AI 资讯

AI Code Security: Claude's rsync Bugs; Europe's GNSS Interference & GPS Anomalies Today's Highlights This week in security, a deep dive explores how AI code generation might introduce new vulnerabilities, with analysis showing Claude increasing bugs in rsync. We also highlight two critical infrastructure concerns: a powerful GNSS interference source over Europe and the mysterious 'numbers station' broadcasts found on GPS frequencies. Did Claude increase bugs in rsync? (Hacker News) Source: https://alexispurslane.github.io/rsync-analysis/ This article presents an intriguing analysis of how large language models (LLMs) might inadvertently introduce bugs into software. Focusing on Claude's contributions to the widely used rsync utility, the author investigates code changes attributed to AI and compares them against human-written code. The study reveals instances where AI-generated code, while appearing plausible, introduced subtle yet significant defects, raising questions about the reliability of AI assistance in critical codebases. The implications extend beyond rsync , pointing to potential supply chain vulnerabilities if AI-generated code is not rigorously audited. This research highlights a new frontier for AI-specific security, emphasizing the need for developers to employ practical hardening guides and thorough review processes when integrating AI into their development workflows to prevent the unintentional introduction of new attack vectors. Comment: As a developer, seeing concrete examples of AI introducing bugs, even subtle ones, in a fundamental tool like rsync is a wake-up call. It's a reminder that AI-generated code requires diligent human review, especially when security or reliability is paramount, highlighting prompt engineering as a defensive technique. Tracing a powerful GNSS interference source over Europe (Hacker News) Source: https://arxiv.org/abs/2606.03673 Researchers have identified and traced a significant source of Global Navigation Satellite

Dropbox Nova for AI Coding Agents, OpenAI's Codex Sandbox, & Puppeteer MCP Server Today's Highlights This week, we dive into Dropbox's Nova platform for scaling AI coding agents and OpenAI's secure sandbox architecture for Codex, highlighting advanced production deployments. We also examine practical solutions for safer browser automation for AI agents, detailing a custom Puppeteer MCP server. Dropbox Introduces Nova, an Internal Platform for Running AI Coding Agents at Scale (InfoQ) Source: https://www.infoq.com/news/2026/06/dropbox-nova-ai-coding-agents/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global Dropbox has unveiled Nova, an internal platform meticulously engineered to orchestrate and scale AI coding agents. This platform tackles the complex challenges of managing autonomous AI entities performing tasks like code generation, bug fixing, and refactoring across a large codebase. Nova's architecture focuses on reliability, efficiency, and safety, providing a robust environment for thousands of agents to operate concurrently without overwhelming system resources or introducing instability. The platform acts as a critical layer between AI models and the vast codebase, enabling agents to interpret development tasks, interact with repositories, and propose changes in a controlled manner. The significance of Nova lies in its ability to industrialize the use of AI in software development workflows. By abstracting away the operational complexities of agent deployment and execution, Dropbox empowers its engineering teams to leverage AI as a force multiplier, accelerating development cycles and improving code quality. Nova represents a practical, large-scale implementation of AI agent orchestration, demonstrating how companies are moving beyond experimental AI tools to integrate them deeply into core business processes. This showcases a production-grade pattern for applied AI, particularly relevant for "code generation" and "workflow automati

DuckDB Integrates Lance Lakehouse; SQLite CVE Fix; Postgres 19 Beta on K8s Today's Highlights This week, DuckDB introduces integrated vector and hybrid search with the Lance lakehouse format, enabling advanced AI workloads directly from SQL. Meanwhile, SQLite addresses a significant security vulnerability with a recent fix, and a new guide helps users test PostgreSQL 19 beta efficiently in Kubernetes clusters. Test-Driving the Lance Lakehouse Format in DuckDB (DuckDB Blog) Source: https://duckdb.org/2026/05/21/test-driving-lance.html DuckDB has announced a new integration allowing users to test-drive the Lance lakehouse format, a design specifically geared towards AI workloads. This collaboration between LanceDB and DuckLabs brings fast vector and hybrid search capabilities directly into DuckDB SQL, significantly streamlining data analysis for machine learning applications. The integration means users can perform complex queries involving vector embeddings and traditional tabular data without needing to move data between different systems or tools. This is a crucial development for data scientists and engineers who rely on efficient data access and processing for large-scale AI projects. The ability to perform sophisticated searches within the familiar DuckDB environment enhances productivity and reduces the operational overhead typically associated with managing specialized vector databases. This new feature democratizes access to advanced data structures for AI, making it simpler to build and prototype machine learning models on massive datasets. By supporting an open lakehouse format, DuckDB continues to position itself as a versatile analytical database, bridging the gap between traditional data warehousing and emerging AI data needs. Users are encouraged to try out this integration, which promises to unlock new possibilities for data exploration and feature engineering using a unified SQL interface. It's an excellent example of how embedded analytical databases

submitted by /u/cnn [link] [留言]

On the side after work I've been experimenting a bit with aws cloud launching my own apps and website (its mostly for hobby/for fun not really expecting income but maybe one day) anyways, one of my website a couple months ago was hit by a bot attack which made my netlify monthly bill go from $20 to $140 in one day Which spooked me im not going to lie. And my knowledge of devops thing is so limited that I had to resort to asking ai to help debug this. We found that there was 8 million botted requests sent to my frontend website and on my .netify.app link netlify does not give you ddos protection unless you pay extra. My actual domain was protected by cloudfare rate limit I didnt even know I had this secondary domain for that website. Anyways that was useful discovery now I feel safer about netlify at least. I don't really want to give up this hobby. Is there anyway to get predictable billing I don't even mind if they shutdown my app if it exceeds usage. I read that fly.io is based on credit usage. Is that good for backend? submitted by /u/Ok_Indication_3656 [link] [留言]

Every week I see the same question in AI governance communities: "We already have NIST AI RMF implemented. Does that cover our EU AI Act obligations?" The honest answer is: sometimes yes, sometimes partially, and sometimes not at all. The problem is that nobody had built a clean, free, interactive tool that showed exactly which controls map to which, how strong those mappings actually are, and where the genuine gaps are. So I built one. Live tool: suhanasayyad.github.io GitHub: SuhanaSayyad / eu-ai-act-crosswalk-tool Interactive crosswalk mapping EU AI Act obligations to NIST AI RMF and ISO 42001 controls, with mapping strength indicators, gap analysis, and source links. 30 controls mapped. Free and open source. EU AI Act × NIST AI RMF × ISO 42001 - Interactive Compliance Crosswalk Tool An open-source tool that maps EU AI Act obligations to their equivalents in NIST AI RMF and ISO 42001, with mapping strength indicators, gap analysis, and source document links. Built for compliance teams, AI governance practitioners, and anyone trying to understand how these three frameworks relate to each other. Live demo: https://suhanasayyad.github.io/eu-ai-act-crosswalk-tool Built by: Suhana Sayyad | MSc Cybersecurity, TUS Athlone Why I built this Every organisation dealing with the EU AI Act is being asked the same questions: "We already have NIST AI RMF controls in place. Does that cover our EU AI Act obligations?" "We're pursuing ISO 42001 certification. Does that satisfy the regulation?" The honest answer is: sometimes yes, sometimes partially, and sometimes not at all. The problem is that nobody had built a clean, free, interactive tool that showed exactly which… View on GitHub What the tool does The EU AI Act / NIST AI RMF / ISO 42001 Interactive Crosswalk Tool maps 30 EU AI Act obligations to their nearest equivalents in NIST AI RMF and ISO 42001. For each mapping it shows a strength rating - Strong, Partial, Indirect, or No Equivalent - so compliance teams know which map

Up front, so there's no confusion: the app I'm describing (Nightmare TV) is a player only . You bring your own M3U / Xtream Codes playlist — it ships with no channels and no content. This post is about the playback engineering, not about where streams come from. Think "VLC for IPTV," not a content service. The problem that started it I watch a lot of live content on my PC — sports, mostly. And every IPTV player I tried on Windows fell into one of two buckets: An Android app running in an emulator. TiviMate and the good mobile players are Android-only, so on a desktop you end up in an emulator or a VM. Input lag, no real HDR path, fans spinning. A thin ExoPlayer / libVLC wrapper. These run natively, but most of them treat HDR as "pass the HDR10 metadata to the display and hope." On an SDR panel — or even a lot of HDR panels — bright skies in a football match blow out to a flat white blob, and 4K HEVC with a DTS track stutters because the decode path isn't doing what you think it is. I wanted the thing that didn't exist: a native Windows player with a reference-grade video path. So I built it on libmpv — the same playback core mpv uses — with a Flutter desktop shell on top for the UI. This post is the part I actually find interesting: the HDR tone-mapping pipeline. Why HDR "just passing through" isn't enough HDR10 content is mastered in the PQ (ST.2084) transfer function against a mastering display — often 1000 nits, sometimes 4000. Your screen is whatever it is: a 350-nit SDR laptop, a 600-nit "HDR400" monitor, an 800-nit OLED. If you map PQ straight to the panel, everything above the panel's peak just clips — all the highlight detail collapses to maximum white. Tone-mapping is the process of intelligently compressing the mastering range into the display range so you keep highlight detail instead of clipping it. The naive version (a fixed curve, or clipping) is what most wrapper players ship. The good version adapts to both the content and the display. The pipeline H

been building AI agent infrastructure for the past few months. The two things that kept biting me — and kept coming up when I talked to other devs building agents — were runaway costs and agents doing irreversible things without asking first. So I built gvnr: an open-source MCP server that gives agents per-agent spend caps (hard-stop before a call if the budget's gone) and a human approval gate (agent asks, you get a mobile link, you approve or deny, agent waits). Both work as plain REST calls or MCP tools — no platform to adopt, no SDK. It's live. You can get an API key in one curl command and try the approval gate for free (it doesn't burn the trial ops). Source is at github.com/mightbesaad/gvnr . Here's what I genuinely want to know from devs building in this space: Does the spend-cap shape match how you think about cost control, or do you manage that somewhere else entirely? Is the approval gate useful if it's email-only and single-approver, or does that make it a toy? What flag would stop you from wiring this into an agent you actually run? Not fishing for encouragement — if this is solving the wrong problem, or solving it the wrong way, I'd rather know now.

Most AI short-form video demos skip the boring part. They show a finished TikTok, Reel, or YouTube Short. Maybe they show the prompt. Maybe they show the generated script or the final render. But the hard part is not making one video. The hard part is making the fifteenth video without the whole system turning into a pile of one-off scripts, half-remembered FFmpeg commands, broken captions, inconsistent hooks, and manual upload steps. That is where I think the conversation around AI video automation gets more interesting. Not: Can an AI generate a Short? But: What workflow does an AI agent need to generate Shorts repeatedly? I was looking at a Terminal Skills use case for building an AI short video generator, and the useful part is not the fantasy of "push one button, print infinite content." The useful part is the stack. The real job is a pipeline A short-form video generator sounds like one tool. In practice, it is a pipeline: topic research -> script -> voiceover -> footage or visual generation -> subtitles -> assembly -> platform formatting -> upload -> analytics Each step has different failure modes. Topic research can produce generic ideas. Scripts can be too long. Voice can drift from the brand. Footage can mismatch the narration. Subtitles can land under platform UI. FFmpeg can export a technically valid file that a platform still hates. Uploads can succeed in the API but fail the actual publishing workflow. If you try to solve all of that with one giant prompt, the agent has to keep too much operational knowledge in its head. That is fragile. The better pattern is to split the workflow into skills. What a skill gives the agent A skill is not just a code snippet. For this kind of workflow, a useful skill tells the agent: when to use this capability what inputs are expected what output should exist afterward what validation is required when to stop instead of pretending success That last point matters. For media automation, "the command ran" is not enough. Th

A post titled "Learn SQL Once, Use It for 30 Years" hit the front page of r/programming this week (307 points, 48 comments). The claim sounds like the kind of thing a database vendor would put on a billboard, so I went looking for the part that holds up. It turns out the longevity is not marketing. It is a property of how the language was designed, and it is the reason SQL is one of the few skills on a developer's resume that does not quietly expire. I run a site that compares developer tools, which means I spend a lot of time watching technologies rise, peak, and get replaced. Most of what you learn in this field has a half-life measured in single-digit years. The framework you mastered in 2019 is legacy by 2024. SQL is the strange exception, and the reasons are worth understanding before you decide where to spend your next month of learning. Where the staying power comes from SQL did not start as a language. It started as a math paper. In 1970, Edgar Codd published "A Relational Model of Data for Large Shared Data Banks," which proposed organizing data into tables of rows and columns with formal rules for combining them. IBM built a query language on top of that model in the mid-1970s, called it SEQUEL, and later renamed it SQL after a trademark conflict. The important detail is the order: the model came first, the language second. SQL is a surface over a mathematical foundation that has not needed to change. That foundation is why the skill compounds instead of decaying. When you learn SQL, you are not memorizing one vendor's API. You are learning the relational model, and the model is the same whether the data sits in Postgres, MySQL, SQLite, Oracle, or SQL Server. A join is a join everywhere. Move from one database to another and the syntax shifts at the edges, but the way you think about the problem carries over intact. Compare that to a frontend framework, where moving stacks means relearning how to think, not just how to type. Declarative is the whole trick

Hi everyone, I've been working on building my own website for my upcoming small business in the pest control. My set up is cloudflare for domain, Hostinger for hosting, and WordPress for CMS. I have a fair amount of coding and tech knowledge (Code simple things in a different languages and understand enough abouting coding to understand most non robust code; have also built a couple simple websites in wordpress) and really want to do things right. My question is what tools, choices, or practices are there that someone trying to research the space wouldn't be able to easily find that provide high value? Things deeper in scope than just building pages with custom blocks, using plug ins, and tweaking settings. Essentially, of the millions of tools and implementations existing in this space, where should a person looking to move from amateur to advanced but not career web dev look? And what is the value in those tools or choices? Additionally. outside of page speed insights, what audits are actually worth running to ensure everything is secure and running as smooth as possible without costing an arm and leg cumulatively? If you were a single person looking to build as professional of a website as possible, in a reasonable timeline (a month or two), what things would you really be focused on? My overall goal is to build everything as close to professional as a single person realistically could, so if you guys could help, I'd really appreciate it! Thanks in advance submitted by /u/ChestnetR [link] [留言]

The deadline to reauthorize Section 702 of the Foreign Intelligence Surveillance Act is coming up a week from now on June 12th, and legislators seem no closer to reaching a deal. If this sounds like deja vu, it's because we've been here before. Congress reauthorized Section 702 in late April - but only for 45 […]

Key Use Cases Power BI Visual Monitoring can be used for: power bi visual monitoring power bi report visual monitoring visual regression testing for Power BI power bi screenshot monitoring monitoring Power BI visuals visual monitoring for Power BI Report Server automated Power BI dashboard validation visual correctness control for BI reports Power BI Visual Monitoring: Automatically Detecting Broken Visuals in Power BI Reports In large Power BI environments, analytics teams often face the problem of silent regressions : even minor changes in data or models can break individual visuals without any obvious errors. Report owners frequently don’t notice that a visual has stopped rendering or is showing incorrect data — this can happen due to changes in data source structure, access rights, deleted fields, broken measures, or refresh failures. Manually checking hundreds of report pages across multiple dashboards in such conditions is extremely inefficient and nearly impossible. We, a team of BI developers and analysts, encountered this pain point during a large analytics implementation project and decided to create a solution for automated Power BI visual monitoring . Project Source Code: GitHub: https://github.com/svergio/Power-bi-report-visual-monitoring Documentation: https://svergio.github.io/Power-bi-report-visual-monitoring/ Wiki: https://github.com/svergio/Power-bi-report-visual-monitoring/wiki Why Standard Power BI Tools Don’t Solve the Problem Standard Power BI tools such as Usage Metrics and Performance Analyzer help analyze report usage and performance but do not detect visual issues. For example, built-in usage metrics show “how those dashboards and reports are being used” — number of views, popular reports, and who is viewing them. These metrics are important for assessing analytics adoption, but they say nothing about whether the visuals themselves are displaying correctly. Similarly, Performance Analyzer shows load times for each visual, helping identify s

Seller of the Sound Blaster Katana V2X doesn't consider the behavior a vulnerability.

Geoff Keighley’s annual June celebration of games is here. Summer Game Fest Live, the big live show that will feature a whole bunch of gaming news and announcements, begins at 5PM ET and is set to run for two hours. The event itself will take place in person at the Dolby Theatre in Los Angeles, […]

One thing I've been wondering lately: We often talk about larger context windows as if they're equivalent to better understanding. But in practice those feel like different problems. Access to information keeps improving. Understanding relationships between pieces of information still feels much harder. I notice this most when working with larger software projects. You can give a model access to a huge amount of code, but that doesn't necessarily mean it understands how the system evolved, which components are tightly coupled, or where risk actually lives. Curious whether others think these are fundamentally different problems or if larger context eventually solves both. Been exploring this while working on RepoWise: https://github.com/repowise-dev/repowise submitted by /u/Icy-Roll-4044 [link] [留言]

Keep PRs, issues, CI, and docs moving with AI agents Discussion | Link