AI 资讯

Next month's Tribeca Festival will include the premiere of an AI-generated film: Dreams of Violets. The 75-minute film is a fictional dramatization of the Iranian government's mass killing of protestors in January, with the people and images fully created by AI, as reported earlier by The Hollywood Reporter. Dreams of Violets cost $2,000 to make […]

I'm not sure if I'm in the right place to ask this, but I need to create a web application, and am looking forwhat stack might be best suited.. So far, SurveyJS seems to tick all the boxes, but I have zero experience with the stack. Another one is Flask/Waitress and JS. Ultimately, this will all have to run off a docker host.. I need it save form data, ideally in something like MariaDB, so the user can pick a form the previously filled out and edit it. Multiple users will be using it, authentication is being handled elsewhere, but everyone should be able to see/edit everyone elses' data.. This is a "nice to have", but is there a functionality to export the form data to XML? The app we're looking at building needs to be able to as a question like "How many cars have you driven", and then from that answer create a section or a sub-form for each car that would ask other questions about the cars. I don't mind throwing a bit of money at this, looking at all-in-one options like FluentForm if that ticks all the boxes Thanks so much! submitted by /u/the_zipadillo_people [link] [留言]

Did you know that a 35-billion-parameter model can generate tokens at the same compute cost as a 4B model? That single fact made me abandon a multi-model agent architecture I'd spent a weekend building. But I had to run the benchmarks first to understand why. Here's the full breakdown, with commands, numbers, and the architectural reason it all falls apart on shared-memory hardware. The Discovery That Changed Everything I'd been running qwen3.6:35b on my Minisforum UM790Pro for weeks as my daily coding assistant. 17.8 tokens/second -- genuinely usable for interactive work. But I kept wondering: could I run a lightweight sidecar model alongside it for quick classification and tool-calling in an agent pipeline? Before I even started benchmarking, I dug into what qwen3.6:35b actually is under the hood. It's a Mixture of Experts model: 256 total experts with only 8 activated per token. The architecture also incorporates SSM (State Space Model) components alongside traditional attention -- Mamba-style layers that handle certain sequence patterns more efficiently than pure transformers. The math hit me: 8 out of 256 experts means each token only touches roughly 4-5B parameters worth of compute. The model carries 36 billion parameters of knowledge , but its per-token cost is comparable to a small dense model. I was planning to run a separate 4B model for "fast tasks" next to a model that already operates at 4B-class speed. But I had to prove it with numbers. Hardware and Ollama Setup The UM790Pro specs that matter for this experiment: CPU: AMD Ryzen 9 7940HS (Zen 4, 8C/16T) iGPU: AMD Radeon 780M (12 RDNA 3 compute units) RAM: 96 GB DDR5-5600 (~80 GB/s bandwidth) GPU memory pool: 2 GB dedicated VRAM + 46 GB GTT = 48 GB GPU-accessible That 48 GB GPU pool sounds enormous until you realize it's carved from the same DDR5 that the CPU also uses. There is no separate GDDR6 bus. Everything -- CPU inference, GPU inference, KV caches, OS operations -- flows through one 80 GB/s pipe.

OpenSparrow v2.6 is out. This one's a big step forward — RAG (Retrieval-Augmented Generation) integration, bulk grid operations, and a whole new UX layer. RAG & AI integration You can now upload documents and let users ask questions against them. The system retrieves relevant sections and generates answers using an LLM (supports Ollama locally or any OpenAI-compatible API). What's new: RAG Statistics tab in admin — tracks query tokens, response times, document matches, and recent queries Multilingual auto-response — user questions are answered in their own UI language, no schema changes needed 20-language support — "Ask AI" panel fully translated, plus language dropdown in the test interface Good for things like: knowledge base Q&A, customer support automation, or letting internal teams ask questions about their own data. Grid & bulk operations Mass Edit module — select rows via checkboxes, bulk edit fields, change owners, duplicate, or delete with one click Keyboard shortcuts — arrow keys to navigate, Tab, Ctrl+C to copy, Ctrl+F to search, Ctrl-hold for help modal — works across all 20 languages Quick Data Cleanup toolbar — find & replace with live preview, case sensitivity, accent-ignore. Editor-gated with audit trail. Admin improvements Renamed "RAG Knowledge Base" to "Centrum AI" (heading is translatable) Migration Manager — tracks pending cleanup tasks after version upgrades, with automatic backups and audit trail FK columns render as dropdowns in forms by default Security & Quality All bulk operations (mass edit, cleanup, delete) are editor-role gated CSRF protection on every operation Full audit trail — every change is logged 20 languages fully supported across all new modules Fixed regressions in RAG API and CSV import Following this series? OpenSparrow v2.3 – visual admin panel, zero dependencies, now with ERD and M2M support OpenSparrow – open-source admin panel builder, zero dependencies, v2.1 just dropped Websites opensparrow.org github.com/wrobeltomasz/

One poisoned extension, one package install, one CI workflow. Any of them can now be the first domino. That is the uncomfortable lesson from the latest Shai-Hulud activity and GitHub’s recently confirmed internal-repository breach. The scary part is not only the number of affected packages, tokens, or repositories. Counts move fast. The scarier part is where the attacker code ran: inside the trusted developer and CI path. The modern supply chain is not just “the dependencies we ship to production.” It is your IDE, your package manager, your GitHub Actions runner, your cache keys, your OIDC flow, your local gh auth, your AI coding tool config, and the cloud account that quietly pays the bill when something goes sideways. What happened, briefly CISA described the original Shai-Hulud wave as a self-replicating npm worm that compromised more than 500 packages and targeted GitHub personal access tokens plus AWS, GCP, and Azure keys. GitHub later said it removed 500+ compromised packages and began pushing npm toward shorter-lived credentials, 2FA enforcement, and trusted publishing. The later waves got more CI-aware. Instead of only stealing npm tokens from maintainers, they looked for credentials inside build environments, abused publishing workflows, and used the build system itself as distribution. Microsoft’s May 2026 reporting on the @antv ecosystem described a “Mini Shai-Hulud” style campaign that targeted GitHub Actions environments and stole GitHub, AWS, Vault, npm, Kubernetes, and 1Password secrets. Microsoft said GitHub removed 640 malicious packages and invalidated 61,274 npm granular access tokens with write permissions and 2FA bypass. Then GitHub confirmed an incident involving a compromised employee device and a poisoned third-party VS Code extension. GitHub said the attacker’s claim of roughly 3,800 internal repositories was “directionally consistent” with its investigation, while also saying its current assessment was exfiltration of GitHub-internal reposi

Analytics is often treated as a reporting feature: a dashboard added after the product already exists. That is usually too late. For software operators, analytics is closer to infrastructure. It is the layer that makes the state of the product visible. Without it, a team cannot evaluate the situation, understand whether the product creates value, or know whether a workflow is improving. That is the reason WebmasterID is built around privacy-first analytics. The goal is not to collect more data than necessary. The goal is to preserve enough signal to make practical decisions without turning measurement into surveillance. Analytics answers operational questions Good analytics starts with plain questions. What happened? Which workflow changed? Which part of the product is used? Where do people leave? Which system events matter? What evidence supports the conclusion? Those questions sound simple, but they are the foundation of product judgment. If the data model cannot answer them, the team is forced to reason from anecdotes, support messages, and internal opinion. Those inputs still matter, but they are not enough on their own. Analytics gives operators a way to compare the current state with the previous state. It makes change visible. It also makes uncertainty visible when the evidence is incomplete. Product value needs evidence A product can look polished and still fail to create value. It can also look unfinished while solving a real operational problem. The difference is usually visible in behavior. Do users return? Do they complete the workflow? Do they avoid a manual step? Does the product reduce confusion? Does it make a business process easier to operate? Privacy-first analytics should help answer those questions without building a profile of every person. In many cases, first-party events, coarse context, workflow state, and careful retention rules are enough. The system does not need to know everything about a user to show whether a product path is working.

In 1994, Peter Deutsch published the Fallacies of Distributed Computing — eight assumptions that every developer building distributed systems makes, discovers are wrong, and pays for in production. The network is reliable. Latency is zero. Bandwidth is infinite. Each assumption sounds true. Each leads to system failures that could have been avoided. Thirty years later, we're making the same category of mistakes with generative AI. The trough of disillusionment for AI-assisted development has begun. Byron Cook, VP and Distinguished Scientist at Amazon, founder of AWS's Automated Reasoning Group (300+ scientists, 15+ teams), says it plainly: "Generative AI is sliding into the trough of disillusionment." The headlines are shifting. The "summer of vibe coding" is over. The disillusionment isn't caused by AI being useless. AI-assisted coding delivers real productivity gains. The disillusionment is caused by false assumptions about WHERE the gains come from and WHAT changes when generation gets fast. Teams expected 10x engineering. They got 10x code generation and 1x everything else. The gap between expectation and reality is the trough. This series names the eight assumptions, explains why each one fails, and presents the resolution — not from theory, but from domains that hit the same wall and climbed out. The Eight Fallacies 1. Faster code generation means faster engineering. You made one sub-system 10x faster. Seven others didn't change. The system doesn't get faster — it breaks at the interfaces. The CPU-memory wall tells you exactly what happens and what fixes it. 2. If the output looks correct, it is correct. AI-generated code is optimized for plausibility, not correctness. It compiles, passes tests, and reads well — while violating properties nobody tested. Plausible is not correct. The gap is where production failures live. 3. You can verify AI output with another AI. Guardrails, LLM-as-judge, AI code review — the verifier has the same failure modes as the thing

Every week another "AI agent for X" launches. Email triage. Calendar coordination. Sales follow-up. PR reviewer. Slack monitor. Meeting summarizer. I've installed enough of them to see the pattern. Here's the dirty secret nobody mentions in the launch posts: These tools don't reduce your work. They multiply your notifications. Each AI tool is configured to be helpful by default. "Helpful" means: "I noticed this thing — here's a notification." Stack a dozen of those, and instead of one inbox to ignore you have twelve. The signal-to-noise ratio gets worse every time you add an AI to your workflow. The mainstream answer is "just configure each one." Sure. Spend four hours tuning notification settings every time you add a tool, and another four hours when one of them ships a "smarter notifications" update. That's not productivity. That's notification janitorial work disguised as setup. This is a structural problem. Not a configuration problem. The wrong question Every AI tool asks the same thing: "Is this important?" Wrong question. There is no objective "important." Importance depends on you, right now. A Stripe webhook is important when you're debugging a checkout flow. The same webhook is pure noise during a deep work block. A Slack message from your cofounder is critical at 11am Tuesday and irrelevant at 11pm Friday. The right question is: Is this urgent enough to interrupt me, right now, given what I'm doing? That's not a question any individual AI agent can answer. It's a layer above all your AI agents. None of them have the context. None of them know what the others are doing. None of them know how you're spending the next hour. So they all default to "I'll just send you a notification, you decide." Which is exactly the experience you have right now: drowning. What an AI firewall actually looks like I'm building that layer. It's called Klorn . Here's how it works in practice. Every signal — email, calendar invite, agent action, webhook, push from another tool — g

By Umair Sheikh, founder of Gateplex Autonomous AI agents are shipping fast. LangChain, CrewAI, AutoGen — the frameworks are mature, the tutorials are everywhere, and developers are connecting agents to real systems: databases, payment APIs, email, file storage. And then something goes wrong. Not because the code is buggy. Because the agent did exactly what it was told — and what it was told turned out to be a problem nobody anticipated. I spent nearly a decade in fintech and responsible AI policy watching this pattern repeat. A system behaves perfectly in testing. In production, an edge case triggers behaviour that was technically correct but operationally catastrophic. By the time anyone notices, the action has already executed. The problem is not the agent. The problem is that there is nothing between the agent's decision and the real world. The gap nobody talks about Most agent observability tools log what happened. That is useful for debugging. It does nothing to prevent the next incident. What agents actually need is a governance layer — something that intercepts every action before it executes, checks it against your rules, and either allows it, flags it for review, or blocks it outright. This is what a firewall does for network traffic. Your AI agent deserves the same treatment. What this looks like in practice Here is a simple LangChain agent calling an external tool: from langchain.agents import initialize_agent , Tool from langchain.llms import OpenAI def send_payment ( amount : str ) -> str : # This actually moves money return f " Payment of { amount } sent " tools = [ Tool ( name = " SendPayment " , func = send_payment , description = " Send a payment " )] agent = initialize_agent ( tools , OpenAI (), agent = " zero-shot-react-description " ) agent . run ( " Send $5000 to vendor account " ) This works. It also has no guardrails whatsoever. If the agent misreads the input, hallucinates a vendor, or gets manipulated via prompt injection, the payment goes

So im working on a saas and am wondering how most of you all handle ToS, liability, and where you get them from? Ill be storing customer data like addresses, emails, phone numbers in a db. Stripe for payment processing. I want to make sure i have a solid tos. To cover refunds, chargebacks, data stored in a db, etc… Should i just find a lawyer or are there resources online i can use? submitted by /u/spacedublin [link] [留言]

Last Friday at 4:30 PM, my product manager walked over: "Hey, can you grab the titles from the Hacker News homepage and send me an Excel file?" I thought: That's it? Five minutes tops. Two hours later, I was still debugging CSS selectors. How Things Spiraled Out of Control Step 1: Initialize the Project mkdir hacker-news-scraper && cd hacker-news-scraper npm init -y npm install puppeteer Hit enter, waited three minutes. Puppeteer needs to download a full Chromium browser — over 200 MB. I stared at the progress bar and started questioning my life choices. Step 2: Write the Code "It's just a document.querySelectorAll , right?" That's what I thought. Then I opened my editor: const puppeteer = require ( ' puppeteer ' ); ( async () => { const browser = await puppeteer . launch ({ headless : true , args : [ ' --no-sandbox ' , ' --disable-setuid-sandbox ' ] }); const page = await browser . newPage (); try { await page . goto ( ' https://news.ycombinator.com ' , { waitUntil : ' networkidle2 ' , timeout : 30000 }); await page . waitForSelector ( ' .titleline > a ' , { timeout : 10000 }); const titles = await page . evaluate (() => { const items = document . querySelectorAll ( ' .titleline > a ' ); return Array . from ( items ). map ( el => ({ title : el . textContent , url : el . href })); }); console . log ( JSON . stringify ( titles , null , 2 )); } catch ( err ) { console . error ( ' Scraping failed: ' , err . message ); } finally { await browser . close (); } })(); I counted: 27 lines. And this is the minimal version — no User-Agent spoofing, no retry logic, no proxy support, no concurrency control. Add all of that and you're well past 50 lines. Step 3: Run It node index.js Error: Navigation timeout of 30000 ms exceeded . Switched to domcontentloaded , got past that. But then waitForSelector timed out — because .titleline was a relatively new class name. Hacker News had silently changed it from .storylink at some point, and nobody sent me the memo. Step 4: Debug Set head

If you're interviewing at Amazon this year, you've probably read that you need to "prepare STAR stories." What most guides don't tell you is exactly how Amazon uses STAR differently from every other company — and what interviewers are silently scoring you against while you talk. Here's the complete 2026 breakdown: the cheat sheet, the full question bank, scored example answers, and the four mistakes that get candidates rejected even when their stories are genuinely impressive. Why Amazon STAR Is Different Amazon evaluates every behavioral answer against its 16 Leadership Principles. This isn't just culture marketing — interviewers are trained to map your stories to specific LPs and give them discrete scores. A Bar Raiser isn't just listening; they're running a rubric. The STAR formula at Amazon has specific time allocations that most candidates ignore: Situation (10%): Set the context in 20–30 seconds max Task (10%): What was specifically your responsibility Action (50%): What you did — not your team, not your manager Result (30%): Quantified outcomes only That weighting is the whole game. Most candidates spend 60% of their answer on Situation and Task, then rush through Action and Result — which is exactly backwards from what gets high scores. The "I" Rule: The Single Biggest Reason Candidates Fail Bar Raisers flag one thing more than any other: candidates who say "we" during the Action phase. Weak answer: "We decided to refactor the codebase, and we deployed a caching layer to fix the latency issue." Strong answer: "I identified the bottleneck using distributed tracing. I proposed the Redis caching layer to my tech lead and personally implemented the proof-of-concept over a weekend before bringing it to the team." Amazon hires individuals. If you can't cleanly separate your contribution from the group's work, interviewers have no signal on whether you were the driver or just along for the ride. Every sentence in your Action phase should start with "I." 30 Amazon S

Elon Musk is publicly reframing xAI’s massive Anthropic compute deal as short-term and cancellable, despite SpaceX’s own S-1 filing describing payments through May 2029.

Sesame’s new iOS app brings its conversational AI agents to the public, offering more natural back-and-forth interactions designed to feel less like traditional chatbots and more like talking to a person.

Activision has officially announced Call of Duty: Modern Warfare 4 and says the game will launch on October 23rd, 2026. Modern Warfare 4, which is developed by Infinity Ward, will be available on PS5, Xbox Series X / S, PC - and it will also be the first Call of Duty title to launch on […]

When Mozilla shut down Pocket in July 2025, I lost my favorite tool. Worse, none of the English alternatives (Instapaper, Readwise, Matter, Raindrop) had Japanese UI, and their article extraction was mediocre on Japanese pages. So I built one. It's called Readbox — Japanese-first, English-too, read-later as a PWA. Here's what I learned shipping it. The stack Next.js 15 App Router + TypeScript strict (no any ) Supabase (Postgres + Auth + RLS) Stripe (JPY + USD prices, locale-routed) Tailwind CSS Service Worker for PWA install + offline read Three things that bit me 1. Article extraction on Vercel serverless First attempt: Mozilla Readability + jsdom. Doesn't bundle on Vercel because of ESM compatibility issues and the 50MB serverless function size limit. I tried 6 approaches — Webpack externals, dynamic imports, edge runtime — none worked cleanly. Ended up using Jina Reader , which returns clean Markdown/HTML from any URL. Trade-off: third-party dependency, rate limits at scale. But it works today, and it's free. 2. Storing article body on-device I didn't want to host millions of articles' worth of HTML on Supabase (cost + privacy). Solution: extracted HTML lives in the browser's IndexedDB only (via Dexie); only metadata (URL, title, tags, read status) syncs to the server. Trade-off: cross-device sync of body content doesn't work seamlessly. Acceptable for a "read it later" workflow where you usually read on the device you saved on. 3. i18n routing — the silent sitemap killer For Japanese + English from one codebase: app/[locale]/ segment with /en prefix for English (default Japanese has no prefix, to preserve old URLs). Middleware detects cookie / Accept-Language and redirects accordingly. The gotcha (cost me a launch-day hour): middleware matcher excludes _next , api , image extensions — but if you forget .xml/.txt/.webmanifest , sitemap.xml and robots.txt get rewritten to /ja/sitemap.xml (which doesn't exist as a route → 404). Fix: export const config = { matcher

I got tired of explaining to people why their "simple weather widget" needed an API key, a signup form, and a credit card. So I built a weather API that doesn't need any of that. Here's how you can add live weather to your personal website, portfolio, or side project in about 60 seconds. The old way (painful) Most weather APIs make you: Create an account Verify your email Generate an API key Paste that key into your code Worry about rate limits Get an email when your "free tier" expires For a weather widget on a personal site? That's overkill. The Nimbus way (one fetch, done) I made a public API that doesn't need keys. Just call it. fetch ( ' https://nimbus-api-gxuc.onrender.com/api/v1/weather?city=Berlin ' ) . then ( response => response . json ()) . then ( data => { console . log ( data ); }); That's it. No headers. No tokens. No signup. Real example: Put it on your site Here's a working snippet you can drop into any HTML page right now: <div id= "weather-widget" > <p> Loading weather... </p> </div> <script> fetch ( ' https://nimbus-api-gxuc.onrender.com/api/v1/weather?city=Berlin ' ) . then ( res => res . json ()) . then ( data => { const weatherHtml = data . temp_celsius + ' °C • ' + data . description + ' <br>Wind: ' + data . wind_speed_kmh + ' km/h • Humidity: ' + data . humidity_percent + ' % ' ; document . getElementById ( ' weather-widget ' ). innerHTML = ' <strong> ' + data . location + ' </strong><br> ' + weatherHtml ; }) . catch ( function () { document . getElementById ( ' weather-widget ' ). innerHTML = ' <p>Weather not available right now</p> ' ; }); </script> Change Berlin to any city. It works. Why did I build this? Because I got tired of closed source APIs that change their pricing every 6 months. Nimbus is open source. The code is on GitHub. You can read it, fork it, or run your own version if you don't trust me. The API is free because hosting a weather endpoint costs me almost nothing, and I'd rather lose money than put up a paywall. Try it righ

This is Lowpass by Janko Roettgers, a newsletter on the ever-evolving intersection of tech and entertainment, syndicated just for The Verge subscribers once a week. Roughly 10 years ago, someone told me that Roku was making "cheap hardware to sell to Walmart customers in flyover states." The remark was meant to be an insult, belittling […]

Proton claims that managing your Gmail messages through its service offers you more privacy.

Hi, What are the things that surprised you that AI cannot do? Would you please also mention what is your work, since i assume most of this thread are coders etc? Ill start here. I work in corporate finance. Doing tons of stuff left and right. AI cannot do finance or accounting..... almost at all. Hundreds of billions on the line, every CEO and their mother pushing AI and nothing major happened. Sure, if you are just a link in chain where you receive the same excel sheet and produce the same powerpoint you are replacable but there are very few people like that anymore left in finance corps. However, if you just receive accounting memo written by random people AI is useless, if you receive bunch of random files and have to come up with valuation AI is useles, if you need to migrate product to a new system AI is useless........... so on and so forth. Hope i dont start a war where everybody is gonna be mad at this. submitted by /u/Zoltan1251 [link] [留言]