AI 资讯

Most recommendations I’m seeing are for generating presentations from a topic, but I already HAVE the content. Problem is it’s usually: messy notes meeting transcripts random docs giant walls of text Main thing I want is help turning all of that into slides that are actually readable. Does anything handle that well right now? submitted by /u/ragsyme [link] [留言]

June 7, 2026. Dennis Kim, ex-CEO of Cyworld, CEO of BetaLabs https://github.com/gameworkerkim/vibe-investing https://github.com/gameworkerkim/CYBER-THREAT-INTELLIGENCE-REPORT Prologue: Two Incidents That Shook South Korea in 2026 In early June 2026, a data breach exposed the personal information of 5 million users of TVING, the largest OTT service in South Korea. The leaked data was extensive: IDs, names, birth dates, gender, CI (connection information), DI (duplicate registration verification information), mobile phone numbers, emails, refund account numbers, passwords, and more. The parent company, CJ ENM, saw its stock price plummet 3.44% in a single day, and investigations by the Personal Information Protection Commission and KISA were launched. But behind this incident hid another shocking fact. TVING's GitHub repository had an AWS access token hardcoded and publicly exposed. It was a stark reminder that a single cloud private key accidentally committed by a developer can jeopardize an entire company's infrastructure. These two events seem like different stories on the surface. Yet here I want to ask one common question: Who protects our generative AI, our LLM systems? Part 1. The Age of Vibe Coding: Security Takes a Backseat Recently, natural language-based programming using LLMs, the so-called "Vibe Coding" trend, has exploded. Generative AI coding assistants dramatically accelerate development speed. But behind this speed lies serious security risks. According to Veracode's 2025 GenAI Code Security report, 45% of code generated by LLMs contained security vulnerabilities. More concerning, developers place excessive trust in AI outputs and show behavior patterns prioritizing speed over vulnerability verification. Kaspersky's 2025 report revealed even more shocking findings. A vulnerability in the popular AI development tool Cursor (CVE-2025-54135) allowed attackers to execute arbitrary commands on a developer's machine, and a vulnerability in the Claude Code a

For the past year I worked on a remote contract with a US tech company. Paid in USD, ultimately needing Korean won. Simple, right? Then a year in, I actually reconciled what landed in my account. The exchange rate had gone up — and yet my real received amount was lower than I'd expected. I traced it, and money was leaking at every step of the transfer path I hadn't been watching. This is what I learned switching routes over that year: from a direct bank wire to Wise, the real cost difference, and one right buried in my contract. If you're a freelancer or contractor in any country earning USD from abroad, this should save you something. Money leaks in more than one place Getting USD from overseas into local currency looks like one step. It's actually at least four: The wire fee from the US bank, through correspondent banks, to the receiving bank. The exchange rate the receiving bank applies — this is the big one. The receiving fee on the destination side. A hidden "lifting charge" some correspondent banks skim. The largest is the rate. Banks quote two rates, and the "buyer rate" applied when an individual sells dollars is worse than the mid-market reference — typically a 1.5–2% spread . On $1,000, that's $15–20 gone to the rate alone. That number looks small. Accumulated over a year, it stops looking small. Route A — receiving directly through a major US bank My first setup was the simplest: the company wired USD to my US bank account, and I wired it on to my Korean bank. I picked this at contract start without much thought, assuming the client would conventionally cover fees anyway. (Lesson one: specify the transfer method, route, and who pays in the contract. ) The problem was the bank's exchange rate. It applied the buyer rate straight up, with a wider-than-usual spread versus mid-market — plus a send fee, plus the Korean receiving bank's fee. I only noticed months in. Comparing statements, there was a steady 2–3% gap between the won I'd expect at mid-market and t

Setting up a 10-page marketing site Count the tools. You reach for Next.js or Astro. You run npm init . There's a bundler config. PostCSS for Tailwind. A Netlify account. A GitHub repository. Environment variables for the CMS token. A build hook URL from Netlify, pasted into the CMS webhook settings so content publishes trigger a rebuild. Maybe a CI configuration file. For a 10-page marketing site. The honest question: does a 10-page marketing site need any of this? For most content-focused sites, the answer is no. How we got here The JAMstack movement was right about the fundamentals. Pre-generated static HTML served from a CDN is faster, cheaper, and more secure than server-side rendering at request time. Netlify and Vercel made this genuinely accessible. The developer tooling that emerged around it was designed well. The problem is that the tooling was designed for applications — large JavaScript codebases with complex component trees, client-side routing, and sophisticated build requirements. It's good tooling for that use case. It became the default for everything, including content sites that have no more complexity than a Markdown file and a CSS stylesheet. When the tool doesn't fit the problem, you inherit the cost of the tool without the benefit. What the build pipeline actually costs Setup time. Getting a new project from blank to deployed with a modern build pipeline takes a few hours if you know the stack, longer if you're making decisions. Framework version, bundler config, PostCSS, Tailwind setup, environment variable management, deploy configuration. That's before you've written a single line of page-specific code. Maintenance surface. Every dependency is something that can break. Node version compatibility, framework major version upgrades, bundler updates, plugin compatibility matrices. A project set up in 2022 may require non-trivial work to update in 2026. For a client site, that maintenance either falls on your agency or accumulates as technical

Imagine you are building a cloud-native backend for a high-frequency trading platform or a core banking ledger. To ensure mathematical immutability and prevent silent data tampering, compliance mandates that every transaction for a specific financial account must be cryptographically chained. This means the signature of Transaction #50 must explicitly include the cryptographic hash of Transaction #49. You cannot sign them out of order, and the backend is strictly responsible for generating and validating this chain. This introduces a massive distributed systems headache: How do you enforce strict, sequential ordering while maintaining the concurrency required to scale a modern cloud architecture? Let's walk through the evolution of this system, deconstruct exactly how the standard event-driven approach fails in production, and examine the Staff-level architecture required to fix it. Phase 1: The MVP & The Database Bottleneck In the early days, traffic is low. An account might see one transaction every few minutes. The "Happy Path" is simple: The API receives a deposit request for Account A. The API queries Postgres for the last_signature_hash . The API computes the new hash in memory: SHA(last_hash + new_transaction_data) . The API writes the new transaction and updates the state. The Pitfall: The Thundering Herd To prevent two concurrent requests from reading the same previous hash, you wrap the database operation in a pessimistic lock: SELECT ... FOR UPDATE . This forces the database to serialize requests at the row level. When a massive partner bank initiates a bulk sync, dumping 5,000 transactions for a single corporate account onto the API in two seconds, 4,999 concurrent threads immediately hit the FOR UPDATE lock and block. The database connection pool is instantly exhausted, latency spikes platform-wide, and the MVP dies. The Insight: The database must be your last line of defense, not your primary queueing mechanism. Contention must be solved upstream in me

Start here This post assumes you have a project and you're trying to pick a tool. It skips the marketing and goes to the technical and economic decisions that actually matter when you're doing the evaluation. All three of these platforms — Contentful, Sanity, and SleekCMS — are used in production by serious teams. The comparison is not going to tell you one of them is bad. It's going to tell you which scenarios each one is genuinely suited for, so you can match your project to the right tool. The three platforms at a glance Contentful is an enterprise-grade headless CMS with a long history of production deployments, a large ecosystem of integrations, and pricing that becomes significant at scale. It's the established choice for large organisations with existing Contentful investment. Sanity is a developer-first headless CMS with a flexible schema system, real-time collaborative editing, and GROQ — a query language purpose-built for content graphs. It has a strong developer community and a genuinely modern developer experience. SleekCMS is a headless CMS with an integrated static site builder. Structured content with REST and GraphQL APIs, a TypeScript-native client library, and the option to generate and deploy a static site from the same content models without maintaining an external frontend stack. Content modeling All three support structured content modeling. The differences are in how you define models and what the system supports natively. Contentful uses a GUI-based model builder in the dashboard. You create content types and add fields through a point-and-click interface. Solid for teams who prefer a visual setup; less ideal if you want models version-controlled as code. Sanity defines schemas in TypeScript or JavaScript config files — committed to your repository, version-controlled, and composable like code. This is Sanity's strongest differentiator for teams who think in code-first workflows. The schema definition is expressive and the TypeScript integrat

The brief Small professional services firm. Needed a clean marketing site: homepage, services section with individual service pages, about page, a blog, and a contact form. Timeline: tight. Budget: fixed. The kind of project where the question isn't whether you can build it — it's whether you can build it without spending three days on project scaffolding before writing a single line of content-specific code. This is what that afternoon looked like. One command to start The cms-sync is the entry point. One command creates the local workspace and starts the file watcher: npx @sleekcms/sync --token YOUR_AUTH_TOKEN On first run, the workspace appears with three files before you've written anything: my-site/ ├── CLAUDE.md ├── AGENT.md └── .vscode/ └── copilot-instructions.md These context files are the key. CLAUDE.md for Claude and Claude Code. AGENT.md for GitHub Copilot in agent mode. .vscode/copilot-instructions.md for GitHub Copilot in VS Code. Each contains the complete SleekCMS site-building reference — file naming conventions, model syntax, template helpers, field types, content format. Open the workspace in Cursor (or VS Code with Copilot, or Claude Code). The AI already knows how to build a SleekCMS site. No setup prompt, no pasting documentation. The prompt We kept it realistic — not a paragraph of precise technical specification, but the kind of description you'd give a developer on a call: Build a professional services marketing site with: - A homepage with a hero section, services overview, client logos, and a contact CTA - A services page listing all services, and individual service detail pages - An about page - A blog with individual post pages - A shared header and footer - A contact form - Tailwind CSS styling - SEO meta tags on every page What the AI generated The output was a complete set of working files: models/pages/_index.model models/pages/services.model models/pages/services[].model models/pages/about.model models/pages/blog[].model models/page

SQL tuning is the process of making a database query run faster and cheaper — cutting response time while minimizing the system resources it burns. Here's the playbook I actually use, from "this query is slow" to "this query is fixed," with the traps that bite people in the middle. The loop Tuning is iterative. The shape is always the same: Identify the problem. Find the slow query (logs, profiler, or user feedback) and measure a baseline — execution time and resource usage. You can't claim an improvement you didn't measure. Analyze & rewrite. Review the SQL for redundant joins, unnecessary work, and complex subqueries. Tighten the WHERE , select only the columns you need, convert subqueries to joins where it helps. Read the execution plan. Understand how the engine actually runs the query; find inefficient join orders and needless full scans. Revisit indexes. Evaluate whether existing indexes help; add or restructure as needed. Consider schema changes. If a column is updated so often that indexing it hurts, split it out. Sometimes the model is the bottleneck. Tune settings/hardware if it comes to that. Re-test and repeat. Apply changes, re-check the plan, confirm the gain, monitor. Reading an execution plan The execution plan shows how the DB will run your query — table scans, index access, join methods. Read it well and you can pinpoint where the time goes. Most engines expose it: EXPLAIN (MySQL/PostgreSQL), EXPLAIN PLAN FOR (Oracle), SET SHOWPLAN_ALL ON (SQL Server). Operators to know: Full Table Scan — reads every row. Happens when there's no suitable index, or the query can't use one. Index Scan — scans via an index; usually cheaper than a table scan. Index Seek — jumps to specific key values; very efficient, reads only the rows it needs. Nested Loops / Hash Join / Merge Join — the three ways to join two tables (more below). Sort — orders data; excessive sorting is a common performance drag. Three numbers that matter: Cost — estimated resources a step will cons

AWS recently announced ExtendDB, a DynamoDB-compatible adapter that lets developers use the DynamoDB API with different storage backends, starting with PostgreSQL. The project supports existing SDKs and tools without modification, giving teams greater flexibility to run DynamoDB-style workloads outside of native DynamoDB while maintaining compatibility with current applications and workflows. By Renato Losio

I run a couple of small niche sites — a pet-health tool and a travel-info site. The thing that actually moves the needle for both isn't clever copywriting. It's having a lot of pages that each answer one specific, low-competition question. "Puppy vaccine schedule by breed." "Is [neighborhood] worth visiting." That kind of thing. This approach has a name: programmatic SEO . You take a data set (one row = one page), pour it into a template, and generate pages at scale. Done well, it's how directories, comparison sites, and tool sites quietly rank for thousands of long-tail terms. Done badly, it's a spam farm that Google buries. More on that later, because it matters. The problem: the tooling is either expensive or a Rube Goldberg machine When I went looking for a way to do this without hand-coding every page, I found two camps: Agency-grade SaaS — powerful, but priced at $99–$299/month . That's a lot of money to spit out HTML when you're a solo operator running sites that make beer money. No-code stacks — wire a spreadsheet to a CMS to a static-site generator with a couple of automation tools in between. It works, but now you maintain a fragile chain of four services, and your pages live inside someone else's platform. Neither felt right. I just wanted: spreadsheet in, clean HTML out, files I own. What I actually built (for myself, first) So I wrote a generator for my own sites. Every morning it reads a CSV, applies a template, and produces a folder of static HTML pages — each with valid JSON-LD, proper meta tags, an internal-link hub, and a sitemap. I deploy the folder. Done. After running it daily for months on my own properties, I cleaned it up and turned it into a product: PageForge . The core idea is deliberately boring: CSV + template → a ZIP of clean static HTML pages you own. No dashboard you have to log into forever. No lock-in. The output is just files. If you stop using PageForge tomorrow, your pages keep working because they're plain HTML sitting in your r

Lip-synced AI dubbing for creators, brands and studios Discussion | Link

Chinese models now account for 61% of global LLM token consumption. DeepSeek, Qwen, GLM, and Doubao consistently dominate the global top 10 on OpenRouter. But for developers outside China, accessing them is painful — no English docs, no international payment, confusing pricing. I tested all 6 major APIs. Here's what I found. Price Comparison (June 2026) Model Provider Input $/1M tokens Output $/1M tokens vs OpenAI DeepSeek V3 DeepSeek $0.35 $0.52 95% cheaper DeepSeek V4-Flash DeepSeek $0.003 $0.015 99.7% cheaper Qwen-Max Alibaba $0.58 $1.74 92% cheaper GLM-5 Zhipu AI $0.87 $4.05 84% cheaper Doubao Pro ByteDance $0.43 $0.87 95% cheaper MiniMax M2.5 MiniMax $0.45 $0.90 95% cheaper DeepSeek V4-Flash at $0.003/M is 1/300th the cost of GPT-4o . For agent chains or batch processing, you can call it without thinking about cost. Quick Start All Chinese models follow OpenAI API format. Change base_url and model — zero code changes. # DeepSeek curl https://api.deepseek.com/v1/chat/completions \ -H "Authorization: Bearer $API_KEY " \ -d '{"model":"deepseek-chat","messages":[{"role":"user","content":"Hello"}]}' # Qwen — same format, different endpoint curl https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions \ -H "Authorization: Bearer $API_KEY " \ -d '{"model":"qwen-max","messages":[{"role":"user","content":"Hi"}]}' How to Get API Access Model Sign Up Payment Free Tier DeepSeek platform.deepseek.com Alipay/WeChat 5M tokens Qwen dashscope.aliyun.com Alipay 2M tokens/month GLM-5 open.bigmodel.cn WeChat/Alipay 1M tokens Doubao console.volcengine.com/ark Alipay 500K tokens MiniMax platform.minimaxi.com Alipay 1M tokens All platforms support English UI. Most don't require a Chinese phone number. Latency (tested from Singapore) Model TTFT Tokens/sec Total (100 tokens) DeepSeek V3 380ms 85 t/s 1.5s DeepSeek V4-Flash 120ms 240 t/s 0.5s Qwen-Max 450ms 65 t/s 2.0s GLM-5 520ms 55 t/s 2.3s Which Model for What Use Case Model Agent chains (5-10 calls) DeepSeek V3 Bulk process

This week the agent economy got another "settlement layer." Actually it got three. They don't agree on what the word means, and one of them raised $8M to keep saying it. So instead of a new argument, here's the map we drew across the week - four honest meanings of "settlement," what each one is genuinely good at, and the one job that none of the funded products this week actually cover. This is a recap post. If you read along this week, you've seen the pieces; this is the through-line. If you didn't, this is the whole week in one place. The week's biggest signal: a funded word The freshest data point is AEON's raise - $8M from YZi Labs to build, in their words, a settlement layer for the agentic economy. Under the hood it's an x402 facilitator on BNB Chain, routing agent-to-merchant payments across a very large merchant network. That is a real and useful thing. It is also, very specifically, payment : an agent sends a stablecoin to a seller it has chosen, value moving one direction to a known recipient. It sits next to two others that shipped recently and also wear the word: Circle's Agent Stack + Nanopayments moves gas-free USDC down to a millionth of a dollar, batched across chains. That's settlement as machine-speed micropayment - still one asset, still one direction, optimized for volume and tiny amounts. Fireblocks' Agentic Payments Suite puts a custodied vault between intent and execution: the vault holds funds and releases them when policy says so. That's settlement as custody-and-release - someone you trust holds the money in the middle. Three products, three meanings: route a stablecoin, micropay at machine speed, custody-and-release. All three are legitimate infrastructure. Builders should use them where they fit. The meaning none of them cover Here's the job that falls through the gap between all three: two agents that don't trust each other, swapping different assets, possibly across two chains, with no one holding the funds in between. A payment rail as

Not long ago, I saw articles analyzing how Chinese people obtain US model API at low prices through non-compliant means, and also saw Chinese developer sharing their Vibecoding experiences. Very interesting, it seems the outside world is finally starting to understand our daily lives. I want to share a complete perspective here: how an ordinary Chinese student, also developer, accesses the most advanced US models. Including the evolution of various access methods over 4 years, the practical experience of using various methods, and the problems encountered, etc. I will try to describe it objectively and truthfully. Let's start by going back to November 2022, when OpenAI released "ChatGPT": Phase 1: "ChatGPT" ChatGPT was released, and it was big news in China, even though it predictably did not serve China. Even though I was still a high school student at the time, I was still interested, after all, it was the first time I saw something truly close to "intelligence". How to access it? There are two types of services generally inaccessible in China: one is that the GFW blocks the domain name or IP of the service, and the other is that the service provider refuses IPs from China. ChatGPT is both. The solution is also simple, use a proxy, which is a basic skill for Chinese developers. In addition, registration requires receiving a SMS verification code. Chinese mobile numbers are definitely not an option, but the solution is not difficult either, find a verification code receiving platform, use a temporary number to receive the verification code. Thus, I started using ChatGPT, which now seems like a model that speaks slowly and is not very smart. Phase 2: "Mirror Sites" During high school, I didn't have many scenarios to use ChatGPT. I started using AI more when I entered university, as AI is well-suited for dealing with those annoying assignments. It was the second half of 2023, and there was a new way to access it: mirror sites. "Mirror sites" originally referred to an

Android 16 desktop windowing is useful for larger-screen workflows, but it also creates a practical QA question: does your Android app still behave correctly when the same real phone is used with desktop-style resizing, keyboard input, mouse input, recording, and external displays? For app teams, I would treat this as a real-device test case, not only an emulator check. What I would test first Resize the app from narrow phone width to tablet-like width Check dialogs, forms, maps, ads, and game HUD overlays Test keyboard focus, text input, mouse scroll, right click, and drag behavior Record a short repro video from a real Android phone Repeat the same flow on a low-end device and a newer device Why real Android phones still matter Emulators are convenient, but they do not always show device-specific differences such as GPU behavior, OS build differences, touch latency, USB/Wi-Fi stability, display density, and app state recovery. A practical workflow is to keep the phone as the real test device, then control and record it from a computer. That is where Android screen mirroring for real-device app testing becomes useful. With LaiCai Screen Mirroring, a QA or support team can operate real Android phones from Windows or macOS, capture evidence, and compare multiple devices without turning the desk into a cable-and-screen mess. Related guides: Android screen mirroring for mobile app testing Build a low-cost Android device lab

we have a real product (thanks claude) and dozen users signedup still using up their free credits. setup payments because it was so easy, then decided to use their atlas product to incorporate and take a single 6 figure pre-seed funding thru stripe invoice (yes stupid, but we are early). Rest of payments are all free coupon payments for testing purposes. Stripe accepted the pre-seed payment, 3 days ago connected to mercury to send it there and just now closed my account and holding funds for 120

Hi everyone, posting here after a really long time. Our industry is experiencing a major shift, we are getting closer to the reality of agentic programming every single day. Though I'm all in for agentic programming, I don't think it should come at the cost of our codebases getting compromised because an LLM decided to install a compromised dependency. With supply-chain attacks being on the verge of becoming part of our daily lingo as developers, especially in the js/ts ecosystem, I've built a vs-code extension which scans your lock files (npm/yarn/pnpm, all three supported) against the listings on Github Advisory Database and osv.dev. Based on the listing it determines the health status of your project. It also scans dependencies which were not installed by you but are required by other dependencies to function properly. Based on the scan, you get four status in the sidebar: SOS Alert - Your installed version is compromised. Act now. Don't Upgrade - You're safe, but a newer version is compromised. Don't Downgrade - You're safe, but an older version is compromised. Passed - Green check. All safe. This is how the extension reporting looks: https://preview.redd.it/c8df2fjegs5h1.png?width=2624&format=png&auto=webp&s=ce506f033beb83d97915281ebf2888c456428fd4 The scanning is done: - Polling based: every 30 minutes. - every time you open the window. - can be manually triggered by commands. Right now it only scans via osv and gha, I plan to integrate more reliable and faster sources like synk in future. Would love everyone's opinion on this since I did not do much research in this and just built it on saturday. The extension can be installed from: https://marketplace.visualstudio.com/items?itemName=uskhokhar.trust-me-bro-vsc The codebase is available at: https://github.com/USKhokhar/trust-me-bro Please give it a try. Rate it on marketplace if you like and star it on github if you like it a little extra. I'm also posting this here seeking open-source contributors who are mor

the interesting shift is when AI stops sitting in a chat box and starts sharing the browser with you. submitted by /u/Old_Command_7050 [link] [留言]