标签：#m

'Strange New Worlds' is uneven in tone, erratic in quality and sometimes gratuitous. But when it works, it works so well.

Reviews drop today. This thread is for reactions, celebrations, commiserations, and anything useful in between. First: if you got good reviews, say so. There's a norm in these threads where only the bad news gets aired, and it skews everyone's sense of what's normal. Post your wins. Second , the thing worth repeating every cycle: the review process is noisy, and that noise is measured, not folklore. The NeurIPS consistency experiments (2014, repeated 2021) found that a large fraction of accepted papers would have been rejected by an independent second committee. Reviewer assignment, load, and luck of the draw account for a lot. A score is a weak signal about your work and a strong signal about the process that produced it. That cuts both ways. It's not a license to dismiss every criticism as noise — it's a reason to weight reviews by the quality of the argument rather than the number attached to them. The reviewer who found a real hole in your evaluation did you a favor, even if the tone was rough. The one who clearly skimmed did not, regardless of the score. So: prioritize the reviews that make the paper better. Fix what's fixable, contest what's genuinely wrong, and concede the rest gracefully in the rebuttal. Things worth discussing: Reviews that caught something you'd missed Rebuttal strategy — what's worth contesting vs. conceding, and when new experiments actually shift a score Patterns you're seeing this cycle (missing baselines, compute comparisons, ablation depth, reproducibility asks) Framing a response when a reviewer has clearly misread the submission Backup plans: ICLR, AISTATS, workshops Please paraphrase rather than paste review text, and no speculation about reviewer or AC identities. To anyone who got bad news: this doesn't define your research impact. Plenty of heavily-cited work took two or three cycles to land somewhere. Rejection is a scheduling problem. How did everyone do? submitted by /u/Afraid_Difference697 [link] [留言]

Google Cloud has published a new blueprint setting out how organisations should secure artificial intelligence workloads running on Google Kubernetes Engine, arguing that the shift from prototype to production has outpaced traditional security models. The document sets out a three layer approach covering infrastructure, model integrity and application security. By Matt Saunders

Paper: https://arxiv.org/abs/2607.19058 Code (GitHub): https://github.com/nuemaan/skewadam Hi everyone, I just published a preprint on a new optimizer designed to tackle the massive VRAM bottleneck in Mixture-of-Experts (MoE) training. If you've trained MoEs, you know that optimizer state is usually the largest single line item in the memory budget. AdamW, for example, spends 50.6 GB of state memory just to update a 12.6 GB model. I built SkewAdam to fix this by using a tiered state allocation . Instead of treating all parameters equally, it allocates precision based on parameter behavior: Backbone (5% of params): Momentum + Factored 2nd moment Experts (95% of params): Factored 2nd moment only Router (<0.01% of params): Exact 2nd moment The Hardware Results: Optimizer state memory drops from 50.6 GB to 1.29 GB (a 97.4% reduction). Peak training memory drops from 81.4 GB to 31.3 GB. This allows a 6.78B MoE to fit comfortably on a single 40GB GPU without sacrificing convergence or router stability. submitted by /u/Kooky-Ad-4124 [link] [留言]

What We Learned Building a Location-Aware Contact Management App Most contact apps are built like digital phonebooks. They store a name, phone number, email, maybe a company name, and then leave the user to remember everything else. That works when someone has 50 people saved. It starts breaking when someone has hundreds or thousands of professional connections from events, client meetings, referrals, business cards, conferences, online communities, and local networking groups. The hard part is not storing people. The hard part is helping users find the right person at the right time. While building a location-aware contact management app, we learned that contact data becomes far more useful when it is connected to context: where someone is, how the user met them, what they discussed, what industry they belong to, and why the relationship matters. Here are some product, UX, and privacy lessons we learned along the way. 1. A contact list is not the same as a usable network A normal contact list answers one basic question: “Do I have this person’s number?” But professionals usually need better questions answered: Who do I know in this city? Who did I meet at that event? Which industry contacts are nearby? Who should I follow up with before visiting this area? Who was that consultant I met last month? Which contacts are important but easy to forget? This is where the product problem becomes interesting. A user may technically have the contact, but still fail to use the relationship because the contact is buried inside a long list. So the first learning was simple: Saving contact details is not enough. The app needs to help users retrieve useful relationships when the context matters. That changed how we thought about the product. We were not just designing a place to store people. We were designing a system to make saved professional relationships easier to act on. 2. Location context changes the experience Most contact managers are list-first. You search by name, comp

I honestly thought learning REST APIs would be easy. At first, creating a simple GET or POST endpoint feels straightforward and you start thinking, "I've got this." Then reality hits. Every API needs middleware, validation, error handling, controllers, database integration, authentication, authorization, testing, pagination, CORS, environment variables, deployment and a dozen other things. Somewhere along the way, you realize you didn't just sign up to build an API—you signed up to build an entire backend ecosystem. 😂💻

Originally published at tengli.dev Your MCP server can be 100% spec-compliant and still be unusable by an agent. The Model Context Protocol spec tells you how to transport tools: JSON-RPC framing, capability negotiation, schema shapes. It says nothing about whether a model can actually use what you serve — whether it picks the right tool out of your catalog, fills the arguments correctly, or burns 8k tokens parsing your schemas on every single request. I integrate first- and third-party MCP connectors into a production AI agent for a living, and I kept seeing the same failure: servers that pass every compliance check, yet the model calls the wrong tool, hallucinates arguments, or ignores the tool entirely. The problems were never in the protocol layer. They were in the parts no one lints: descriptions, naming, schema design. So I wrote mcpgrade — a Lighthouse-style scorecard for MCP servers. One command, no API key, report in seconds: npx mcpgrade --stdio "npx -y your-mcp-server" Then I pointed it at 36 popular servers. It did not go great. The results Full sortable table: https://tengli.dev/mcp-leaderboard.html . The short version (static analysis, point-in-time snapshot; servers marked (archived) are unmaintained reference implementations, included because they're still widely installed and copied): Top of the class (A): brave-search (archived) , exa, google-maps (archived) , slack (archived) , perplexity-ask, @shopify/dev-mcp, @apify/actors-mcp-server, airbnb, figma-developer-mcp, tavily, gitlab (archived) , elastic, shrimp-task-manager, and more — 15 of 36. Bottom of the class (D/F), 11 of 36 — and it's not hobby projects: MongoDB's official server (66, with 66 errors), Notion's official server (62), Airtable (69, 66 errors), todoist-mcp-server (67, 110 errors ), GitHub's archived reference server (67, 44 errors), and firecrawl-mcp at the very bottom (57, 134 errors ). Two more servers (Stripe, Supabase) couldn't be scanned with dummy credentials and were exclud

As I was reading interp papers, I found myself copy-pasting passages back and forth to Claude to parse through them. Eventually just vibe-coded a tool to annotate and discuss papers in place. https://paper-reader.dev - select a passage, a formula, or a figure, and explain the selection with the full paper as context. You can also select a citation to get a brief overview of the cited paper without switching context. Repo is at github.com/tumanian/paper-reader if anyone curious (mostly Claude, some Cursor, some me - built on vercel and supabase). Please be gentle, this runs on my own API key with a modest cap, so don't be too enthusiastic. Hoping this can be useful to someone, and genuinely looking for feedback, especially on where the explanations are wrong or unhelpful — that's the part I can't fully self-evaluate. submitted by /u/tumanian [link] [留言]

On 26 June 1974, German regulators withdrew the banking license of Bankhaus Herstatt, a mid-sized bank in Cologne, in the middle of the trading day. The timing is what made it famous. Herstatt's FX counterparties had already irrevocably paid the Deutsche Mark legs of that day's trades in Frankfurt. The corresponding dollar legs were due to settle hours later in New York. They never did. Banks that had done nothing wrong except pay first were left holding losses on trades that were half-settled: one leg complete, one leg gone. The episode was significant enough to name a category of risk - settlement risk, still called Herstatt risk - and it pushed the G10 central banks to form the Basel Committee on Banking Supervision later that same year. Here is the part worth sitting with: the actual fix took 28 years. The fix was a central utility CLS launched in 2002 with one job: settle FX trades payment-versus-payment. Both legs of a trade settle simultaneously, or neither does. There is no window in which one side has paid and the other has not. It works - CLS settles on the order of trillions of dollars a day - and it is the reason a Herstatt-style failure has not repeated at scale in the currencies it covers. But look at the shape of the solution. To make two legs atomic, traditional finance built one institution that every major bank trusts, connected the world's main currencies to it, and routed the trades through it. Atomicity was achieved by adding the most systemically important middleman in the history of payments. That was probably the only option available to 1990s banking infrastructure. It is not the only option available now. The agent economy is still in its payments era A study published last week by Keyrock, run with Coinbase and Tempo, put numbers on machine-to-machine commerce: 176 million transactions, $73 million settled between May 2025 and April 2026, average transaction size around $0.31. Those numbers describe a payments economy. A payment is a singl

A mobile user taps a button. Nothing opens. There is no validation message, exception, or visible loading state. The control simply appears dead. These bugs are frustrating because the visible symptom is tiny while the real interaction crosses several technical boundaries. I recently investigated this kind of failure in a Blazor Hybrid image workflow. The feature behaved sensibly in a desktop browser, but the same interaction did not reliably open the photo picker inside an iOS WebView. The useful lesson was broader than the eventual CSS change: A native capability launched from hybrid web UI is a cross-layer contract, not a single component event. To make the interaction dependable, the browser gesture, responsive dialog, native application metadata, and automated tests all had to agree. The visible button was not the real control Styled file-upload controls commonly hide the browser's native file input. A label or custom button receives the click and forwards it to the hidden input. That pattern can work well on desktop browsers. It provides visual freedom while retaining a native file-selection control underneath. The implementation I examined had taken the hiding quite far: the real input was clipped to a tiny area, while a separate visible element acted as its proxy. On desktop, the browser carried the user action through that indirection. Inside the iOS WebView, the picker did not open. This matters because browsers deliberately protect privileged actions. File pickers, cameras, pop-ups, clipboards, and media playback often require a trusted user activation. The further the real privileged element is removed from the original tap, the more likely platform differences become visible. The fix was conceptually simple: make the transparent file input span the visible button. The control still looks custom, but the user's tap now lands directly on the input that owns the privileged action. The input is visually transparent, not functionally absent. One repaired lay

Visibility modifiers is a method used in programming to specify the specific object for it's as visible or invisible, the purpose of visibility modifier is to define what is able to access or what is not to be able to access the object. In coluber it's able to define visibility modifier at several objects: data. task. As an example defined: public data measurement: inch: float type_meas: string public task process(): serve measurements = measurement(inch: 1.5, type_meas: "meter") public, defined as visibility modifier it can accessed through main.clbr at the root project or across modules in stdlib or library. private data measurement: inch: float type_meas: string private task process(): serve measurements = measurement(inch: 1.5, type_meas: "meter") main.clbr or other modules in both are unable to access the objects for as is the private modifier.

🚀 JavaScript Fundamentals (Week-03): Understanding the Concepts That Every Developer Should Know "Writing JavaScript code is one thing, but understanding what happens behind the scenes is what makes you a better developer." When I first started learning JavaScript, I knew how to declare variables and write functions. However, I often found myself asking questions like: Why are there three ways to declare variables? What exactly is hoisting? How does JavaScript execute my code? Why can an inner function access variables from its parent function? What does the this keyword actually refer to? Why do developers keep talking about writing clean code? This week, I focused on understanding these core JavaScript concepts instead of simply memorizing syntax. In this article, I'll explain each concept in a beginner-friendly way with examples and practical explanations. 📚 Topics Covered Variables ( var , let , const ) Hoisting Lexical Scope Execution Context Call Stack Closures this Binding DRY Principle KISS Principle Let's start from the beginning. 📦 Variables in JavaScript What is a Variable? A variable is a named container used to store data in memory . Instead of writing the same value repeatedly, we store it inside a variable and reuse it whenever required. For example, let name = " Sai " ; console . log ( name ); Output Sai Here, let → Variable declaration keyword name → Variable name "Sai" → Stored value Why Do We Need Variables? Imagine writing this: console . log ( " Sai " ); console . log ( " Sai " ); console . log ( " Sai " ); If the value changes, every occurrence must be updated. Using variables, let name = " Sai " ; console . log ( name ); console . log ( name ); console . log ( name ); Now changing one line updates every usage. Variables improve: Readability Reusability Maintainability Types of Variables JavaScript provides three ways to declare variables. var let const Although all three create variables, they behave differently. var var was introduced in the

Join us as we bring you live coverage from Samsung's Unpacked event in London, where it's expected to reveal new foldables and wearables.

Leave a comment below to introduce yourself! You can talk about what brought you here, what you're...

Hey everyone, A few months ago, I had zero coding background. I wanted to learn programming, but Python and JS felt a bit dry for me. I’ve always loved first-order predicate logic, which eventually led me to stumble upon Prolog. A lot of people laughed and told me it’s a dead language, but I fell in love with it anyway. Fast forward to today, after lots of trial and error, fixing arities, and using AI to help me debug, I managed to build the core POS engine for my project, LOGICBIZ v2.0. To see if my beginner-written code could actually hold up under a heavy local workload, I ran an endurance stress test. I am honestly blown away by the results and wanted to share the screenshots: The Simulation : 100 virtual cashiers firing a total of 100,000 transactions simultaneously on a single machine. The Pipeline : Every single transaction triggers 5 physical SQL queries ( Induk , Stok , Waktu , Detail , Rekap ) handled asynchronously via a background worker thread, while enforcing active SQLCipher 256-bit AES encryption and generating SHA-256 signatures per invoice. The Result : The test finished with ZERO DEADLOCK after 12,574 seconds. The most insane part for me as a hobbyist is the resource efficiency. Despite executing over 64 billion logical inferences , SWI-Prolog's terminal statistics show active memory usage stayed at just 1,115 KB . My Windows Task Manager also showed CPU hovering around 27% and Disk I/O sitting at 0% because the async worker perfectly absorbed the write spike. As a complete beginner, achieving this kind of stability and efficiency makes me so proud of choosing Prolog. It’s definitely not an outdated language; it’s a hidden superpower for backend logic. Would love to hear any thoughts or feedback from the seasoned Prolog devs here! submitted by /u/lokinpendawa [link] [留言]

Technical books have a shelf life that nobody prints on the cover. A cookbook from 2018 still works. A history book from 2018 still works. A Laravel book from 2018 will teach you a middleware pattern that was replaced twice, recommend a package whose maintainer archived it, and show you a test suite in a syntax that no longer runs. I've written a series of ebooks on PHP, OOP, SOLID, design patterns, Laravel conventions, testing with Pest, application architecture, and AI-assisted development. There are also two aimed at kids learning to code. Every one of them was correct when I wrote it. That is a much weaker claim than "correct now," and I'd rather find the gap myself than have a reader find it for me. So: I'm opening the series to technical reviewers before the final edition ships. Applications close Sunday, 26 July. Why I can't do this alone Not because I lack the time. Because I lack the distance. When you write a technical book, you build a mental model of the reader and then you write to that model for months. The model is always partly wrong, and you are the last person who can see how. You skip a step because it's obvious to you. You keep an example that made sense when you drafted the chapter and no longer matches the surrounding code. You cite a package because it was the right answer for a project you shipped two years ago, and you never checked whether it's still maintained. None of this shows up on a reread. Rereading your own work is mostly pattern-matching against your own memory. You see what you meant, not what you wrote. A reviewer who has never seen the manuscript reads what's actually on the page. That's the whole value, and it's not something more effort on my side can substitute for. What the job actually is You pick one book from the series. You read it properly — not skim it — and you flag what's broken. Four things in particular: Things that are outdated. The framework moved, the syntax changed, there's now a cleaner way to do the same thin

Over the past few months, I've noticed that most discussions around AI coding assistants focus on prompts. People share: .cursorrules AGENTS.md CLAUDE.md long prompt templates custom instructions The assumption is always the same: "If I explain my engineering practices clearly enough, the AI will follow them." For simple projects, that works. For real software projects, it eventually breaks down. The problem isn't intelligence. It's governance. Every AI coding assistant eventually produces something like this: giant functions skipped tests undocumented architectural decisions ignored security practices direct commits inconsistent commit messages missing pull request descriptions Not because the model suddenly became "worse". Because nothing prevents it from taking shortcuts. Exactly like humans. We already solved this problem... for humans. Professional software engineering has never relied on trust. Instead, we built systems that enforce discipline. We don't ask developers to: write tests We fail CI. We don't ask them to: use meaningful commit messages We reject the commit. We don't ask them: not to push directly to production Protected branches make it impossible. Engineering isn't based on trust. It's based on constraints. Yet with AI... ...we went backwards. Instead of constraints, we write instructions. We create increasingly sophisticated prompt files hoping the assistant will remember them. Always write tests. Always document architectural decisions. Use GitHub Flow. Follow OWASP. Keep functions below 40 lines. Never commit directly to main. Those aren't guarantees. They're suggestions. And suggestions are eventually ignored. Rules are not enforcement. Recently I came across an article making a simple observation: Rules without enforcement are just hopes. That sentence stayed with me. It perfectly describes the current state of AI-assisted development. An AI may fully understand your engineering rules. It may even agree with them. But unless something checks

Every team shipping an agent has the same meeting. Someone asks "is it ready?" and the room splits. One person saw a great demo. Another watched it invent a refund policy an hour ago. The argument runs in circles because nobody agreed what "ready" means, so the loudest opinion wins and the agent ships on a vibe. Making an AI agent production-ready is not a moment of confidence. It is a bar you write down before you build, then measure against. This post is about that bar: why agents need a different one than the services you already ship, and how to define it so "is it ready?" becomes a number instead of an argument. Why "production-ready" breaks for agents For a normal service, "production-ready" is settled. Correct output for valid input, handles errors, meets a latency target, has tests and a rollback. You know the shape of done. An agent breaks three of those assumptions at once: It is non-deterministic. The same input can produce different output, so "correct" becomes "acceptably right, often enough." Its failure surface is open-ended. A function fails in ways you enumerated; an agent fails in ways you never imagined, because it composes language, tools, and judgment on the fly. Its worst case is not a 500 error. It is a confident wrong answer that looks right, which is far more expensive than a crash, because a crash at least tells you it failed. So the honest question is not "is the agent correct." It is "is the agent acceptably wrong, safely, within budget, and repeatably enough to trust." That question has four parts, and each is a line on your bar. The four lines of the bar Write these down before you build. If you cannot fill them in, you do not have a spec, you have a wish. Task success. On a fixed set of real tasks , not the happy-path demo, what fraction must the agent complete correctly? Pick the number. 85 percent means one in seven users gets a wrong answer. Acceptable for this job, or fireable? Decide on purpose. Failure acceptability. Not all wron

My LLM bill kept growing, so I did what seemed obvious: I looked for a cheaper model. That helped a little, but it didn't explain why the bill was growing. The dashboard could tell me how many tokens the application used. It couldn't tell me what those tokens were doing. Were they coming from chat? Document summaries? Background classification? An agent retrying the same tool call? I was trying to optimize a total without knowing which product feature created it. The useful unit wasn't tokens per model . It was tokens per feature . Model-level totals hid the real problem A provider dashboard usually groups usage by model, API key, project, or time period. That is useful for billing, but not always for product decisions. Imagine an application with four LLM-powered features: interactive chat document summarization support-ticket classification an agent that prepares weekly reports If the bill increases by 30%, the model name doesn't explain which feature changed. Maybe chat traffic grew. Maybe summarization started sending entire documents instead of selected sections. Maybe the classifier received a much larger system prompt. Maybe the report agent retried after tool failures and generated the same plan several times. Those problems require completely different fixes. Switching every request to a cheaper model would reduce the bill, but it could also hide the engineering mistake. Tag every request with a feature I started giving every LLM call a small amount of application context: const context = { feature : " document_summary " , operation : " initial_summary " , customer_tier : " pro " }; The model provider doesn't need these fields. They belong in the application's usage record. I avoid using individual user IDs as the primary grouping dimension. For cost analysis, a product feature, workflow, or operation is normally more useful and creates fewer privacy problems. A practical record looks like this: { "timestamp" : "2026-07-22T03:12:48.201Z" , "feature" : "docu

Samsung's next Galaxy Unpacked event is just around the corner, and the company is expected to take the wraps off a bunch of new devices. Based on the rumors and leaks we've seen so far, Samsung's next generation of foldables will likely be the stars of the show. Samsung is expected to show off a […]