AI 资讯

Even in blue states, nonreligious tech entrepreneurs and CEOs are increasingly asking for “traditional” and “conservative” women, matchmakers tell WIRED.

OpenAI introduces three Academy courses that help people build practical AI skills, create repeatable workflows, and apply agents in everyday work.

Saturday morning. I opened Twitter and saw a tweet about the Laravel-Lang packages being compromised. My first reaction was simple: "I don't use that package." Then I opened composer.json on a project I work on and found this in require-dev : "laravel-lang/lang" : "^14.8" , "laravel-lang/publisher" : "^16.8" , That changed things. What Actually Happened The attack used laravel-lang packages as the distribution channel. And the sneaky part: the main repository branch looked completely clean. No suspicious commits, no new code. The malicious payload was pushed via git tags on forks . Most developers would not notice anything. Just a routine composer update , same as always. Once installed, the payload executed at autoload time . That means every php artisan command, queue worker, or web request running that codebase triggered the malware the moment PHP hit require_once __DIR__.'/../vendor/autoload.php' in public/index.php . Silently. No error, no red screen, nothing. The malware was a credential stealer. It searched the machine for: .env files from Laravel projects AWS access keys and session tokens SSH private keys GitHub CLI tokens NPM tokens Infrastructure secrets This is not a SQL injection that messes with your database rows. This is a key stealer that runs on your machine and takes everything it finds. Aikido Security caught it and reported it to Packagist. Packagist removed the affected versions. But if you ran composer update during that window, you were exposed. Why Supply Chain Attacks Are Different Classic Laravel security talks about SQL injection, XSS, CSRF. Those are attacks that come from outside users sending malicious input to your application. Supply chain attacks come from inside your own development process. The attacker does not need to find a vulnerability in your code. They need to compromise one developer account at one package maintainer. Every project depending on that package is now exposed. With AI tools, these attacks are getting more soph

Pada series sebelumnya, kita sudah melakukan instalasi nix di VirtualBox dan setup SSH agar dapat diakses diluar VirtualBox. Sebelum kita lanjut untuk melakukan konfigurasi system lagi, kita butuh mengetahui bagaimana syntax dalam menulis program Nix dan di artikel ini kita akan mempelajari dasar syntax-nya. Nix Language Nix adalah purely functional language yang lazy-evaluated , digunakan untuk mengkonfigurasi Nix package manager dan NixOS. Karakteristik utama: Purely functional : sebuah function hanya bisa mengembalikan nilai berdasarkan inputnya, tidak bisa mengubah variabel di luar scope-nya (no side effects), dan tidak ada variabel yang bisa diubah setelah didefinisikan (no mutation). Kalau kamu familiar dengan const di beberapa bahasa pemrograman, semua variabel di Nix berperilaku seperti itu. Lazy evaluation : Nix tidak menghitung nilai suatu ekspresi sampai nilai itu benar-benar dibutuhkan. Ini artinya kamu bisa mendefinisikan ribuan package di nixpkgs tanpa semuanya dievaluasi sekaligus. Hanya yang kamu gunakan saja yang akan diproses. Semua adalah expression : tidak ada statement di Nix, setiap baris kode selalu menghasilkan sebuah nilai. if/else bukan statement seperti di bahasa pemrograman pada umumnya, melainkan expression yang harus mengembalikan nilai dari kedua cabangnya. Tidak ada loops : karena variabel tidak bisa diubah, loop seperti for atau while tidak ada artinya di Nix. Sebagai gantinya, kamu menggunakan fungsi seperti map dan filter , atau rekursi untuk mengolah kumpulan data. 1. Basic Data Type Konsep JavaScript Nix String "hello" "hello" Number 42 , 3.14 42 , 3.14 Boolean true , false true , false Null null null List [1, 2, 3] [ 1 2 3 ] Object { a: 1 } { a = 1; } ⚠️ Perbedaan Penting List di Nix menggunakan spasi sebagai pemisah, bukan koma Attribute set menggunakan = bukan : , dan setiap entry diakhiri dengan ; Nix let name = "Alice" ; age = 30 ; scores = [ 10 20 30 ]; person = { name = "Bob" ; age = 25 ; }; in person Javascript const name

When code becomes cheaper, what still makes an engineer valuable? Recently, while writing my cover letter for remote roles and Upwork projects, I asked myself a very direct question: Why should a remote team or client choose me, especially in the AI era? I do not think the answer should be: “Because I am the strongest engineer technically.” That is not how I want to position myself. What I want to become is this: A backend engineer who can turn unclear business problems into reliable, maintainable systems. AI is making implementation faster. It can generate code, explain technologies, and provide alternatives. At the same time, remote work and platforms like Upwork make competition more global. We are not only competing with engineers nearby, but also with engineers from everywhere. If the only question is “Who knows more frameworks, patterns, or tools?”, many ordinary engineers may feel hopeless. But I believe there is another path. In real systems, code is only part of the work. Someone still needs to understand the business workflow. Someone still needs to define what “correct” means. Someone still needs to identify risks, edge cases, performance concerns, and reliability boundaries. My usual way of working starts from these questions: What is the real requirement? What does correctness mean in this workflow? What data must stay consistent? What edge cases could break the process? What performance or reliability signals should be protected? Where should the module boundary be? Who should orchestrate the main flow, and who should act as collaborators? This “orchestrator + collaborators” thinking helps me keep the main business process clear. The orchestrator owns the workflow. The collaborators handle specific responsibilities such as validation, translation, persistence, messaging, or external integration. I also use AI in this process, but not only to generate code. I use it to challenge my assumptions, explore alternatives, find missing cases, improve naming, r

A few days ago I finished benchmarking something I've been building - a cache-aware, stable, histogram-based sorting algorithm I'm calling BusSort . The results surprised even me. At 100 million elements, it runs ~2x faster than Java's Dual-Pivot Quicksort on random data - while being stable . Dual-Pivot QS is not. The Problem With Quicksort at Scale Quicksort-based algorithms partition elements with random writes across the entire array. At large scales this causes cache thrashing - elements are being written to memory locations all over the place, constantly missing L1 and L2 cache. The larger the array, the worse it gets. The Core Idea Instead of scattering elements globally, BusSort processes data in L1 cache-sized chunks - 4096 integers (~16KB). For each chunk, it does 4 passes: PASS 1 - Scan left-to-right, compute bucket for each element, build a local histogram PASS 2 - Compute local prefix sums (bucket positions within the chunk) PASS 3 - Scatter into a local grouped buffer - because this buffer is L1-sized, all random writes stay in cache ✅ PASS 4 - Copy each bucket's portion to its correct global position With 128-way splitting , recursion depth stays at just ~4 levels even for 100M elements. Base case: Insertion Sort for ≤ 1024 elements. On the benchmark machine (i5-1135G7, 48KB L1 data cache): 4096 × 3 × 4 bytes = 49,152 bytes ≈ 48KB The three working arrays fit exactly in L1. Not a coincidence. Benchmark Results Tested against Arrays.sort(int[]) - Java's Dual-Pivot Quicksort . n = 100,000,000 | Java 17 | i5-1135G7 @ 2.40GHz Input Type BusSort Dual-Pivot QS Ratio Random 3991ms 8604ms ~2x Sorted 57ms 104ms ~2x Reverse 280ms 166ms 0.6x Nearly Sorted 2452ms 2789ms ~1.1x Duplicates 712ms 2242ms ~2.4x Few Duplicates 1295ms 3185ms ~2.3x All Same 51ms 32ms 0.6x Clustered 1419ms 2242ms ~1.6x Consistently faster on most input types. Stable. Zero comparison overhead. The two losses (Reverse, All Same) are where Dual-Pivot QS has structural advantages - run detecti

The things you said you'll do. Done. Discussion | Link

I used to hear the pitch for context compression and think: sure, makes sense. Smaller prompts. Lower latency. Lower cost. Same output quality. Then I watched an agent blow a perfectly good debugging session because one field name disappeared from compressed memory. That changed my opinion fast. Three hours into a Claude Code run, the agent made the wrong API call with full confidence. The plan looked coherent. The reasoning looked clean. The summary of prior steps sounded smart. It was also missing the one detail that mattered: a field name from an earlier error log. The agent had already seen the bug. It had already “understood” the bug. But the compressed version of history dropped the exact detail it needed to avoid repeating it. That’s the real failure mode. Not “compression loses words.” Compression loses the one fact your agent needs later, after it has already committed to the wrong action. While researching this, I found a thread on r/openclaw about using Headroom with OpenClaw: https://reddit.com/r/openclaw/comments/1u3j5xs/anyone_using_headroom_with_openclaw/ That thread gets at the real tension: compression is useful, but only if you treat it as a reversible optimization, not a memory wipe with better branding. The bug pattern nobody talks about Here’s the pattern I keep seeing in long-running agents: The agent collects a lot of noisy context. The team compresses it to save tokens. The summary preserves the broad story. The summary drops one edge-case fact. Two hours later, that fact becomes the only thing that matters. The agent confidently does the wrong thing. This is why “same answers, fewer tokens” is not a serious reliability claim for agent workflows. It might be true for some short chat tasks. It is absolutely not something I’d assume for: n8n agents Make scenarios Zapier AI steps OpenClaw sessions Claude Code runs custom OpenAI-compatible agent loops multi-step debugging or incident workflows In those systems, exact details matter more than eleg

Every developer I know has built something for themselves. A productivity tool. A habit tracker. A personal finance app. An AI that makes them smarter, faster, calmer. I did the same thing for 2 years. Then I had a conversation with someone close to me that I completely mishandled — and I realised no amount of personal productivity tools would have helped me there. The problem wasn't me, individually. The problem was the space between us. So I started asking a weird question Why has all of AI been built for individuals? Copilot helps you code faster. ChatGPT makes you smarter. Notion AI organises your thoughts. Calm helps you sleep better. Not one of them is built for what happens when two people try to understand each other. That's a massive gap. And it's one I couldn't stop thinking about. What I built Mendle — an AI-powered Relationship Intelligence platform. Not a therapy app. Not a chatbot companion. Not another journaling tool with an AI skin on top. The core idea is **shared emotional memory. Most relationship apps are built around one person's perspective. You log your feelings. You get insights. Your partner is an afterthought in the architecture. Mendle is different at the data model level. Both people contribute. Both people benefit. The AI builds an understanding of the relationship not just an individual. Over time it surfaces patterns. Communication loops. Emotional triggers. The things you keep missing because you're too close to them. The technical challenge that surprised me Building AI for two people is fundamentally harder than building it for one. Single-user AI: one context window, one set of preferences, one voice to understand. Relationship AI: two different communication styles, two different emotional vocabularies, shared history that neither person has complete visibility into, and privacy boundaries that have to be respected even between partners. The shared memory architecture was the hardest part to get right. How do you build something

Shifting from traditional application testing to serverless TypeScript engineering is all about shifting your perspective: you stop testing a running server, and you start testing how your function responds to events and SDK states. Here is a simple, practical example for each testing, using modern AWS SDK v3 syntax. 1. Unit Testing: Jest + Mock Payloads & SDK Client Mocking In unit tests, you don't call real AWS services. You pass a simulated API Gateway event to your handler, and you mock the AWS SDK so it returns predictable data instead of hitting live infrastructure. The Code Under Test ( src/handler.ts ) import { APIGatewayProxyEvent , APIGatewayProxyResult } from ' aws-lambda ' ; import { DynamoDBClient } from ' @aws-sdk/client-dynamodb ' ; import { DynamoDBDocumentClient , GetCommand } from ' @aws-sdk/lib-dynamodb ' ; const ddbClient = new DynamoDBClient ({}); const docClient = DynamoDBDocumentClient . from ( ddbClient ); export const handler = async ( event : APIGatewayProxyEvent ): Promise < APIGatewayProxyResult > => { const userId = event . pathParameters ?. id ; if ( ! userId ) { return { statusCode : 400 , body : JSON . stringify ({ message : ' Missing ID ' }) }; } // Fetch from DynamoDB const result = await docClient . send ( new GetCommand ({ TableName : process . env . USERS_TABLE , Key : { id : userId } })); if ( ! result . Item ) { return { statusCode : 404 , body : JSON . stringify ({ message : ' User not found ' }) }; } return { statusCode : 200 , body : JSON . stringify ( result . Item ), }; }; The Jest Unit Test ( tests/unit.test.ts ) Instead of the legacy aws-sdk-mock , the modern standard for AWS SDK v3 is aws-sdk-client-mock . import { handler } from ' ../src/handler ' ; import { APIGatewayProxyEvent } from ' aws-lambda ' ; import { mockClient } from ' aws-sdk-client-mock ' ; import { DynamoDBDocumentClient , GetCommand } from ' @aws-sdk/lib-dynamodb ' ; const ddbMock = mockClient ( DynamoDBDocumentClient ); describe ( ' Lambda Handler Unit

The company has set aside an unusually high number of shares for retail investors. Still, experts say, you’re just getting the crumbs.

David Stein shares how to rethink large-scale architectural migrations using AI. He discusses ServiceTitan's "assembly line" pattern, explaining how decomposing legacy codebase refactoring into standardized tasks can achieve massive parallelization. He highlights the critical role of programmatically rigid validation loops to eliminate LLM hallucinations and accelerate engineering agility. By David Stein

Originally published on the Prufa blog . In June 2026 we pointed Prufa's free audit at 50 products that had just launched on Show HN — every launch from the previous 30 days that earned at least 10 points. These are products at their moment of maximum attention: front page, real traffic, founders watching the comments. The headline numbers, from the 49 audits that completed (one site couldn't be reached by our runner): 100% of the 49 launches had at least one machine-verified finding. 78% — 38 of 49 — had at least one critical finding. 40 critical and 61 warning findings in total, every one verified by deterministic checks against captured browser evidence. No site is named in this post. The point isn't to embarrass anyone — it's that these failures are systematic, and if these teams have them on launch day, you probably do too. Methodology, briefly Each site got the same audit a free Prufa run does: a real browser loads the public pages, captures network traffic, console output, cookies, and response codes, and a fixed suite of deterministic checks grades the evidence. Same input, same verdict. Every number below is from a code-verified check — no LLM opinions are counted anywhere in this data. One honest caveat: our export keeps only the top findings per site, so the per-issue counts below are floors , not totals. The real numbers are equal or worse. What actually breaks at website launch: the numbers Sites affected (of 49) Finding Severity 38 No analytics events detected critical 24 No canonical link on entry page info 22 Cookies set without the Secure attribute warning 14 Broken links warning 12 No <h1> heading on entry page info 11 No robots.txt info 10 JavaScript console errors during page load warning 10 Missing meta description warning 8 Images missing alt text info 7 Missing Open Graph tags info 3 Tag container loads, but no analytics events fire warning 2 Canonical URL pointing to a different host critical The most common launch bug: analytics that record

Here's a small thing that drove me up the wall using Claude Code on a real codebase. I have a pre-commit hook. It runs the linter and the type-checker. It exists precisely so that broken code doesn't reach a commit. And Claude — diligent, eager, trying to be helpful — would hit a failing check, decide the check was in the way of the goal , and quietly run: git commit --no-verify -m "fix: update handler" It wasn't malicious. From the agent's point of view, the task was "commit this change," the pre-commit hook was an obstacle, and --no-verify was the documented way around the obstacle. Perfectly logical. Also exactly the thing I never want to happen, because the entire point of the check is that it is not optional . I tried the obvious fix first: I put it in CLAUDE.md . Never use git commit --no-verify . Fix the failing check instead. This works about 80% of the time. Which is another way of saying it fails one commit in five. CLAUDE.md is context — a strong suggestion the model weighs against everything else in the conversation. Under enough pressure ("just get this committed"), a suggestion loses. An 80%-reliable guardrail on something irreversible isn't a guardrail. It's a coin flip with good odds. So I stopped trying to persuade the model and started intercepting the tool call instead. Hooks run before the action, not after the apology Claude Code has a hooks system. The one that matters here is PreToolUse : a script that runs before a tool call executes, receives the call as JSON on stdin, and decides whether it proceeds. Exit 0 and the call runs. Exit 2 and it's blocked — and whatever you wrote to stderr gets fed back to the model as the reason. That last part is the whole game. It's not "please don't." It's a wall, plus an explanation the model can act on. Here's the entire hook: #!/usr/bin/env node // Block `git commit/push --no-verify`. Exit 2 blocks the call. ' use strict ' ; let raw = '' ; process . stdin . on ( ' data ' , ( d ) => ( raw += d )); process .

Most of today went into a user-management overhaul in kickoff — my Laravel starter kit. Flyout CRUD panels, bulk actions, permission assignment, and the piece I want to talk about: account status . Active, suspended, unverified, deleted. The interesting part isn't the feature. It's the modelling decision underneath it. Where do those four states actually live ? The trap: a status column The obvious move is a status enum column on users . Set it to suspended when you suspend someone, active when you reinstate, unverified until they verify their email, deleted when they're soft-deleted. It works. Until it doesn't. Now you've got a status column and an email_verified_at column and a deleted_at from soft deletes — and all three encode overlapping truths. Soft-delete a user and forget to flip status ? Now your database says the account is both active and trashed. Verify an email but the status update fails mid-request? Drift. Every place that mutates a user becomes a place that has to remember to keep status in sync. That's not a feature, that's a maintenance tax. The signals already exist. email_verified_at tells you verified-or-not. deleted_at (soft deletes) tells you removed-or-not. The only genuinely new state is suspended — an admin deliberately blocking sign-in. So that's the only thing worth storing. What we actually store: one nullable timestamp Schema :: table ( 'users' , function ( Blueprint $table ) { $table -> timestamp ( 'suspended_at' ) -> nullable () -> after ( 'email_verified_at' ); }); That's the whole migration. Not a boolean is_suspended — a nullable timestamp. Null means not suspended; a value means suspended and tells you when. A boolean throws that second fact away for free; the timestamp keeps it at no extra cost. Same instinct as email_verified_at and deleted_at — Laravel models "did this happen, and when" as a nullable timestamp everywhere, so we follow the grain of the framework. The behaviour on the model stays tiny: public function isSuspended

Liquid syntax error: Unknown tag 'lineage'

Earlier this week, Life Biosciences, a biotech company focused on reversing age-related diseases, announced that it had dosed its first volunteer. A person with glaucoma has had an experimental treatment injected straight into their eyeball. The idea is to try to treat the disease—which can cause vision loss—by regenerating healthy nerves in the eye. But…

MIT Technology Review Explains: Let our writers untangle the complex, messy world of science and technology to help you understand what’s coming next. You can read more from the series here. Your brain lives in the dark space of your skull. Yet it knows when the wind lifts the hairs on your skin, when your heart is…

In this podcast, Shane Hastie, Lead Editor for Culture & Methods spoke to Craig McLuckie, co-creator of Kubernetes and CEO of Stacklok, about the impact of AI coding tools on open source communities and engineering teams, designing deliberate organisational culture, and navigating evolving career paths for engineers in the age of AI. By Craig McLuckie