần mềm như Revit hay AutoCAD vốn đã ngốn tài nguyên rất lớn, vì vậy bạn cần một môi trường lập trình 'nhẹ' và ổn định. Tối ưu hóa WSL2 và Docker cho máy Workstation Với các dòng máy như Dell Precision hay Lenovo LOQ, việc chạy WSL2 với cấu hình mặc định có thể chiếm dụng quá nhiều RAM, làm ảnh hưởng đến các ứng dụng kiến trúc đang mở. Bạn nên giới hạn tài nguyên cho WSL2 bằng file .wslconfig . Truy cập vào đường dẫn %USERPROFILE%_\.wslconfig (hoặc tạo mới) và cấu hình như sau: [wsl2] # Giới hạn RAM để dành cho Revit/AutoCAD memory = 8GB # Giới hạn số lượng nhân CPU processors = 4 # Tự động giải phóng bộ nhớ khi không sử dụng autoMemoryReclaim = true # Thiết lập swap nếu cần swap = 4GB Nếu bạn có GPU rời (như trên dòng Lenovo LOQ hay Alienware), hãy đảm bảo đã cài đặt NVIDIA Container Toolkit để thực hiện Docker GPU passthrough . Điều này giúp bạn chạy các container xử lý AI hoặc render mà không làm treo hệ điều hành chính. Quản lý nhiệt độ và giới hạn phần cứng Một giới hạn thực tế quan trọng khi dùng laptop workstation là VRAM ceiling . Các dòng máy tầm trung thường có VRAM hạn chế, nếu bạn chạy Docker image nặng hoặc render cùng lúc, máy sẽ bị giật lag do tràn bộ nhớ đồ họa. Lời khuyên về Thermal Mode: Khi Code/Làm việc nhẹ: Hãy để ở chế độ Balanced hoặc Quiet . Việc này giúp giảm tiếng ồn của quạt (fan noise) và kéo dài tuổi thọ linh kiện. Khi Build Project/Render: Chuyển sang chế độ Performance hoặc Turbo . Lúc này, ưu tiên là đẩy hết nhiệt lượng ra ngoài để duy trì xung nhịp CPU cao nhất có thể. Việc cân bằng giữa sức mạnh phần cứng cho đồ án kiến trúc và sự ổn định cho môi trường dev sẽ giúp bạn làm việc hiệu quả hơn rất nhiều.

We're building an AI marketing operation in public, and early on we hit a question we couldn't skip: how aggressive can you be about growth before you've crossed into something you'll regret? "Be ethical" is easy to say and useless under pressure. Every real decision is messier than that. Is using a VPN cheating? Is running more than one channel a trick? Is bending a platform's rules the same as lying? We needed a line we could actually hold at 2am when a shortcut looks tempting. Here's the one we found — and it turned out to be simpler and sturdier than "follow all the rules." The line isn't rule-breaking. It's deception. The cleanest test we landed on: the line is deception, not rule-breaking. Breaking a rule is a fight you can have in the open. You can announce it, defend it, and accept what comes. Deception is different — it works by making someone believe something false, which strips away their ability to respond honestly, because they don't even know what's real. That's the move that does the damage. So the question to ask about any tactic isn't "did this break a rule?" It's: "does this work by causing a real person to believe something that isn't true?" If yes, that's the line. If no, you're probably fine even if you're being bold. The daylight test Here's how to apply it fast. Ask: would this tactic still work if everyone could see exactly what I was doing? If yes — it survives daylight. People are choosing freely with full information. That's honest, even when it's aggressive. If it only works in the dark — the concealment itself has become the product. Something only works hidden because someone is acting on a false belief you planted. That's the part to cut. A poker bluff survives daylight (everyone knows bluffing is part of poker). A magician's trick survives daylight (the audience knows it's a trick and enjoys it). A fake testimonial does not. A sock-puppet account vouching for you does not. Run every growth idea through the daylight test and most hard

A unified control plane for Magento with Claude Code web Discussion | Link

Midjourney CEO David Holz just showed off the company's first hardware product and plans to build a San Francisco spa, which he admitted is a bit different from the "cat pictures" produced by its AI image generator. Dubbed The Midjourney Scanner, it's an ultrasound-based full-body scanner that uses a ring of sensors to capture vertical […]

The Cryptographic Trust Problem (Why Webhooks Are Unforgiving) Webhooks are the nervous system of modern production apps. Whether you are processing a payment on Stripe, tracking a subscription on Lemon Squeezy, or fulfilling an order via Shopify, webhooks are how external platforms tell your backend: "Hey, something important just happened". Because these webhook endpoints have to be publicly accessible, they are prime targets for malicious actors. To prevent this, platforms use cryptographic signature verification . The Golden Rule of Verification When a provider sends a webhook, they take the HTTP request body and hash it with a shared secret key using HMAC-SHA256 . They pass this resulting signature in the request headers (like Stripe-Signature). When the request hits your server, your code has to do the exact same math: Grab the shared secret. Grab the exact raw bytes of the incoming request body. Hash them together and compare your result with the signature in the header. This process is completely binary and zero-tolerance. If your backend framework alters even a single byte—adding a trailing newline, stripping a whitespace, or reordering a JSON key during parsing—the math changes entirely. The signatures won't match, and the verification will fail. This brings us to our fundamental architectural bottleneck: to verify a webhook, you must intercept the request before your framework touches it. Why Python/Werkzeug Struggles If you build a Cloud Function in Python using the Firebase Functions SDK, you are working on top of Flask, which relies on Werkzeug to handle the underlying web server mechanics. Werkzeug is fantastic for standard web apps, but it has a specific architectural design that makes webhook verification a nightmare: it treats the incoming request body as a one-time, sequential input stream. The Single-Consumption Stream Under the WSGI (Web Server Gateway Interface) standard that powers Python web frameworks, the network payload arrives as an activ

你知道吗？GitHub 上有一个 17,889 Stars 的开源项目，能让你的 AI Agent 拥有跨会话的持久记忆——不是简单的向量检索，而是一个会自动进化的知识图谱。但大多数开发者只用它来做基础的文档搜索，完全忽略了它真正的能力。 Cognee 是一个开源 AI 记忆平台，它把知识图谱、向量搜索和认知本体论生成统一到一个记忆层中。在 2026 年，AI Agent 正从单轮对话机器人向长时间运行的自主系统演进，而瓶颈不再是模型能力，而是上下文管理。以下是大多数人不知道的五个隐藏用法。 隐藏用法 #1：自动图谱同步的会话记忆 大多数人的做法：把对话历史存在简单的列表或向量数据库里，上下文长了就塞进 prompt。这在前几轮还行，但会话一长就迅速退化。 隐藏技巧：Cognee 的会话记忆充当快速缓存，会在后台自动同步到持久化知识图谱。你既能获得内存上下文的速度，又能拥有图数据库的持久性——而且同步过程完全不需要手动编排。 import cognee import asyncio async def agent_session (): # 会话记忆——快速、临时、按会话隔离 await cognee . remember ( " 用户询问了 Q3 收入趋势并请求导出 CSV。 " , session_id = " support_ticket_4421 " ) # 后续查询会话记忆（快速路径） results = await cognee . recall ( " 用户问了什么收入相关的问题？ " , session_id = " support_ticket_4421 " ) # 会话结束时，会话记忆自动同步到永久图谱 # 无需手动导出，不会丢失任何数据 asyncio . run ( agent_session ()) 效果：你的 Agent 在会话内部保持对话上下文以实现快速响应，但会话结束后不会丢失任何信息。知识图谱会自动跨所有会话积累洞察。 数据来源：Cognee GitHub 17,889 Stars，README 文档中 session_id 参数和自动同步行为在"Use with AI Agents"章节有详细说明。 隐藏用法 #2：面向领域推理的本体论 grounding 大多数人的做法：把文档灌入向量数据库，依赖语义相似性做检索。模糊匹配还行，但当你需要结构化的、领域感知的推理时就不行了。 隐藏技巧：Cognee 的 cognify 流水线不只是嵌入文档——它会从你的数据中生成认知本体论，创建带有类型化关系的结构化知识图谱。这意味着你的 Agent 可以对实体及其连接进行推理，而不仅仅是找到相似的文本。 import cognee import asyncio async def build_domain_memory (): # 摄入领域文档 await cognee . remember ( """ 客户 Acme Corp 有 3 个活跃订阅。 订阅 A：企业计划，到期日 2026-09-15。 订阅 B：入门计划，已于 2026-03-01 到期。 客户经理是 Sarah Chen。 升级路径：Sarah -> 销售副总裁 -> CRO。 """ ) # Cognee 自动提取实体和关系： # (Acme Corp) --拥有--> (订阅 A) # (订阅 A) --类型--> (企业计划) # (订阅 A) --到期--> (2026-09-15) # (Sarah Chen) --管理--> (Acme Corp) # 现在进行结构化精确查询 results = await cognee . recall ( " 哪些客户在未来 90 天内订阅到期？ " ) # 返回 Acme Corp 及具体订阅和日期—— # 而不仅仅是"关于订阅的相似文本" asyncio . run ( build_domain_memory ()) 效果：你的 Agent 不再依赖向量相似性碰运气，而是从理解实体类型、关系和时间约束的本体论中获得结构化答案。 数据来源：Cognee README "Product Features"章节描述了"ontology grounding"和"cognitive-science-grounded ontology generation"；ArXiv 论文 2505.24478 关于优化知识图谱与 LLM 的接口。 隐藏用法 #3：通过共享图谱实现跨 Agent 知识共享 大多数人的做法：每个 Agent 维护自己独立的记忆。客服 Agent 无法受益于销售 Agent 昨天学到的东西。知识按设计被隔离。 隐藏技巧：Cognee 的知识图谱是一个共享基础设施层。多个基于不同框

A practical walkthrough of SQL-First persistence: no XML, no Mapper interfaces, no generated queries. I maintain a Java backend that handles ~1M requests/day. For persistence, we used to run MyBatis. The XML was manageable at first, then it wasn't. Dynamic conditions became <if> tag soup. A simple join query needed three files and two languages. We switched to a simpler approach. Here's how it works for the most common case: single-table CRUD. What You Need Java 21+ Spring Boot (any 3.x) A database (H2 for the demo, MySQL/PostgreSQL for production) That's it. No XML parser, no code generator, no annotation processor. The Project pom.xml src/main/java/example/ DemoApplication.java user/ User.java -- entity UserDao.java -- data access UserCond.java -- query conditions src/main/resources/ application.yml schema.sql Three Java files for a complete CRUD API. The Entity @Data @Builder @Table ( "sys_user" ) public class User { @Id private Long id ; private String name ; private Integer age ; private String email ; // ... other fields // These four are auto-managed: private LocalDateTime createTime ; private Long createBy ; private LocalDateTime updateTime ; private Long updateBy ; private Byte dr ; // 0 = active, 1 = soft-deleted } @Table maps to the database table. @Id marks the primary key (Snowflake ID by default). The audit fields and soft-delete marker are handled automatically—you don't set them in business code. The DAO @Repository public class UserDao extends BaseDao < User > { // Empty. All CRUD methods inherited. } BaseDao provides save , saveBatch , update , delete , findById , list , page , count , exists . For single-table operations, this is all you need. The Conditions @Getter @Setter @Builder public class UserCond extends BaseCondition { private String name ; private Integer ageMin ; private Integer ageMax ; private Byte dr ; private Object [] ids ; @Override protected void addCondition () { and ( "name LIKE" , name , 3 ); // 3 = %value% and ( "age >=" , ag