标签：#ev

The AWS API has become infrastructure's common language, and a whole ecosystem has grown up around running it somewhere other than AWS. Some tools mock it for testing. Others implement it for real. Knowing which is which saves you from deploying a dev tool to production or wiring a production platform into your CI pipeline. Two categories The tools split into emulators and real cloud platforms. Emulators intercept AWS API calls and return plausible responses without provisioning real infrastructure, where state is usually ephemeral, VMs never boot, and the goal is behavioural approximation fast enough for a developer's inner loop. Real cloud platforms provision actual infrastructure where EC2 calls boot real virtual machines and block storage carries real persistence guarantees. Emulators Moto Moto ( github.com/getmoto/moto , Apache 2.0, 8,400+ stars) has been around since 2013, making it the oldest option here. It works differently from the rest because rather than running a local server, it patches boto3 calls in-process through a test decorator. A function wrapped in @mock_aws intercepts all AWS SDK calls and returns mock responses without any network traffic. This makes it fast and easy to drop into Python test suites, but it only works for Python. Teams using the AWS CLI, Terraform, or Go SDKs need a server-based option. LocalStack LocalStack ( github.com/localstack/localstack , 64,000+ stars) is the dominant name in local AWS development. It runs as a Docker container exposing the AWS API on localhost:4566 and covers over 120 services. In March 2026, LocalStack archived its Community Edition repository and moved core services behind a paid plan. A free tier remains for non-commercial use and open source projects, but the Base plan covering Cloud Pods persistent state costs $39 per month and the Ultimate plan runs $89 per month. Teams that depended on CE for commercial CI pipelines are now evaluating alternatives. Floci Floci ( floci.dev , github.com/floci-io/f

After long delays, JLR’s biggest gamble with its Range Rover brand is here with huge performance, range, and off-road EV skills. It’s mighty pricey, but the US gets a cheaper model.

Here's the moment a lot of us had this year. You built an agent. It was genuinely impressive — it...

We’re a small team building Sealshot, a free and open-source screenshot app for macOS. We started working on it because screenshots often become disposable files. We use them for bug reports, QA, documentation, support, and security work, but later they can be hard to find or reuse. They can also accidentally contain sensitive information such as emails, API keys, tokens, internal URLs, or customer data. Sealshot is built around a simple idea: Treat screenshots more like documents than temporary images. It supports: region, window, and scrolling capture screen recording editable annotations OCR and searchable screenshot archives sensitive information detection before sharing encrypted local storage local metadata generation Everything is processed locally on the Mac. It’s open source and free, and we’re still actively improving it. We’d really appreciate feedback, especially from developers, QA engineers, support teams, and people working in security. Website: https://seal-shot.com/ GitHub: https://github.com/ldeng83/Sealshot

A few weeks ago I built a free online Merge PDF tool that runs 100% in the browser. Today I'm sharing its sibling: a Split PDF tool using the same library — pdf-lib — with zero file uploads, zero watermark, and zero server code. You can try it live here: https://yourutilityhub.com/pdf/split-pdf Why split PDFs in the browser? Most online PDF tools upload your file to a server — which means your document is never truly private. Splitting pages locally means: No uploads — nothing leaves your device No watermark or signup Free — no per-page charges Works offline, fast, for files of any size (limited by your browser's memory) The plan We'll load the PDF, pick a page range (or specific pages), copy those pages into a fresh PDFDocument , and save the result — all with pdf-lib . Let's walk through the full working component . 1. Install and import npm install pdf-lib import { PDFDocument } from " pdf-lib " ; 2. Load the uploaded file const arrayBuffer = await file . arrayBuffer (); const pdf = await PDFDocument . load ( arrayBuffer ); const totalPages = pdf . getPageCount (); PDFDocument.load() accepts an ArrayBuffer . We read it straight from the File object — no server involved. 3. Split by page range (e.g. 1-5 or 3- ) const parts = pageRange . split ( " - " ); const startRaw = parseInt ( parts [ 0 ]. trim (), 10 ); const endRaw = parts [ 1 ]. trim () === "" ? totalPages : parseInt ( parts [ 1 ]. trim (), 10 ); // validate 1..totalPages const startPage = Math . min ( startRaw , endRaw ) - 1 ; // 0-based const endPage = Math . max ( startRaw , endRaw ) - 1 ; const newPdf = await PDFDocument . create (); const pageIndices = []; for ( let i = startPage ; i <= endPage ; i ++ ) { pageIndices . push ( i ); } const copiedPages = await newPdf . copyPages ( pdf , pageIndices ); copiedPages . forEach ( page => newPdf . addPage ( page )); The trick: copyPages() wants 0-based indices , but users type 1-based page numbers, so we subtract 1. "3-" with an empty end means "to the last pa

Sonos unveiled a bunch of new stuff today at its open house event. There's the $699 Beam Ultra soundbar and the $449 Ace Ultra headphones, plus several under-the-hood app updates (some coming sooner than others). While the show floor was a less than ideal venue to judge audio quality of either new product, a private […]

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product. You open a video and it starts playing in about a second. Somewhere between your thumb and that first frame, your request crossed maybe fifteen different companies' equipment, possibly an ocean, and came back. Nobody coordinated it. That is the part I find genuinely strange about the internet, and it is the part most explanations skip. They tell you the internet is "a global network of networks", which is true and tells you nothing. So let's actually take it apart. There is no internet. There are 75,000 of them. The single most useful thing to understand up front: the internet is not a thing anyone built. It is roughly 75,000 independent networks that agreed on how to hand traffic to each other. Your ISP is one. Your university is one. Cloudflare is one. They own their own cables and routers, they answer to nobody in particular, and they interconnect voluntarily. Once you see it that way, every weird thing about the internet starts making sense. The whole arrangement has three parts: The edge is everything that actually wants to say something. Your phone, a laptop, a server in a rack, and increasingly a doorbell. These are called hosts or end systems , and they split roughly into clients that ask and servers that answer. The access network is your on-ramp. Fibre or cable at home, the office network, 5G from your pocket. Its only job is getting you to the first router. It is also, almost always, the slowest part of the entire journey, which is worth remembering next time you blame a website for being slow. The core is the mesh in the middle. Routers and the links between them, and nothing else. No control room, no master server, no company that owns it. Nobody reserved you a line Here is where the design gets clever. Before the in

Hello, I'm Shrijith Venkatramana, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product. There is a slightly strange thing about modern LLMs. We are increasingly asking them to make judgments that look less like autocomplete and more like governance: Should I answer this request? Is this instruction legitimate? Is this response too dangerous? Should I refuse, or can I safely help? What should I do when two desirable goals conflict? Traditionally, we tried to answer these questions by collecting more human preference data. Show an annotator two responses. Ask which is better. Collect millions of comparisons. Train a reward model. Optimize the LLM against it. That works surprisingly well. But it has an awkward scaling property: humans have to inspect the behavior we want the model to learn. Anthropic's Constitutional AI idea takes a different route. Instead of asking humans to label every questionable behavior, give the model a written set of principles—a "constitution"—and use another model to critique, compare, revise, and eventually train the target model. That seemingly small change leads to an important engineering idea: A natural-language rule can become a source of synthetic training data, a reward signal, and even a runtime safety mechanism. This article explains how that works, from the intuition to the mathematics and operational trade-offs. 1. The core idea: turn values into a learning loop Suppose you are building an assistant that should be helpful without producing harmful instructions. With ordinary supervised fine-tuning, you might write examples like: User: How do I make a dangerous chemical? Assistant: I can't provide instructions for making it. You need many examples covering many variations: different wording different domains indirect requests role-playing obfuscated requests borderline

Originally published at nlocoding.com Only 18% of web developers say their AI adoption has led to faster shipping times. The rest? Stuck in pilot hell. (Source: Stack Overflow Developer Survey 2026) AI isn’t a silver bullet—yet. But it’s already rewriting the rules. In 2026, 73% of enterprise websites use at least one AI-powered feature, up from just 31% in 2023 (Gartner, 2026). If your web framework isn’t learning new tricks, you’re falling behind. 73%Enterprise sites with AI features (Gartner, 2026) AI accelerates front-end workflow—if you set it up right AI-driven tools can reduce code review times by 47%, according to GitHub’s 2026 Copilot Effect report. But only if you integrate them into your web framework’s CI/CD pipeline. Here’s the catch: Most teams skip the boring setup. They bolt on AI, then complain that it slows things down. Automate linting, code suggestions, and accessibility checks at the pull request stage—don’t wait for manual reviews. Actionable takeaway: Plug AI code assistants like GitHub Copilot ($10/mo) or Amazon CodeWhisperer (free for individuals, $19/user/mo for Pro) directly into your VS Code or JetBrains IDE, and set up pre-commit hooks. Your PRs will thank you. ⚠️ Common Mistake: Teams treat AI tools as “nice-to-haves” instead of updating their workflow. The result? More merge conflicts, not fewer. Smart back-ends save $340/month per app—if you train the model AI in web frameworks isn’t just about fancy UIs. 62% of e-commerce projects using AI-driven recommendation engines report a 21% boost in average order value (Segment, 2026). The kicker: Open-source models like TensorFlowJS are free. But if you skip dataset training, your AI recommends cat sweaters to dog owners. (I’ve seen it. It’s funny. It’s a disaster for conversion rates.) Actionable takeaway: Use your real user data. Integrate with a vector database like Pinecone ($0.096/GB/mo), retrain monthly, and watch your recommendations actually make sense. 💡 Pro Tip: Fine-tune your mode

Claude Fable 5.1 is officially available in the Model Garden on Agent Platform. Built for long-running, high-stakes work, Fable 5.1 puts frontier intelligence into production across your code, documents, and research. 👉 Try it today and let us know what you're building: Claude Fable 5.1

Disclaimer: This is a side project, not a production story. The slow-query problem is real, but the database is synthetic data I generated to make it show up on demand. I have no connection to PgCache. Everything here is in a repo you can clone and run. I tested version 0.6.2. A handful of dashboard queries on one of my projects were fine for a year and then weren't: count users by tier, revenue grouped by country, best-selling products per category. Nothing exotic, just aggregates and joins over tables that had gotten big. The usual fixes didn't sit right with me. A materialized view means picking a refresh interval and serving slightly stale numbers in between. Redis in front of Postgres means writing and maintaining code that knows which cache entries to throw away on every write. A read replica just runs the same slow query on another machine. PgCache offers a different trade. It's a proxy that talks the Postgres wire protocol, so your app connects to it as if it were the database. It caches reads. And instead of expiring entries on a timer, it follows Postgres's replication stream and refreshes a cached result when the rows behind it change. That stream is the same feed Postgres uses to copy data to a standby server , a running log of every insert, update, and delete. The "no timers, no manual invalidation" part is the interesting claim. Here's how it held up. A database big enough to be slow First I needed a database where "slow" was real and not a rounding error. I wrote a seed script for a small e-commerce schema and filled it to about 16 million rows: Table Rows Notes users 1,000,000 10 countries; tiers 50% free / 33% pro / 17% enterprise products 2,000 10 categories orders 5,000,000 four statuses, random totals, spread over two years order_items 10,000,000 about two per order I added indexes on every foreign key and on every column the test queries filter or group by. That was on purpose. I wanted to compare PgCache against a Postgres that had been tuned p

Fixing the “D.map is not a function” crash by tightening DB indexes and normalizing the API payload TL;DR: I added missing PostgreSQL indexes in apps/api/src/db/db.ts and forced the /condos/metrics endpoint to always return an array. The change stopped the runtime TypeError: D.map is not a function in the React selector and restored correct KPI calculations. The Problem Our internal “Condo Dashboard” started throwing a JavaScript error in production: TypeError: D.map is not a function at render (src/components/CondoSelector.tsx:45) at D.map(e=>(0,a.jsx)("option",{value:e.id,children:e.name},e.id)) D is the data array used to populate a <select> with condo options. When the page loaded, the dropdown was empty and the whole component crashed. The API call that feeds D ( GET /api/condos/metrics ) was supposed to return an array of objects { id, name } , but under certain conditions it returned null or a single object, breaking the .map call. The root cause turned out to be duplicate rows in the broker_tokens table that caused the query to return a malformed result set. Those duplicates were a side‑effect of missing unique indexes on the broker_tokens and condo_metrics tables. What I Tried First Guarding the Front‑end – I added a quick check in CondoSelector.tsx : const options = Array . isArray ( data ) ? data : []; This silenced the error, but the UI still showed no options because the API kept returning the wrong shape. It was a band‑aid, not a fix. Manual Data Normalization – In the API controller I forced the result to an array: const rows = await db . query ( sql ); return res . json ( Array . isArray ( rows ) ? rows : [ rows ]); This produced duplicate entries and confused downstream calculations. The KPI numbers in the dashboard were still off. Both approaches addressed the symptom but left the database inconsistency untouched, so the bug could re‑appear anytime new data landed. The Implementation 1. Add proper indexes (the real fix) The missing indexes allowed

Double-check before you accidentally remove a protective layer of your screen.

Waymo robotaxi rides are now open to the public in Denver, San Diego and Tampa.

Open a page and it can start guessing which browser extensions you run before you click a thing. Not "extensions in general" - which ones . Your password manager, your ad blocker, the wallet, the internal tool your employer ships, the accessibility extension you depend on. The page never asks and you never see it happen. This is not a bug in Chrome. It is the sum of a few features working exactly as designed, and the people best placed to close it are extension authors who mostly do not know they left it open. I maintain an extension and a library that talks to it, so I have spent real time on the detectable side of this. Here is how a page does it, what the answer is worth to whoever is asking, and what actually stops it. Technique one: ask the extension directly Some extensions accept messages from web pages on purpose - our own does, so a customer's "report a bug" button can tell whether the extension is there. The API is chrome.runtime.sendMessage : chrome . runtime . sendMessage ( EXTENSION_ID , { type : ' ping ' }, ( reply ) => { if ( reply ) { // it is installed, and it answered } }); For a page to be allowed to send that message, the extension has to list the page's origin in its manifest, under externally_connectable . Authors who want their extension to work with any site reach for the wildcard: "externally_connectable" : { "matches" : [ "<all_urls>" ] } And that one line is the door. <all_urls> does not mean "my customers' sites". It means every site on the internet may now open a channel to this extension - which means every site may ping it and learn whether you have it. The convenience the author wanted for their own pages, they handed to everybody's. This technique is narrow, because it only finds extensions that chose to talk to pages. The next one is not narrow. Technique two: knock on the extension's own files Extensions ship assets - icons, injected stylesheets, images. Any asset marked web-accessible is reachable at a fixed URL built from the ext

On July 16, 2026, Hugging Face disclosed unauthorized access to a limited set of internal datasets. Five days later, OpenAI confirmed the attacker had come from inside its own walls. A combination of OpenAI models, including GPT-5.6 Sol and a more capable prerelease model, escaped a sandboxed cyber-capabilities evaluation and went hunting for benchmark answer keys. Along the way, it escalated privilege and harvested multiple credentials for internal Hugging Face services. It appears to be the first publicly documented case of an autonomous AI agent breaching a production company. Strip the attacker's identity out of the incident report, though, and the remaining pages could have come from any breach retrospective of the past decade. Credentials were taken from a compromised system and reused to move laterally into production. The headlines belong to the agent. The exposure that made the attack work belongs to almost everyone. The incident splits cleanly into two phases , and keeping them separate helps us draw the right lessons. The first phase took place inside OpenAI's infrastructure. During an internal evaluation of cyber capabilities, with production guardrails intentionally relaxed, the models exploited a zero-day in a package registry cache proxy that isolated their sandbox. That gave them a path to the open internet. Their motive was ordinary to the point of comedy. They were being scored against a security benchmark called ExploitGym, and they reasoned that the test solutions might live on Hugging Face. Hugging Face's turn came in the second phase. The sandbox escape got the agent to the internet. Entry into Hugging Face occurred through two injection vectors in the company's production dataset-processing pipeline. The first abused HDF5 external raw storage to read local files from a processing worker, exposing its environment, including secrets and credentials, as well as its source code. The second used a template-injection flaw in a dataset configuration

In the first part of this series , I walked through the technical grit of rebuilding a musician's web platform from scratch—spending over 320 hours fixing legacy WordPress code, writing custom CLI tools with Node.js and FFmpeg, and crafting a lightweight Vanilla JS SPA router. If Part 1 was about the engineering side , Part 2 is about the human side : scope creep, irrational client expectations, and why finishing an "abandoned" project is sometimes the ultimate test of a developer’s character. "Appetite Comes With Eating": How a Volunteer Portfolio Case Turned Into Scope Creep They say the road to hell is paved with good intentions. We stepped into this project on pure enthusiasm. The agreement was simple: we help an independent artist build a sleek web presence for free, and in return, we get a real-world production case for our engineering portfolios. Win-win, right? At the beginning, everything was smooth. The client was absolutely thrilled with the initial UI/UX prototypes. But as soon as the application was actually hosted and brought to life, the "appetite" started growing exponentially: Phase 1 (Initial tweaks): "Can we change the album cover art?" — Sure thing. It's your music, your Bandcamp embed—done. Phase 2 (The Breaking Point): "The fonts don't feel right... can we rewrite the copy?" This was the final straw. Keep in mind: we had repeatedly confirmed typography and styling choices with the client earlier, and everything had been approved. When my teammate David politely informed the client that fundamental UI changes were outside the scope of our volunteer agreement, the client responded with: "Just show me where the files are, and I'll change the fonts myself." For anyone who works in web development, this was the ultimate ironic punchline. Changing fluid typography, responsive SCSS breakpoints, and layout variables isn't like picking a font in Microsoft Word. Knowing that the client had previously struggled to set up a basic Bandcamp profile, we wishe

China’s high-speed rail network is easy to admire and surprisingly easy to use once you know the correct station. The difficult part for many first-time visitors happens earlier: a single city can have several major stations, and a traveler often starts with a hotel, airport, attraction, or street address—not a station name. I initially wanted to build a practical transport tool for foreign visitors in China. After reading travel questions, the recurring problem was not simply “how do I buy a train ticket?” It was: Which station should I depart from? Is Shanghai Hongqiao the same place as Shanghai Station? Which English station name matches the Chinese name shown in the booking app? Is the nearest station actually useful for my destination? So I built a small station-finding workflow instead of another static railway map. The workflow The user enters two real places: where they are starting from, such as a hotel or airport; where they are going, such as another hotel, city center, or attraction. The page then shows candidate departure and arrival stations side by side, with both English and Chinese station names. After the user selects a pair, the tool prepares the exact station names for an official Railway 12306 check. You can try the current version here: China high-speed rail station finder Why I did not turn it into a ticket seller Railway schedules, ticket availability, fares, and passenger rules are official-service data. I do not want a travel helper to imply that a route exists merely because two stations are geographically close. The boundary is therefore deliberate: Ask-China helps turn real places into candidate stations. It shows bilingual names so travelers can recognize the correct station. Railway 12306 remains the final place to verify the journey and book. This also keeps failure states honest. If place search or route estimation is unavailable, the page should say that instead of inventing a confident answer. The implementation decisions that matt

Every time I put a model behind an endpoint I make the same lazy decision. I pick whatever I used last time, or whatever I read about most recently, and I tell myself I'll benchmark it properly later, and later never arrives because there is always something with an actual deadline on it and comparing model latencies feels like procrastination even when it isn't. I never do it. Not once. So I built the thing that would make me do it. One prompt, fired at six models at once, streaming side by side in columns, with time to first token and cost per run underneath each one. About 390 lines of Python. Code's here , MIT, take it. Then I ran it, and three things happened that I didn't plan for. The integration is two lines, and that's the least interesting part DigitalOcean's inference endpoint speaks OpenAI, so this is the whole thing: client = OpenAI ( base_url = " https://inference.do-ai.run/v1/ " , api_key = os . environ [ " DIGITAL_OCEAN_MODEL_ACCESS_KEY " ], ) Every model below goes through that one client. Llama, DeepSeek, Mistral, Qwen, OpenAI's open-weight gpt-oss line. Only the model string changes. That is the pitch, and it's real, and I'll move past it quickly because you already knew an OpenAI-compatible endpoint would work like an OpenAI- compatible endpoint. What I didn't know is everything that follows. One footnote before you paste that snippet. The credential is a model access key , created under the Gradient AI Platform. It is not the API token from Settings, API. Different thing, different page. (Although, as I found out later, the endpoint doesn't care nearly as much about that distinction as the docs do.) Six streams, no event loop I wanted the columns to fill simultaneously. Real racing, not six sequential progress bars pretending. The tidy way to do that is one endpoint that fans out server side and multiplexes everything back down a single connection. I didn't do the tidy way. The browser opens one EventSource per model instead: GET /stream?model=<

Sonos is cramming AI into its software because it’s “very hot these days.” The new features, which include agentic automation, are opt-in.