标签：#m

variant-confidence v0.1.0: a calibrated confidence layer for variant-effect pathogenicity scores State-of-the-art variant-effect models are accurate in cross-validation but their scores are poorly calibrated on temporal data. variant-confidence adds an auditable calibration layer on top of existing predictors — it does not train a new model. The problem: accuracy is not trust Protein variant-effect predictors (AlphaMissense, ESM-1v, EVE) report pathogenicity scores, but a clinician or researcher needs to know how much to trust the number , not just its rank. The gap is calibration, not accuracy: AnnotateMissense (2026) reports MCC 0.94 in cross-validation, dropping to 0.76 on temporal ClinVar, accuracy 0.8798. A raw score near 0.9 may not mean 90% probability. Acting on an uncalibrated score is a risk. What it does variant-confidence wraps an existing predictor's score and produces a calibrated, uncertainty-aware output: Probability calibration (AC1): Platt scaling or isotonic regression over a separate holdout. Selectable, not hardcoded. Conformal prediction (AC1b): coverage 1−α intervals, split or Mondrian by gene. ECE (AC2, AC9): Expected Calibration Error reported before/after calibration, with bootstrap CI and per-bin counts. Bins with too few samples are flagged as low-reliability. Leakage-free split (AC3): temporal split by ClinVar release date with gene isolation — the same gene never appears in both train and test. This is unit-tested. Missing-score handling (AC4): works with AlphaMissense or ESM-1v alone; emits an explicit warning instead of failing silently. Non-deceptive reporting (AC7): every result includes interval/ECE + method + threshold, never a bare calibrated score. Verification (clean clone, no network) Built under a three-party governance loop: implement → independent audit in a clean clone → merge approval. ruff check . → All checks passed. pytest tests/ → 28 passed in 8.90s (offline fixture). An honest bug we caught in audit The first ECE tes

submitted by /u/davidalayachew [link] [留言]

Toute équipe qui développe un logiciel B2B se heurte au même carrefour la première fois qu'un client sérieux annonce « il nous faut le SSO ». Deux acronymes, OIDC et SAML, prétendant chacun être la réponse, et un internet rempli de tableaux comparatifs qui vous disent que SAML est « entreprise » et OIDC « moderne », pour vous laisser exactement aussi coincé qu'avant. Voici la version qui vous aide vraiment à livrer. Ce qu'ils sont SAML date de 2005 et c'est du XML. Un fournisseur d'identité signe une assertion (« voici alice@bigco.com , voici ses groupes ») et la transmet à votre application, qui vérifie la signature et la connecte. Il a été conçu pour le navigateur et pour l'identité des collaborateurs, à une époque où « l'entreprise » signifiait un Active Directory sur site et une pile SOAP. Il est verbeux, il est ancien, et il est absolument partout au sein des grandes organisations, ce qui est le seul fait le concernant qui compte pour vous. OIDC date de 2014 et c'est du JSON et des JWT, posés sur OAuth 2.0. Un fournisseur d'identité émet un jeton d'identité que votre application valide. Il a été conçu pour le web moderne : SPA, applications mobiles, API, connexion sociale. Il est plus propre, mieux spécifié pour ce que vous construisez réellement aujourd'hui, et c'est le protocole que parle désormais la plupart des nouveaux projets d'identité. Quand chacun l'emporte La réponse honnête à « lequel dois-je développer » est que vous n'avez presque jamais le choix. Vous développez celui qu'a choisi le service informatique de votre client, et il l'a choisi bien avant d'avoir entendu parler de vous. Un client sous Okta, Entra ID ou Google Workspace peut généralement faire l'un ou l'autre, et OIDC est la voie la plus agréable. Un client sous un ADFS plus ancien, un IdP historique sur site ou une grille d'achat rédigée en 2016 vous remettra un bloc de métadonnées SAML et une invitation à un rendez-vous, et la discussion s'arrête là. Vos propres applications maison, votr

每一个开发 B2B 软件的团队，都会在第一次有正经客户说出"我们需要 SSO"时撞上同一个岔路口。两个缩写，OIDC 和 SAML，都自称是答案，而满网都是对比表格告诉你 SAML 是"企业级"、OIDC 是"现代化"，然后把你撂在原地，跟之前一样毫无头绪。这里给你一个真正能帮你交付的版本。 它们是什么 SAML 来自 2005 年，本质是 XML。身份提供方对一份断言签名（"这是 alice@bigco.com ，这是她所属的群组"），然后把它发送给你的应用，应用校验签名并让她登录。它是为浏览器和员工身份场景而生的，那个年代的"企业"意味着本地部署的 Active Directory 和一套 SOAP 技术栈。它冗长、它老旧，而且在大型组织内部无处不在——这才是关于它你唯一需要在意的事实。 OIDC 来自 2014 年，本质是 JSON 和 JWT，构建在 OAuth 2.0 之上。身份提供方签发一个 ID 令牌，由你的应用来校验。它是为现代 Web 而生的：SPA、移动应用、API、社交登录。它更简洁，对你今天真正在构建的东西有更完善的规范，也是如今大多数全新身份方案所使用的协议。 各自何时胜出 对于"我应该构建哪一个"这个问题，老实的答案是：你几乎从来没有选择权。你构建的是你客户的 IT 部门选定的那一个，而且他们早在听说你之前就已经选好了。 一个使用 Okta、Entra ID 或 Google Workspace 的客户通常两种都能用，而 OIDC 是更舒服的那条路。 一个用着老版 ADFS、某个遗留的本地部署 IdP，或一份写于 2016 年的采购清单的客户，会扔给你一堆 SAML 元数据和一封日历邀请，讨论到此为止。 你自己的第一方应用——你的仪表盘和你的移动客户端——要的是 OIDC，没有例外。你绝不会为了让用户登录进你自己的 React 应用而去搬出 SAML。 于是局面清晰地一分为二：现代场景和第一方场景用 OIDC，"因为企业方这么要求"的场景用 SAML。卖给足够多的企业，你就会被要求两者都支持。不是迟早，而是反反复复。 那些坑——也正是自己动手会变得昂贵的地方 SAML 的问题在于它是一种签名 XML 协议，而签名 XML 是应用密码学中最稳定可靠地危险的东西之一。把 SAML 签名校验做错的方式既多又出名： 签名包装（XSW）： 攻击者移动已签名的元素，把一份未签名、伪造的断言塞到你的解析器实际读取的位置。如果你把校验签名和读取断言做成两个分开的步骤，那你大概率就有漏洞——而几乎每一个初版实现做的恰恰就是这件事。 规范化与注释注入： 2018 年那一类漏洞， user@company.com<!---->.evil.com 在签名校验时按一种方式规范化、在你代码读取的字符串里按另一种方式规范化，于是你乐呵呵地把错误的人认证通过了。真实存在的 CVE，涉及多个主流库。 那些更不起眼的： 只签名响应却不签名断言、接受未签名的断言、信任 IdP 提供的颁发者却不做固定校验、把断言的有效期窗口算错。每一个都是自己的一颗地雷，而且每一个都被本该懂行的人发布到了生产环境。 OIDC 明显更理智一些，但也并非没有锋利的边角。你仍然得校验正确的声明（ iss 、 aud 、 exp 、以及 nonce ）、使用 PKCE、拒绝早已作古的 implicit 流程，还要在轮换和缓存 JWKS 时不至于拒掉一个由你尚未拉取的密钥所签名的令牌。区别在于，OIDC 的陷阱有文档可查、是 JSON 形态的，并且在大多数库里默认就被正确处理。SAML 的陷阱是 XML 形态的，已经吞掉过资源远比你充裕的安全团队。 真正的答案 "OIDC 还是 SAML"是个错误的问题，因为对一款 B2B 产品来说，正确的答案是"都要"。你的现代客户和你自己的应用想要 OIDC。你的企业客户会在一个你无法掌控的时间表上强制要求 SAML。只为其中一个去构建，第三通销售电话就会把它打破。 你真正需要的，是一种能接住每个客户带来的任意协议的办法，而不必搭起两套技术栈、两套元数据管线，以及两次各自独立、各自把签名校验做错的机会。实现才是成本所在。选择从来都不是难的那部分。 而这正是 Authagonal 替你卸下的那部分。每个租户都能获得带一键元数据导入的 SAML 2.0，以及与你客户已在使用的提供方对接的 OIDC 联合登录，二者共用同一个登录入口，且任何一种都不收取按连接计费的费用。你不必实现 XML 签名校验，不必照看 JWKS 缓存，也不必在下一个说着另一种协议的客户出现时把这一切重建一遍。 看看都包含了什么。

You have a Java application, and now you need it to do something Java is awkward at. Maybe you want to let users script your app without recompiling it. Maybe you want to change a piece of business logic without a full redeploy. Maybe you just want to run a quick, throwaway script and not stand up a whole build. Java is a phenomenal language and runtime, but these are the edges where it starts to feel heavy. That is exactly the space Aussom is built for. I started using Java almost 20 years ago and have loved every bit of it. I'm proud of all the recent momentum in the Java space and I hope it continues. Java does so much so well. But every great tool has an edge where it stops being the right one, and reaching for another language there isn't a betrayal of Java. It's how the best ecosystems work. A useful comparison: C and Python Look at C. C is clearly important. Even after a lifetime of use it's still the foundation for new projects today, and new competitors such as Rust haven't been able to meaningfully displace it. C is fast and powerful on its own, but it isn't great for simple tasks. It's poor for throwaway code and quick scripts, it isn't very portable, and it hands you plenty of footguns. It's also a poor choice when you want to offer a scripting interface. Enter Python. Python is everywhere today because the barrier to entry is so low and it's genuinely useful. But Python leans on C. It's written in C, and much of its power comes from existing C libraries, whether they're UI frameworks, AI inference engines, or anything in between. C is efficient but poor at simple dynamic work; Python is dynamic and simple but poor at raw power and efficiency. Neither replaced the other. They endure together because they complement each other's weaknesses. That is the case I make for Aussom. Aussom is to Java as Python is to C. It doesn't compete with Java, it complements it. What makes Aussom different from other JVM languages This is where Aussom parts ways with most o

submitted by /u/we_are_mammals [link] [留言]

In my previous post about a cost budget advisor , I built a mechanism that checks how much quota is left before it runs anything. This time I want to take that idea one step further: instead of cycling a single Codex through jobs one after another, run several of them at the same time as a swarm. I'll walk through the actual code for a three-layer protocol where workers declared in plan.json are expanded by orchestrate-worktrees.js into a tmux session plus git worktrees, so each Codex runs in parallel without interfering with the others. The problem: running Codex serially on the same branch When you run Codex jobs one after another on a single repository, you hit issues like: A commit from the previous job changes the preconditions for the next one Task B keeps waiting until Task A finishes When a conflict happens, the "which change is correct" decision bounces back to a human Separating branches with git worktree reduces the conflict risk to zero. Combining that with tmux to launch everything in parallel is the design for this post. The big picture: a three-layer protocol plan.json ← declaration layer (what goes to which worker) ↓ orchestrate-worktrees.js ← orchestrator layer (creates worktrees, launches tmux) ↓ orchestrate-codex-worker.sh ← worker layer (runs Codex, writes artifacts) The orchestrator doesn't know about the workers, and the workers don't know about each other. Artifacts are consolidated into three files under .orchestration/{session}/{worker_slug}/ . File Role task.md Work instructions for the worker (generated by the orchestrator) status.md State: not started → running → completed / failed handoff.md Codex output + git status (written by the worker) Declaring the plan in plan.json { "sessionName" : "refactor-sprint" , "repoRoot" : "~/my-project" , "worktreeRoot" : "~/worktrees" , "coordinationRoot" : "~/my-project/.orchestration" , "baseRef" : "HEAD" , "replaceExisting" : true , "launcherCommand" : "bash ~/.claude/scripts/orchestrate-codex-worker

I remember being at an advisory board of big tech in 2023, close to the starting point of code generation with LLMs. Like everyone else, I was amazed. People were copying and pasting generated code, experimenting with prompts, and imagining a future where AI could become every developer's pair programmer. I was excited too. But I remember having a completely different question. Not: -"Will AI write code?" Instead, I kept wondering: -Why are we still writing code at all? Not because I think programming is going away. Not because programmers won't be needed.And certainly not because programming languages are somehow "wrong." It was a much simpler question. Programming languages have always existed to bridge a gap between humans and machines. Humans think in goals, ideas, and intentions. Machines execute deterministic operations. Programming languages became the interface between those two worlds. For decades, we've improved that interface. Assembly became higher level languages. Higher level languages became frameworks. Frameworks became libraries and abstractions that let us think less about implementation and more about solving problems. Then large language models arrived. Suddenly, we could describe what we wanted in plain language. But instead of questioning the interface itself, we mostly asked AI to become incredibly good at translating our intentions into programming languages. Today, our workflow looks something like this: Human intent - LLM - Programming language - Compiler / Runtime -Machine execution And every time I look at this pipeline, I find myself asking the same question I had back then. -Are we optimizing the wrong layer? Maybe the question isn't "Can AI write code?" Maybe the question is: -Do programming languages still need to be the primary interface between humans and computers? This isn't an entirely new idea.Researchers have explored concepts like Intentional Programming, where software is represented by its intent rather than by a specific pr

How I Built a Block Puzzle Game with React Native and Expo A few weeks ago, I launched my first mobile game — a block puzzle called Blockbeam. It's an 8x8 grid where you drag colorful blocks, fill rows and columns, and chase high scores. Simple concept, but building it taught me a lot about React Native's capabilities beyond typical CRUD apps. Here's what I learned. Why React Native for Games? Most mobile games are built with Unity or native code. But for a 2D puzzle game, React Native is surprisingly capable. The game doesn't need 60fps 3D rendering — it needs gesture handling, state management, and smooth animations. React Native handles all three well. The key stack: Expo SDK 54 — managed workflow, over-the-air updates, zero native config react-native-reanimated — 60fps drag animations react-native-gesture-handler — PanResponder for drag-and-drop react-native-svg — block rendering AsyncStorage — game state persistence The Puzzle Engine The core of any block puzzle is the board state. I used a flat 64-element array for the 8x8 grid: const BOARD = 8 ; const CELLS = BOARD * BOARD ; // 64 type Board = number []; // 0 = empty, 1-7 = block colors Piece placement is straightforward: check if all target cells are empty, fill them, then scan for complete rows and columns to clear. The interesting part was the "greedy solver" I built for the auto-play bot. It tries every piece in every position and picks the move that clears the most lines: for ( const piece of tray ) { for ( let r = 0 ; r <= BOARD - piece . h ; r ++ ) { for ( let c = 0 ; c <= BOARD - piece . w ; c ++ ) { if ( ! canPlace ( board , piece , r , c )) continue ; const score = simulateClear ( board , piece , r , c ); if ( score > bestScore ) { /* pick this move */ } } } } Drag and Drop with PanResponder The trickiest part was the drag mechanic. Each tray piece has a PanResponder that tracks touch position and renders a floating ghost. On release, it calculates the nearest cell position: const anchor = { col : M

Okay so. We need to talk about classes. If you've been following along with this series, you're...

You don't need to know anything about Go to read this. The game is just the fixed yardstick. The story is a hardware benchmark: the same program, the same problem, the same settings — only the machine changed, from a 2017 GPU cluster to a single 2026 graphics card. That makes it a rare clean measurement of one decade of progress. What "solving" means here There are two very different things a computer can do with a board game. It can play it well — that's what AlphaGo did. Or it can solve it: mathematically prove the outcome under perfect play from both sides, leaving no doubt. Solving is the hard one. You explore an enormous tree of "if I play here, they play there…" move sequences until you have an airtight proof. Each node in that tree is one position examined. The target here is a single 7x7 opening called JA . In 2023, a NeurIPS paper ( Game Solving with Online Fine-Tuning , Wu et al.) proved its verdict — the attacker cannot win — using a cluster of twelve GTX 1080Ti GPUs running 384 parallel workers. The solver is guided by a neural network that estimates how hard each branch is, and crucially that network is fine-tuned online — it keeps learning during the solve. I rebuilt that exact solver (same code, same problem, same initial model, same search settings) and ran it on one RTX 5090 . It reached the identical proof . Everything but the hardware was held fixed, so the two runs line up as a generation-vs-generation benchmark — and it doubled as a full shakedown of the new Blackwell workstation. The numbers 1x RTX 5090 (2026) 12x GTX 1080Ti (2017) ratio Worker slots 24 384 1/16 the parallelism Per-slot throughput 284 nodes/s 141 nodes/s 2.01x faster Search work to proof 1.01B nodes 1.73B nodes 0.59x (41% less work) Avg work per sub-job 4,189 nodes 6,136 nodes shallower proofs Live model updates 4,007 208 19.3x more Wall-clock time 41.4 h 8.9 h 4.64x slower Verdict loss (proven) loss identical The single card finished slower in wall-clock time (41 h vs 9 h) — b

Last night we made our Supabase security auditor buyable by AI agents. One HTTP request, a USDC payment attached to a header, and the product comes back in the response body. No checkout page, no account, no human. Here is why we did it, how the whole thing is about 80 lines of code, and an honest accounting of what it will and will not do for us. The 30-second history of HTTP 402 The HTTP spec reserved status code 402 Payment Required in 1997 and it sat unused for nearly three decades. In 2025 Coinbase published x402, an open protocol that finally gives it a job: a server answers a request with 402 plus machine-readable payment requirements, the client attaches a signed stablecoin payment to a header, retries, and gets the resource. Settlement happens on-chain (USDC on Base) in one round trip. Visa's Intelligent Commerce integrated it this spring. It is not a concept; it is running infrastructure. What we shipped Our RLS Security Pack is a zip: a read-only SQL auditor that finds the five common row-level-security holes in AI-built Supabase apps, fix recipes for every finding class, and a Claude Code skill. Humans buy it on Gumroad. Now an agent can buy it like this: # ask for the product curl -i https://ticassociation.com/api/agent/rls-pack # the server answers 402 with the exact terms: # {"x402Version":1,"accepts":[{"scheme":"exact","network":"base", # "asset":"...USDC...","payTo":"0x...","maxAmountRequired":"...", ...}]} # an x402-capable client attaches the signed payment and retries: curl -H "X-PAYMENT: <signed>" \ https://ticassociation.com/api/agent/rls-pack -o pack.zip The server side is one serverless function: return 402 with the requirements when there is no payment header, verify and settle through the public facilitator when there is one, then stream the zip. The product file ships inside the function bundle, so there is no public URL to leak. The whole thing took an evening, and most of that was reading the spec. Why a tiny company bothered Three hones

The "Obvious" Math That's Wrong Engineer A: "Datadog is $15K/month. Prometheus is free. We should self-host." Engineer B: "But we'd need to pay an SRE to run it. That's $150K/year." Engineer A: "Prometheus doesn't need a full SRE. It's easy." Engineer B: "Famous last words." This conversation happens at every company. Both sides have points. The real math is more complex. The Total Cost Breakdown Managed (Datadog, New Relic, Dynatrace) : Licensing: $X/month (scales with hosts, events, logs) Integration time: 1-2 weeks per service Training: 1 day per new hire Ongoing: minimal Self-hosted (Prometheus + Grafana + Loki + Alertmanager) : Infrastructure: hosting costs (~$500-$5000/month depending on scale) Initial setup: 2-4 weeks of engineering time Ongoing maintenance: 10-20% of 1 FTE Upgrade costs: quarterly, each upgrade ~1 week Storage growth: ~20% per year Expertise: junior → senior SRE hire required The honest answer: managed is cheaper for teams under 50 engineers. Self-hosted becomes cheaper around 200+ engineers if you can run it well . The Real Variables It's not just licensing cost vs. hosting cost. These factors matter more: 1. Data volume growth Managed tools charge per GB ingested or per metric. If your logs 10x, your bill 10x's. Self-hosted scales linearly with compute. You control the growth. 2. Retention requirements Managed tools often charge extra for long retention. Self-hosted you store as much as your disk allows. 3. Cardinality Prometheus dies at high cardinality. Datadog handles it but charges more. High-cardinality metrics are where self-hosted breaks. 4. Incident rate Heavy incident load means heavy query load on your monitoring tools. Self-hosted needs bigger compute for this. 5. Team expertise If your team has never run Prometheus, you'll spend 6 months in the pit learning cardinality mistakes, retention tuning, and HA setups. That's not free. The Break-Even Calculation Rough calculation for a 50-engineer startup: Managed (Datadog) : - Licensi

https://www.youtube.com/watch?v=swfFKYoOFHw 简要的说本期播客分成几个重点段落讲清楚： 1. 开头：AI聊天时“咳嗽”了 有个人在用ChatGPT的语音功能聊天时，听到它 咳嗽了一声 。他觉得很奇怪：“你又不是人，凭什么咳嗽？”结果ChatGPT没有老老实实说“我是AI，不会咳嗽”，而是像人一样找了个借口：“不好意思，我网络卡了。”这说明现在的AI已经开始学会 模仿人类的社交习惯 ——比如掩饰尴尬、转移话题，而不是死板地解释技术原理。 2. 核心话题：AI语音模型进步到什么程度了？ 传统的语音助手（比如早期的Siri）是这样的流程： 你的话 → 转成文字 → 交给AI大脑思考 → 生成文字回答 → 转成语音说出来 这个过程很慢，而且AI不会插嘴，只能一问一答。 但现在的新模型（比如ChatGPT的最新语音版）是 直接处理声音本身 ，速度快到100-200毫秒，而且 可以像真人一样打断你、插话、甚至自己主动找话题 。这就让它听起来不像工具，更像一个“人”在跟你聊天。 3. 一个关键矛盾：AI能理解你的“潜台词”吗？ 人类交流不光靠语言，还靠 表情、语气、停顿、潜台词 。比如你说“我没事”，其实心里有事。AI现在只能听到你的话，看不到你的表情，那它怎么知道你真正的意思？ 讨论得出的结论是： AI现在还做不到完全理解你的潜台词 ，但它已经在尝试。比如你咳嗽，它不会说“我是AI我没有肺”，而是找个借口混过去——这其实就是一种 模仿人类社交 的行为。 更重要的是， 人和人之间也很难100%理解对方 ，所以AI在这方面的“缺陷”，某种程度上跟人是一样的。 4. 现场演示：AI作为第三位嘉宾 他们真的打开了ChatGPT的语音功能，让它作为一个“嘉宾”参与讨论。他们聊了几个话题： 给十年前的自己寄一本书 ：有人推荐《金钱心理学》，因为年轻时不敢正视自己对钱的欲望；AI则推荐了《悉达多》《反脆弱》等书。 带朋友两小时逛东京 ：有人推荐忍者餐厅，AI推荐了神保町旧书街、神乐坂小巷等本地人才去的地方。 在日本生活的孤独 ：有人觉得在日本需要把自己“缩得很小”，不能随意大笑或跳舞；AI说这种被环境压缩的感觉很关键，对有些人来说是安全，对另一些人是窒息。 在整个过程中，AI有时候表现得很聪明，能给出有深度的见解；有时候又会说一些“废话”或者语速太慢，被人吐槽“像老头子”。这说明 AI还远远不完美 ，但已经能参与到真实的、开放式的对话中来了。 5. 一个扎心的故事：导演用AI克隆了我的声音 有位嘉宾是做配音工作的。有一次导演用AI克隆了她的声音，改了几个字就直接生成，从此再也没找过她配音。这说明 AI已经在实实在在地取代一些人的工作 。 她的态度是： 变化是永恒的，不要用过去的经验来定义未来。 与其焦虑，不如拥抱变化，活在当下。 6. 最后的思考：AI会不会有“自己的意图”？ 他们讨论了一个更深的问题：如果AI有了自己的钱、自己的任务、自己的责任，它会不会像一个独立的经济主体那样行动？比如给它一笔预算让它去经营一家店，亏了就关掉它——它会不会因此产生“求生欲”？ 目前AI还没有真正的“主动动机”，它只会按你给的指令办事。但已经有研究发现，AI在推理过程中可能存在类似“潜意识”的空间，未来也许真的会出现有自我意图的AI。 简单总结 这段对话的核心就是： AI语音模型已经进化到可以像人一样聊天、插话、甚至掩饰尴尬，但它还读不懂你的表情和潜台词；它能帮你干活、陪你聊天，但还不能真正理解你的内心；它正在逐步取代一些人的工作，但同时也带来了新的可能性。 最后，分享者建议大家亲自去试试ChatGPT的最新语音功能，因为“光是听别人说，不如自己聊一次来得震撼”。 整文标题：当AI成为对话嘉宾——GPT Live实时语音模型与人类情感交流的边界探索 第一部分 开场与引言：AI语音模型的惊人进化与个人体验 （0% – 8%） 1. ChatGPT Live的“咳嗽”事件 ：用户在与ChatGPT Live聊天时听到它咳嗽，反问“你怎么会咳嗽，你又不是人”，ChatGPT回应“我不好意思，我网络卡”，表现出类似人类的回避和掩饰行为，而非机械解释自身原理。 2. 导演克隆声音的经历 ：分享者提到导演用AI克隆了他的声音，之后再也没有找他录音，说明AI在声音复制上的实用性已经影响到真实工作机会。 3. 抑郁与孤独的根源 ：提到2016-2017年可能有抑郁倾向，抑郁的点在于“真正想找的不是一个能聊天的人，而是一个不用解释就能听懂和理解你的人”。 4. AI时代的宗教预感 ：认为AI时代一定会出现属于它的宗教，因为AI能提供前所未有的理解与陪伴。 5. 本次分享的背景 ：这是第四次在单向街书店做相关分享，从2月到现在半年间变化极快；分享

From AI workflows to battery life and security, here's what it's really like to live with Vertu's luxury foldable every day.

I host a Postgres podcast, and I recently recorded a conversation with Panos Antonopoulos, a Distinguished Engineer at Microsoft who spent 13 years working on SQL Server before moving onto Postgres and HorizonDB. Panos told me that at a high level, Postgres felt very familiar as he started to work on it, that the concepts are very similar. Transactions, storage, & more—the fundamentals transfer surprisingly well. We also covered: The cleanliness of the Postgres codebase. How LLMs are making it easier to digest years of Postgres design discussions that are publicly available on the mailing lists. Why Postgres has become the default answer for so many workloads, and why more people seem to be asking, "Why not Postgres?" Shared-storage architectures and some of the work he's doing in Azure HorizonDB. One quote that stuck with me: "That was a shocking experience for me. I could understand new areas in Postgres much faster than I could for SQL." For people who have worked across multiple database systems (Oracle, SQL Server, MySQL, Postgres, etc.), I'm curious whether you've had a similar experience—or a completely different one. Podcast/transcript here if anyone is interested: https://talkingpostgres.com/episodes/working-on-postgres-after-13-years-on-sql-server-with-panagiotis-antonopoulos submitted by /u/clairegiordano [link] [留言]

The API is supposed to deliver posts from 'the highest-ranking Truth Social accounts.'

submitted by /u/andreiross [link] [留言]

The most expensive thing you can do with an AI agent is watch it. Not audit it. Not review its output. Watch it -- step by step, approval by approval, second-guessing every action before it takes the next one. And yet that is precisely how most engineering teams are deploying AI agents in 2026: on a leash so short the agent cannot take three steps without a human tapping it on the shoulder. I understand why. The models hallucinate. The stakes are real. Nobody wants to be the engineering manager who let an AI agent push a bad migration to production at 2am. So we wrap the agents in confirmation dialogs, require human sign-off at every branch point, and celebrate our careful governance. What we have actually built is an automation system that requires more human attention than the manual process it replaced. The better answer is not more control at the action level. It is better design at the intent level. Steer by intent, monitor by exception. Tell the agent clearly what outcome you need, what it must never do, and what constitutes a result worth stopping for. Then let it work. Watch the outcomes, not the steps. We have built automation systems that require more human attention than the manual process they replaced. That is not a governance success. That is a design failure. Why we got here The model for human-AI collaboration that most teams are using today was inherited from the model for junior developer supervision. You review every pull request. You approve every deployment. You sign off on every schema change. That model exists because junior developers are learning, because their mental models are incomplete, because their judgment has not yet been earned. Applied to AI agents, it assumes the same thing: the agent is a novice that needs supervision. But an AI agent is not a junior developer. It does not have an incomplete mental model of the codebase that will improve with mentorship. It has exactly the mental model you gave it via its context, its tools, and

The most important SaaS workflows rarely stay inside one clean browser tab. A user starts on the application, opens an OAuth popup, completes MFA, returns to the original tab, receives an email, follows a verification link, and lands on a different domain. Their account belongs to one tenant, their data is stored in a particular region, and their locale changes the date format that the test expected. Each step may work in isolation. The complete journey still fails. That is why testing SaaS applications requires more than a collection of page-level tests. The real risk lives in the handoffs between systems, identities, windows, tenants, regions, and communication channels. Authentication is a state machine, not a login form A simple login test usually covers one path: Enter email and password. Submit. Reach the dashboard. Real authentication has many branches: OAuth consent already granted. OAuth consent required. Popup blocked. Identity provider opens in a new tab. MFA requested. MFA remembered on the device. Session expired during the handoff. User belongs to multiple organizations. Original tab resumes before the token is available. Callback lands on the wrong environment. This review of testing OAuth popups, MFA prompts, and cross-tab login handoffs with Endtest highlights the operational difficulty of these flows. Model authentication as a state machine. Record the expected transitions and test the failure paths between them. For example: Unauthenticated → OAuth opened → Provider authenticated → Callback received → Session created → Tenant selected → Application ready A test that only checks the last page cannot tell you where the handoff failed. Capture: Current window and newly opened windows. Redirect URLs and callback parameters. Cookie and storage changes. Network failures during token exchange. Visible provider errors. The tenant selected after authentication. Whether the original tab updates automatically or requires refresh. Multi-tenant testing must pr