标签：#m

How EvalPort's Grader System Works When designing EvalPort, the grader system was the hardest part to get right. Every eval framework has its own way of scoring LLM outputs — DeepEval uses metric classes, Promptfoo uses assertion objects, Inspect AI uses solver functions. We needed a system expressive enough to cover 90%+ of real-world eval needs, but simple enough that any framework could implement it. The result: 11 grader types that carry their own semantics. A grader isn't just a name — it specifies its parameters, its model, its threshold. An eval suite is self-describing. The 11 Grader Types exact_match — Compare output to expected output, optionally ignoring case. contains — Check if the output contains a substring. regex — Match against a regular expression. semantic_similarity — Embed output and expected output, compare cosine similarity against a threshold. llm_judge — Use an LLM to evaluate the output against a prompt template. The most powerful grader. json_schema — Validate that the output is valid JSON matching a JSON Schema. json_path — Extract a value from JSON output using a JSONPath expression, then compare it. code — Run a function to evaluate the output. human — Defer to human review. model_graded — Compare the output to a reference answer using a model. custom — Escape hatch for graders not covered by built-in types. How Graders Connect to Test Cases A test case references graders by ID. Multiple graders can evaluate the same test case. The ResultSet records each grader's score separately. Why This Design Works Self-describing: An eval suite carries everything a framework needs to execute it. Framework-agnostic: Any framework can implement any subset of grader types. Extensible: The custom type lets frameworks bring their own graders. Comparable: Results from different frameworks use the same grader IDs. Try It pip install evalport-sdk npm install evalport-sdk Spec: https://github.com/adhabnr-ux/evalport/blob/main/spec/SPEC.md Repo: https://gith

CryptoCabana: Azure Cloud CTF Walkthrough 🏖️ Introduction Room: TryHackMe - CryptoCabana Category: ☁️ Cloud Difficulty: Medium Objective: Exploit a misconfigured Azure cloud environment to retrieve a hidden flag. This writeup details a classic cloud privilege escalation path: an exposed SAS token → storage enumeration → credential discovery → Key Vault access → secret reconstruction. The challenge simulates a real-world scenario where poor security practices lead to a complete compromise. Table of Contents Reconnaissance & Initial Access Cloud Enumeration Service Principal Discovery Key Vault Exploration The "Freshly Rotated" Clue Reconstructing the Flag Key Security Takeaways Tools Used Reconnaissance & Initial Access Action: Visited the target website: https://cryptocabanaf5scjagc.z13.web.core.windows.net/ Finding: The website offered to back up seed phrases. Right-clicking and selecting "View Page Source" revealed critical information in the JavaScript code. JavaScript Code: javascript const STORAGE_ACCOUNT = "cryptocabanaf5scjagc"; const BACKUPS_CONTAINER = "backups"; const BACKUP_SAS = "?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"; Analysis: The SAS (Shared Access Signature) token was hardcoded in client-side JavaScript. Permissions: Read (r) and List (l) Expiration: 2099 – far too long! This token grants anyone access to the storage account. bash az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table Cloud Enumeration Action: Listed all containers in the storage account. Command: bash az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table Output: Name Lease Status Last Modified $web 2026-07-16T18:26:22+00:00 backups 2026-07-16T18:26:22+00:00 vault 2026-07-16T18:26:23+00:00 Analysis: $web: Standard container for Azure Static Website hosting. backups: Appeared empty. vault: Hidden

Driven by demand for AI capacity, AMD's data center revenue more than doubled year-over-year in its latest earnings report, reaching $6.7 billion. That's up from $5.8 billion in Q1, and jumping 107 percent from the $3.2 billion it reported for the same period a year ago. At the same time, AMD's gaming revenue fell 31 […]

I’ve seen a lot of people whose reviewers went silent after initial reviews, but I am also noting abnormally quiet authors. I ultimately withdrew my paper, but stayed an active reviewer. Out of my batch of 4 papers, one withdrew, one posted a rebuttal, and two have been completely silent. Of the two papers with radio silence, I think one had borderline scores. I was also the only reviewer who responded to the one paper with a rebuttal. Has anyone noticed this abnormally dead review period or did I just get a strange batch? I’m seeing either reviewers just dropping out of the review process or authors completely checking out after initial reviews are released. It’s strange to me to not even withdraw your paper if you’re not rebutting. Is this a new gambling trend of just submitting papers everywhere, and not even sticking around long enough to withdraw the paper? submitted by /u/RevolutionaryPea8272 [link] [留言]

Electronic Arts has officially become a private company. Last September, EA announced that an investor group led by Saudi Arabia's Public Investment Fund (PIF), Silver Lake, and Affinity Partners would be taking the company private in a $55 billion deal, and on Tuesday, EA said the deal successfully closed. The PIF will reportedly own 93.4 […]

A new SaferAI report finds Z.ai's open-weight GLM-5.2 approaches frontier AI capabilities while lacking key safety mitigations, renewing concerns that powerful open models could outpace governance and safeguards.

Learn how to build tools to simplify how you work—without writing a single line of code. The post How the GitHub legal team used Copilot CLI to streamline their workflows appeared first on The GitHub Blog .

submitted by /u/f311a [link] [留言]

Can MS Paint run Doom? (Yes)

Google's Gemini Notebook rollout has expanded across subscriber and account groups, but Google's published information describes a staged, multi-phase release , not a confirmed global completion for every Google AI Pro subscriber. That distinction matters for users evaluating access, planning source-based research workflows, or deciding whether a subscription tier will immediately provide the enhanced Notebook experience. The product was previously known as NotebookLM . In its official Gemini Notebook announcement , Google describes the rebrand and a broader rollout across Google Workspace and personal accounts. Its earlier rollout communications said initial web access was being provided to Google AI Ultra, Pro, and Plus subscribers, with plans to expand to mobile and additional accounts in the following weeks. In practical terms, expanded availability is real, but availability should be assessed by account type, region, and platform. Reports of delays for some UK Pro users are consistent with a rollout that has reached many users without becoming universally available everywhere at the same time. What Google has confirmed about Gemini Notebook Gemini Notebook is the new name for NotebookLM, Google's source-grounded notebook product. The relevant official updates establish three important points: The rebrand is confirmed. Google announced the move from NotebookLM to Gemini Notebook in its July 16, 2026 update. Access has broadened. Google identified AI Ultra, Pro, and Plus subscribers as initial recipients of web access during the rollout. The release is phased. Google said mobile availability and access for additional accounts would follow, while its later update described a broad rollout spanning Workspace and personal accounts. These statements provide a clearer interpretation than treating subscription eligibility as an identical experience for every user immediately. A tier can be included in a rollout while individual accounts still await activation, or while

Why Decouple Reasoning from Motor Control General-purpose robots have to pull off two very different jobs at once. They need to read a cluttered, full-room visual scene, hold a multi-minute plan in memory, and converse with a person — and, in the same instant, close a high-frequency control loop that keeps a balancing humanoid upright and moves a delicate hand without dropping whatever it holds. Cramming both jobs into a single end-to-end network forces uncomfortable trade-offs: the large context window you want for reasoning fights the low latency you need for torque control. On July 28, 2026, Google DeepMind pushed directly against that trade-off with Gemini Robotics 2 , followed on July 30 by Gemini Robotics ER 2. Rather than one monolithic network, the suite splits the problem across three specialized models — whole-body vision-language-action (VLA) control, high-level embodied reasoning, and on-device adaptation — each tuned to a different cadence and context size. The same modular thinking is visible across recent robotics and VLA research collected on the arXiv robotics listings and on Hugging Face Papers , where decomposed perception-planning-control stacks have become a recurring pattern. Understanding DeepMind's specific split clarifies why this architecture is gaining traction. The Three-Model Split ER 2: High-Level Task Reasoning Gemini Robotics ER 2 is the cognitive planner of the stack. It is a vision-language model built for embodied reasoning: it ingests the live camera feed and a natural-language instruction, then decomposes a task that may run several minutes into structured sub-goals. Beyond planning, ER 2 manages dialogue with a human supervisor, interprets spatial context, and coordinates multiple robots operating in a shared workspace — deciding which sub-task gets handed to which platform. Operating more slowly than the control layer (roughly a few times per second), ER 2 trades frequency for breadth of context. That separation matters: a reas

I didn't put Shelly Plus 1PM and 2PM behind my wall switches for the app or the cloud. I put them there because each one quietly does two jobs at once: it switches a circuit locally, and it measures exactly what that circuit draws. The moment I had them wired in, every light group and every roller shutter in the flat became both controllable AND measurable in Home Assistant — with no separate energy meter and, deliberately, no cloud in the loop. This is the part most Shelly write-ups skip: the metering isn't a bonus, it's the reason to use them. This is how I set them up, kept them fully local, wired the physical switches so they still work like switches, and pulled per-channel energy into the HA Energy Dashboard. Why the Plus series for in-wall use The Plus 1PM and 2PM are Gen2 devices. That matters: they speak a local RPC API over HTTP and WebSocket, they're supported by the native Home Assistant Shelly integration out of the box, and nothing about them needs the internet once they're on your Wi-Fi. The 1PM is a single relay with power metering — I use it behind light circuits. The 2PM has two relays with metering and a dedicated cover/roller-shutter mode — that's what sits behind my shutters. The catch you plan for up front: both need a neutral wire in the switch box. Older installations often don't have one at the switch, so check before you order. If the neutral is there, the rest is easy. The first thing I change: kill the cloud, pin the IP Straight out of the box I do two things in the Shelly web UI (just browse to the device's IP). First, I disable Bluetooth and Cloud under Settings — I don't want the device reaching out to anything, and Home Assistant talks to it directly on the LAN. Second, I give it a fixed address via a DHCP reservation on my router, so the native integration never loses it after a reboot. That's the whole hardening story. No firmware flashing, no third-party firmware — stock Shelly firmware with the cloud switched off is already a fully

Most business prediction problems do not arrive as prose. They arrive as rows: account attributes, transactions, sensor readings, test results, and a target column. For this kind of data, gradient-boosted trees and other conventional methods remain hard to displace. A new paper, Why Large Language Models Fail at Tabular Prediction , asks a much more useful question than “can an LLM classify a table?”: what, specifically, breaks as the task becomes more like ordinary tabular machine learning? The answer from the authors’ controlled experiments is input dimensionality. Their result matters because it separates a real limitation from several explanations that sound plausible but did not hold up in their tests. The experiment was about prediction, not table chat The paper evaluates frontier LLMs in a pure inference setup: a model receives labeled examples and must predict labels for new rows in a single generation pass. There is no fine-tuning, retrieval pipeline, tool calling, or agent loop to compensate for the base model. This is deliberately narrow. It asks whether a general-purpose language model can act as a direct tabular learner. Across 31 benchmark datasets, the authors compare nine methods and 252 configured classical models. That scope is important: a weak result on one CSV is easy to explain away as prompt design or a quirky dataset. A consistent trend across many tasks is harder to dismiss. The headline is not simply that LLMs lose to established tabular baselines. It is that their accuracy declines as the number of input dimensions grows, while the classical baselines in the study stay stable or improve. The paper therefore treats dimensionality as the central failure mode rather than an incidental property of difficult datasets. Four popular explanations did not survive testing There are several standard reasons developers give for poor LLM performance on tables. The researchers turn these into falsifiable hypotheses. “The classes overlap too much.” If th

Have you ever had this happen? You're chatting with a friend about buying a new pair of shoes. A few hours later... Instagram shows you an ad for those exact shoes. Or maybe you're talking about planning a trip. Suddenly...Your feed is filled with hotel deals, flight offers, and travel videos. The first thought that comes to almost everyone's mind is: "𝐌𝐲 𝐩𝐡𝐨𝐧𝐞 𝐢𝐬 𝐥𝐢𝐬𝐭𝐞𝐧𝐢𝐧𝐠 𝐭𝐨 𝐦𝐞." 👀 Honestly... I've thought the same. And maybe you have too. But what if I told you that the truth is actually more fascinating than the myth? So... is your phone secretly listening? Probably not. Not because it can't. But because it usually doesn't need to. Think about it. Every day you leave behind hundreds of tiny digital clues. 🔍 What you search. ❤️ What you like. ⏱️ How long you watch a video. 🛒 What you browse. 📍 Where you go. 👥 Even who you interact with online. Individually...They don't say much. Together...They tell a story that's surprisingly accurate. A story about your habits. The scary part? AI doesn't need to hear your conversations. Sometimes...It already knows what you're likely to do next. Not because it can read your mind. But because it's incredibly good at recognizing patterns. And when a prediction is accurate enough... It starts to feel like magic. Or surveillance. Here's what fascinates me the most. The real superpower of modern AI isn't listening. It's predicting. And sometimes...Those predictions are so good that they make us question reality itself. The next time you think, "My phone is definitely listening to me." Ask yourself a different question. "How much of my digital behavior have I already shared without realizing it?" Because maybe...The microphone isn't the real story. Your patterns are. 💬 Have you ever had an experience that made you think your phone was listening to you? What happened? Takeaway : Technology doesn't always become powerful by knowing more. Sometimes... It becomes powerful by predicting better. Technology becomes less magical when you und

NJ antitrust suit accuses Amazon of unlawfully wielding power over delivery contractors .

I built a debugging-practice site where student code runs entirely in the browser . Python via Pyodide , JavaScript in a worker. No server executes anything. No execution bill, no queue, no sandbox to maintain. But four things bit me hard. 1. Your arguments aren't Python objects Pass a JS object into Python and you get this: TypeError: 'pyodide.ffi.JsProxy' object is not subscriptable It's not a dict . It's a live view of the JS object, and it supports neither obj[key] nor .get() . Convert explicitly: const pyArgs = input . map (( arg ) => pyodide . toPy ( arg )); const result = fn (... pyArgs ); 2. null is not None This one passed my entire test suite while being broken in production. pyodide . toPy ( null ) check result type(v) JsNull bool(v) False ✅ falsy, as expected v is None False ❌ the surprise It's falsy, so truthiness checks work fine. But is None fails — which was exactly what my code was checking. Why my tests missed it: the harness used json.loads . The app used toPy . Different conversion paths, different answers. If you need a real None , create it in Python. Don't pass one across. 3. sys.settrace is a free step debugger Want to show users their code running line by line? Python basically hands it to you: def _tracer ( frame , event , arg ): if frame . f_code . co_name != target : return None # skip library frames if event == " line " : steps . append ({ " line " : frame . f_lineno , " locals " : dict ( frame . f_locals ), }) return _tracer Two things this naive version gets wrong: Add a step cap. A tight loop generates steps faster than it burns a 5-second timeout. You need both guards. Handle exception . During unwinding, the return event still fires with arg=None . Miss it and your trace says "returned None" for code that crashed. 4. Your snapshots are lying A user screenshot exposed this one. Every step in the trace showed the final state of a list. Step 1 included mutations that hadn't happened yet. tracing: nums = []; nums.append(1); nums.append(

Hay muchísimo escrito sobre qué tiene que reportar una organización: guías de Supersalud, de Supersociedades, de SAGRILAFT, de PTEE, de SST, de reportes ambientales. Todas contestan la misma pregunta — ¿qué me aplica? — y la contestan bien. Casi nadie escribe sobre la pregunta que de verdad hace fallar a las organizaciones: ¿cómo no perder ninguno, todos los años, cuando son treinta? Porque los incumplimientos que he visto de cerca casi nunca vienen de que alguien ignorara la obligación. Vienen de que la obligación se conocía perfectamente y aun así se pasó la fecha. Este artículo va del problema operativo —fechas, evidencia, responsables— no de cuáles normas le aplican a su entidad. Eso es otra conversación, y no es esta. Por qué el archivo de Excel deja de servir Con tres obligaciones, una hoja de cálculo sobra. El dolor no empieza por el número: empieza cuando el calendario hay que derivarlo . 1. Las fechas no son fechas, son reglas. Muchos vencimientos no están escritos como un día del calendario: dependen del último dígito del NIT, de días hábiles, o de un plazo contado desde un hecho. Eso significa que alguien recalcula el calendario entero cada año, a mano . Cada enero se reintroduce la misma oportunidad de equivocarse, y basta con un festivo mal contado. 2. El calendario vive en una persona. Casi siempre hay alguien que "sabe cómo es la cosa". Mientras esté, funciona. Cuando se va de vacaciones —o se va de la empresa— se va con ella el contexto que nunca estuvo escrito. La hoja sobrevive; el criterio para llenarla, no. 3. La hoja dice que se entregó, no lo prueba. La celda en verde es una afirmación de alguien. La evidencia real —el radicado, el archivo exacto que se subió, la hora— está en el correo de alguien. El día que hay que demostrarlo, empieza la arqueología en bandejas de entrada. 4. Los terceros que le reportan a usted. Si recibe información de contratistas, sedes o filiales, ahora administra dos problemas: sus propios vencimientos y los de ellos.

I built an orchestration skill for Claude Code that delegated everything to subagents. It worked. It also cost somewhere on the order of 1-2 million Opus tokens per task - including tasks whose final diff was a handful of lines. Nothing was broken. Every individual decision was defensible. Three modest multipliers stacked, and then the whole stack ran on every single request. This is the postmortem, the redesign, and the enforcement layer I should have written first. v1: pure delegation The design goal was context hygiene. The main session gets polluted fast - it accumulates file contents, tool output, and dead ends, and its judgment degrades as the window fills. So: don't let it do any work. Make it a coordinator, and give every unit of real work a fresh context. That produced four rules: A hard gate. The main session was forbidden from reading, editing, or running anything itself. Every action went through a subagent. A fixed 5-phase pipeline on every task: Plan → Approve → Execute → Review → Report. Fresh subagents per phase. No reuse. Each phase got clean context by construction. Mandated reviewers with "loop until clean." A review phase that re-ran until it found nothing. And the trigger was broad - essentially any actionable request. "do this," "implement," "fix," "build," "change." Read those four rules again with a cost lens instead of a correctness lens. That is the whole postmortem. The three multipliers 1. The dispatch schema made model optional The subagent dispatch tool takes a model parameter. My skill never set it. Omitted, it inherits from the parent session - which was Opus 4.8. So every subagent, including the ones whose entire job was "read this file and summarize it," ran on the most expensive tier available. Here's what that actually costs at list prices: Model Input $/MTok Output $/MTok vs. Opus Claude Opus 4.8 ( claude-opus-4-8 ) $5.00 $25.00 1× Claude Sonnet 4.6 ( claude-sonnet-4-6 ) $3.00 $15.00 0.6× Claude Haiku 4.5 ( claude-haiku-4-5 ) $1.

submitted by /u/f311a [link] [留言]

"Because typing the same 15 commands every day is so 2026." A command-line utility that turns your chaotic terminal sessions into a beautiful, interactive menu. Stop memorizing commands. Start executing like a pro. 🚀 What Makes This Tool Special? Feature What It Does For You 🎯 Zero Memorization Never type kubectl get pods --all-namespaces --context=prod again ⚡ Lightning Fast One binary. No dependencies. Runs everywhere. 🔗 Command Chaining Execute complex workflows with --exec "1-2-3-4" 📁 Team-Ready Share menu.yml with your team. Onboard new devs in 30 seconds. 🔐 Env Variables Store secrets safely in env.ini — never hardcode credentials 📦 Installation (30 seconds or less) Option 1: One-Liner (if binary is hosted) curl -sSL https://example.com/hello | sudo tee /usr/local/bin/hello && sudo chmod +x /usr/local/bin/hello Option 2: Build from source git clone https://github.com/yourrepo/hello cd hello go build -o hello main.go ./hello --help Option 3: Copy & Go # Anywhere you want: cp hello ~/hello # Home folder cp hello /usr/local/bin/ # Global access (recommended) 🎮 Usage That Will Make You Smile Interactive Mode — The "I'm Feeling Lazy" Way # Just run it. The menu will greet you. ./hello # Using your own config ./hello -c ./deploy_menu.yml Headless Mode — The "I'm Automating Everything" Way # Execute a single command ./hello --exec "1" # Execute a whole pipeline (1 → 2 → 3 → 4) ./hello --exec "1-2-3-4" Perfect for: CI/CD pipelines, morning standup scripts, and impressing your boss. 📂 Example Menu (Your New Best Friend) items : 1 : title : " 1. 🚀 Deploy to Production" commands : - " git checkout main" - " git pull origin main" - " docker build -t myapp:latest ." - " docker push myapp:latest" - " kubectl rollout restart deployment/myapp" 2 : title : " 2. 📊 Check System Health" commands : - " htop" - " df -h" - " free -m" - " netstat -tulpn | grep LISTEN" 3 : title : " 3. 🔥 Clean Up Docker Garbage" commands : - " docker system prune -af --volumes" - " echo '✨ Saved 47 GB