标签：#ai

We Scanned 100 AI Repos on GitHub. Here's What We Found. A drone firmware project with 3× more stars than the real one. A crypto protocol that turned GitHub into a points farm. A README with 6,289 stars and 2 commits. As a developer turned architect, I used to treat GitHub stars as a proxy for trust. More stars meant more legitimate, fewer reasons to question before cloning. That instinct got me thinking. So I built TrustStar , audited hundreds of repos, and found that some people had figured out that instinct before me. Here's what the data showed. Case 1: The Airdrop Farm (QuipNetwork) 🔴 DANGEROUS Repository Stars Forks Fork/Star ratio hashsigs-py 11,200 9 0.0008 hashsigs-rs 11,300 42 0.0037 hashsigs-ts 11,300 31 0.0027 hashsigs-solidity 11,300 33 0.003 quip-protocol 11,645 159 0.014 ethereum-sdk ~11,400 72 0.006 cpp-sdk ~11,300 44 0.004 Six repos in completely different languages (Python, Rust, TypeScript, Solidity, C++) all converging on exactly ~11,300 stars. Projects with genuinely different audiences don't do that. The mechanism was on their own website: "Each GitHub repo star earns 5 QUIP points." QuipNetwork launched a crypto airdrop in early February 2026. Users who wanted QUIP tokens starred every repo in the organization. 11,000 stars in 48 hours, after five months of zero activity. The tell: dashboard.quip.network has 2 stars. nodes.quip.network has 2 stars. The repos they forgot to include in the airdrop show the real numbers. This is the first documented instance of a crypto airdrop using GitHub as a gamification layer. These aren't bots. They're real users who just wanted tokens. Case 2: The Typosquat (ShlkOfTheRa/scarab-osd) 🔴 DANGEROUS. The most dangerous case in this dataset. ShikOfTheRa/scarab-osd is a legitimate drone flight controller firmware project. 468 stars, built over 10 years. ShlkOfTheRa/scarab-osd , one character different, was created March 3, 2026. Byte-for-byte identical code. Twelve days later, 1,485 stars purchased in a 90-minute

There are only 3 LLM API protocols, but unlimited providers running the same protocol. Separate protocol from identity — protocol is code, provider is data — and complexity drops from N×M to N+M. 300 lines of TypeScript. Zero dependencies. The problem isn't "it doesn't work." It's "it won't tell you it broke." In May, I built a Claude Code skill called unblind . I use DeepSeek as my daily driver, but it can't see images. So unblind forwards images to Mimo and OpenAI's vision APIs. The MVP had two providers. A few dozen lines of if-else. It worked. Then I noticed something more unsettling: an expired API key — no warning. A network hiccup — no retry. A missing permission — silently skipped. This tool didn't fail. It quietly stopped working without telling you. I added Phase 0 self-healing, circuit breakers, persistent caching, and a security sandbox. Now unblind wouldn't fail silently. But then I noticed something else. The circuit breaker doesn't care if you're calling a vision API or a translation API. The cache doesn't care if the response is an image description or OCR text. The error normalization doesn't care whether the other end is Mimo or OpenAI. A universal provider infrastructure, trapped inside a vision skill. First attempt: follow the ecosystem, hit the ceiling The largest similar project in the ecosystem is vision-support, with 19 providers. The pattern is standard—base class + subclasses, GoF Template Method. I followed it for v2.0. class BaseProvider { async analyzeImage ({ image , prompt , options }) { const { url , body , headers } = this . _buildRequest ( image , prompt , options ); const res = await apiRequest ( url , { body , headers }); return { content : await this . _parseResponse ( res ), model : this . _model }; } } class MimoProvider extends BaseProvider { ... } // 54 lines class OpenAIProvider extends BaseProvider { ... } // 45 lines class GeminiProvider extends BaseProvider { ... } // ~50 lines One subclass per provider. I expanded unblin

According to every product demo from the last four years, planning a trip is a killer use case for AI. Just tell it where you're going, they all promise, and your chatbot / agent / other buzzword will exhaustively search travel options, read up on all the fun things to do, check all the local […]

Blockchain performance is determined by consensus rules. There is no acceleration layer within the protocol. One of the most common misconceptions about blockchain technology is the belief that transaction speed can be dramatically increased through special tools, hidden settings, or external services. While applications can improve user experience and optimize how information is presented, they cannot change the fundamental rules that govern how blockchain networks process transactions. At the core of every blockchain is a consensus mechanism. Consensus is responsible for ensuring that independent participants agree on the validity and order of transactions before they become part of the permanent ledger. Whether a network uses Proof of Work, Proof of Stake, or another consensus model, transaction processing remains tied to the protocol rules that all participants follow. Every transaction moves through a structured lifecycle: submit → validate → confirm Submission introduces the transaction to the network. Validation ensures that the transaction complies with protocol requirements and contains legitimate data. Confirmation establishes agreement across the network and records the transaction as part of the blockchain. These stages are not optional. They are essential to maintaining consistency and trust within decentralized systems. Because blockchain performance is governed by consensus, there is no protocol-level acceleration layer that can bypass validation or force immediate finality. No application can override consensus. No service can remove verification requirements. No external process can alter the execution sequence established by the protocol. What users often interpret as slow performance is usually the result of network conditions such as congestion, validator workload, transaction prioritization, or fee market activity. These factors can influence confirmation times, but they do not change the underlying rules of the system. Blockchain networks are d

I've been running AI infrastructure for startups long enough to know one painful truth: when you're iterating fast, GPU costs will eat your runway before your product finds product-market fit. Last quarter alone, I watched a promising seed-stage company burn through $12,000 on self-hosted inference before they had 100 paying users. That's not scale — that's a funeral. Let me share what I've learned about making open-source models production-ready without bleeding cash. This isn't theory. This is what I've deployed across three startups, and it's saved us roughly 70% on inference costs while keeping our iteration speed at hyperscale. The Real Cost of Self-Hosting (Spoiler: It's Not Just GPUs) Here's the thing nobody tells you about self-hosting. The GPU rental is just the headline number. The real cost — the one that kills startups — is the hidden infrastructure tax. Model GPU Requirements Cloud Rental (Monthly) On-Prem (Amortized) 7-9B 1× A100 40GB $400-800 $200-400 13-14B 1× A100 80GB $600-1,200 $300-600 27-32B 2× A100 80GB $1,000-2,000 $500-1,000 70-72B 4× A100 80GB $2,000-4,000 $1,000-2,000 200B+ 8× A100 80GB $4,000-8,000 $2,000-4,000 Cloud pricing based on Lambda Labs / RunPod / Vast.ai reserved instances. But here's the kicker — and I learned this the hard way after two months of burning cash on a 32B model that got 50 requests per day: Hidden Cost Monthly Estimate GPU servers (idle or loaded) $400-8,000 Load balancer / API gateway $50-200 Monitoring & alerting $50-200 DevOps engineer time (partial) $500-3,000 Model updates & maintenance $100-500 Electricity (on-prem) $200-1,000 Total hidden costs $900-4,900/month That DevOps line alone is brutal. At scale, you need someone who can handle model updates, handle crashes at 3 AM, and optimise inference. At a startup, that's either your CTO (me) or a contractor who costs $150/hour. Neither is sustainable when you're trying to ship. The Break-Even Math That Changed My Architecture Decisions I ran these numbers befor

A new AI compliance service sits between AI models and end users to flag and replace any messages that might present a compliance problem.

Every inventory tool says real-time. Every single one. Open the settings. Find the sync frequency configuration. It says 15 minutes. Or 10. Or 30 on the cheaper plan. That's not real-time. That's a cron job. There's a meaningful architectural difference and the industry has collectively decided to pretend there isn't. I want to make the technical case for why this matters — and ask why so few tools have actually fixed it. What "real-time" actually means technically Real-time in distributed systems has a specific meaning. It means the system responds to events within a bounded, predictable latency — not on a schedule. javascript// This is NOT real-time — this is scheduled // Latency: up to 15 minutes (the full interval) setInterval(async () => { const stock = await getSourceOfTruth(); await syncToAllChannels(stock); }, 15 * 60 * 1000); // This IS real-time — event-driven // Latency: network round-trip (~milliseconds) orderEventBus.on('order.confirmed', async (event) => { const updated = await decrementStock(event.sku, event.qty); await propagateToAllChannels(updated); }); The first example responds to state changes on a schedule. The second responds to events as they happen. These are fundamentally different architectures with fundamentally different latency guarantees. Calling the first one "real-time" is technically incorrect. It's scheduled sync. The schedule is just short enough that most users don't notice — until they do. When users notice The failure mode is predictable and well documented: javascript// Flash sale scenario — 10x normal velocity const normalOrdersPerWindow = 500 / ((24 * 60) / 15); // ~5.2 const flashSaleOrdersPerWindow = normalOrdersPerWindow * 10; // ~52 // 52 orders processed against potentially stale stock // per 15-minute window // across multiple channels simultaneously // none of which know what the others have sold 52 orders per window. At 2% oversell rate — just over 1 oversell per window. Across 96 windows per day — nearly 100 oversel

Learn strategies for building interrupt-resilient AI workloads on Google Kubernetes Engine (GKE).

Engineering physical systems still depends on human talent, according to Impulse Space president Eric Romo.

In the previous article, we defined the forward pass for our neural network. Now, we will provide...

As part of their 20th Anniversary celebration, Dark Reading asked five cybersecurity industry leaders who wrote blogs or columns for them over the years to select their favorite piece and share their reflections on the topic today. This is my section. Renowned technologist and author Bruce Schneier contributed a column on June 20, 2010, warning about cryptography’s inability to secure modern networks , a point he says he has been trying to argue since 2000. “For a while now, I’ve pointed out that cryptography is singularly ill-suited to solve the major network security problems of today: denial-of-service attacks, website defacement, theft of credit card numbers, identity theft, viruses and worms, DNS attacks, network penetration, and so on...

This is a submission for the GitHub Finish-Up-A-Thon Challenge The Project That Got Away Three months ago, I started building something I was genuinely excited about: devto-mcp — a Model Context Protocol (MCP) server that would let AI agents interact with Dev.to's API natively. No more cobbling together curl commands. No more writing custom wrapper scripts for every AI tool. Just a clean, standards-compliant MCP server that any AI agent could plug into. I had a vision: an AI agent that could autonomously research trending topics, draft articles, publish them, track engagement, and iterate — all through a single protocol. The kind of thing that sounds simple until you actually sit down to build it. I got about 40% of the way through. Then life happened. A client project deadline. A cross-country move. A laptop that decided to corrupt its SSD at the worst possible time. The repo sat there on GitHub, collecting digital dust, with half-implemented tool functions and a README that promised way more than the code delivered. Sound familiar? If you've been a developer for more than a year, you have at least one of these ghost repos. That ambitious side project you were so sure you'd finish "next weekend." The one with the clever name and the detailed architecture doc but barely functional code. Two weeks ago, I saw the GitHub Finish-Up-A-Thon announcement. I looked at my list of abandoned repos. And I thought: it's time. What I Built: devto-mcp devto-mcp is a Model Context Protocol server that exposes Dev.to's entire API as MCP-compatible tools. If you're not familiar with MCP, it's the protocol that lets AI assistants like Claude, Cursor, and other coding agents interact with external tools in a standardized way. Think of it as a universal adapter between AI models and the services developers actually use. Here's the problem it solves: Every time you want an AI agent to interact with Dev.to — whether it's searching for articles, publishing a post, checking analytics, or ma

Stanford Just Published Rules for AI Coding Agents — What Devs Should Know Stanford dropped a document last week that every developer using AI coding tools should read. It's called CLAUDE.md , it's part of CS336 (Language Modeling from Scratch), and it's a brutally honest set of rules for how AI agents should — and shouldn't — help students write code. The document hit #1 on Hacker News for good reason. It doesn't just apply to students. If you use Claude Code, Cursor, Copilot, or any AI coding assistant, these rules expose the uncomfortable gap between what these tools can do and what they should do. GitHub just rolled out token-based billing for Copilot, and developers are furious. The tension is the same: when does AI assistance stop helping and start hurting? The Core Principle: Teaching Assistant, Not Solution Generator Stanford's position is unambiguous: "AI agents should function as teaching aids that help students learn through explanation, guidance, and feedback — not by completing assignments for them." This isn't academic hand-wringing. It's a design constraint that maps directly to professional development. The same agent that writes your PR in 30 seconds is also the one that leaves you unable to debug it when it breaks at 2 AM. The AI agent role framework from Stanford's CS336 guidelines: teaching assistant vs solution generator The document draws a hard line: What agents SHOULD do: Explain concepts by guiding toward understanding Review your code and point out areas for improvement Ask guiding questions instead of giving fixes Reference documentation, lectures, and debugging tools Suggest sanity checks, assertions, and profiler investigations What agents SHOULD NOT do: Write any Python or pseudocode Complete TODO sections in assignments Give solutions to problems Edit code in the student repo Convert requirements directly into working code Point to third-party implementations If you're a professional developer, the "SHOULD NOT" list probably looks extr

Original post: GitHub Copilot for Engineers: Getting Better Results GitHub Copilot moved to usage-based billing in June 2026, dropping the flat subscription model that made monthly costs predictable. For teams using it heavily across multiple projects, that shift puts a premium on being deliberate: reaching for the right model, keeping prompts focused, and building a configuration that produces good results without a lot of back-and-forth iteration. Many of us install the extension, start with the defaults, and only tune settings later. The defaults are a reasonable starting point, but they are not a full configuration. A small investment in setup changes how much you get out of every request on an ordinary working day, and that matters more now that each request has a cost attached. This guide covers the full path: getting the tooling in place, choosing models with cost in mind, layering global and project-level rules, and building out instructions, agents, and skills that make Copilot predictable across different kinds of work. Architecture overview Diagram fallback for Dev.to. View the canonical article for the full version: https://sourcier.uk/blog/github-copilot-for-engineers Before you start Subscription and VS Code extension You need an active GitHub Copilot subscription. Plans are available at individual, business, and enterprise tiers at github.com/features/copilot . Once active, all tools use your GitHub account credentials. The GitHub Copilot extension for VS Code is the primary day-to-day interface. Install it from the Extensions panel or via the CLI: code --install-extension GitHub.copilot The extension provides inline completions as you type, Copilot Chat in the sidebar, inline chat on any selection via Cmd+I / Ctrl+I , agent mode for multi-step tasks, and multi-file edits with a single review step. Defaults keep improving, so avoid cargo-culting old setting lists. Focus on non-default tweaks that improve signal quality and control usage: Setting Value

AI applications are generating more data than ever before. From model telemetry and user interactions to observability events and real-time analytics, modern systems need infrastructure that can ingest, process, and query massive datasets with low latency. That's exactly the problem ClickHouse is targeting with its latest release. The update introduces improvements across query performance, memory management, Kafka integration, lakehouse support, and developer tooling. While many of these changes appear incremental on the surface, together they highlight a much larger shift happening across the industry. One of the most notable additions is improved memory management for large joins. ClickHouse can now automatically spill hash joins to disk when memory usage exceeds configured thresholds. Instead of failing due to memory pressure, queries can continue running using more efficient execution strategies. For teams working with large feature tables, event enrichment, AI telemetry, or observability data, this can significantly improve reliability. The release also expands ClickHouse's Kafka capabilities with Schema Registry integration, AvroConfluent write support, metadata mapping, and zone-aware communication. These improvements make it easier to integrate ClickHouse into real-time event pipelines while reducing latency and unnecessary cross-zone traffic in cloud environments. Another major focus is support for modern lakehouse architectures. Improvements for Apache Iceberg and Apache Paimon strengthen ClickHouse's ability to query data stored in open table formats while maintaining high analytical performance. As more organizations separate storage and compute, ClickHouse is increasingly positioning itself as a high-speed query layer on top of cloud-native data lakes. Performance optimization remains a major theme throughout the release. Improvements include faster JOIN execution, better ORDER BY LIMIT performance, enhanced JSON processing, smarter index pruning, redu

In this article, author Aaditya Chauhan discusses the limitations of RAG pipelines based purely on vector search and how an internal omni-search application using Reciprocal Rank Fusion (RRF) that combines BM25 and vector results, can enhance the search solution. By Aaditya Chauhan

Most AI tutorials start with a setup checklist. Pick a model provider. Create an account. Wire up a...

Frontend automation has been getting pretty wild lately. 🫠 A few months ago, this comparison would...

OpenAI calls for global action on youth AI safety, proposing an international institute to strengthen safeguards, standards, and opportunities for young people.

If you write code for Adobe Commerce or Magento 2, you spend a lot of time waiting. Build times are slow, static content deployment takes forever, but the real time sink is documentation. The EAV architecture, nested XML layouts, and ever-changing GraphQL mutations mean you are constantly Alt-Tabbing to a browser to double check a syntax pattern. Every time you leave your IDE to search the Experience League portal, you lose your train of thought. You copy error codes, dig through unrelated search results, and try to find a working code snippet. It is exhausting. I wanted my coding assistant to just know this stuff without making me look it up. That is why I configured this MCP server. The adobe-commerce-docs-mcp package connects your IDE directly to the official Adobe documentation. It works with Cursor, Claude Desktop, VS Code, and Windsurf, pulling raw markdown docs right into your chat context. The architecture: bridging AI and docs Instead of relying on web search or stale training data, the server queries the live Adobe Experience League site. It indexes the content locally, caches pages, and handles queries via the MCP protocol. 1. BM25 search ranking The server parses the official Adobe sitemap and ranks pages using BM25 relevance scoring. This is the same search algorithm databases use to weigh search term frequency against document length. It means your assistant gets the most relevant setup guide first, not just the page that mentions a keyword the most. 2. Synonyms and fuzzy matching You do not have to query exact terminology. The search engine maps Magento specific synonyms: graphql searches also find pages with gql module searches also match extension cloud searches match ece It also corrects simple typos like chekout or catlog to checkout and catalog. 3. Local caching Network requests are slow, so the server uses two layers of caching: An in-memory cache for recent queries. A persistent file cache on your disk. Sitemap data lasts 24 hours, while downlo