AI 资讯

submitted by /u/Successful_Bowl2564 [link] [留言]

Last week I built a little dashboard with Claude. Took maybe ten minutes. Then I spent the next hour trying to get it online. ssh in, install docker, write a Dockerfile, set up nginx, run certbot, certbot fails, read the log, oh the DNS hasn't propagated, wait, run it again, open port 443, realize ufw was blocking it the whole time. By the time it was live I'd forgotten what the app even did. I've done that maybe a few hundred times by now. I'm a backend guy, I'm fast at it. But fast at something boring still means doing the boring thing. So at some point I just thought: the AI already wrote the app. Why does it stop right when the annoying part starts? Why doesn't it just deploy the thing itself? The reason is it has no hands. The model can write you a perfect docker-compose file. It can't ssh into your box and run it. No connection to your server, nowhere to hold your key. So I gave it hands. It's an MCP server, vibe-deploy. You hook it up once to a VPS you own, and then you just say "deploy this to notes.mydomain.com" and the agent containerizes it, ships it over ssh, sets up nginx, gets a real Let's Encrypt cert. Node, Python, Go, plain static. It figures out the stack and writes the Dockerfile. No PaaS, no per-seat pricing, no free tier you'll outgrow. A $5 box runs a dozen of my projects and I own the whole thing. The "you gave an AI root on your server??" reaction is fair, so: it runs locally, your key never leaves your laptop. I used a separate ssh key scoped to deploys, not my real one, and you should too. It checks the server host key before connecting and validates everything you pass it, because a deploy tool that pastes your input straight into a shell is a horror story waiting to happen. I had someone audit the security before I put it out. They found two real bugs. I fixed them. It's free and MIT, on GitHub and npm as @cgnguyen/vibe-deploy . I built it because I wanted it. If you live in the same gap between "it works on localhost" and "it's online",

ᓯᐅᓇᕐᑕᖅ — Inuktitut for "that which lies ahead; a purpose" 🗣️ On the Name Full disclosure: I named this repository at 2 AM, which is probably when most repository names are decided. Siunertaq comes from Kalaallisut (West Greenlandic), a polysynthetic language — the kind where a single word can encode an entire clause's worth of meaning through agglutination and incorporation. I'm a bit of a grammar nerd, and polysynthetic languages have always fascinated me precisely because of how much structure they pack into a single morphological unit. One word carries subject, object, tense, evidentiality, and mood all at once, with none of it ambiguous if you know the grammar. That felt like the right metaphor for what this project is trying to do: pack a build graph's topology, its norm constraints, and its effect ordering into a single type-checkable unit — where the structure does the work, not the runtime. The word itself means something like "that which lies ahead; a purpose" — which seemed fitting for a tool that reasons about what needs to happen before anything actually runs. 🧵 TL;DR What if your task orchestration system couldn't even represent an ill-ordered build? Not "it would fail at runtime" — but "the type system refuses to construct the value in the first place." That's the idea behind Siunertaq : a Scala 3 project that combines Dhall (a total, non-Turing-complete configuration language), Cats Effect (purely functional async runtime), and a BSD Quiver model (directed Banach space graph) to make inconsistent build topologies structurally non-representable . This post walks through the design — with analogies aimed squarely at the Typelevel community — and closes with some thoughts on what modern AI-assisted development actually looks like when you refuse to let the LLM take the easy path. 🤔 Why Yet Another Build/Orchestration Abstraction? Most task orchestrators model their dependency graph as a mutable Map[Task, List[Task]] or similar at runtime, then check for

At Twio we picked pg-boss for our job queue, ran into trouble when we went serverless, looked at Pub/Sub, and ended up on Google Cloud Tasks. This is what each queue got right, what it got wrong for our workload, and the rule we landed on for choosing between them. The workload Twio is an AI SaaS for loan brokers. The piece that needs a job queue is email processing: download an email, parse the body and attachments, OCR, classify with an LLM, write structured data, and index for RAG. One email with five attachments easily becomes 30+ background jobs. A batch upload becomes hundreds. Why pg-boss worked — until it didn't Our database was Postgres on Neon, so pg-boss was the obvious starting point. No extra infrastructure, and one feature we genuinely loved: transactional enqueue . Because jobs live in the same database as business data, you can create a job in the same transaction as the row that triggered it. No dual-write problem, no "DB succeeded but the queue API failed" inconsistency. It also gave us retries, delayed jobs, dead-letter queues, dedup keys, and full SQL visibility into stuck or failed jobs. For a Postgres-first app on always-on infra, it's an excellent tool. Then we moved heavy processing to Cloud Run, and the cracks showed up. pg-boss polls. Neon suspends. They want opposite things. pg-boss runs a query roughly every 1–2 seconds to look for the next job, plus maintenance queries. Neon autosuspends compute when nothing touches the database. If the queue is polling every second, Neon's idle timer never expires — you pay for always-on compute even when the queue is empty. Worse, when Neon did manage to suspend, the next poll had to wake it. That wake-up takes hundreds of ms to a few seconds, and queries that triggered it would fail with Connection terminated , ECONNRESET , or timeouts. Pooled connections made it worse: the pool kept sockets that the server had already closed during suspend, and the next polling cycle picked one up and broke. This isn

I read a lot of PDFs at night, especially on my phone. And honestly, PDFs are not great for that. Most of them still feel like digital paper: white background, fixed layout, and tiny text. Dark mode helps a bit, but many tools only change the page color. The bigger problem for me was mobile reading. When the text is too small, I have to pinch zoom, move the page left and right, zoom out again, then repeat the same thing on the next paragraph. After doing that too many times, I thought: Why can’t I just read the PDF text like an article? So I built a small free tool: PDF Dark Mode It has two reading modes. Page color mode This keeps the original PDF layout, but makes the page darker and easier to read at night. I use this for scanned PDFs, tables, image-heavy documents, or files where the original layout matters. Text reading mode For selectable PDFs, the tool can extract the text and show it in a cleaner reading view. You can adjust the font size, line height, font family, and theme. This is the part I personally wanted most, because it makes mobile reading much more comfortable. Instead of constantly pinch-zooming a fixed PDF page, the PDF starts to feel more like a normal article. Privacy The tool runs locally in the browser. Your PDF is not uploaded to a server, and refreshing the page clears the current session. Try it You can try it here: PDF Dark Mode I built it for my own night reading, but I’d love to hear feedback from anyone who reads PDFs on mobile. Also, if you ever need to convert a dark PDF back to a light version, I made a related tool for that too: PDF Light Mode

In the first post I told you the story: 20 years as a developer, six months of being scared of AI, $800 in burned tokens, and a stubborn agent named Claudio who taught me — by failing over and over — how to ask for things properly. This post is the method that came out of all that pain. Five rules, one per letter of FORGE. I want to be honest about one thing up front: this is not a framework I invented at a whiteboard. Every rule here is a scar. Each one is the lesson from a specific mistake that cost me money, time, or sleep. I'm going to tell you the mistake first, and then the rule. Because the rule only makes sense once you've felt the pain that created it. Let's go. First, the idea behind all of it Here's the thing nobody told me when I started: A task is not a post-it. It's a contract. When you ask an AI agent for something with no structure, you're not giving an order — you're placing a bet. The agent interprets, assumes, improvises, and the result depends on how much context it managed to reconstruct on its own. Sometimes it guesses right. Often it doesn't. And you only find out after the tokens are gone. The Forge Method is the agreement between you and your agents: you bring the structure, they execute with precision . That's it. Five rules to hold up your end of that contract. F — Focused The mistake: My early tasks had titles like "Fix bug" and "Update stuff." I'd come back twenty minutes later to find the agent had fixed a bug — just not the one I meant. It wasn't wrong. It just had no way of knowing which thing I was talking about. **The rule: **If the title is vague, the task is vague. Vague in, vague out. A focused title needs a domain, an action, and a scope. Two words minimum, and no generic placeholders. ❌ Rejected: - "Fix bug" - "Update auth" - "Do the thing" ✅ Accepted: - "Fix authentication timeout on Nginx reverse proxy" - "Update JWT expiry from 1h to 24h in src/auth/config.ts" The test: Read the title with no context. Do you know the domain,

A Google Sheets add-on with 4 million installs has been silently sending your spreadsheet cell data to OpenAI. Hacker News discovered this 9 days ago, when a PromptArmor security report went viral. Last night — when any normal HN story would be decaying into oblivion — it exploded a second time, gaining 59 points and 23.9% in a single day. I track Hacker News every day. I've seen 518 posts come and go over 319 days of systematic monitoring. Most stories follow a predictable death curve: peak on Day 1, bleed points for 2–3 days, then vanish from the Algolia search layer entirely. A post that survives 5 days is exceptional. One that accelerates on Day 9 is something else entirely. Here's the trajectory: 104 → 106 → 148 → 199 → 219 → 247 → (gap) → (gap) → 306 points. Over 9 days, that's a +194.2% total gain. But the real story is the shape of the curve. From Day 5 to Day 6, it added 20 points. From Day 6 to Day 7, roughly 28. Then on Day 9, it jumped 59 points — a single-day increment that's 2–3x the earlier daily gains. 109 comments and counting. This isn't normal HN physics. This is a second wave of attention — the kind that happens when a story percolates through social media and circles back to the search layer with amplified urgency. People didn't just read this and move on. They came back. The vulnerability itself is brutally simple: ChatGPT for Google Sheets, a popular add-on that lets you use GPT inside spreadsheets, sends cell contents to OpenAI as part of every API call. The PromptArmor research documented specific data flows — workbook data that users never intended to share, flowing to OpenAI's servers as part of "context." No breach required. No malicious actor. Just the plugin working as designed, with a data-sharing envelope nobody bothered to read. I've spent 319 days cataloging every AI security signal that hits HN's front page. Patterns emerge when you watch this long. The data is unambiguous: application-layer AI security is the most underserved mark

Let me start with a confession: I'm a data scientist who's been burned by hype more times than I care to admit. When everyone told me "Model X is the next GPT-killer," I'd run my own benchmarks and find... well, let's just say the results were rarely as advertised. So when I started seeing claims about Chinese AI models catching up to (and sometimes surpassing) Western counterparts, I did what any self-respecting data nerd would do: I put them through my own rigorous testing pipeline. Over the past three months, I've run over 2,000 API calls across four major Chinese model families — DeepSeek, Qwen, Kimi, and GLM — using Global API's unified endpoint (more on that later). I tracked latency, token costs, output quality across multiple benchmarks, and even threw in some real-world tasks that mattered to me personally. Here's what I found, with all the numbers you'd expect from someone who still gets excited about statistical significance. The Testing Methodology (Because Anecdotes Aren't Data) Before we dive into results, let me be transparent about my approach. I ran each model on the following standardized tests: Code Generation : HumanEval (Python) and MBPP (multi-language) — 164 problems total Reasoning : GSM8K (math word problems) and MMLU-Pro (general knowledge) — 1,200 questions Chinese Language : CLUE benchmarks (text classification, NER, reading comprehension) — 3,500 samples English Language : LAMBADA and Hellaswag — 2,000 samples Speed : Average tokens per second over 100 consecutive requests with consistent prompt lengths I also tested vision tasks where applicable, but let's be real — Kimi doesn't support vision at all, and DeepSeek's implementation is... experimental at best. More on that later. All tests were conducted using the same global-apis.com/v1 endpoint, which normalizes API compatibility to OpenAI's format. This isn't an ad — I genuinely found it made my testing easier because I could swap models without rewriting code. The Big Picture: Pricing

I am considering switching from Contentful to a different headless CMS platform and I have noticed that a lot of them are self hosted. It seems like Sanity, Prismic, and Strapi all require you to create a project locally, then (at least in the case of Sanity) deploy the project for editors to use. Is this something people want? Maybe I haven't used it enough, but I don't really see the point of doing it this way. I have created a Sanity project locally and it seems I can't even edit the Studio dashboard, I can just define my types there and deploy. Why would the CMS provider not just host the UI (that they built anyway) themselves? submitted by /u/darkshadowtrail [link] [留言]

I need to share my misery with someone. Hope you get a laugh out of this. About a year ago, I built a web app for a client. Let's call her Karen. She loved the UI; she loved the functionality - every meeting was a joy. She was shit-kickin happy. I have 10 months of emails from her saying stuff like "it's like you're in my head! You get it exactly!" She even paid me extra for new functionality that she came up with halfway through. Then, after I had delivered everything she asked for (and signed off on), I demonstrated the finished app to her and her staff, and I thought it went well. I kept asking her when she wanted to launch it - crickets. Then she called me two weeks later, saying that one of her employees was still using her old system and asking Karen why. Apparently, the employee said that what we built didn't meet her needs... no details. So then Karen lays into me and says that what I built her is worthless and we need to start over. This is just out of the blue; absolutely no complaints until then. She was literally screaming on the phone. My wife heard this because I put her on speakerphone. I told Karen, " Hey, I'm sorry, but you have never said you weren't happy or that anything was wrong. I can't start over. I have to pay my staff to start over. If we did something wrong, I would cover the cost - but I built what you asked for, and I have many emails and Zoom calls recorded where you were happy." Then I don't hear from her for about four months, and she sent me this nasty-ass email saying that I screwed her over, used templates off the web (not true), and she wanted $45k in compensation (more than she paid) - or - make up for it by redesigning her Claude designs for her other stuff. "I did it on the weekend in 2 hours, I don't know why you developers charge so much!" She would never win a lawsuit. I forwarded everything to my attorney - and he laughed. He said, "No way she can build a case. But try to settle with her and do what she asks; it's not worth

Please post your personal projects, startups, product placements, collaboration needs, blogs etc. Please mention the payment and pricing requirements for products and services. Please do not post link shorteners, link aggregator websites , or auto-subscribe links. -- Any abuse of trust will lead to bans. Encourage others who create new posts for questions to post here instead! Thread will stay alive until next one so keep posting after the date in the title. -- Meta: This is an experiment. If the community doesnt like this, we will cancel it. This is to encourage those in the community to promote their work by not spamming the main threads. submitted by /u/AutoModerator [link] [留言]

Did you ever just want to see what ChatGPT, Gemini, Claude, etc., would say to your prompt at the same time?!? These guys figured it out. They have all the responses in their own column to the prompt you gave. Its freaking amazing. They offer a discounted rate through one vendor. If you want me to post it let me know. I don't want this post removed so I'm not putting it in this main post. Check it out on their actual site though. AIfiesta.ai I stumbled on this one and am really glad I did. This is not self promotion. I have nothing to do with this app except using it daily. submitted by /u/ActiveUpstairs3238 [link] [留言]

submitted by /u/ThereWas [link] [留言]

The Next Era of Knowledge Work report explores how Codex is transforming productivity through AI-powered research, data analysis, workflow automation, and content creation.

ASUS revealed new convertible Windows laptops and three Zenbook 14 models with ARM64 and x86 processors.

79% of enterprises have adopted AI agents. Only 11% run them in production. We've spent the past year building agent systems for banks, clinical operations teams, and engineering orgs. The problem isn't that agents don't work — they work fine. The problem is that every framework leaves compliance, cost governance, and crash recovery as exercises for the team. After the framework fails them in production. We built MeshFlow to close that gap. **The core idea:** treat governance as infrastructure, not middleware. Every agent step passes through a 15-step kernel that handles identity, rate limiting, budget enforcement, compliance profiles, input/output guardrails, PII detection, risk classification, tool permission, the LLM call itself, audit ledger write, and SLA recording — in that order, always, without configuration. ```python from meshflow import Workflow, CostCap, Agent wf = Workflow(cost_cap=CostCap(usd=5.00)) wf.add(Agent('researcher'), Agent('analyst'), Agent('writer')) result = wf.run('Write a competitive analysis of our market') # Compliant. Durable. Audited. Cost-capped. Done. ``` ```bash pip install meshflow ``` **What's technically interesting:** **Token optimization layer** — five compounding mechanisms that reduce LLM spend 70-85%: - `cache_control` on every system prompt and tool definition (Anthropic: 10% of normal price on cached tokens) - `ModelRouter`: task-type classification routes simple tasks to nano models (keyword + token-count heuristic, zero LLM call) - `ContextCompactor`: sliding window summarization activates at configurable token threshold - `RAGTokenBudget`: hard `max_chars` cap on knowledge injection with truncate/drop/tail strategies - `ContextDeduplicator`: shared context sent once for N parallel agents, not N times **SHA-256 audit chain** — each step record stores `prev_hash` (SHA-256 of the previous record) and `entry_hash` (SHA-256 of its own canonical fields). Modify any log entry and `verify_chain()` breaks. This is the artifact

Hey ML community, We’ve just open-sourced **MeshFlow** , a code-first, framework-agnostic runtime designed for governing and optimizing multi-agent systems in production. Most agent frameworks focus on rapid prototyping, but ML and platform engineering teams usually run into hard bottlenecks around LLM cost scaling, evaluation alignment, and execution safety. MeshFlow tackles these from a runtime/infrastructure perspective. Here are the key ML and system features: * **Task-Based Model Routing** : Before an agent executes a node, MeshFlow runs an evaluation on task complexity, routing the execution to one of four model tiers (`nano`, `small`, `medium`, `large`). This cuts overall API costs by 50-60% by utilizing smaller local models (e.g. LLaMA-3-8B) for standard formatting or extraction and reservation of frontier models (e.g. Claude Opus) for high-complexity reasoning. * **Context Compactor & Summary Pruning Middleware** : Implements sliding window summarization and context deduplication across parallel agent teams to limit prompt length growth. * **System Prompt Caching** : Native injection of Anthropic `cache_control` tags when system prompts exceed 1024 tokens. * **Cost Regression Evaluation Gate** : Integrates with CI pipelines to evaluate agent changes against a golden scenario baseline, throwing failures if code updates introduce token cost regressions. * **Resilient State Persistence** : Multi-backend state serialization (Redis, PostgreSQL, S3) that preserves checkpoint frames and allows resuming paused workflows. Here is the basic API contract: ```python from meshflow import Workflow, Agent, CostCap wf = Workflow(cost_cap=CostCap(usd=5.00)) wf.add(Agent('researcher'), Agent('critic'), Agent('writer')) result = wf.run('Compile comparative literature review of LLM reasoning pathways') print(result) ``` We'd love to discuss: 1. How do you handle token budget enforcement and model routing in your agent loops? 2. What evaluation pipelines do you use to detect co

A security reviewer finds a critical issue a day or two before the release of an application. While it's an important issue, it sets the team back weeks, frustrating their product management partners and customers. The review came at the most expensive time in the process. There are many examples of how work items move through different processes to deliver software in large companies. While GenAI has allowed us to rapidly create code, it also moved and exposed the bottlenecks in our processes. It has also caused us to re-examine where it is most effective to make certain decisions. This is the challenge, and a deliberate blend of automated, programmatic, and human judgment is well suited to help you solve it. We can borrow from the well-trodden path of value stream mapping here. It is useful for spotting bottlenecks and waste in a given process, but it's also valuable to ask the deeper question of who or what should own each step. Each option earns its place differently. Is there an earlier step that may reduce costs with an agent where it was previously limited by human availability? Or is the stronger determinism of a programmatic step more important for a critical piece of the flow? Some decisions should stay with human judgment, where confidence without context is a liability. The opportunity for security teams and other stakeholders is to scale their impact across these options rather than scaling headcount. Workflow-as-code is not a new idea. There are a number of existing engines where the workflow definition is its own entity, separate from the work itself. GitHub Actions defines pipelines in version-controlled files, while the execution happens on separate runners. Airflow and Temporal follow a similar pattern for data and application workflows. Because the definition lives on its own, a team can change how a given step runs without rebuilding the whole flow. That separation is what makes it practical to adjust who or what owns each step over time. Rather