AI 资讯

Lithium battery packs are only as strong as their weakest cell. Whether you're designing a drone battery, an EV pack, or an energy storage system, cell balancing plays a critical role in battery safety, lifespan, and performance. But many developers and hardware engineers still confuse passive balancing and active balancing , or underestimate how important balancing becomes in multi-cell lithium systems. In this article, we'll break down: Why battery balancing matters What causes cell imbalance How passive balancing works How active balancing works Engineering trade-offs between both methods Where each balancing strategy is commonly used 1. Why Battery Cells Become Unbalanced In theory, every lithium cell inside a battery pack should behave identically. In reality, that never happens. Even cells from the same production batch will have slight differences in: Internal resistance Capacity Self-discharge rate Temperature response Aging characteristics Over time, those small differences accumulate. For example: One cell may charge slightly faster Another may discharge deeper One may heat up more under load Eventually, the pack voltage becomes uneven. This is called cell imbalance . 2. Why Cell Imbalance Is Dangerous Imagine a 4S lithium battery pack. If one cell reaches 4.25V while the others are still at 4.10V, the charger must stop to avoid overcharging that single cell. That means: The entire pack never reaches full usable capacity Weak cells age faster Heat generation increases Safety risks become higher The same problem happens during discharge. If one cell drops below the minimum safe voltage earlier than others, the BMS cuts power to protect the pack — even though the remaining cells still contain energy. In other words: A battery pack is limited by its weakest cell. 3. What Is Battery Balancing? Battery balancing is the process of equalizing cell voltages inside a battery pack. The goal is simple: Prevent overcharge Prevent over-discharge Improve pack lifespan I

As developers, indie hackers, and solo founders, we launch numerous static sites, minimal landing pages, and open-source project documentation blocks. Every single one of these deployments shares a universal prerequisite: a reliable path to gather raw incoming user feedback, inbound sales leads, or bug reports. The traditional path of least resistance has long been to embed a hardcoded HTML <form> inside our page, or worse, expose a standard mailto: link. However, we all know what happens next. Within hours of your app hitting public hosting servers or GitHub, automated asynchronous spam bots find your raw source code, harvest your personal email address, and turn your inbox into a living nightmare. I used to spend hours configuring captchas, writing honey-pot filters, or spinning up custom Serverless Lambda routines just to secure a simple contact form. Eventually, I realized I was fighting the wrong battle. The best way to protect your inbox isn't to build a better shield around your frontend form; it's to remove the form from your code entirely. That is why I built FormCrab.com . 🦀 The Problem: Why Client-Side Forms are a Risk When you embed a custom form or mailto link into your landing page, you are effectively publishing your communication architecture to the world. Spam bots don't even need to render your page anymore; they use basic regex scrapers to crawl through millions of raw static HTML repositories looking for keywords like type="email" or action="..." . Once your endpoint or raw email identity is captured, it is added to bulk programmatic marketing lists. The Trade-Off We All Hate: Option A: Spin Up a Custom Backend. Configuring an Express or Spring Boot API routing layer solely to act as an authenticated SMTP relay. This adds infrastructural complexity and database burdens to what should be a 15-minute frontend project. Option B: Use Form Backends. Even if you use a standard form endpoint handler, you still have to code the frontend UI, handle valida

"The output filter runs after the LLM has already seen the confidential data. By then, three classes of leak can no longer be stopped. The right surface is retrieval. Walking through a real implementation." TL;DR Most RAG-with-RBAC stacks I see in production put the access-control gate at the output stage: an LLM-response post-filter that masks PII or redacts confidential strings. This is defense-in-depth, not the load-bearing layer. By the time the filter runs, the LLM has already received the confidential context, and three classes of leak — creative paraphrasing, inference, cross-turn persistence — can no longer be stopped by string-matching the output. The protective surface that actually carries the weight is retrieval-stage ABAC: documents and graph nodes the user can't read are never traversed, never make it into the prompt, never seen by the model. The output filter still belongs in the stack, but as the second-to-last line, not the first. This post is a walk through why and how, with code references from a working implementation. It was prompted by a 6-turn LinkedIn DM exchange with Ali Afana (Provia founder, dev.to Featured) on injection-fixture schema design, where the framing crystallized. The seductive default You build a RAG system. You have documents at different sensitivity levels — public, internal, confidential. You want the model to answer based on whichever documents the user is allowed to see. The default mental model: "I'll let the model answer freely, and then I'll filter the response on the way out." This is appealing because: The retrieval pipeline stays simple (one query, one vector search, one response) The access control feels surgical (just before the user, just before damage) The PII-mask vocabulary is well-established (Presidio, regex catalogs, named-entity recognition models) So you wire up something like: Python The seductive default def answer(query, user): chunks = retrieve(query, top_k=10) # No ABAC here context = "\n".join(c.text

你知道吗？GitHub 上有一个 6,870 Stars 的开源项目，它自称是「MCP 服务器的 App Store」。但大多数开发者只知道用它查服务器名字，却完全忽略了它的 5 个隐藏用法——这些用法能彻底改变你构建 AI Agent 工作流的方式。 这个项目叫 MCP Registry（modelcontextprotocol/registry），2025 年 9 月正式上线，是 Model Context Protocol 官方社区维护的 MCP 服务器目录。到 2026 年，它已经成为 MCP 生态系统的核心基础设施——但 90% 的开发者仍然只用它做一次性查询。 今天我来揭示 MCP Registry 的 5 个隐藏用法，这些用法在 2026 年将决定你能否构建真正智能的 AI Agent 工作流。 隐藏用法 #1：动态工具发现端点（像 npm 一样查询 MCP 服务器） 大多数人的用法： 手动打开 registry 网站，找到想要的服务器，复制安装命令，结束。一次性查询，没有后续。 隐藏技巧： MCP Registry 提供了一个完整的 REST API（ registry.modelcontextprotocol.io/docs ），MCP 客户端可以在运行时动态查询可用工具——不需要在代码里硬编码服务器 URL。 为什么这在 2026 年很重要： MCP 服务器正在爆发式增长（官方 modelcontextprotocol/servers 仓库有 86,424 Stars），静态工具列表已经无法维护。Registry API 让你的 Agent 可以在需要时动态发现工具——就像包管理器发现 npm 包一样。 代码示例： import requests , json # 通过 Registry API 查询某个分类下的所有服务器 def discover_mcp_servers ( category = " web " ): base = " https://registry.modelcontextprotocol.io/v0 " resp = requests . get ( f " { base } /servers " , timeout = 15 ) if resp . status_code == 200 : servers = resp . json () # 按分类动态过滤 filtered = [ s for s in servers if category . lower () in s . get ( " tags " , [])] return filtered return [] # 发现所有 web 相关的 MCP 服务器 web_servers = discover_mcp_servers ( " web " ) print ( f " 发现 { len ( web_servers ) } 个 web MCP 服务器 " ) for s in web_servers [: 5 ]: print ( f " - { s [ ' name ' ] } : { s [ ' description ' ] } " ) 效果： 你的 Agent 可以动态发现并使用网页自动化工具（浏览器、API 测试、爬虫），无需你预先安装任何东西。工具发现成为 Agent 运行时逻辑的一部分。 数据来源： MCP Registry API 在 registry.modelcontextprotocol.io 确认可访问（HTTP 200，2026-05-29）。Registry 自述文件称其为「MCP 服务器的应用商店」。 隐藏用法 #2：服务器可信度评分（在安装前验证维护状态） 大多数人的用法： 随便选一个看起来合适的 MCP 服务器，不管维护状态。 隐藏技巧： MCP Registry 为每个服务器追踪关键元数据：最后更新时间、维护者信誉、GitHub Stars、以及是否经过 Anthropic「官方验证」。你可以在安装前程序化地获得可信度信号。 为什么这在 2026 年很重要： MCP 生态正在爆发，社区服务器质量参差不齐——有些维护活跃，有些已被放弃。Registry 的元数据让你可以在将服务器接入 Agent 管道之前程序化地构建「可靠性评分」。 代码示例： import requests from datetime import datetime , timedelta def score_server_trust ( server_name ): base = " https://registry.modelcontextprotocol.io/v0 " resp = requests . g

Think of it as the "npm for AI agents" — but most developers still don't know it exists. The Model Context Protocol Registry (modelcontextprotocol/registry, 6,870 GitHub Stars) launched in September 2025 as a community-driven catalog of MCP servers. By 2026, it has become the backbone of the MCP ecosystem — yet 90% of developers are only using it as a simple lookup tool when they're missing its most powerful hidden capabilities. In this article, I reveal 5 hidden uses of the MCP Registry that will completely change how you build and deploy AI agent workflows. Hidden Use #1: The Registry API as a Dynamic Tool Discovery Endpoint What most people do: They manually browse the registry website, find a server they like, copy the installation command, and move on. This is a one-time lookup. The hidden trick: The MCP Registry exposes a full REST API at registry.modelcontextprotocol.io/docs that MCP clients can query dynamically at runtime to discover available tools — without hardcoding server URLs in your code. Why it matters in 2026: With the explosion of MCP servers (the official modelcontextprotocol/servers repo has 86,424 Stars), static tool lists are impossible to maintain. The Registry API lets your agent discover tools on demand, the same way a package manager discovers npm packages. The code: import requests , json # Query MCP Registry API for all servers in a category def discover_mcp_servers ( category = " web " ): base = " https://registry.modelcontextprotocol.io/v0 " resp = requests . get ( f " { base } /servers " , timeout = 15 ) if resp . status_code == 200 : servers = resp . json () # Filter by category/tag dynamically filtered = [ s for s in servers if category . lower () in s . get ( " tags " , [])] return filtered return [] # Discover all web-related MCP servers web_servers = discover_mcp_servers ( " web " ) print ( f " Found { len ( web_servers ) } web MCP servers " ) for s in web_servers [: 5 ]: print ( f " - { s [ ' name ' ] } : { s [ ' description ' ]

OpenAI launches Rosalind Biodefense, expanding trusted access to GPT-Rosalind for vetted developers and U.S. government partners advancing biodefense, public health, and pandemic preparedness through frontier AI.

Successful developers, question above. How much time do you devote to web dev/programming/learning outside of your regular working hours? How much time do you spend involved in the web-dev-sphere and absorbing knowledge and/or discussing with others? I was browsing remote jobs and came across one that seemed pretty cool but in the application , just the application that you fill out to see if they are interested, they asked mandatory/required questions like " What’s an idea, book, blog post, or talk that recently changed how you think about your craft?" and "What’s a controversial or unpopular opinion you hold about software engineering, and why?" I've been a webdev for 15 years and I don't even know how to answer either of those questions. None? I read daily posts and blogs about webdev (subbed to TLDR) but I haven't read anything mindblowingly earthshattering to change how I think about web dev. Am I just not devoting enough time outside of work to "the craft"? Am I supposed to spend 15+ hours a day thinking/reading/discussing web dev? *HONEST QUESTION, NOT A RANT OR COMPLAINT. I honestly want to know if I need to be doing more?* submitted by /u/X5455 [link] [留言]

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Real-time AI captions and translation for any browser video Discussion | Link

The best AI tools for conversion rate optimization (CRO) in 2026 are the platforms that continuously...

At a previous job I worked at as a Dev we had someone who ran Semgrep on our codebase for the first time. It came back with 180 findings. We had no security engineer. The developer who ran it looked at the output, closed the terminal, and we never ran it again. That's not a story about a careless team. That's a story about a tool that produced output most teams in small companies with no expertise knew what to do with. I've seen this exact moment happen more times than I can count working with small dev teams. And it's the reason I spent the last year building SecOpsium. But before I get to that let me explain the actual problem, because I think it's misunderstood. The problem isn't the scanning Semgrep and Gitleaks are excellent tools. They're free, actively maintained, and genuinely powerful. If you're not using them you should be. The problem is what happens 10 minutes after you run them. You get 200 findings. Some are critical. Some are test files. Some are commented-out code from 2021. Some are legitimate secrets. Some are variable names that pattern match against a rule but contain nothing sensitive. They all look the same in the output. Now you're a developer who also does DevOps, also reviews PRs, also handles incidents, and you're staring at 200 items with no clear indication of which three actually matter this week. So you close the terminal. Or you create a Jira ticket labeled "security findings" that lives in the backlog forever. Or you spend two days triaging manually and burn out before you fix anything. This is the real problem. The scanning was never the hard part. Why rule based scanners produce so much noise It helps to understand technically why this happens. Semgrep and Gitleaks are rule-based. They match patterns. A variable named api_key_example in a test file flags the same way as a live Stripe key in an active production config. Gitleaks scans for entropy and known credential patterns but can't distinguish between a key that was rotated and r

I've been working on something others might find interesting. It's under heavy development as I learn. Most AI agent setups treat the model like a better autocomplete — paste a prompt, get output, hope it's right. That works for small tasks. It falls apart when you try to use agents for sustained work across sessions: they skim specs, declare victory at 60%, burn context on noise, silently resolve ambiguity without surfacing it, and mark checklist items done without actually doing them. The failures are predictable and nameable — so I named them. This is a white paper and implementation guide for a full-stack agentic system — everything from planning through promotion under structural enforcement. It documents 24 failure modes from months of multi-agent operation and, for each, describes what actually prevents it: some through mechanical gates the agent cannot skip, some through procedural skills, and some through human supervision. The guide covers how to structure specs, plans, and verification so that agent work is evidence-led rather than vibes-led, how to use MCP capability surfaces as structural levers, and how the failure modes apply regardless of which model or vendor you use. The white paper also includes a Related Work section that positions it against the emerging industry consensus — CodeRabbit, Anthropic, Spotify, Cloudflare, OpenAI, Karpathy, Thoughtworks, and academic research all independently arrived at pieces of the same conclusions. The difference here is the integrated stack: a failure taxonomy mapped to prevention mechanisms, a three-layer enforcement architecture, and a concrete reference implementation with an orchestrator, task graphs, step verification, adversarial review, and model stratification. White paper: https://gitlab.com/naive-x/naive-artifact-coding/-/blob/main/white-paper.md Reference implementation: https://gitlab.com/naive-x/naive-artifact-coding/-/blob/main/docs/reference-implementation-guide.md Implementation guide: https://gi

submitted by /u/Hot-Upstairs9603 [link] [留言]

The enterprise AI search startup tripled its annual revenue even as tech giants entered the category.

The most downloaded and widely used methodology in the Claude Code ecosystem is Superpowers , with over 208k stars⭐️ and 18.5k forks🍴 on GitHub (and counting!) Going from raw Claude Code to using Superpowers is as revolutionary as going from a manual transmission to an automatic. Here's why this analogy holds: Planning Mode vs. Coding Mode When we build with Claude (or Codex, or Gemini...), we're usually in one of two states: planning mode coding mode Like shifting gears in a car🚘, moving between these modes effectively is what makes it all work. Skip the shift, and you're just revving your engine (aka burning context and going nowhere.) Superpowers lets Claude automatically detect and shift between these modes. It picks up on ambiguity in your prompt and ensures it fully understands the task before entering coding mode. No manual shifting required! Slower, but for Good Reason Superpowers can feel slower and less satisfying than raw Claude Code, like how driving an automatic can feel less engaging than a manual. But both serve the same critical purpose: they stop you from blowing up your engine! That said, there's still a time and place for raw Claude. Sometimes you want direct, fast, unmediated output. But that minor gain in speed often isn't worth the added complexity, the ambiguity risk, and the tradeoffs that come with it. The Layer Underneath Entire is building the foundation beneath all of this — capturing every session and decision, and linking it to the commit it produced. It's the full record of how the code was written, not just the code itself. So the question is this: how will you put your agent in drive🚘?

I had a screenshot to send. Nothing secret — a stack trace from a side project — but it had an internal hostname, a file path with my username, and a chunk of a config file in the terminal behind it. The fast move is to drag it onto a free image host and paste the link. I sat there with my cursor over the upload button and couldn't do it. Because I know what happens next. That image lives on someone else's infrastructure, indefinitely, behind a URL I don't control, and I have no idea who else can reach it. For a throwaway screenshot, that's a permanent record I never agreed to. So I closed the tab and built a thing instead. It's called tmpdrop , and it's ~500 lines of Node. The threat model The problem with public file hosts isn't that they're evil. It's the gap between what you intend ("share this once, with one person") and what the platform delivers ("store this forever, serve it to anyone who finds the link"). A few specific things go wrong: Retention. "Temporary" hosts keep your files long after you've forgotten them. There's no expiry you can trust, and deletion is usually best-effort. Predictable URLs. Plenty of hosts use sequential or short IDs. Scrapers walk the keyspace and hoover up everything. Your "private" link was never private. Stored XSS via uploads. If a host serves an uploaded .html or .svg file inline with a permissive content type, an attacker can ship JavaScript that runs in your browser, in the host's origin. Your file host becomes an XSS delivery service. Abuse vectors. No rate limit means the box is a free CDN for whatever someone wants to dump on it — malware, spam payloads, the works. So the design goal wasn't "another uploader." It was: close each of those gaps, then stop. What I built tmpdrop is a single Fastify server backed by SQLite. The whole defensive surface is small enough to hold in your head: Unguessable URLs. Slugs are 9 random bytes, base64url-encoded — 72 bits of entropy. You cannot enumerate them. A TTL reaper. Every upload

Today I discovered something I honestly should have explored a long time ago: Google Lighthouse. Funny enough, revamping my portfolio is one of those projects I kept pushing forward with the classic “I’ll do it tomorrow” mindset — and somehow tomorrow kept winning. But today I finally sat down and started improving it, and during that process, I came across Lighthouse. For anyone who hasn’t heard of it yet, Google Lighthouse is an open-source automated tool designed to help developers improve the quality of web pages. You can run it on almost any page — whether it’s public or behind authentication. What immediately caught my attention is that it audits things like: Performance Accessibility SEO Best Practices And probably a few more things I’m still discovering You can run Lighthouse directly inside Chrome DevTools, through the command line, or even as a Node.js module. The process is simple: You give Lighthouse a URL, it scans the page, runs a series of audits, and then generates a detailed report showing how your website performs. What makes it powerful is that it doesn’t just tell you what’s wrong it also explains: _ Why the issue matters How it affects users And how you can fix it _ As a beginner software engineer and developer, I’m slowly realizing that writing code is only one part of building great applications. Performance, accessibility, maintainability, and user experience matter just as much. And honestly, tools like Lighthouse make the learning process feel less overwhelming because they point you in the right direction. One thing I’ll say though don’t fall into the trap of chasing a perfect Lighthouse score instead of building useful projects. A lot of developers start optimizing numbers before validating whether the product itself solves a real problem. Lighthouse is a guide, not the final goal. For my portfolio specifically, Lighthouse exposed a few weaknesses immediately: Large unoptimized images Accessibility issues Slow-loading assets Missing metad

MikuMikuDance still lives mostly on the desktop: PMX models, VMD motion, skirt physics, camera work. We built AnimaStage Lite — an open-source browser studio so you can load assets, preview motion, add FX, and export vertical Shorts without installing MMD. 🔗 Repository: https://github.com/FBNonaMe/animastage-lite 🌐 Live demo: https://animastage-lite.app/ 🎬 Open the studio: https://animastage-lite.app/app Why the browser? Short-form creators need: 9:16 framing and 1080×1920 export Fast PMX + VMD iteration Stable WebGL on everyday laptops AnimaStage Lite is not a full MMD clone — it’s a focused stage : load, animate, light, record. Stack Layer Tech UI React 19 + TypeScript 3D Three.js + React Three Fiber Build Vite 6 Physics Bullet (Ammo.js) HQ video WebCodecs + mp4-muxer Live video MediaRecorder All core features run client-side . What it does Drag & drop PMX/PMD, VMD, textures, HDR Timeline + dopesheet + Bézier curves + VMD export Bullet physics — skirt, hair, accessories RTX Lite — bloom, DOF, weather, style presets MP4 HQ (frame-by-frame) and Live recording Clean capture — no gizmos in the final video 9:16 Lite — lighter render path to reduce WebGL context loss Optional: MediaPipe mocap, Gemini AI keys, Local/WebRTC collab. Try it Online: https://animastage-lite.app/app — drop your PMX + VMD. Locally: bash git clone https://github.com/FBNonaMe/animastage-lite.git cd animastage-lite npm install npm run dev https://animastage-lite.app/ — landing http://localhost:3000/app — studio (local) Optional AI: copy .env.example → .env and set VITE_GEMINI_API_KEY. Open source Star ⭐ the repo, open issues, send PRs: https://github.com/FBNonaMe/animastage-lite MMD models are not bundled — use only content you have rights to publish. What would you use this for — Shorts, VTuber previews, or learning Three.js? Comments welcome. ---