AI 资讯

How Reinvoice Uses HMAC Signatures to Detect Invoice Tampering Every invoice sent through Reinvoice includes a cryptographic integrity signature. It is not a PDF stamp, a visual badge, or a checkbox. It is an HMAC-SHA256 hash generated from the invoice payload and a server-side signing secret. If signed invoice data changes after creation, Reinvoice can recompute the hash, compare it to the stored signature, and flag the invoice as potentially tampered with. Here is why we built it, how it works, and what we learned. Why Integrity Checks Matter for Invoicing Invoices are high-value documents. A single altered field could change a payment amount, tax calculation, client record, or audit trail. Most invoicing systems treat invoices as ordinary database records. That works for normal CRUD workflows, but it does not automatically prove that the invoice data being viewed today is the same data that was created and sent. Reinvoice adds an integrity layer. When an invoice is created, we sign the fields that define the invoice. Later, when someone verifies the invoice, we recompute the signature from the current data and compare it against the original stored signature. If the values do not match, the invoice is flagged. The Implementation The signature is stored in two places: on the invoice record in the database, and behind a public verification endpoint. import { createHmac , timingSafeEqual } from ' node:crypto ' ; const SIGNATURE_FIELDS = [ ' invoiceNumber ' , ' issuerName ' , ' clientName ' , ' totalAmount ' , ' currency ' , ' taxAmount ' , ' issuedAt ' , ' dueDate ' , ' lineItems ' , ' notes ' , ' subtotal ' , ' discountAmount ' , ' shippingAmount ' , ] as const ; export function generateInvoiceHash ( invoice : InvoiceData ): string { const payload = SIGNATURE_FIELDS . map (( field ) => { const value = invoice [ field as keyof InvoiceData ]; return ` ${ field } = ${ JSON . stringify ( value )} ` ; }). join ( ' | ' ); return createHmac ( ' sha256 ' , SIGNING_SECRET )

Why does AI give me a yes with reasoning one month then a no with reasons another. With the same exact question? submitted by /u/Unknownspace614 [link] [留言]

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. Large Language Models have made it surprisingly easy to generate text. Building a reliable AI application, however, is a completely different problem. Once you move beyond a simple "send prompt, get response" demo, you quickly encounter real-world concerns: Prompt management Structured outputs Multi-step workflows Tool calling Observability Evaluation Model switching Production debugging Many teams end up creating custom frameworks around OpenAI, Anthropic, Gemini, or local models just to manage these concerns. This is where Genkit comes in. Originally developed by Google, Genkit provides a framework for building AI-powered applications with a focus on workflows, tooling, observability, evaluation, and production readiness. While most examples online focus on Node.js, Genkit now has growing support for Go, making it an interesting option for backend engineers who want AI capabilities without introducing an entirely separate application stack. In this article we'll build practical examples and explore how Genkit helps structure real-world AI systems. Why Genkit Exists Most AI applications evolve like this: Phase 1: response := callLLM ( prompt ) Everything seems simple. Phase 2: You need: Retry logic Prompt versioning JSON outputs Tool integrations Tracing Metrics Human review workflows Now your codebase starts accumulating AI-specific infrastructure. Genkit attempts to provide these building blocks from day one. Think of it as: "Spring Boot for AI workflows" rather than "an LLM SDK." Installing Genkit for Go Create a new project: mkdir genkit-demo cd genkit-demo go mod init github.com/example/genkit-demo Install Genkit: go get github.com/firebase/genkit/go/ai Depending on your provider, you'll also install provider plugins. For Gemini: go get github.com/fi

The memo also prevents companies from altering AI models being used by the military without prior approval.

I just launched Kotobato on Google Play after about two and a half years of solo development. It's a word puzzle RPG — you swipe connected letters on a board to form words, and those words become attacks. Longer words deal more damage. Rarer words hit harder. I want to share what I built, why I built it this way, and what surprised me most during development. The core mechanic The board is a grid of letters. You swipe a path through connected letters to form a word. When you submit the word, it becomes an attack against the enemy. The twist: word length isn't the only thing that matters . The game has six elemental types — Animal, Nature, Knowledge, Food, Life, and Fantasy — and each word is categorized into one of these elements. Enemies have elemental weaknesses, so the right word beats a long word if you're hitting a weakness. This created an interesting design problem. In most word games, you're just maximizing point value. In Kotobato, you're making tactical choices: do I use a short word that hits a weakness, or a long word that deals raw damage? Why hiragana and English both work The game runs in both Japanese (hiragana) and English. This wasn't a late addition — it was part of the original design. Japanese hiragana is a syllabic script with 46 base characters. Because each character represents a whole syllable rather than a single phoneme, even short hiragana words feel phonetically "weighty." A 4-character hiragana word might correspond to an 8-letter English word in spoken syllables. This means the game feels different in each language — not just translated, but genuinely different. Japanese mode rewards knowledge of vocabulary that uses phonetically distinctive combinations. English mode rewards knowledge of unusual high-value words (think quixotic , ephemeral ). What I actually built 100-floor tower with escalating bosses, including historical Japanese figures like Oda Nobunaga and Toyotomi Hideyoshi Gacha character system — collectible characters with d

Production is down. Slack is on fire. Your phone is ringing. You've seen this exact error before — ConnectionResetError: [Errno 104] cascading through your FastAPI worker pool — but you can't remember exactly which Redis configuration tweak fixed it last time, who applied it, or how long the incident lasted. You're starting from zero again. Twenty minutes of context-building before you even touch a fix. I got tired of that feeling. So I built an AI agent that never forgets. The Problem With Generic AI in Production When production breaks, most engineers reach for their LLM of choice and paste in the stack trace. And the response is almost always the same: a competent, thoughtful, completely useless answer. The model has no idea that your team already tried increasing max_connections six weeks ago and it made things worse. It doesn't know that your infrastructure runs on a specific internal Kubernetes setup that changes how standard fixes apply. It gives you textbook advice for textbook problems, and your problems are never textbook. This is what I started calling the Round 1 problem. Round 1 — generic response: Error: ConnectionResetError: [Errno 104] Connection reset by peer Stack: redis.exceptions.ConnectionError in worker pool The agent responds with something like: "This typically indicates your Redis connection pool is exhausted. Try increasing max_connections in your Redis client config, add retry logic with exponential backoff, and check network stability between your app and Redis instance." Technically correct. Practically useless if you've already tried all three. The agent is reasoning from general knowledge, not from your specific production history. It has no memory of your past incidents. Every error feels like the first error. What I Built: Code Memory's Incident Agent Code Memory is a developer workspace I built in Next.js with a three-pane interface — a file explorer, a code viewer with syntax highlighting, and a real-time AI fix panel. But the core

A scraper can pass every check you wrote and still be wrong about the one thing you actually care about: how much it collected. No exception. No 500. No broken row. Exit code 0, logs green, every field valid. And the set on disk is a quarter of what the site actually has. I have run scrapers in production enough times to stop trusting a green run on its own, and this is the failure that taught me to count. TL;DR A paginated source can serve fewer rows than it claims and never throw — page caps, hidden offset limits, infinite scroll that "ends" early. Your status check (200), schema check (valid row), and byte check (you got data) all pass. None of them counts records. The tell: declared total vs unique ids collected. Or, when there's no declared total, the page that quietly repeats an earlier page. Below is a 40-line probe you can run right now. On a source that caps at 1,500 of a declared 4,000, it returned VERDICT: INCOMPLETE (missing 2500 rows) . This is a completeness check, not a correctness check. Different layer, different bug. What actually goes wrong You write the loop everyone writes. Walk ?page=1 , ?page=2 , keep going until a page comes back empty. Stop. Save. Done. The source has other plans. It says it has 4,000 records — the count is right there in the envelope, or in a "Showing 4,000 results" line in the HTML. But it only ever hands out real data for the first 30 pages. Page 31 doesn't error. It doesn't return empty either. It returns page 1 again. Still HTTP 200. Still 50 valid rows. Your loop has no reason to stop, so it grinds on until its own page budget runs out, collects a pile of rows, and exits clean. You now have 5,000 rows in hand and feel great about it. Looks like plenty. The catch: only 1,500 are unique. The page cap fed you the same first page over and over, and those duplicates hid the shortfall behind a big-looking row count. That is the exact shape of "50 rows passed every check while 4,000 existed" — the scraper saw a lot of rows an

Last April I shared about my Resonate project here ( https://news.ycombinator.com/item?id=43694157 ) A lot has happened since: the work I presented in much more detail at last June's International Computer Music Conference (ICMC) got best paper award. I also gave a talk at the Audio Developer Conference in Bristol last November, the video is on YouTube). This year's work, which I recently presented at this year's ICMC, starts with known techniques from the phase vocoder literature to build self-

From TF's website: Quantization aware training emulates inference-time quantization, creating a model that downstream tools will use to produce actually quantized models. So is it designed to work with a very specific quantization method (for Gemma-4, presumably, Google's own)? Or would it make sense to use alternative quantization methods? According to the benchmarks unsloth released, its (alternative) quantizations of Gemma-4-QAT are closer to the QAT fine-tunes, but is it a good thing, or does it defeat the purpose of QAT? submitted by /u/we_are_mammals [link] [留言]

Fellow Traveller, the publisher behind games like Titanium Court and 1000xResist, just wrapped up its Story-Rich Showcase, which featured a bunch of narrative-driven indie games. With more than 20 games on display, there was a lot to follow, but we've pulled together some of the most notable announcements below. You can also catch the full […]

Plus, check out the new trailer for the cosmic horror game Penguin Colony.

GOG sent a newsletter about the game The End of the Sun on June 5th that included symbols associated with the Nazi SS. The Steam competitor issued a statement attributing the inclusion to a "series of mistakes," including miscommunication with the German QA team, inconsistent font rendering, and being understaffed during a bank holiday, among […]

Krishnan is reportedly starting a new institution to continue shaping Trump's AI policy.

I was writing Playwright E2E tests for a small Three.js platformer and hit a confusing issue. Game context: https://games.xgallery.online/forest-quest/ The game worked in the browser. But in headless Chromium, enemies barely moved, jumps looked inconsistent, and the boss test would sometimes fail for no obvious reason. The problem was requestAnimationFrame throttling. In a headless run, the page does not always get normal frame pacing. My game loop depended on rAF, so waiting 1 second in the test did not mean the game simulation advanced like 1 second of real play. The fix was to expose a manual frame step in the game. The test can call a small internal function that advances one frame with a controlled timestamp. Then the test helper advances the game in small steps. Instead of waiting one big second, it calls that frame step about every 50ms. That made the tests deterministic enough to check real gameplay behavior. Example observations from the full run: L2 mushroom patrol delta: 1.071 L6 boss HP sequence: [7, 6, 5, 4, 3, 2, 1, 0] Boss phase switched: true The funny part is that the boss model did not need to be loaded for this to work. The boss could be a Meshy model or a gray fallback box. For E2E, the important thing was the state machine, collision, HP, and portal reveal. I would be careful with this kind of hook in a serious public game. For this tiny project, it is a testing helper, not a scoring or account system. I used to think of browser game testing as screenshot-heavy. This project reminded me that sometimes the best test hook is just a safe way to drive the loop yourself. submitted by /u/Top-Cardiologist1011 [link] [留言]

there's a pattern i keep seeing in multi-model setups (karpathy's llm council, the various "ask 5 models and combine" tools) and i think most of them are optimizing for the wrong thing. they treat agreement as the goal. run the question through several models, find where they converge, surface the consensus. but in my experience the consensus is the least useful output. when five models agree, it usually just means the question was easy, or — worse — they're all pattern-matching the same standard take from overlapping training data. agreement can be a sign of shared blind spots, not correctness. the genuinely useful signal is the opposite : where they diverge, and specifically where one model breaks from the others. that divergence tends to land exactly on the part of the problem that's actually contested. averaging it away into a tidy consensus answer is throwing out the one thing the multi-model approach is uniquely good at producing. which makes me think the design goal for these systems is backwards. you don't want a machine that manufactures agreement. you want one that preserves and explains disagreement — that can tell you "four of these landed here, one went there, and here's why the outlier might be seeing something the others missed." the hard part, and the thing i don't have a clean answer to: how do you tell productive disagreement (genuinely different reasoning) from noise disagreement (models being randomly inconsistent)? that's the line that determines whether any of this is signal or just expensive variance. curious what people working on multi-agent or ensemble setups think. is consensus the wrong target? and how would you separate real divergence from noise? submitted by /u/wartableapp [link] [留言]

I wanted a simple place to see what games come out this week without digging through ten ad-heavy sites. I couldn't find one I liked, so I built it. gamecalendar.es What it does: - Releases week by week — you can scroll forward/back through weeks - "Recent" and "Most anticipated" views - Metacritic + OpenCritic scores on each game - Gaming events & showcases with countdowns and stream links - English + Spanish, light/dark mode - Works on mobile Honest context: - It's a personal project, built by one person in my spare time. - Game data comes from IGDB. I'm not affiliated with any company or store. - It's completely free. No ads, no accounts, no invasive tracking (just privacy-friendly analytics, no cookies). - Stack is plain HTML/CSS/vanilla JS, a Postgres database (Neon), hosted on Vercel. No frameworks — I wanted it fast and simple. It's brand new, so there are rough edges and the database is still being filled out. Any feedback — features, bugs, things that feel off — is genuinely welcome. submitted by /u/zwrkly [link] [留言]

i am a reasonably intelligent person. i have been coding for years. i can hold my own in a technical conversation. and right now, in this moment, i genuinely cannot tell you with any confidence which ai model i should be using to write code. not even close. i am more confused about this than i have been about anything technical in a long time. here's where i am. i have cursor open. cursor lets me pick the model. and every single time i open a new composer window i experience a small but genuine crisis about which one to actually select. claude opus 4.8. claude sonnet 4.6. gpt-5.5. gpt-5.4. grok 4.3. gemini 3.1 pro. qwen3-coder. deepseek v4-pro. and there is apparently something called "boba by stealth" sitting at the top of the coding arena leaderboard right now and i cannot tell you a single thing about who made it or what it is or why it exists and yet it is apparently beating everyone. i have read approximately forty reddit threads about this. they all contradict each other. someone with eight hundred upvotes says opus 4.8 is the only correct answer for anything serious. the top reply says that person is wrong and gpt-5.5 has better agentic performance on multi-file refactors. third comment says both of them are cooked on long runs and gemini 3.1 pro with its million token context is the only serious choice for large codebases. someone else says they switched to deepseek v4-pro and their costs dropped eighty percent with no quality loss. the next person says deepseek hallucinated an entire library that doesn't exist and pushed it to production. i have no framework for evaluating any of this. because here's the thing. the benchmarks don't help. i have looked at so many benchmarks. swe-bench verified. swe-bench pro. terminal-bench 2.0. terminal-bench 2.1. live code bench. the coding arena elo. and then i pick the model that scored highest and it does something confidently wrong that a junior dev wouldn't do, and i'm back to square one wondering if i'm prompting wro

Every year at Summer Game Fest, nestled in between the splashy blockbuster showcases, the Wholesome Direct provides a nice change of pace. It's similarly packed with games - this year's edition had more than 50 - but the vibe is more chill and, well, wholesome. As in years past, I've pulled out some of the […]

Hey [ r/webdev ]( r/webdev )! I just open-sourced the frontend for a tool I built to solve a very real (and timely) problem in the cannabis space. With the 2025/2026 federal hemp law changes coming (seeds will no longer freely cross state lines), growers need to know exactly what genetics are available in their state. So I created CI Seed Map — a fully interactive, data-heavy map of 1,039 breeders, seed banks, dispensaries, and cultivators across 27+ states. Live demo: https://seed-map.poweredbyci.live Repo: https://github.com/Shannon-Goddard/seed-map-usa Key features I’m proud of: • Dual UI modes: Location mode (filter by type/state, marker clustering) + Breeder mode (searchable list of 924 unique breeders → show every location carrying them with custom logo markers). • Priority stacking — when a spot carries multiple selected breeders, the top one’s logo shows with a green ring + “+N” badge. • Rich popups with brand logo grids (up to 12 + “+more”), strain highlights, and hand-written editorial notes. • “Find Me” geolocation with branded radius circle, live search, mobile-first responsive design (collapsible filters, hamburger nav). • Age gate + strong data protection: AWS API Gateway + Lambda serving private S3 data via time-limited HMAC-SHA256 session tokens (no static JSON exposure). Tech stack: • Leaflet.js 1.9.4 + MarkerCluster • OpenStreetMap tiles • Vanilla JS + responsive CSS (mobile-first) • AWS Lambda (Python 3.12) + API Gateway + private S3 • 700+ processed brand logos, Nominatim geocoding pipeline, Formspree forms The dataset was manually researched and verified (huge shoutout to the data side), but the map itself was built lightning-fast with Amazon Q Developer helping on architecture, token system, responsive bits, etc. Would love any feedback on the UX, performance, code structure, or ideas for future enhancements (e.g. more advanced filtering, user submissions, etc.). Especially curious how the logo marker + priority logic feels! 🌱 (21+ only, obviou