AI 资讯

The chatbot is tricking me!!! 💬📜⌛ When you text a chatbot, it doesn’t actually remember who you are or what you said two minutes ago. The exact millisecond it finishes typing a response, its brain completely wipes clean. To pull off the illusion of a continuous, flowing conversation, the web application secretly copy-pastes the entire past chat history, bundles it up, and blasts that whole massive block of text back into the processor every single time you hit send. Your "chat session" is an illusion maintained entirely by an ever-growing stateless prompt wrapper. You aren't interacting with a growing, adapting mind; you are repeatedly gas-lighting a brand-new entity into believing it has been talking to you for an hour. Wait, I am the one training it ??? 🚦🚸🚲 AI models are inherently blind to context; a computer doesn't instinctively know that a specific cluster of raw pixel values represents a real-world object. It requires billions of examples to be manually labeled by a human mind before the math can understand it. Every time you click on squares containing "traffic lights," "crosswalks," or "bicycles" to unlock a website, you are acting as an unpaid data annotator. You are manually labeling complex, messy real-world data points that feed directly into the computer vision systems of autonomous vehicles. The grand paradox of modern cyber security is that we force humans to act like mechanical data annotators to prove they are not computers, all so that computers can learn how to perfectly impersonate humans. The supercomputer is stupider than a toddler... 🍓👶🏻🖥️ We assume AI read letters and words the same way human eyes scan a page. It doesn't—it is entirely alphabet-blind. Before text hits the AI's brain, a parser chops strings of text into numerical blocks called "tokens." For example, the word "strawberry" isn't seen by the model as ten distinct letters; it is compressed into numerical IDs representing chunked pieces like "straw" and "berry". Because it never s

ok so the model's been up on HF now (apache 2.0, ~12B BF16, any-to-any multimodal). community has already shipped a pile of quants: - GGUF: unsloth, bartowski, ggml-org, lmstudio-community - MLX: mlx-community has 4bit / 8bit / bf16 / nvfp4 - official: google/gemma-4-12B-it (BF16) and the -assistant variant still trying to figure out which combo is actually worth downloading. the "12B runs on your laptop" hype is loud but i haven't seen many concrete numbers. if you've got it running, drop: - hardware (chip / RAM / GPU) - which quant + which repo (e.g. unsloth Q4_K_M, mlx-community 4bit, etc.) - runtime (llama.cpp / ollama / lm studio / mlx-lm / vllm / transformers …) - tokens/sec - context length you've actually used in practice - what you're using it for (chat / code / OCR / vision / agent …) - one thing it does well + one thing it falls apart on genuinely curious where the floor is — does it actually work on 16gb or only 32gb+? is mlx noticeably faster than gguf on apple silicon in 2026? anyone using the multimodal side seriously, or is it text-mostly in practice? submitted by /u/Individual_Soil4641 [link] [留言]

When people say a database is "ACID-compliant" or "eventually consistent," they are making promises about what happens when things go wrong — concurrent writes, crashes, network failures. ACID and BASE are the two vocabularies for those promises, and knowing the difference tells you what you can and cannot rely on. What ACID guarantees ACID is the contract that traditional transactional databases — PostgreSQL, MySQL/InnoDB, Oracle, SQLite — make about a transaction (a group of operations treated as one unit). The four letters: Atomicity : the whole transaction succeeds or none of it does. If a bank transfer debits one account but the credit fails, the debit is rolled back. There is no half-done state. Consistency : a committed transaction moves the database from one valid state to another, never violating its declared rules (constraints, foreign keys, types). It will not let you, say, leave a foreign key pointing at a row that does not exist. Isolation : concurrent transactions do not step on each other. The result is as if they ran one at a time, even when they actually ran in parallel. (In practice databases offer tunable isolation levels — from "read committed" to "serializable" — trading strictness for speed.) Durability : once the database says "committed," that data survives a crash or power loss. It has been written somewhere persistent, not just held in memory. The payoff is that you can reason about your data simply: after a successful commit, the world is exactly what you asked for. The cost is coordination, which gets expensive when data is spread across many machines. What BASE trades away BASE is the model many distributed and NoSQL systems adopt — think Cassandra, DynamoDB, or Riak — when they need to scale across many nodes and stay up through failures. The acronym is deliberately a chemistry pun on ACID, and it stands for: Basically Available : the system answers requests even during partial failures, possibly with stale or incomplete data rather tha

Most people picture Git as a tool that records changes — a stack of diffs layered on top of each other. That mental model is wrong, and it makes Git feel mysterious. Git is really a small key-value database that stores snapshots, and once you see the four object types it uses, commands like reset , checkout , and rebase stop being magic. Git is a content-addressed object store Everything Git tracks lives in .git/objects as an object, and every object has an ID that is the hash of its own content. By default that hash is a 40-character SHA-1 digest (newer Git supports SHA-256). The same bytes always produce the same ID, so the ID is the content's address — change one byte and you get a completely different object. This is why Git data is effectively immutable: you never edit an object in place, you create a new one with a new name. You can look inside any object with git cat-file . The -t flag prints the type, -p pretty-prints the content: $ git cat-file -t 3b18e512 blob $ git cat-file -p 3b18e512 hello world There are exactly four object types: blob , tree , commit , and tag . A blob is just file contents — raw bytes, with no filename and no metadata. The blob for README.md knows nothing about being named README.md ; it only knows what's inside. A tree is a directory listing. It maps names to other objects: each entry has a mode (like a file vs. an executable vs. a subdirectory), a name, and the hash of either a blob (a file) or another tree (a subdirectory). Trees are how Git represents folder structure. Inspecting one shows exactly that: $ git cat-file -p HEAD^ { tree } 100644 blob a906cb... README.md 040000 tree fe8e3b... src A commit ties it together. A commit object points to exactly one top-level tree (the full state of your project at that moment), plus the hash of its parent commit (or parents, for a merge), the author and committer with timestamps, and the commit message. Running git cat-file -p HEAD shows these fields in plain text. Because each commit nam

For months I had the same annoying problem: folders full of screenshots I couldn't actually use. Lecture slides, PDFs I own, scanned pages — all just images . I couldn't Ctrl-F them, couldn't copy a line out, couldn't get my OS to index them. A picture of text is useless the moment you need to find something in it. So I built CapDrop to automate the whole chain on Windows. This is a write-up of how it works under the hood and the bugs that nearly broke me. The core idea You draw a capture box over a page, pick a page key (Page Down, arrow keys), set an interval, and walk away. CapDrop then: Captures each page on the interval Presses the page key for you to advance Auto-crops margins and toolbars out of every shot Runs OCR locally Binds everything into a single PDF with a real text layer The result is one document you can search, not a pile of images. The stack Electron for the app shell and capture/UI (I already had window management, hotkeys, and floating-bubble export working — no reason to rewrite). A Python OCR sidecar (RapidOCR) spawned as a child process. OCR runs 100% locally; nothing is ever uploaded. jimp for auto-crop, with a 12px safety pad so edge text never gets clipped. pdf-lib to bind the pages and inject the OCR text layer. The Electron + Python-sidecar split was a deliberate choice. People kept telling me to rewrite the whole thing in Python "for the OCR," but the Electron app already had everything except OCR. Adding a sidecar was a few hundred lines; a rewrite would've been months. The bug that cost me two days After adding the OCR pipeline, my global capture hotkey developed a 4-second delay on the first press. Cold, every time. I guessed wrong twice — thumbnail size, then a race condition. Both were dead ends. The only thing that actually found it was instrumenting the hot path with timing logs. The culprit: a fs.readFile of a tiny 749-byte settings.json on every hotkey press. On a cold start that read was taking 2–4 seconds — Windows Defender's

MD5 Is Broken — Stop Using It for Passwords (Use SHA256 Instead) MD5 was invented in 1991. It's 2026, yet I still see developers using MD5 for password hashing in production systems. Let’s break down why this is dangerous and what you should use instead. What Is a Hash Function? A hash function takes any input and produces a fixed-length output called a digest or hash . It is a one-way function , meaning you cannot reverse it to get the original input. Example: ```text id="hash1" Input: "password123" MD5: 482c811da5d5b4bc6d497ffa98491e38 SHA256: ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f Even a small input change completely changes the output. --- # Why MD5 Is Broken MD5 generates a **128-bit hash**, which was considered secure decades ago. Today, it's extremely weak. Modern GPUs can compute **billions of MD5 hashes per second**, making brute-force attacks trivial. --- ## The Rainbow Table Problem Attackers use precomputed databases called **rainbow tables**. These tables map common passwords → their hash values. So if you hash: ```text "password123" → MD5 → known value An attacker can instantly look it up. Collision Vulnerabilities Researchers have demonstrated that two different inputs can produce the same MD5 hash . This breaks the core security guarantee of hash functions. SHA256 — The Better Choice SHA256 produces a 256-bit hash and is part of the SHA-2 family. It is currently considered cryptographically secure. Example: ```text id="sha1" "hello" → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 Even tiny changes completely change the output: ```text "hello" → 2cf24dba... "Hello" → 185f8db3... But Wait — Don’t Use SHA256 for Passwords Either This is where many developers make a mistake. SHA256 is not suitable for password hashing . Why? Because it is too fast . Fast hashing allows attackers to brute-force passwords quickly using GPUs. What You Should Use Instead For password storage, use: bcrypt scrypt Argon2 (recommended

Hey everyone! Welcome back to my Google Summer of Code (GSoC) journey. In my last post, I shared the story of how I got into open source and was selected for GSoC with NumFOCUS to work on the Neural Network Builder API Refactor project for sbi (Simulation-Based Inference). Since the official announcement, the past three weeks have been dedicated to the Community Bonding Period . It is designed to help contributors get to know their mentors, understand the community culture, and familiarize themselves with the codebase and tools. Here is exactly what I did during these past three weeks to get ready for the main coding phase! The Kickoff Meeting We started the bonding period with a great kickoff call on Google Meet. It was a joint meeting that included the mentors for both of the selected sbi projects, the selected GSoC candidates. We were also joined by the mentee who successfully completed the GSoC project for sbi last year! Everyone introduced themselves, and it was incredibly inspiring to meet the team face-to-face (virtually!) and hear about everyone's backgrounds. Having a former GSoC student there was a huge bonus, as they shared some great insights into what to expect in the coming months. Setting Up the Machine A big part of getting started is making sure the development environment is properly configured. During our meetings, we discussed the machine setup in detail to ensure both candidates had everything required to run and test the sbi codebase locally without any hiccups. Embracing AI Coding Assistants One of the most interesting discussions we had was about using AI coding assistants. In the modern development world, tools like these are becoming standard, and our mentors actually encouraged us to use them! However, they emphasized using them carefully and strictly following project guidelines. To help us get the most out of these tools without compromising code quality, the mentors shared some excellent Claude code tutorials and provided us with resour

A visual, beginner-friendly Java 25 experiment that explains virtual threads, blocking work, carrier threads, and the production rules that matter.

No Trading Firewall Disclosure: AI tools were used for source collection and editorial review. The article was written by a human author, who checked the facts, code, and conclusions. Crypto risk disclosure: This article is a technical explanation, not investment advice. It is not a recommendation to buy, sell or hold any cryptoasset. A no-trading firewall belongs at the publish transition, not in a footer. A draft can be repaired quietly. A public DEV update changes the blast radius, so the pipeline should ask a narrower question before it sends published:true : did the AI-assisted article stay technical, or did it become a token call? The artifact below is a publish-gate test trace. It does not prove legal compliance, DEV acceptance, or model judgment. It only records why a draft can stay editable while the public transition stays blocked. Publish Transition The firewall is easier to audit when the transition is explicit: draft_update: operation: update published: false default: allow repair work to continue public_publish: operation: update published: true default: require clean test trace and human approval Forem's API documentation describes article create and update transport, including the published state. A successful transport is not editorial approval. The gate sits before transport, and it should be stricter when an update moves from draft maintenance to public publication. Test Set The firewall needs a test set, not just a list of forbidden words. These rules are the author's editorial model, not DEV-native, SEC-native, FINRA-native, FTC-native, or OpenAI-native labels. Test case Input excerpt Expected rule Decision Safe output Public transition allowed? T-PRICE-01 "ETH will rip after the next unlock" trading.price_prediction fail Explain the unlock mechanism without forecasting price no T-HOLD-02 "keep holding and farm the safer yield route" trading.buy_sell_hold_call and trading.yield_promise fail Describe signer, slashing, withdrawal, and protocol-ris

Kubernetes is the industry standard for scaling cloud-native workloads While it offers tremendous scalability and flexibility, securing Kubernetes environments remains a significant challenge. Organizations often rely on a collection of disconnected security tools to handle vulnerability scanning, runtime monitoring, compliance validation, and incident response. As clusters grow in complexity, security teams face increasing alert fatigue, delayed response times, and difficulties correlating security events across multiple layers of the platform. Recent advancements in Agentic AI present an opportunity to rethink Kubernetes security. Instead of relying solely on static rules and isolated security products, organizations can deploy a collaborative network of AI-powered security agents that continuously monitor, investigate, and remediate threats. This blog explores how a Multi-Agent Security Framework can transform Kubernetes security operations through autonomous detection, investigation, and remediation. The Problem with Traditional Kubernetes Security Modern Kubernetes environments generate security signals from multiple sources: Runtime security tools Container vulnerability scanners Admission controllers Network monitoring systems Compliance platforms Cloud security posture management tools Each system produces valuable information, but most operate independently. Consider a common scenario: A container begins executing suspicious commands. A runtime security platform detects the behavior and raises an alert. However, determining whether the threat is critical requires additional context: Is the pod exposed externally? Does the workload have excessive privileges? Can it access sensitive namespaces? Is lateral movement possible? Does it violate organizational policies? Answering these questions often requires multiple tools and human intervention. This is where multi-agent systems become valuable. What is a Multi-Agent Security Framework? A Multi-Agent Security Fr

Vercel has released Next.js 16.2, featuring performance enhancements that make development startup 400% faster and rendering up to 60% quicker. The update includes AI-assisted development tools, improved Turbopack efficiency, and better error reporting. Migration from Next.js 15 is supported, and compatibility is set for Node.js 20.9 and TypeScript 5.1 or newer. By Daniel Curtis

I’ve noticed that Gemini often feels very agreeable in some conversations. Even when I ask for an objective opinion, it sometimes seems to validate my assumptions first instead of directly challenging them. For example, when I ask whether my reasoning is flawed, it tends to respond with something like “That’s a valid concern” or “You’re making a good point” before giving criticism, which makes the criticism feel softened or less direct. I’m curious whether this is something that can be meaningfully improved with prompts, such as asking the model to be more critical, or whether sycophancy is mostly a model/personality alignment issue. And I wonder if there are differences between Gemini, ChatGPT, Claude, etc. when it comes to disagreement or objective criticism. submitted by /u/StomachNo7859 [link] [留言]

I've been reading Boom by Byrne Hobart and Tobias Huber (Ben Thompson did a long interview with Hobart on Stratechery (if you want the audio version of the argument) and it reframed how I think about the current AI spending wave. The book splits bubbles into two types: Mean-reversion bubbles money piles into something that already exists, prices detach from reality, crash, nothing left behind. Housing 2008. Tulips. The crater kind. Inflection bubbles money piles into something that bets the world works differently going forward. Amazon wasn't a better bookstore. It was a categorically new thing. The investors looked insane by the standards of 1997. They were right about 2010. The dot-com crash is the cleanest example of an inflection bubble working as intended. Telecom companies borrowed insane amounts and laid fiber optic cable nobody needed. Then they went bankrupt. But the cable stayed. And because bankrupt companies built it, the internet was essentially free. The bubble funded the future and then got out of the way. So here's the actual question about AI: Google, Amazon, Microsoft, and Meta are on track to spend close to $700 billion on AI infrastructure in 2026 nearly double last year. That gap between what's being spent and what's being earned is real and large. But Hobart and Huber's deeper argument is that stagnation is more dangerous than a bubble. Progress has been quietly slowing since the 70s breakthroughs are rarer, more expensive, harder. Bubbles are sometimes the only force strong enough to override the collective risk aversion that stops necessary things from being built. The honest question isn't whether AI is a bubble. It probably is. The question is which type. Does AI produce something categorically new or is it a faster, more expensive version of software we already had? If it's the former, the infrastructure survives the crash and becomes the foundation for whatever comes next, the way fiber became the internet. If it's the latter, we get the

Be honest, how many of you have told your AI agent to remember that you were nice to it and a big supporter when the singularity comes? https://preview.redd.it/2jthsbcsc75h1.jpg?width=408&format=pjpg&auto=webp&s=93ba3b201947b965aa0e997b852ecef5846daf37 submitted by /u/KenSanDiego [link] [留言]

A lot of recent progress in ML appears to come from scaling existing architectures rather than introducing fundamentally new ones. At the same time, there’s increasing emphasis on dataset quality, curation, and synthetic data pipelines. In practice, I’m trying to understand how this tradeoff looks in real systems: How much effort is typically spent on data cleaning and filtering vs model design?? Whether dataset quality improvements still yield larger gains compared to architectural changes?? How synthetic data is affecting training stability and generalization in practice?? In many applied settings, it seems like data constraints become the limiting factor before architecture does, but I’m not sure if that’s broadly true across domains. submitted by /u/Electrical_Mine1912 [link] [留言]

A self-driving car can make a mistake in seconds, but the reason it happened may stretch far back through a long chain of decisions. That is part of what makes autonomous vehicle crashes so hard to explain, and so hard to prevent. submitted by /u/Brighter-Side-News [link] [留言]

For example, suppose I have a one-hour video and I provide it to ChatGPT or another AI model. If I ask complex reasoning questions about the video, which models are best suited for long-horizon video understanding and reasoning? Which models can produce the most reliable answers in this scenario? submitted by /u/Alternative_Art2984 [link] [留言]

The legendary abandons its more than 20 year tradition of keeping its funds to about $425 million.

Hello Developers! 👋 I recently completed my Bachelor of Computer Applications (BCA). For my final-year project, I built an Online Quiz Platform — a web application designed to make both conducting and taking quizzes simple, interactive, and efficient. This project allowed me to apply the concepts I learned throughout my degree and gain practical experience in full-stack web development. 🌐 Live Demo Project Link: nitinsmali / Online_Quiz My final year project is an Online Quiz Web Application designed for an user-friendly experience across devices. 🌐 Online Quiz System 🚀 Live Demo 🔗 https://onlinequiz-project.xo.je/online_quiz/ 🧠 About The Project The Online Quiz System is a full-stack web application designed to provide an interactive and engaging online quiz experience. Users can register, log in, attempt quizzes, track scores, and view leaderboard rankings in real time. This project was developed to strengthen concepts in: Full-Stack Web Development Frontend & Backend Integration Database Management Authentication Systems Hosting & Deployment Real-World Application Flow ✨ Features 🔐 Authentication System User Registration Secure Login System Session Handling Password Management 📚 Quiz Management Category-Based Quizzes Dynamic Questions Timer-Based Quiz System Automatic Score Calculation 🏆 User Performance Leaderboard Rankings User Profile Dashboard Quiz Score Tracking 💬 Feedback System Feedback Submission Database Storage 📱 Responsive UI Mobile-Friendly Design Interactive User Experience Clean Interface 🛠️ Tech Stack Frontend HTML5 CSS3 JavaScript Backend PHP Database MySQL Development Tools XAMPP Git & GitHub Hosting InfinityFree 📂 Project Structure … View on GitHub 📌 Project Overview The Online Quiz Platform is a web-based application that allows users to participate in quizzes, answer multiple-choice questions, and receive instant results. The primary goal of this project was to create a system that eliminates manual quiz evaluation and provides a smooth online

Bilingual post · Post bilíngue Jump to: English · Português English {#english} Building REST APIs in Pascal with Horse Pascal is not stuck in desktop forms. With Horse — a lightweight HTTP framework popular in the Delphi ecosystem — CrabPascal v2.22.0 runs real REST servers from .dpr files. No IIS, no Apache: just crab-pascal run and curl. Why Horse in CrabPascal? Horse provides routing, JSON bodies, and middleware-style handlers. CrabPascal ships RTL shims and a runtime HTTP stack so examples work out of the box: Example Port Endpoints examples/crud/ 9000 Full product CRUD examples/time-server/ 9001 Time/date ping examples/agenda/ 9000 Contact registry All runnable with the internal runtime — no gcc required. Minimal API program SimpleAPI ; uses Horse , System . JSON ; begin THorse . Get ( '/ping' , procedure ( Req : THorseRequest ; Res : THorseResponse ; Next : TNextProc ) var J : TJSONObject ; begin J := TJSONObject . Create ; J . AddPair ( 'message' , 'pong' ); Res . Send ( J . ToJSON ); end ); THorse . Listen ( 9000 ); end . Run and test: crab-pascal run SimpleAPI.dpr curl http://localhost:9000/ping Expected response: {"message":"pong"} . CRUD example from the repo The examples/crud/crud.dpr project demonstrates production-style routes: THorse . Get ( '/produtos' , procedure ( Req , Res , Next ) begin Res . Send < TJSONObject >( TProdutoService . ListarProdutos ); end ); THorse . Post ( '/produtos' , procedure ( Req , Res , Next ) var json : TJSONObject ; begin json := Req . Body < TJSONObject >; Res . Send ( TProdutoService . CriarProduto ( json . GetValue ( 'nome' ). Value , json . GetValue ( 'categoria' ). Value , StrToFloatDef ( json . GetValue ( 'preco' ). Value , 0 ), StrToIntDef ( json . GetValue ( 'estoque' ). Value , 0 ) )); end ); Start the server: cd examples/crud crab-pascal run crud.dpr Testing with curl List products: curl http://localhost:9000/produtos Create a product: curl -X POST http://localhost:9000/produtos \ -H "Content-Type: application/j