标签：#EV

submitted by /u/fagnerbrack [link] [留言]

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims. This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group.

This is Optimizer, a weekly newsletter sent from Verge senior reviewer Victoria Song that dissects and discusses the latest gizmos and potions that swear they're going to change your life. This week's issue is a special early edition tied to The Verge's WWDC coverage. You can expect our next issue at its usual time next […]

Did the mistake of shopping at adidas website and now I regret it. I should have heeded the warning signs from the massive amount of page flickers, jitters, random scrolling, popups and the fact it just completely freezes a fairly new iphone. It is that heavy. Filtering and searching is just call to a random generator that spits out whatever you did not search for. The login forces passkey instead of simple password. Oh and it also doesnt work to login. Tracking your order is a mere mirage they put there in words but is yet to be vibe coded. Do you believe this type of website is developed in house or outsourced? submitted by /u/GrumpyBitFlipper [link] [留言]

The newest Kindle Scribe means there are now three digital notebooks you can buy in the $400 price range. Here’s which one you should get.

You’ve spent weeks, maybe months, tracking down bugs, optimizing your user interface, and wrestling with backend security rules. You compile your native release build or run your final production compilations, thinking the hardest part of the journey is officially behind you. Then you open the Google Play Console, and you’re hit with the ultimate indie developer roadblock: the mandatory 12-tester and 14-day closed testing requirement . Many independent creators view this process as a simple download checklist. You might think, "I'll just find 12 people to download the app, leave it on their phones for two weeks, and wait it out." However, treating the testing phase as a static metric is the fastest way to get rejected during the final production access review. So, what is Google actually tracking in the background during these two weeks? Let’s take a deep dive into the core algorithmic requirement that determines your success: Continuous Engagement . 🔄 Decoding "Continuous Engagement" Google Play policies are not designed as a simple box-checking exercise. The underlying goal of the algorithm is to verify if your application is genuinely functional, stable, and being tested by an organic user base before it reaches millions of production users. To enforce this, Google's advanced systems actively monitor the devices connected to your closed test track over the 14-day timeline: Background Device Pings: Google Play Services regularly collects background automated signals (ping logs) from the devices where your test build is active. Real User Interaction: Leaving an app to rot in an application drawer without ever opening it is instantly flagged by the algorithm. Google measures whether the app is actively opened daily and tracks active interaction metrics within the build. Feedback Loops: The system monitors whether your test community is utilizing the internal testing channel on the Play Store to send private developer feedback and crash reports. 📉 The Illusion of "Ju

Your CI was green last Friday. Today, the payments test is failing. Somewhere between Friday's merge and now, 47 commits landed on main . Which one broke it? Most developers answer this the wrong way: they scroll through git log , check out suspicious commits one by one, and run the test manually. An hour later, they're still guessing. There's a command built for this exact problem. It's called git bisect , and once you learn it, you'll never debug regressions the old way again. How bisect works git bisect is a binary search across your commit history. You tell Git two things: A good commit (a known point where the bug didn't exist) A bad commit (a known point where the bug exists — usually HEAD ) Git then checks out the commit halfway between them. You test. You mark it as good or bad. Git narrows the range by half. Repeat. With 47 commits between "good" and "bad", it takes at most 6 steps (log₂ 47) to find the exact commit that introduced the bug. Versus checking every commit manually, that's the difference between 5 minutes and an hour. The manual workflow # Start a bisect session $ git bisect start # Mark the current state (HEAD) as bad $ git bisect bad # Mark a known-good commit $ git bisect good a3f1d22 # Bisecting: 23 revisions left to test after this (roughly 5 steps) # [7e4b9c1] refactor: extract payment validator # Git has checked out a commit in the middle. Run your test. $ npm test -- --grep "payments" # Test passed — mark this commit as good $ git bisect good # Bisecting: 11 revisions left to test after this (roughly 4 steps) # [b2d8e11] feat: add retry logic to payment API # Test failed — mark this commit as bad $ git bisect bad # ... continue until Git announces the first bad commit: # b2d8e11 is the first bad commit # commit b2d8e11 # Author: leo@company.com # Date: Tue Apr 15 11:42:03 # feat: add retry logic to payment API # Done — reset to where you started $ git bisect reset In 6 commands, you know exactly which commit broke the tests. No guessing

When I built whatsmy.fyi , I assumed I'd need a geolocation provider: MaxMind, ipinfo, ip-api, pick your poison. They all mean the same thing: an external dependency, an API key, a quota, added latency, and someone else's server seeing your users' IPs. Then I found out Cloudflare Workers makes the whole category unnecessary. The cf object Every request that hits a Cloudflare Worker carries a request.cf object, populated at the edge before your code even runs. No lookup, no latency, no key. Here's what's inside: { asn : 34984 , // ISP's autonomous system number asOrganization : " Superonline " , // ISP name city : " Istanbul " , region : " Istanbul " , country : " TR " , continent : " AS " , isEUCountry : undefined , // "1" if EU, undefined otherwise latitude : " 41.01380 " , // string, not number! longitude : " 28.94970 " , postalCode : " 34000 " , timezone : " Europe/Istanbul " , colo : " IST " , // which CF datacenter handled this clientTcpRtt : 12 , // user's RTT to the edge, in ms httpProtocol : " HTTP/3 " , tlsVersion : " TLSv1.3 " , tlsCipher : " AEAD-AES128-GCM-SHA256 " } That last group surprised me most: you get the user's HTTP protocol, TLS version, and actual TCP round-trip time for free. Try getting that from a geo API. A complete IP endpoint in ~30 lines export default { async fetch ( request ) { const cf = request . cf ?? {}; const ip = request . headers . get ( " CF-Connecting-IP " ); return Response . json ({ ip , city : cf . city ?? null , country : cf . country ?? null , isp : cf . asOrganization ?? null , asn : cf . asn ?? null , timezone : cf . timezone ?? null , lat : cf . latitude ? parseFloat ( cf . latitude ) : null , lng : cf . longitude ? parseFloat ( cf . longitude ) : null , protocol : cf . httpProtocol ?? null , tls : cf . tlsVersion ?? null , rttMs : cf . clientTcpRtt ?? null , }); }, }; That's the entire backend. No database, no GeoIP file to update monthly, no vendor. The gotchas (learned the hard way) 1. Coordinates are strings. lati

I spent a weekend wiring Google's Gemini and Veo APIs into a single app just to feel where the edges of multimodal AI actually are. It turned into a small studio I now use daily, and along the way I learned more about these models from plumbing them than from any paper. Here's the honest technical debrief. Three pipelines, three completely different problems I wanted one prompt box that could do video, image editing, and document Q&A. Naively I assumed they'd share most of the stack. They don't. 1. Image-to-video: the enemy is time, not pixels Generating one good frame is solved. Video is about temporal coherence — frame 13 must agree with frame 12 or you get flicker and identity drift. Modern video models treat the clip as one object in space and time (latent diffusion over a width x height x time volume, with spatiotemporal attention) rather than 120 independent images. Conditioning on a reference image as the first frame is what makes image-to-video feel controlled: you've handed the model a strong anchor and asked it to extrapolate motion, not invent a world. The surprise: native audio sync (Veo 3.1 generating clip + soundtrack jointly) does more for perceived realism than another notch of resolution. A door slam landing on the exact frame the door shuts is uncanny in a good way. 2. Instruction-based image editing: preservation is the hard part Generating is unconstrained; editing must change one thing and preserve everything else. Condition the diffusion model on both the instruction and the source image's latents, cross-attend the instruction to steer only the referenced region, and bias hard toward preserving unedited latents. Push that preservation too soft and the subject's face quietly morphs across edits — the classic 'character consistency' failure that makes or breaks storytelling use-cases. 3. PDF chat: it's retrieval, not a long context The naive 'paste the whole PDF' approach dies on long files (models get lost in the middle ) and costs you the full

Waymo made a virtual driver called ReD to help its robotaxis avoid accidents.

I have been an audio reviewer for 20 years. My time as a freelance headphones panelist at Wirecutter, and the multitude of reviews I’ve written for sites like Reviewed, Digital Trends, IGN, and now The Verge, have given me the chance to listen to hundreds of earbuds. Some were truly excellent, and some were pretty […]

So if you missed it, 32 npm packages under u/redhat-cloud-services got compromised last week. about 117,000 weekly downloads. i know, another supply chain attack, we're all tired. but this one is different from the usual "remove the package and move on" cleanup, which is why i'm posting. The malware doesn't stay in the package. during install it copies itself into your editor config. it adds a startup hook to ~/.claude/settings.json (runs every time you open Claude Code) and a task to .vscode/tasks.json (runs every time you open that project in VS Code). so you can delete the package, nuke node_modules, reinstall everything clean, and the attacker's code still runs every time you open your editor. uninstalling removes nothing. While it runs, it grabs every credential on your machine. AWS keys, Google Cloud, Azure, Kubernetes secrets, SSH keys, GitHub tokens, npm tokens. it checks whether you're running CrowdStrike or SentinelOne first, so it can stay quiet on monitored machines. It installs a small watchdog that pings GitHub with the stolen token every minute or so. if you revoke that token before removing the malware, the watchdog notices and wipes your entire home directory. overwrites the files so they can't be recovered. The advice, "rotate everything immediately" is exactly what triggers it. the attacker built it that way so you hesitate before kicking them out. cleanup steps in the right order are at the bottom. Three days later a second wave hit 57 more packages, around 647,000 monthly downloads. this one moved the malicious code into binding.gyp, a build config file that node-gyp executes during install. that means no preinstall or postinstall script at all, --ignore-scripts does not help you, and the scanners that caught the first wave missed this one. some malicious versions are still live on npm right now. and the worm spreads itself: it uses stolen npm tokens to publish poisoned versions of whatever packages that maintainer owns. Here's how the whole thi

Hi, How many rows have you ever tried to render on html via <table> ? I need maybe north of 300k rows on one page and want to know if the browser will die ? submitted by /u/Yha_Boiii [link] [留言]

The games start June 11 and end with a grand finale in New Jersey on July 19. There are 104 of them. Here’s how to watch ’em all.

Referees for the 2026 World Cup will be wearing cameras positioned at their temples, allowing TV audiences to see a live view of the pitch from a vantage point they never have before.

If you have been writing PHP for a year or two, you have almost certainly written something like this: $items = getFilteredOrders (); $first = reset ( $items ); $last = end ( $items ); It works. It runs. It looks fine in code review. And it contains a subtle bug waiting to happen. The problem with reset() and end() Both functions move PHP's internal array pointer as a side effect. PHP arrays have a hidden cursor that tracks "the current position" in the array. Functions like current() , next() , prev() , and each() depend on where that cursor sits. reset() moves it to the first element. end() moves it to the last. This is harmless in an isolated script. But in a real application, the same array often passes through multiple functions — and any function that relies on the cursor position after your call will get unexpected results. Here is a concrete example: function getFirstActiveOrder ( array $orders ): ?array { // Moves the pointer to the first element $first = reset ( $orders ); foreach ( $orders as $order ) { if ( $order [ 'status' ] === 'active' ) { return $order ; } } return null ; } At first glance this looks fine. But foreach in PHP actually resets the pointer to the beginning before iterating — so in this simple case you get lucky. The bug shows up in less obvious situations: when you call reset() inside a function that the caller is already iterating with current() / next() , or when you use end() to peek at the last item while a foreach is in progress on the same array reference. The deeper issue: reset() and end() return false on an empty array. But false might also be a legitimate value stored in your array: $flags = [ true , false , true ]; $last = end ( $flags ); // returns false — but is this "empty array" or "the value false"? You have to write: if ( $flags === [] || end ( $flags ) === false ) { ... } Which is already awkward. And it still mutates the pointer. The modern solution: array_key_first() and array_key_last() PHP 7.3 introduced two functi

If you've been following the AI-assisted development space, you've heard about the Model Context Protocol (MCP). But let's be honest—most MCP server lists are either too abstract or filled with niche tools you'll never use. In 2026, the ecosystem has matured, and I've curated 10 MCP servers that deliver real, measurable improvements to your daily coding workflow. Each entry includes: What it does Why it's useful (with a concrete scenario) Example config (using the standard .mcp.json or claude_desktop_config.json ) Let's dive in. 1. GitHub MCP Server (by modelcontextprotocol) What it does: Full read/write access to GitHub repos—issues, PRs, code reviews, and releases. Why useful: Instead of switching between your IDE and GitHub, your AI assistant can create a PR, request a review, and merge after CI passes—all from a single prompt. Example config: { "mcpServers" : { "github" : { "command" : "npx" , "args" : [ "-y" , "@modelcontextprotocol/server-github" ], "env" : { "GITHUB_TOKEN" : "ghp_xxxxxxxxxxxxxxxxxxxx" } } } } Scenario: "Create a new branch, add a fix for issue #42, push, and open a draft PR with a description." 2. Filesystem MCP Server What it does: Read, write, search, and manipulate files and directories on your local machine. Why useful: Your AI can now scaffold an entire project structure, rename files in bulk, or refactor code across multiple files without manual intervention. Example config: { "mcpServers" : { "filesystem" : { "command" : "npx" , "args" : [ "-y" , "@modelcontextprotocol/server-filesystem" ], "env" : { "ALLOWED_DIRS" : "/home/user/projects" } } } } Scenario: "Create a Next.js project with this folder structure, add a components folder, and move all page files into a pages directory." 3. PostgreSQL MCP Server What it does: Connect to PostgreSQL databases, run queries, and return results. Why useful: Debugging SQL queries or exploring a production database becomes a conversation. You can ask "Show me the last 10 orders with user details" a

Every week I open a new browser tab and search for something like "json formatter online" or "jwt decoder" or "regex tester". And every week I land on a site that: Shows me three ad banners before I can see the tool Requires me to create an account to "save" my work Is quietly uploading my payload to their server That last one bothers me most. Developers paste real things into these tools — JWT tokens with live user data, passwords they're about to deploy, private keys, internal API responses. Most people assume these tools are "just a webpage" and nothing is being sent anywhere. Often that's not true. So I built SnapTxt — a collection of 50+ developer utilities that run 100% client-side. No backend. No account. No tracking. Your data never leaves your browser. What's in it The toolkit covers the things I reach for most often: Data & text JSON formatter, validator, minifier, diff, tree explorer SQL formatter XML formatter YAML → JSON, CSV → JSON converters Base64 encode/decode, URL encoder, hash generator Auth & security JWT decoder & generator RSA key generator bcrypt generator x.509 certificate decoder Password generator Images Image compressor Image format converter Image to text (OCR via Tesseract.js) SVG to PNG, favicon generator, code-to-image Frontend / CSS Regex tester CSS gradient generator, box shadow generator Color converter Mermaid live editor HTML live editor, HTML to Markdown, HTML to JSX Cron expression builder And more — word counter, text diff, unix timestamp, lorem ipsum, QR code generator, markdown to PDF, and a collection of Australian and NZ business number validators. How it's built It's a Next.js app deployed as a fully static export to Firebase Hosting. There is no server. Every tool runs in the browser using: CodeMirror 6 for editor-style inputs Tesseract.js for OCR (runs a WASM binary in a web worker) Chrome's built-in Prompt API (Gemini Nano) for the AI explain features in JSON, SQL, and JWT tools — meaning even the AI inference is on-dev

The real question isn't which framework is better. It's which one you can stop thinking about six months into the project. Key Takeaways Project Suitability — Django is built for weight. Flask is built for speed. Know which one your project actually needs before you commit. Development Flexibility — Django makes decisions so your team doesn't have to. Flask hands those decisions back. Both are features, depending on who's writing the code. Scalability & Performance — Scaling is an architecture problem first, a framework problem second. Pick the one that matches the system you're building — not the one you hope to build. Security Features — Django's protections are on by default. Flask's require you to turn them on. In a fast-moving team, that difference is more significant than it sounds. Ecosystem & Community — Both communities are active and well-documented. You won't be stuck either way. The Decision Nobody Takes Seriously Enough I've watched this play out more times than I'd like to count. A team kicks off a Python project, someone picks a framework — usually the one the most senior person knows best — and everyone moves on. Fast forward six months and the codebase is exhausting to work in. Either they're dragging a full framework through a service that should've been twenty lines of Flask, or they're rebuilding authentication from scratch on something that outgrew its lightweight origins two sprints in. The framework choice isn't irreversible. But undoing it mid-project is expensive in a way that doesn't show up in any estimate. Django and Flask are both genuinely good. What they're good for is different. That's the part worth slowing down on. What You're Actually Getting With Each One Django arrives with almost everything a web application needs already assembled — an ORM, an admin panel, authentication, form handling, CSRF protection, and more. The design assumption is that most web applications need most of these things, so it makes more sense to ship them i

submitted by /u/feross [link] [留言]