标签：#ai

In the previous article, we defined the forward pass for our neural network. Now, we will provide...

As part of their 20th Anniversary celebration, Dark Reading asked five cybersecurity industry leaders who wrote blogs or columns for them over the years to select their favorite piece and share their reflections on the topic today. This is my section. Renowned technologist and author Bruce Schneier contributed a column on June 20, 2010, warning about cryptography’s inability to secure modern networks , a point he says he has been trying to argue since 2000. “For a while now, I’ve pointed out that cryptography is singularly ill-suited to solve the major network security problems of today: denial-of-service attacks, website defacement, theft of credit card numbers, identity theft, viruses and worms, DNS attacks, network penetration, and so on...

This is a submission for the GitHub Finish-Up-A-Thon Challenge The Project That Got Away Three months ago, I started building something I was genuinely excited about: devto-mcp — a Model Context Protocol (MCP) server that would let AI agents interact with Dev.to's API natively. No more cobbling together curl commands. No more writing custom wrapper scripts for every AI tool. Just a clean, standards-compliant MCP server that any AI agent could plug into. I had a vision: an AI agent that could autonomously research trending topics, draft articles, publish them, track engagement, and iterate — all through a single protocol. The kind of thing that sounds simple until you actually sit down to build it. I got about 40% of the way through. Then life happened. A client project deadline. A cross-country move. A laptop that decided to corrupt its SSD at the worst possible time. The repo sat there on GitHub, collecting digital dust, with half-implemented tool functions and a README that promised way more than the code delivered. Sound familiar? If you've been a developer for more than a year, you have at least one of these ghost repos. That ambitious side project you were so sure you'd finish "next weekend." The one with the clever name and the detailed architecture doc but barely functional code. Two weeks ago, I saw the GitHub Finish-Up-A-Thon announcement. I looked at my list of abandoned repos. And I thought: it's time. What I Built: devto-mcp devto-mcp is a Model Context Protocol server that exposes Dev.to's entire API as MCP-compatible tools. If you're not familiar with MCP, it's the protocol that lets AI assistants like Claude, Cursor, and other coding agents interact with external tools in a standardized way. Think of it as a universal adapter between AI models and the services developers actually use. Here's the problem it solves: Every time you want an AI agent to interact with Dev.to — whether it's searching for articles, publishing a post, checking analytics, or ma

Stanford Just Published Rules for AI Coding Agents — What Devs Should Know Stanford dropped a document last week that every developer using AI coding tools should read. It's called CLAUDE.md , it's part of CS336 (Language Modeling from Scratch), and it's a brutally honest set of rules for how AI agents should — and shouldn't — help students write code. The document hit #1 on Hacker News for good reason. It doesn't just apply to students. If you use Claude Code, Cursor, Copilot, or any AI coding assistant, these rules expose the uncomfortable gap between what these tools can do and what they should do. GitHub just rolled out token-based billing for Copilot, and developers are furious. The tension is the same: when does AI assistance stop helping and start hurting? The Core Principle: Teaching Assistant, Not Solution Generator Stanford's position is unambiguous: "AI agents should function as teaching aids that help students learn through explanation, guidance, and feedback — not by completing assignments for them." This isn't academic hand-wringing. It's a design constraint that maps directly to professional development. The same agent that writes your PR in 30 seconds is also the one that leaves you unable to debug it when it breaks at 2 AM. The AI agent role framework from Stanford's CS336 guidelines: teaching assistant vs solution generator The document draws a hard line: What agents SHOULD do: Explain concepts by guiding toward understanding Review your code and point out areas for improvement Ask guiding questions instead of giving fixes Reference documentation, lectures, and debugging tools Suggest sanity checks, assertions, and profiler investigations What agents SHOULD NOT do: Write any Python or pseudocode Complete TODO sections in assignments Give solutions to problems Edit code in the student repo Convert requirements directly into working code Point to third-party implementations If you're a professional developer, the "SHOULD NOT" list probably looks extr

Original post: GitHub Copilot for Engineers: Getting Better Results GitHub Copilot moved to usage-based billing in June 2026, dropping the flat subscription model that made monthly costs predictable. For teams using it heavily across multiple projects, that shift puts a premium on being deliberate: reaching for the right model, keeping prompts focused, and building a configuration that produces good results without a lot of back-and-forth iteration. Many of us install the extension, start with the defaults, and only tune settings later. The defaults are a reasonable starting point, but they are not a full configuration. A small investment in setup changes how much you get out of every request on an ordinary working day, and that matters more now that each request has a cost attached. This guide covers the full path: getting the tooling in place, choosing models with cost in mind, layering global and project-level rules, and building out instructions, agents, and skills that make Copilot predictable across different kinds of work. Architecture overview Diagram fallback for Dev.to. View the canonical article for the full version: https://sourcier.uk/blog/github-copilot-for-engineers Before you start Subscription and VS Code extension You need an active GitHub Copilot subscription. Plans are available at individual, business, and enterprise tiers at github.com/features/copilot . Once active, all tools use your GitHub account credentials. The GitHub Copilot extension for VS Code is the primary day-to-day interface. Install it from the Extensions panel or via the CLI: code --install-extension GitHub.copilot The extension provides inline completions as you type, Copilot Chat in the sidebar, inline chat on any selection via Cmd+I / Ctrl+I , agent mode for multi-step tasks, and multi-file edits with a single review step. Defaults keep improving, so avoid cargo-culting old setting lists. Focus on non-default tweaks that improve signal quality and control usage: Setting Value

AI applications are generating more data than ever before. From model telemetry and user interactions to observability events and real-time analytics, modern systems need infrastructure that can ingest, process, and query massive datasets with low latency. That's exactly the problem ClickHouse is targeting with its latest release. The update introduces improvements across query performance, memory management, Kafka integration, lakehouse support, and developer tooling. While many of these changes appear incremental on the surface, together they highlight a much larger shift happening across the industry. One of the most notable additions is improved memory management for large joins. ClickHouse can now automatically spill hash joins to disk when memory usage exceeds configured thresholds. Instead of failing due to memory pressure, queries can continue running using more efficient execution strategies. For teams working with large feature tables, event enrichment, AI telemetry, or observability data, this can significantly improve reliability. The release also expands ClickHouse's Kafka capabilities with Schema Registry integration, AvroConfluent write support, metadata mapping, and zone-aware communication. These improvements make it easier to integrate ClickHouse into real-time event pipelines while reducing latency and unnecessary cross-zone traffic in cloud environments. Another major focus is support for modern lakehouse architectures. Improvements for Apache Iceberg and Apache Paimon strengthen ClickHouse's ability to query data stored in open table formats while maintaining high analytical performance. As more organizations separate storage and compute, ClickHouse is increasingly positioning itself as a high-speed query layer on top of cloud-native data lakes. Performance optimization remains a major theme throughout the release. Improvements include faster JOIN execution, better ORDER BY LIMIT performance, enhanced JSON processing, smarter index pruning, redu

In this article, author Aaditya Chauhan discusses the limitations of RAG pipelines based purely on vector search and how an internal omni-search application using Reciprocal Rank Fusion (RRF) that combines BM25 and vector results, can enhance the search solution. By Aaditya Chauhan

Most AI tutorials start with a setup checklist. Pick a model provider. Create an account. Wire up a...

Frontend automation has been getting pretty wild lately. 🫠 A few months ago, this comparison would...

OpenAI calls for global action on youth AI safety, proposing an international institute to strengthen safeguards, standards, and opportunities for young people.

If you write code for Adobe Commerce or Magento 2, you spend a lot of time waiting. Build times are slow, static content deployment takes forever, but the real time sink is documentation. The EAV architecture, nested XML layouts, and ever-changing GraphQL mutations mean you are constantly Alt-Tabbing to a browser to double check a syntax pattern. Every time you leave your IDE to search the Experience League portal, you lose your train of thought. You copy error codes, dig through unrelated search results, and try to find a working code snippet. It is exhausting. I wanted my coding assistant to just know this stuff without making me look it up. That is why I configured this MCP server. The adobe-commerce-docs-mcp package connects your IDE directly to the official Adobe documentation. It works with Cursor, Claude Desktop, VS Code, and Windsurf, pulling raw markdown docs right into your chat context. The architecture: bridging AI and docs Instead of relying on web search or stale training data, the server queries the live Adobe Experience League site. It indexes the content locally, caches pages, and handles queries via the MCP protocol. 1. BM25 search ranking The server parses the official Adobe sitemap and ranks pages using BM25 relevance scoring. This is the same search algorithm databases use to weigh search term frequency against document length. It means your assistant gets the most relevant setup guide first, not just the page that mentions a keyword the most. 2. Synonyms and fuzzy matching You do not have to query exact terminology. The search engine maps Magento specific synonyms: graphql searches also find pages with gql module searches also match extension cloud searches match ece It also corrects simple typos like chekout or catlog to checkout and catalog. 3. Local caching Network requests are slow, so the server uses two layers of caching: An in-memory cache for recent queries. A persistent file cache on your disk. Sitemap data lasts 24 hours, while downlo

Meta Description: Learn how to build AI agents with persistent memory using Azure AI Foundry Memory Service. A complete developer guide covering concepts, memory types, scope, provisioning, and a full Python implementation with the Foundry Hosted Agent Framework. Persistent Agent Memory with Azure AI Foundry: A Complete Developer Guide Table of Contents Introduction What Is Azure AI Foundry Memory? Memory Types Deep Dive Memory Architecture: How It Really Works Access Patterns: Tool vs. Low-Level API Understanding Scope Hands-On: Provisioning a Memory Store Hands-On: Building the Foundry Hosted Memory Agent Running & Deploying the Agent Security Best Practices Quotas, Limits & Regional Availability Conclusion + Next Steps Introduction Imagine you've just shipped a polished AI assistant for your SaaS product. Users log in, ask questions, and get sharp, helpful responses. The launch goes well. Then the complaints start rolling in. "Why does it keep asking me for my name every single session?" "I told it last week that I'm vegetarian — why is it recommending steak again?" "It feels like talking to someone with amnesia." This is the stateless agent problem — one of the most frustrating gaps between the promise of conversational AI and the lived reality of production deployments. Every conversation starts from a blank slate. The agent has no idea who it is talking to, what that person prefers, or what was discussed yesterday, last week, or a month ago. The result is a user experience that feels hollow and repetitive — the opposite of the intelligent, personalized assistant your users were promised. The solution is persistent memory, and Azure AI Foundry Memory is Microsoft's production-grade answer to exactly this problem. Introduced as part of the Azure AI Foundry platform, the Memory Service gives agents the ability to remember facts across sessions, distill long conversation histories into concise summaries, and retrieve the right context at the right moment — all wit

The dominant production failure mode for LLM agents in 2026 isn't bad reasoning — it's capacity. Here's what the data shows, why nobody demos it, and the capacity-engineering patterns that actually keep agents alive under load.

I'm excited to announce Elmo , an open source AEO / AIO / GEO tool that tracks AI visibility. It's the most popular, regularly maintained AI visibility tracker on GitHub. A lot of tools in this space are very expensive or have a lot of lock in. Really you just need to run prompts against LLMs, track mentions, and analyze citations. I'm also using it to improve the AI visibility for Elmo itself (although it's still early days). All you need to run is Docker and a web scraper API key (like BrightData) and OpenAI/Anthropic/Mistral/OpenRouter API key, and you're good to go. There's a lot coming soon (sentiment analysis, content simulations, etc) but it's already in use by a number of e-commerce and SaaS sites. Curious to hear what you think!

Ever received a WebSocket tick stream for US stocks and wondered why your indicators behave oddly outside regular hours? The raw data doesn’t tell you which session a trade belongs to, but identifying the session is crucial for signal quality. Here’s a clean, no-dependency-heavy way to do it in Python. Quick Session Reference Session US Eastern Time Data Characteristics Pre-market 04:00-09:30 Sparse trades, choppy moves Regular hours 09:30-16:00 Dense liquidity, smooth price action After-hours 16:00-20:00 Volatility often triggered by news Method 1: Timestamp Conversion Almost every API sends a UTC timestamp. Convert it to US/Eastern and classify. from datetime import datetime import pytz # US Eastern timezone et = pytz . timezone ( ' US/Eastern ' ) def get_session ( ts ): t = datetime . fromtimestamp ( ts , et ) # Check pre-market window if t . hour < 9 or ( t . hour == 9 and t . minute < 30 ): return " pre " # Regular session if t . hour < 16 : return " regular " # After-hours return " after " Method 2: Use a Session Status Field If your provider sends a field like sessionType , you can skip the timezone math. Just make sure to test edge cases at session boundaries. Live Integration Example Using a WebSocket feed (like AllTick’s market data stream) that includes a timestamp, I label ticks on the fly. import websocket import json from datetime import datetime import pytz # US Eastern timezone et = pytz . timezone ( ' US/Eastern ' ) def session ( ts ): t = datetime . fromtimestamp ( ts , et ) if t . hour < 9 or ( t . hour == 9 and t . minute < 30 ): return " pre " elif t . hour < 16 : return " regular " else : return " after " def on_message ( ws , message ): data = json . loads ( message ) s = session ( data [ " timestamp " ]) print ( f " { data [ ' symbol ' ] } | { s } | { data [ ' price ' ] } | { data [ ' volume ' ] } " ) # Open WebSocket connection ws = websocket . WebSocketApp ( " wss://ws.alltick.co/stock " , on_message = on_message ) ws . run_forever () Effic

When we started experimenting with AI translations, we assumed the biggest challenge would be accuracy. We were wrong. The harder problem was preference. Give two AI models the same sentence, and both translations can be technically correct. Yet people almost always have a favorite. One sounds more natural. One feels more human. One is the version they'd actually use. That observation eventually led us to build Parley , a simple game where players compare two translations and choose the better one. What happened next surprised us. People became highly engaged with a task that looked almost trivial. They started debating word choices, discussing tone, and noticing subtle differences between translations. Some users spent far longer interacting with translation examples than they ever would reading documentation or language-learning materials. It highlighted something interesting about AI products: evaluation can be more engaging than generation. Most AI interfaces focus on creating content. But humans are often much better at judging quality than producing it from scratch. Asking someone to choose between two outputs requires less effort while still training their intuition. The experiment also changed how I think about language learning. Traditional language apps often rely on memorization and repetition. But comparing alternatives forces you to think about meaning, context, and natural expression. You're not just learning vocabulary, you're developing taste. And in a world where AI can generate endless content, taste might become one of the most valuable skills we can build. Have you seen similar patterns in AI products where evaluation turns out to be more engaging than creation?

Last week I built a little dashboard with Claude. Took maybe ten minutes. Then I spent the next hour trying to get it online. ssh in, install docker, write a Dockerfile, set up nginx, run certbot, certbot fails, read the log, oh the DNS hasn't propagated, wait, run it again, open port 443, realize ufw was blocking it the whole time. By the time it was live I'd forgotten what the app even did. I've done that maybe a few hundred times by now. I'm a backend guy, I'm fast at it. But fast at something boring still means doing the boring thing. So at some point I just thought: the AI already wrote the app. Why does it stop right when the annoying part starts? Why doesn't it just deploy the thing itself? The reason is it has no hands. The model can write you a perfect docker-compose file. It can't ssh into your box and run it. No connection to your server, nowhere to hold your key. So I gave it hands. It's an MCP server, vibe-deploy. You hook it up once to a VPS you own, and then you just say "deploy this to notes.mydomain.com" and the agent containerizes it, ships it over ssh, sets up nginx, gets a real Let's Encrypt cert. Node, Python, Go, plain static. It figures out the stack and writes the Dockerfile. No PaaS, no per-seat pricing, no free tier you'll outgrow. A $5 box runs a dozen of my projects and I own the whole thing. The "you gave an AI root on your server??" reaction is fair, so: it runs locally, your key never leaves your laptop. I used a separate ssh key scoped to deploys, not my real one, and you should too. It checks the server host key before connecting and validates everything you pass it, because a deploy tool that pastes your input straight into a shell is a horror story waiting to happen. I had someone audit the security before I put it out. They found two real bugs. I fixed them. It's free and MIT, on GitHub and npm as @cgnguyen/vibe-deploy . I built it because I wanted it. If you live in the same gap between "it works on localhost" and "it's online",

Back in February, a friend asked me to join his hackathon team. My first reaction wasn't excitement. It was: "Can I even contribute anything?" I remember repeatedly telling him not to add dead weight to the team and to find someone better. He kept insisting that it didn't matter and that I should just join. The funny thing is, I still don't think I've done anything extraordinary since then. No big startup. No crazy achievement. No overnight success story. Mostly just hundreds of hours of learning, building random things, breaking them, fixing them, and realizing how much I still don't know. But today I caught myself doing something weird. I'm the one thinking about who to bring into a team. And for the first time, I don't immediately feel like I'd be dead weight. Not because I know everything now. Just because I've reached the point where I can look at a problem and genuinely believe that, given enough time, I'll figure out how to contribute. It's a small shift, but it feels important. A few months ago I was wondering if I belonged on a team at all. Today I'm wondering who should be on mine. 👀

In the first post I told you the story: 20 years as a developer, six months of being scared of AI, $800 in burned tokens, and a stubborn agent named Claudio who taught me — by failing over and over — how to ask for things properly. This post is the method that came out of all that pain. Five rules, one per letter of FORGE. I want to be honest about one thing up front: this is not a framework I invented at a whiteboard. Every rule here is a scar. Each one is the lesson from a specific mistake that cost me money, time, or sleep. I'm going to tell you the mistake first, and then the rule. Because the rule only makes sense once you've felt the pain that created it. Let's go. First, the idea behind all of it Here's the thing nobody told me when I started: A task is not a post-it. It's a contract. When you ask an AI agent for something with no structure, you're not giving an order — you're placing a bet. The agent interprets, assumes, improvises, and the result depends on how much context it managed to reconstruct on its own. Sometimes it guesses right. Often it doesn't. And you only find out after the tokens are gone. The Forge Method is the agreement between you and your agents: you bring the structure, they execute with precision . That's it. Five rules to hold up your end of that contract. F — Focused The mistake: My early tasks had titles like "Fix bug" and "Update stuff." I'd come back twenty minutes later to find the agent had fixed a bug — just not the one I meant. It wasn't wrong. It just had no way of knowing which thing I was talking about. **The rule: **If the title is vague, the task is vague. Vague in, vague out. A focused title needs a domain, an action, and a scope. Two words minimum, and no generic placeholders. ❌ Rejected: - "Fix bug" - "Update auth" - "Do the thing" ✅ Accepted: - "Fix authentication timeout on Nginx reverse proxy" - "Update JWT expiry from 1h to 24h in src/auth/config.ts" The test: Read the title with no context. Do you know the domain,

A Google Sheets add-on with 4 million installs has been silently sending your spreadsheet cell data to OpenAI. Hacker News discovered this 9 days ago, when a PromptArmor security report went viral. Last night — when any normal HN story would be decaying into oblivion — it exploded a second time, gaining 59 points and 23.9% in a single day. I track Hacker News every day. I've seen 518 posts come and go over 319 days of systematic monitoring. Most stories follow a predictable death curve: peak on Day 1, bleed points for 2–3 days, then vanish from the Algolia search layer entirely. A post that survives 5 days is exceptional. One that accelerates on Day 9 is something else entirely. Here's the trajectory: 104 → 106 → 148 → 199 → 219 → 247 → (gap) → (gap) → 306 points. Over 9 days, that's a +194.2% total gain. But the real story is the shape of the curve. From Day 5 to Day 6, it added 20 points. From Day 6 to Day 7, roughly 28. Then on Day 9, it jumped 59 points — a single-day increment that's 2–3x the earlier daily gains. 109 comments and counting. This isn't normal HN physics. This is a second wave of attention — the kind that happens when a story percolates through social media and circles back to the search layer with amplified urgency. People didn't just read this and move on. They came back. The vulnerability itself is brutally simple: ChatGPT for Google Sheets, a popular add-on that lets you use GPT inside spreadsheets, sends cell contents to OpenAI as part of every API call. The PromptArmor research documented specific data flows — workbook data that users never intended to share, flowing to OpenAI's servers as part of "context." No breach required. No malicious actor. Just the plugin working as designed, with a data-sharing envelope nobody bothered to read. I've spent 319 days cataloging every AI security signal that hits HN's front page. Patterns emerge when you watch this long. The data is unambiguous: application-layer AI security is the most underserved mark