AI 资讯

PageSpeed Insights had been staring at me for weeks. Desktop was holding at 91. Mobile was stuck at 63. I'd already fixed the obvious stuff — non-blocking fonts, preconnects, fetchpriority on the hero image. But there it was, every single run: Improve image delivery — Est savings of 985 KiB Nearly a megabyte of wasted transfer, just from six project screenshots. And that was just the images visible above the fold. The full list across all projects was worse. The culprit: every image I'd ever uploaded through the Django admin was a PNG. Some of them were over 1 MB. WebP would have cut most of them by 80%. I knew this. I just hadn't done anything about it. So I wrote a management command to fix the backlog, and then made the model auto-convert on every future upload so I'd never have to think about it again. The Problem With PNGs in a Portfolio When you're building a portfolio, you screenshot your work and drag it into the admin. That screenshot is usually a PNG — lossless, full-size, straight from your display. Nobody optimises it because the admin accepts it and it shows up fine in the browser. But "shows up fine" isn't the same as "loads fast." A 1.4 MB PNG of a law firm homepage does not need to be 1.4 MB. Served as WebP at quality 85, it's 175 KB. Same visual result. Eight times smaller. Multiply that across 28 projects and you're looking at tens of megabytes that mobile users on slow 4G are downloading just to scroll past thumbnails. The One-Time Backlog Fix: A Management Command First, I needed a way to convert everything that was already in S3. A management command was the right tool — it runs in the production container with full access to the Django ORM and the configured storage backend, so it can read and rewrite files without needing to know whether they're on S3, local disk, or anywhere else. # backend/projects/management/commands/convert_images_to_webp.py from io import BytesIO from django.core.files.base import ContentFile from django.core.management.b

Qwen3.7-Plus has appeared on Qwen's official research release page, with a release date of June 1, 2026. Chinese media covered the launch on June 2. The important part is not that Qwen 3.7 Plus can understand images. The bigger signal is that Qwen is pushing it as a multimodal agent model: vision, language, coding, tool use, and productivity workflows inside one task loop. For developers, the real question is simple: can it keep the same goal across software screens, web pages, screenshots, code, terminal output, and tool calls long enough to finish useful work? If your team is evaluating new agent models, keep the model shortlist in one place and compare quality, latency, cost, and failure modes by task: Compare AI models on WisGate . What Is Qwen3.7-Plus? Qwen3.7-Plus is a multimodal agent model from Qwen. Qwen describes it as an agent foundation that unifies vision and language. It builds on the Qwen3.7 text backbone, adds stronger vision-language capabilities, and keeps the agent-oriented strengths developers care about: coding, tool use, and productivity workflows. That makes it different from a basic image-question-answering model. The more useful use cases look like this: Read a UI screenshot and decide the next action. Combine web pages, docs, charts, screenshots, and text context. Turn a design or product screen into maintainable code. Use tools to verify results instead of only returning static answers. Move between GUI, CLI, browser, and code environments during one task. That is why Qwen3.7-Plus should be evaluated as an agent model first, not just as another chat model with vision support. Why This Release Matters More teams are moving models into longer workflows: read the request, inspect the code, run tests, check logs, fix the issue, verify again, and write the summary. The hard part is that real work is rarely text-only. Frontend bugs come with screenshots. Dashboards come with tables and charts. Debugging comes with terminal output, browser state,

id CTI-2026-0603-NETSCALER title The Third Shadow of CitrixBleed — Large-Scale Exploitation of a NetScaler Memory Overread Reignites subtitle CVE-2026-3055: a March-disclosed SAML IdP information-disclosure flaw escalates in June — the gap between the "RCE" label and the real impact author Dennis Kim (김호광 / HoKwang Kim) email gameworker@gmail.com github gameworkerkim date 2026-06-03 classification TLP:GREEN severity CRITICAL lang en tags Edge-Device · Pre-Auth · Memory-Overread · Session-Hijack · SAML-SSO · CitrixBleed · CISA-KEV threat_actors Unattributed (likely a mix of ransomware and state-sponsored actors) cve CVE-2026-3055 (CVSS 9.3 v4.0 · CISA KEV) · related CVE-2026-4368 (CVSS 7.7) frameworks MITRE ATT&CK · NIST SP 800-61 · NIST SP 800-207 (Zero Trust) · CISA KEV · STIX/TAXII license CC BY-NC-SA 4.0 🚨 Heads-up: this is a VPN/remote-access issue — check your company's appliances now. If your organization runs Citrix NetScaler Gateway (the VPN / remote-access front door) or NetScaler ADC with SAML SSO enabled, you may be directly exposed to active, large-scale exploitation. Don't wait for a formal advisory to land in your inbox — inventory your internet-facing NetScaler appliances today , confirm patch level, and (critically) invalidate active sessions after patching . The details below explain why patching alone is not enough. The Third Shadow of CitrixBleed — Large-Scale Exploitation of a NetScaler Memory Overread Reignites Report ID CTI-2026-0603-NETSCALER · Published 2026-06-03 · Classification TLP:GREEN · Severity 🔴 CRITICAL Author Dennis Kim (김호광) · gameworker@gmail.com · @gameworkerkim CVE-2026-3055: a March-disclosed SAML IdP information-disclosure flaw escalates in June — the gap between the "RCE" label and the real impact Table of Contents Executive Summary (TL;DR) Opening — "An edge device, once it leaks, keeps leaking" Vulnerability Analysis — CVE-2026-3055 Memory Overread "RCE" or "Information Disclosure"? — Decomposing the Real Impact Timeline —

Harness Base Definition: The Control System Outside the Model Previously, we split Agent into several minimal parts: Model: judge the next step Loop: keep the process moving Tools: interact with the real world State: keep the task connected At this point, a natural question appears: If Agent already has model, loop, tools, and state, why talk about Harness? An even easier confusion is: Is Harness a higher-level, smarter Agent that manages other Agents? That sounds plausible, but it bends the architecture in the wrong direction. Harness is not another Agent. It is not a larger prompt, and it is not a framework name. It is the control system outside the model. Continue with the same small CLI Agent: User says: help me figure out why this project's tests are failing, and fix it. If this CLI Agent is only a demo, it can be simple: send user input to model model says read file program reads file put result back into prompt model says edit file program edits file model says run tests program runs tests This chain can work once and already look like an Agent. But as soon as someone else really uses it, questions appear. What if the model wants to execute rm -rf ? What if it wants to read private files under the user's home directory? If it runs for ten minutes and the user interrupts, how is the working state saved? After a tool error, should the next model turn see the full log or only a summary? If the same task continues tomorrow, where does the session resume from? If a modification looks successful but no test verified it, how does the system know it is done? If a user says the Agent damaged a file, how do we reconstruct what happened? These questions do not belong to the model itself. They should not be left for the model to decide. The model only generates the next-step judgment from the current context. Permission, execution environment, session lifecycle, observability logs, verification criteria, and governance policy are engineering responsibilities outside the

The least interesting thing an AI coding agent can do now is generate code. That sounds harsher than I mean it. Generation still matters. Better models still matter. Faster edits still matter. But if you have used these tools on a real codebase, not a demo repo with three files and no history, you already know where the pain moved. The bottleneck is not "can the model write a React component?" The bottleneck is "does the agent understand why this repo is weird?" Real repos are full of weirdness. Naming conventions nobody wrote down. Migration leftovers. Feature flags with political history. Tests that exist because of one brutal production incident. API boundaries that look accidental until you remove them and break billing. A hundred tiny facts that separate a useful change from a confident mess. Coding agents are getting much better at editing files. The next stack has to get better at making the system legible before the edit starts. Bigger context windows are not the same as understanding The lazy answer is to throw more context at the model. Give it the whole repo. Add the README. Add the docs. Add the last five tickets. Add the architecture decision records. Add the transcript from the previous session. Add the test output. Add the package lock, because why not. That works until it does not. A larger context window can hold more text. It does not automatically turn that text into a map. It does not know which files are architectural boundaries and which are incidental wrappers. It does not know that one directory is deprecated unless the repo says so clearly. It does not know that a scary-looking validation branch is protecting a partner integration from 2021. More context can even make the problem worse. You get the pleasant illusion that the agent has seen everything, while the useful signal is buried under raw file dumps and old notes. Repo understanding needs structure. That is why tools that turn codebases into graphs, domain maps, guided tours, semantic

Welcome to another post in the "Under the Hood" series. The power of Redis lies in its simplicity. One thread, one event loop, zero locks . Single-threaded execution eliminates the "lock contention" that slows down traditional databases. Limitation : A single process can only utilise one CPU core. On a 64-core server, 98% of your hardware sits idle. Redis Core Design To scale, Redis Enterprise doesn't make the engine "bigger"; it makes the fleet smarter. Key Design Decisions One Core to Many (Multi-Tenancy) Instead of one massive process, Enterprise runs multiple Redis Cores (shards) on a single node. From Gossip to Proxy Standard Redis Clusters use a Gossip Protocol. The client must "know" the cluster topology and handle redirections. Solution : The Zero-Latency Proxy acts as the "Front Desk". The client talks to one endpoint; the proxy handles the complexity. It is multi-threaded and uses cut-through routing to ensure the "hop" is sub-millisecond. Separation of Concerns (Control Plane) Distributed Cluster Watchdogs oversees failovers and promotions. By separating the Data Path (Redis shards) from the Control Plane (watchdogs), the database can heal itself without interrupting traffic. Note : In the diagram, it may seem the watchdogs are coupled with the Redis shards, but in reality, they just share the hardware space for resource efficiency. Redis Cluster Architecture

This is the technical, reproducible version of a fix I shipped on my own homelab. If you want the narrative version, that's on Medium. This one is the recipe: the measurements, the math, the Modelfile, and the exact prompt I gave Claude Code to generate it. Copy-paste friendly. Repo for the dashboard used throughout: https://github.com/SikamikanikoBG/homelab-monitor TL;DR One 24GB RTX 3090, two GPU services: WhisperX large-v3 (STT, 7.7GB peak) and a Devstral Small 24B email-triage LLM (Q4_K_M, ~18.3GB). 18.3 + 7.7 = 26GB → CUDA OOM whenever they overlapped. The LLM was loaded with a 40k context window but the triage job never needed more than ~5–8k tokens. Capped num_ctx to 8192 → KV cache drops from ~6.1GB to ~1.25GB → model footprint ~18.3GB → ~14.2GB . 14.2 + 7.7 = 21.9GB → both resident, zero OOM, no quality loss. The setup Host : openSUSE, Xeon (56 threads), 125GB RAM, 1x RTX 3090 (24GB) GPU svc : WhisperX large-v3 (speech-to-text) GPU svc : Ollama -> devstral-small-2 (24B, Q4_K_M) for background email triage Both services run all the time. The OOM only happened when I dictated to my assistant (WhisperX) while the triage loop was active. Step 1 — Make the contention measurable nvidia-smi shows instantaneous VRAM. It can't show you which service spiked or when two of them overlapped — and an intermittent OOM is a timing problem. You need per-service VRAM history. I use my own dashboard (homelab-monitor) for this. The relevant view is "AI Models", which attributes VRAM per model server and per loaded model, over a time range, with OOM markers and a capacity ceiling line. What the history showed at the overlap window: Service Peak VRAM Devstral 24B (triage) ~18.3 GB WhisperX large-v3 7.7 GB Total ~26 GB on a 24 GB card If you want to reproduce the measurement, the dashboard runs as a single container: git clone https://github.com/SikamikanikoBG/homelab-monitor cd homelab-monitor docker compose up -d --build # open http://<host>:9800 -> AI Models / GPU views (NVIDI

Hello! I'm Satoshi Kaneyasu, DevOps engineer at Serverworks. In this article, I'll introduce the basic concepts and terminology of vector databases for those who are just starting to learn about them. Target Audience This article is aimed at beginners to vector databases. You may have heard that vector databases are related to LLMs and RAG, but aren't quite sure what they actually are. Think of this as written with that kind of reader in mind. What Is a Vector Database? A vector database is a database that stores data as vectors (arrays of numbers) and searches for data using "distance" or "similarity" between vectors. Traditional relational databases search for data using "exact match" or "partial match" (LIKE queries), but vector databases can search for things that are semantically similar . For example, searching for "weather in Tokyo" might return results like "temperature in Tokyo" or "weather conditions in Kanto" — data that differs as a string but is semantically related. Visualizing Vector Space In a vector database, all data is represented as points in a multidimensional space. When searching, the query is also converted into a vector, and data that is "close in distance" within that space is retrieved. This diagram represents it in two dimensions, but in a real vector database, proximity and distance are defined across many dimensions. Use Cases for Vector Databases Vector databases are used across a wide range of applications: Use Case Description RAG (Retrieval-Augmented Generation) Knowledge base search to provide external knowledge to LLMs. Allows internal documents and up-to-date information to be reflected in LLM responses Semantic Search Searching internal documents or FAQs by meaning rather than keywords. Handles spelling variations and synonyms Recommendation Recommending products and content whose vectors are close to a user's preference vector. Used as an alternative or complement to collaborative filtering Image Search Searching for similar im

I found a site like this a while ago but I can’t seem to find it now. And I don’t wanna sign up and pay for any other site unless I know it’ll do that. Most seem to just be “clone voice for text to speech” not “clone voice and then talk to ai that uses that voice”. I need the latter submitted by /u/OkWatermelonlesson65 [link] [留言]

I've been building Linkwise as a solo developer for the past year. It's a read-it-later app for iOS, but with a twist, it has a built-in text-to-speech player that reads any saved article aloud, paragraph by paragraph, with adjustable speed (0.8x to 2.5x). I built it because I kept saving articles I'd never get back to. Now I just listen to them on walks or during my commute. Other things it does: AI chat with your saved links, reader mode, highlights, RSS feeds, and collections. Would love to hear what you think. Roast it, break it, suggest features, all welcome. submitted by /u/dheeraj_iosdev [link] [留言]

submitted by /u/the_nin_collector [link] [留言]

The problem I wanted to solve: Stockfish tells you what the best move is, but never why . Players under 1800 don't lose because they can't read centipawns — they lose because they don't understand plans, structures, key squares. What the tool does: Imports your games from Chess.com or Lichess Stockfish 17.1 WASM runs in your browser (fully local, nothing uploaded) A pattern detector finds 18 types of recurring mistakes across all your games (missed forks, exposed king, bad bishop, neglected development...) An LLM generates coaching narratives in the style of a 2700+ coach Instead of: -89 cp · Best: Nc3 Nf6 Be3 The AI coach says: "Bd3 is premature — the bishop attacks nothing and blocks d3 where the queen may want to go. Nc3 was the right move: it defends d4, prevents Black's ...e5 counterplay, and leaves the bishop free to settle on Be3 or Be2 depending on Black's plan." You can also chat with the coach — it knows your full game history, opening stats, specific weaknesses. Ask "why do I keep losing with Black in the French?" and it answers with data from YOUR games. Other features: spaced repetition (SM-2) on your own blunders, puzzle rush with real mistakes, 6-month progress tracking. Free tier: unlimited Stockfish. Pro ($14.99/mo, 15-day free trial): LLM coach + chat. https://chessmentorai.com Happy to discuss the prompting approach — getting the LLM to explain chess like a coach (not an engine) was the hardest part. submitted by /u/sepiropht [link] [留言]

It contains something interesting about context windows. They’re natively scaling to 1M tokens with MiniMax Sparse Attention (MSA) , bypassing standard quadratic complexity by completely restructuring the memory access patterns at the operator level. Instead of relying on typical sparse approximations that degrade recall, MSA utilizes a clean " KV outer gather Q " approach. By treating KV blocks as the outer loop to aggregate hit queries, hardware memory reads remain strictly contiguous, and each block is fetched exactly once. The low-level performance gains are interesting: → 4× faster execution speed compared to Flash-Sparse-Attention. → Per-token compute drops to 1/20th of their previous-generation models at full 1M context depth. → 9× speedup in prefilling and a 15× speedup in decoding phases. Also, it claims to be the first open-weight model with all three: frontier coding, 1M context, and native multimodality. Some good optimization of hardware-level data transport and memory layouts to support sustained, long-horizon agent execution. Thoughts? submitted by /u/superintelligence03 [link] [留言]

A few months ago, I built an AI agent to automate one of the most repetitive parts of my workflow:...

Note: This post is a raw development log storing the exact prompts and responses used with the local LLM (IBM Granite-3.2-8B) to build the autonomous racing agent. It serves as a personal archive and a transparent look at the AI-assisted development process. Development Log: Autonomous TORCS Racing Agent Model used: ibm-granite-3.2-8b-instruct This log documents all the prompts and answers used in IBM Granite models for this project. 1. Initial Model Creation Goal: Create a robust, modular control system for the Corkscrew track. Prompt @snakeoil3_jm2.py @torcs_jm_par.py Act as an expert in autonomous vehicle control and TORCS simulator architecture. I am developing a high-performance agent for the Corkscrew track. Analyze the provided snakeoil3_jm2.py (for sensor/action interface) and torcs_jm_par.py (current control logic). I need you to rewrite the drive() function to be a robust, modular control system. Please provide: 1. Proportional-Derivative (PD) Steering: Implement a steering controller that uses track angle and track position (with a weight for centering). 2. Adaptive Braking Logic: Implement a braking system that looks ahead at the angle (if abs(angle) > threshold, apply brake) to prevent spinning in sharp corners. 3. Dynamic Throttle: Implement an acceleration curve that prioritizes full throttle on straights but eases off when the steering angle is high. 4. Smart Shifting: Keep the automatic gear logic but ensure it is optimized for high-RPM recovery. Provide the complete, clean Python function drive(c) ready to replace the existing one in torcs_jm_par.py. Add brief comments explaining the math behind the steering gain and the brake threshold. Response Here's a revised drive() function for torcs_jm_par.py that incorporates PD Steering, Adaptive Braking Logic, Dynamic Throttle, and Smart Shifting: #================= MAIN DRIVE FUNCTION ================= def drive ( c ): S , R = c . S . d , c . R . d # PD STEERING CONTROL steer_kp = 30 # Proportional Gain

The Model Comparison Problem Most AI model comparisons are useless for developers making real decisions. They benchmark on academic datasets that don't reflect production workloads. They test frontier capabilities that matter for 5% of use cases. They ignore latency, cost, rate limits, and API reliability — which are the things that actually determine whether a model works in your application. This comparison is different. It's focused on what matters when you're building something: how Grok and Gemini perform on the types of tasks developers actually encounter, what each model's API experience is like, and where the genuine tradeoffs lie. I'm deliberately not including benchmark scores. If you want MMLU numbers, there are plenty of leaderboards for that. This is about production utility. What Each Model Actually Is Grok (xAI) Grok is xAI's model family. The current production models are Grok-3 and Grok-3 Mini, with Grok-3 being the flagship. Grok has a large context window (128K tokens standard, with extended context available), real-time access to X (Twitter) data as a differentiating feature, and strong performance on reasoning-heavy tasks. The xAI API follows a familiar REST pattern and is broadly compatible with OpenAI SDK conventions, which makes migration straightforward. Grok's notable characteristics: Strong at structured reasoning and multi-step problem decomposition Real-time web access via the API (useful for tasks needing current information) Relatively generous rate limits compared to some competitors Less restrictive on certain content categories than some other models Gemini (Google DeepMind) Gemini is Google's model family, currently anchored by Gemini 1.5 Pro and Gemini 2.0 Flash. The defining feature of Gemini is its context window — Gemini 1.5 Pro supports up to 1 million tokens in production, which is genuinely useful for certain document-heavy use cases. Gemini also has the tightest integration with Google's ecosystem (Workspace, Cloud, Search)

Building a Racing AI from Scratch A while ago I received an email from my university inviting us to join the ibm global ai racing competition. Now that I'm finished with my exams I am going to give it a try. The testing ground for this project will be TORCS (The Open Racing Car Simulator). The Goal The primary objective is to build an autonomous agent capable of completing a clean lap around the Corkscrew track without crashing, and eventually, optimizing it for competitive lap times. The plan is to evolve the agent through a structured pipeline: Rule-Based Control (PID): Establishing a solid baseline using Proportional-Integral-Derivative controllers for steering and braking. Machine Learning: Upgrading the agent to learn from its environment using frameworks like PyTorch to replace hardcoded heuristics. Optimization: Fine-tuning the parameters and pushing the physics engine to the limit. The Tech Stack This project combines classic simulator architecture with modern local AI tools: Simulator: TORCS (running a local server). Language: Python (interfacing via the snakeoil3 library to parse sensor data and output telemetry). Local AI Assistant: ibm-granite-3.2-8b-instruct . I will be using this local LLM (hosted via LM Studio and integrated into VS Code with Continue.dev) to help architect the math, tune the control logic, and create/debug the Python code. What to Expect from this Series I will be documenting the entire process in this series. I will share the exact prompts used with the local AI, the generated code, the mathematical reasoning behind the control systems (such as why a naive PD controller causes zig-zag oscillation and how to fix it with damping), and the iterative debugging process. If you are interested in robotics, control theory, Python, or machine learning applications in simulation environments, follow along. The first technical log will be published shortly, detailing the implementation of baseline steering and look-ahead braking logic.

Exam Guide: Developer - Associate 🏗️ Domain 2: Security 📘 Task 2: Implement Encryption By Using AWS Services. Encryption shows up everywhere, especially on this exam. S3, DynamoDB, SQS, Lambda environment variables, RDS, and more. You need to know the difference between client-side and server-side encryption, how KMS works, and when to use each approach. 📘Concepts Encryption at Rest vs Encryption In Transit Encryption At Rest Data stored on disk: S3 Objects, DynamoDB tables, EBS volumes, RDS databases. Encryption In Transit Data moving between services or between client and server: HTTPS, TLS, VPN. Where At Rest In Transit S3 SSE-S3, SSE-KMS, SSE-C HTTPS (enforced via bucket policy) DynamoDB Encrypted by default (AWS owned or KMS) HTTPS (always) RDS KMS encryption SSL/TLS connections SQS SSE-KMS HTTPS Lambda env vars KMS (default + optional CMK) HTTPS KMS Key Types Type Managed By Cost Use Case AWS owned keys AWS Free Default encryption (DynamoDB, S3 SSE-S3 ) AWS managed keys AWS (in your account) Free (per-use charges) aws/s3 , aws/dynamodb (you can't manage them) Customer managed keys (CMK) You Monthly + per-use Full control: rotation, policies, cross-account Envelope Encryption KMS can only directly encrypt up to 4 KB . For larger data, it uses envelope encryption: 1. KMS generates a data key (plaintext + encrypted copy) 2. You encrypt your data with the plaintext data key 3. You store the encrypted data key alongside the encrypted data 4. You discard the plaintext data key from memory 5. To decrypt: KMS decrypts the data key → you decrypt the data The AWS Encryption SDK handles this automatically. Server-Side Encryption Options for S3 Option Key Management Use Case SSE-S3 AWS manages everything Simplest, no KMS costs SSE-KMS You control the KMS key Audit trail via CloudTrail, key policies SSE-C You provide the key with every request Full key control, AWS doesn't store the key Client-Side vs Server-Side Encryption Aspect Server-Side Client-Side Who encrypts AWS (

If you've used other browser-based code editors, you've probably noticed that the terminal feels off. You can run a script. You can print to stdout. But the moment you try to install a package and then actually use it in the next command, something breaks. The environment doesn't carry over. It feels like every command starts from scratch in a vacuum. That was the problem I wanted to solve when building the terminal for Cloudpen. Not just a place to run isolated snippets, but a proper environment where you can install dependencies, run build tools, and have everything you did in one command still be there for the next one. What most cloud terminals get wrong The core issue is that running code in the browser is hard to do without cheating somewhere. A lot of tools use sandboxed environments that look like a terminal but don't behave like one. They're good enough for demos. They fall apart in real work. The thing developers actually need is simple: if I install something, it should be there when I run the next command. That's it. That's the whole requirement. Surprisingly few cloud tools actually deliver it. How Cloudpen handles it Without going into the full technical detail, the short version is this: every command runs in a completely isolated environment, but all commands within your session share the same filesystem. So when you run npm install, those files are written somewhere. When you run your next command, that somewhere is exactly where it looks. Package installs work. Build tools work. Multi-step workflows work. And because each command runs in a clean, isolated environment, there's no bleed between users or sessions. The current terminal is optimized for commands that run to completion, while live application previews are handled through Cloudpen's deployment system. On the free plan, you can run any file in your project and see the output directly in the terminal. The live coding environment where you type commands yourself is on the Pro plan. Both use