标签：#AR

Most engineers who stall at a level have the skill. What they don't have is anyone willing to explain the machine they're inside. The explanation you get from your manager is partial by design. They know their part of the process and not the committee's, so what comes back is "keep doing what you're doing, you're close." Which is true, and useless, and then you're close again next cycle. So here is the machine, reconstructed from what the four big companies publish, what their engineers write up afterward, and what levelling aggregators have pieced together. None of it is your company's internal doc. Check the specifics with your own manager. The ladders don't line up Stage Google Meta Amazon Microsoft Apple Typical YOE Entry L3 E3 L4 (SDE I) 59–60 ICT2 0–2 Mid L4 E4 L5 (SDE II) 61–62 ICT3 2–5 Senior L5 E5 L6 (SDE III) 63–64 ICT4 5–8+ Staff L6 E6 L7 (Principal) 65–66 ICT5 8–12+ Senior staff L7 E7 L8 67 ICT6 12+ Principal / Distinguished L8–L9 E8–E9 L10 68–69 Distinguished rare Google's L5 is a senior engineer. Amazon's L5 is a mid-level SDE II. Recruiters map between them and the map is approximate, so the year ranges are typical rather than required. Two things here matter more than the numbers. The gap between adjacent levels is not constant. Entry to mid is mostly about becoming reliable. Mid to senior is about becoming independent. Then senior to staff, which is where the ladder stops behaving like a ladder: it's a change of job, and the things that earned you the last promotion only partly transfer. And every company has a level it considers a perfectly good place to spend a career. Google's L5, Meta's E5, Amazon's SDE II or III depending on who you ask, Microsoft's 63 or 64. Below that level there is an expectation you keep climbing, and at some companies a clock. Above it, promotion is optional and much harder, and nobody will chase you about it. What actually happens in the room The four processes differ enough that optimizing for the wrong one wastes a year

Most EM interview prep fails the same way. You pick three strong stories, polish them until they're tight, run them past a friend, and walk in confident. Then somebody asks how you'd handle a high performer who's difficult to work with, and none of your three stories touch it. That isn't a depth problem. It's a coverage problem, and it's the thing that makes the EM loop different from every IC loop you've done. An IC loop samples from a narrow surface. Systems, code, a couple of behavioural questions that mostly serve as tiebreakers. You can prepare for it by going deep on a small number of technical narratives. An EM loop samples from a wide one. Nine areas, roughly, and you can be excellent at seven of them and still lose the loop on the two you never thought about. The nine areas Team building and hiring Performance management and difficult conversations Conflict and difficult relationships Delivery, prioritization and ambiguity Cross-functional partnership Growth, coaching and career development Technical judgment and architecture Values, culture and self-awareness Vision and scaling Look at that list and be honest about which two are thin for you. For most people coming from a senior IC role it's 2 and 3, because those are the parts of the job you've watched from the outside rather than done. What the questions are actually checking Underneath the surface wording, almost every behavioural question in an EM loop is checking one of four things. Did you run a real process, or improvise? "I had a conversation with them" is an improvisation. "I named the specific pattern with dates, we agreed a 30-day plan, I checked in weekly" is a process. Can you name a specific tradeoff you made, and why? Not that tradeoffs existed. Which one you picked, what it cost, and what you got. Do you own outcomes without deflecting or over-apologizing? Both failure modes read badly. Blaming the org is worse, but flagellating yourself for four minutes over a bad hire is not much better.

Originally published on indiecore.net . I deployed, opened the console on the live site out of habit, and found this: Loading the script 'https://static.cloudflareinsights.com/beacon.min.js/v3d52…' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'inline-speculation-rules'". The action has been blocked. I had not added that script. It is in no template, no build output, and no dependency. grep -c cloudflareinsights dist/index.html returns 0. It is not in the page you build Cloudflare Web Analytics has an automatic mode, on by default when a site is added, that injects beacon.min.js into HTML responses at the edge. Your origin never sees it. Your repository never contains it. It also does not inject for everything. I fetched the same URL with curl, then again with a full desktop browser User-Agent, and neither response carried the script. Only a real browser navigation gets it, which is why Lighthouse saw it and my terminal did not. That combination is worth sitting with for a second. The artefact exists in production, is absent from your source, and cannot be reproduced with the tool most of us reach for first when we want to see what a server actually returned. Nothing was tracked The CSP did its job. From the Lighthouse network trace: url : https://static.cloudflareinsights.com/beacon.min.js/v3d52… resourceType : Script statusCode : -1 transferSize : 0 Status −1 with zero bytes transferred means the request never started. The browser matched the URL against script-src , found no permitted source, and refused before opening a connection. No data left anyone's browser. So the console error is the sound of a guard working. It still costs something: a logged error drops the Best Practices category from 100 to 92, and a red line in the console trains you to ignore red lines in the console. The fix everyone reaches for is the wrong one here Search the error and the common answer is to add https://static.cloudflareinsights.com

When a support agent is trying to recover an account after a suspicious login, JWKS verification and session verification define different trust boundaries for API requests. The distinction decides which recovery path the agent can offer and how much damage a stolen credential can do. Short answer: use JWKS verification for a stable, distributed signature boundary, and session verification when the request must reflect current session state; most customer-support systems need both, with an explicit recovery policy between them. 1. Separate the two trust boundaries before scoring a device JWKS verification checks a token signature with a public key set. The verifier never needs a copy of the issuer's private key, which keeps key material out of every API service. That is a good fit for a high-volume edge where the identity claim should remain stable while requests cross service boundaries. Session verification asks a different question: is this particular session still valid right now? Revocation, expiry, or a changed recovery decision can make a previously well-signed token unsuitable for a sensitive action. A valid signature is necessary, but it does not satisfy the business constraints by itself. That distinction is the invariant. Device-fingerprint risk scoring should not silently turn a cryptographic result into an account-recovery decision. Keep it explicit. 2. How should JWKS and session verification govern API requests? Start with the least surprising path. Verify the token signature at the request boundary, then apply issuer, audience, expiry, and device-risk rules. For password reset, email change, or an agent-assisted recovery, perform session verification as a second check when the policy requires current state. The operational catch is key rotation. A JWKS client needs a bounded cache, a refresh trigger for an unknown key identifier, and telemetry for fetch failures. In capacity planning, that means sizing the refresh path separately from ordinary reques

1. How this project started? I'm going to be honest, it's been ages since I have written something without the use of AI to fix my writing. English is not my first language so please bear with me! With the rapid rise of AI, I felt that I have been losing passion for what I used to love at some point: learning . Nowadays, we can quickly solve most of our problems with the use of AI, often times, not even reviewing if it correct or not. That's why I decided to take some time daily to learn something new without or minimal use of AI. The first step is deciding, what should I try to learn first? Well, it was quiet easy to find out what. If you are into Linux, you have probably heard of Omarchy at this point. Like it or not, there's no deny that it's getting more popular among developers. So, why not try to build a decent looking Arch workspace? Before continuing, I would like to mention that this is not a guide. There are lot of resources online that teaches you how to install Archlinux and other packages. 2. Why Archlinux? Archlinux has -or had- the reputation of being difficult to get started with. Most of us are used to booting into a nice-looking, functional operating system. Although I have some Linux knowledge, I wanted to have a better understanding of what it takes to have a decent workspace. 3. Installing Archlinux The first step is actually installing Arch on my device. The device I'm going to use is my trusty built PC that I currently use exclusively for gaming. There are a few things to consider before jumping into installing Arch: My PC has an Nvidia RTX 5050 and AMD Ryzen 5 CPU. Need dual boot to switch between Windows 11 and Archlinux. I don't want to change the BIOS options repeatively. With this in mind, I quickly created a bootable USB using RUFUS . 3.1. Booting the USB If you are a Windows 11 user and have dual boot, you may know that Windows requires Windows Secure Boot. In order to boot another operation system, you'll need to change your Secure Boo

The company is reducing pressure on workers to use artificial intelligence tools while encouraging them to experiment with Hatch, its most advanced AI project yet.

AI apps have moved past simple chat boxes. Today's AI systems need agents, tools, memory, data, security, monitoring, and scale. The hard part is not calling an LLM API. The hard part is building a reliable system around that API call. 1. From LLM Demo to Production System A demo is simple: flowchart LR A[Prompt] --> B[Model] --> C[Response] A real production system looks very different: flowchart TD U[User] --> API[API] API --> APP[Application Layer] APP --> ORCH[AI Orchestration] ORCH --> LLM[LLM] ORCH --> TOOLS[Tools] ORCH --> RAG[RAG] ORCH --> MEM[Memory] ORCH --> GUARD[Guardrails] ORCH --> DATA[Data + Infrastructure] DATA --> OBS[Observability] Each box matters. If you skip Guardrails , bad input can hijack your system. If you skip Memory , every message re-explains itself and costs more tokens. If you skip Observability , you won't know why the system failed until a user tells you. The rest of this article walks through each box. 2. Where AWS Fits Instead of listing AWS services, let's match each one to a real problem. Problem AWS Service Why Need a foundation model Amazon Bedrock Managed access to multiple LLMs, no infra to run Store documents and files S3 Cheap, durable, scales easily Store app data RDS / Aurora / DynamoDB Structured data, users, sessions, transactions Search by meaning (retrieval) OpenSearch / pgvector Vector search for RAG Run code Lambda / ECS Serverless or container compute for your app logic Handle async work SQS / EventBridge Queue jobs, decouple slow tasks, avoid lost requests Watch the system CloudWatch Logs, metrics, alarms Keep it secure IAM / Secrets Manager Access control and safe storage of keys flowchart LR subgraph Compute L[Lambda / ECS] end subgraph Data S3[(S3)] DB[(RDS / DynamoDB)] VEC[(OpenSearch / pgvector)] end subgraph AI BR[Bedrock] end subgraph Ops CW[CloudWatch] SEC[IAM / Secrets Manager] end L --> BR L --> S3 L --> DB L --> VEC L --> CW L --> SEC 3. AI Agents Change the Architecture An agent doesn't just answer — i

Is a blank cell signal, or just missing? Sometimes an empty cell is the most informative thing in the row. The trouble is that you usually only know which case you're in by reading the data dictionary — and that doesn't scale to 800 columns named f_0347 . So we measure it instead, then check the answer against the literature. Ames housing · 1,460 sales · 79 columns · 19 of them contain blanks "Drop any column that's more than 70% missing." I've written that line into more pipelines than I can count. On Ames it deletes four columns — and three of them have real price signal sitting in the gap. The blanks in this dataset are structural . A blank GarageQual doesn't mean the value was lost; it means the house has no garage. A blank Alley means no alley access. The emptiness is the measurement. That's easy to see here because the columns have English names and a published data dictionary. It is not easy to see on a vendor feed of anonymised features, which is what most real projects look like. So the question worth answering isn't "does missingness carry signal" — it's can you tell, without knowing what the column means? 0.41 R² from the blank/not-blank pattern alone — every value discarded 1.00 AUC recovering the garage blanks from other columns' values ±0.9% Total spread across five strategies — inside a ±1.5% CV noise band 1 · A blank cell has a price tag Start with the crude check: does sale price differ between rows where a column is blank and rows where it isn't? Columns that go blank on the same rows describe one fact, so the five garage columns collapse into one. Fig 1. Median sale price, blank rows vs. valued rows. No garage is a $68k median discount on a $163k median house. Note the sign flip: houses that have an alley or fence are the cheaper ones — those features mark older, denser blocks. "Blank = worse" is not a rule you can assume. Then the harder test. Throw away every value in the table and keep only a 19-column matrix of True / False — was this cell emp

Let me start with a question. Why did I fear development done by artificial intelligence? The answer is plain. AI can build software, and on top of that, it never rests. AI has no labor law People rest. There are labor laws. We sleep at night. We need weekends. Work too many days in a row and the body breaks. So there is a ceiling on how much work a person can move forward in a day. For a long time, we treated that ceiling as a given. But AI has no labor law. It works at night. It works on weekends. Give it an instruction once, and it does not stop until morning. It never says it is tired. It takes no breaks. It keeps working for hours at the same quality. This difference did not fit inside the word "convenient." What I felt was fear. This was not a story about one more handy tool. It was a story about the ground under the speed of work changing at the root. Claude Code came out about a year and a half ago. That is when I understood. The company that runs it 24 hours takes the first-mover advantage. And the company that can punch with money wins. This is not a cynical take. It is the obvious consequence. The first mover wins — that story is not new. Whoever enters a market early takes the ground. They set the standard. Everyone after them chases the gap. AI widens that gap by the day. A company that moved ten hours forward overnight and a company that stood still overnight are ten hours apart by morning. The gap compounds daily. Can you catch up by hiring more people? You cannot. Hiring takes time. Post the opening, interview, teach, wait for people to settle in. That takes months. Meanwhile, the other side's AI keeps moving through the night. The speed of adding people cannot match the speed of adding AI. So the moment a small company steps into a contest of headcount, it loses. It was a ring we should never have entered. Companies that can punch with money win — obviously Why can I say it becomes a contest of money? Because there is no ceiling on how fast you can

🎮 ADAM-PS5 — A PS5 Emulator in Development I’m working on an ambitious project called ADAM-PS5 , with the ultimate goal of developing a PlayStation 5 emulator for PC capable of running PS5 games . The project is still in the early stages of development , and I do not consider it a complete emulator at this point. I’m building the foundation step by step: system architecture, low-level emulation, memory and resource management, graphics, input handling, execution, debugging, and development tools. 🚧 Early Development There is still a huge amount of work ahead before reaching the point where commercial PS5 games can actually run. That’s why I’m sharing the project from its early stages rather than presenting it as a finished product. 🤖 One of the project’s goals is also to integrate Artificial Intelligence to help analyze errors, monitor performance, understand system logs, and assist with the development process. The long-term goal is: PC → ADAM-PS5 → PS5 Software Environment → Games Reaching that stage requires implementing and accurately simulating many different components of the console’s hardware and software architecture. I’m sharing the project now because I want to document the entire development journey from the beginning — including what gets built, what fails, what gets improved, and how the project evolves with each release. 🔥 ADAM-PS5 is not finished. It is being built. And the ultimate goal is simple: Run PlayStation 5 games on PC through our own emulator. ADAM-PS5 is an independent development project and is not affiliated with Sony Interactive Entertainment.

Uber beat out Waymo in launching a commercial robotaxi service in London, the city's first. The vehicles use autonomous driving tech developed by Wayve, a UK-based startup, and will initially feature safety drivers behind the wheel. The launch is a milestone for Uber, which has been plotting a UK launch with Wayve for several years. […]

The acquisition also leaves Sequoia-backed Serval as the de facto startup leader in AI IT service automation, industry watchers believe.

Amazon just hiked prices on Kindles, Echo speakers, Eero routers, and Fire TV devices ahead of the holiday shopping season.

The Comfort Zone Trap Most developers hit a point where they know enough to be productive, and then... stop growing. You can build features, fix bugs, ship code — and still be standing still. The comfort zone doesn't feel like stagnation. It feels like competence. This is one of the sneakiest traps in a dev career. Early on, growth is forced on you — every new project throws unfamiliar problems your way, and you have no choice but to learn. But once you've built a solid mental toolkit (a stack you're comfortable in, a set of patterns that "just work"), it becomes very easy to keep reaching for the same tools on every new problem. You're productive. You're shipping. And you're not actually getting better. The danger is that this plateau is invisible from the inside. Nobody sends you a notification saying "you've stopped growing." You just keep doing what you know, at the same level, for years — until you compare yourself to someone who deliberately kept pushing, and the gap feels much bigger than it should. Why "Just Keep Coding" Doesn't Work The common advice is to just build more projects. But volume without friction doesn't teach you much — repeating the same patterns on new ideas just reinforces what you already know. Growth comes from deliberately picking problems slightly outside your current skill ceiling, not from doing more of what's comfortable. Think about it like weightlifting. If you lift the same weight every session, you get very good at lifting that exact weight — and nothing more. Progressive overload works because you're constantly pushing slightly past your current limit. Coding is the same. If every project you build uses the same stack, the same architecture patterns, and the same problem shapes, you're doing bicep curls with the same 10kg dumbbell for five years straight. The fix isn't "build more" — it's "build harder." Pick a project that forces you to learn a new paradigm (functional if you're used to OOP, distributed systems if you've only b

Google has dodged an effort to break up its ad business, but a judge said Wednesday that the company will need to adjust its business to benefit competitors.

Every developer I know now runs an AI coding agent in something like auto-accept mode. Claude Code, Codex, Cursor: you give it a task, it runs commands, edits files, installs packages, and you review... the diff, maybe. The commands? The installs? The thing it did in that folder outside the repo? Nobody looks. The activity scrolls off the terminal and is gone. That asymmetry bothered me. We built an entire industry around audit trails for humans (git blame, CI logs, access logs), then handed the keyboard to agents and kept none for them. So I built Tracon: a local flight recorder for AI coding agents. The name is the FAA's term for Terminal Radar Approach Control, the radar room that tracks every aircraft in an airspace. This one tracks every agent on your machine. What it does Tracon is a Mac and Windows desktop app (Tauri 2, Rust core, React UI, SQLite store) that sits in the tray and records what your agents do: A timeline per session: every command, file edit, package install, and prompt, attributed to the agent and session that did it Danger flags as they happen: recursive deletes, pipe to shell installs, credential access, force pushes, permission bypasses. Tracon flags; it never blocks A Live page: one monitor per active session, like a security room, streaming recent commands with flagged ones highlighted in red, plus which subagents the session has spawned A conversation reader: the actual chat behind any event, read straight from the agent's own transcript, read only A package watch across npm, pnpm, pip, cargo, and brew, with opt in threat intelligence against osv.dev Capture is deliberately passive. Hooks give real time events over localhost; transcript tailing (filesystem notify, read only) covers everything else, so CLI sessions show up live even with zero setup. A dead or closed Tracon never slows an agent down. Everything stays on your machine: no telemetry, no accounts, AGPL. The recursive part Here is the part I find genuinely funny: Tracon was lar

The US government wrote a letter in support of OpenAI’s argument that training AI on others' intellectual property is fair use.

A startup called Mostik has a wild new approach to combining the capabilities of AI models.

Google's Pro model updates are seemingly paused, but there's yet another Gemini Flash today.

Why shorter outputs can cost more, and how GitHub Copilot reduces wasted work across the complete coding task. The post How we make AI coding more cost efficient without sacrificing task quality appeared first on The GitHub Blog .