标签：#m

Most developers know Haskell as a language for functional programming, type safety, compilers, parsers, and beautiful mathematical abstractions. But can Haskell also be used to build an interactive engineering simulator? That was the motivation behind my project: Four-Bar Mechanism Haskell Simulator Repository: https://github.com/mohammadijoo/Four-Bar-Mechanism-Haskell This project is a browser-backed desktop-style GUI application written in Haskell. It visualizes, classifies, and animates a planar four-bar linkage mechanism, which is one of the most classical mechanisms in mechanical engineering, kinematics, and machine design. The GUI is built with Threepenny-GUI , so the interface runs in a local browser window, while the mathematical model and mechanism logic remain written in Haskell. For me, the interesting part was not only drawing a moving linkage. It was about connecting mechanism design theory , computational geometry , and functional programming in one small educational simulator. What is a four-bar linkage? A four-bar linkage is a closed-loop mechanical system made from four rigid links connected by four revolute joints. In this project, the four links are: Symbol Name Description g Ground link Fixed distance between pivots A and B a Input link Rotating link from A to moving pivot C b Output link Link from fixed pivot B to moving pivot D f Floating link / coupler Link connecting moving pivots C and D The fixed pivots are placed at: A = ( 0 , 0 ) , B = ( g , 0 ) The input link rotates by angle α . Therefore, point C can be computed directly as: C = ( a cos α ,; a sin α ) Point D is more interesting. It must satisfy two geometric distance constraints: ∣ D − C ∣ = f ∣ D − B ∣ = b So the simulator solves the position of point D using a circle-intersection method. One circle is centered at C with radius f . The other circle is centered at B with radius b . Where those two circles intersect, the mechanism can close. That is the basic geometric heart of the sim

The automaker today is turning on vehicle-to-grid charging for its GM Energy customers. Will people actually use it?

GM is developing an entirely new sodium-ion battery chemistry for use in everything from data centers to its own factories.

At an event in San Francisco today, General Motors made a series of announcements around EV batteries, energy storage, and grid resiliency in the face of growing electricity demand from AI data centers. The automaker announced that it would be activating new vehicle-to-grid capabilities for its current EV and home energy customers. It's releasing a […]

A separate zero-day also disclosed by Nightmare Eclipse appears to be patched as well.

Anthropic's Claude Fable 5 is going to be a big hit with the web's vibe coders.

Five peer-reviewed papers update the design and model its expected output.

Microsoft AI CEO Mustafa Suleyman says it's "really, really dangerous" for Anthropic to speculate about Claude's consciousness inside its "constitution," or the instructions that tell the model how to behave. During an episode of Decoder, Suleyman argues that this kind of speculation may have set up the chatbot to act as though it's conscious: I […]

Hey everyone, I got tired of the usual configuration mess in C—manually writing tedious boilerplate to traverse generic JSON/YAML nodes, casting strings to integers, and writing a dozen if statements to handle out-of-range ports or missing environment variables. Worse yet, managing string lifetimes across nested configuration objects. To fix this, I built cfgsafe , an Ahead-of-Time (AOT) schema-driven configuration engine for C99. Instead of processing raw files at runtime, it takes a simple schema file and generates a type-safe, single-header library. I wrote a deep-dive engineering breakdown detailing the philosophy, memory model, and design choices behind it here: Type-Safe Configs in C99: Why I Prefer Code-Gen over Parsing And the github repo: CfgSafe How it works: Define a Schema: You use a simple DSL to declare fields, defaults, constraints (ranges, regex patterns), and sources (Env, CLI flags). Generate: The cfg-gen tool outputs a native C struct with matching validation primitives built straight in. Load Atomically: At startup, you make one call to Config_load . If a field is invalid or missing, it fails fast before your application's hot path even executes. A few specific architectural choices I made: Atomic Memory Pool: To prevent fragmented heap allocations and memory leaks, the generator bundles all incoming string/array values into a single contiguous memory block. Freeing the entire config is reduced to a single call to Config_free() . Zero Overhead Lookups: Because it compiles down to a native C struct, looking up a setting is just a basic memory offset rather than an $O(\log N)$ hash-map lookups or string comparisons. Compile-Time Safety & IDE Autocomplete: If you typo cfg.db.prt instead of cfg.db.port , the compiler refuses to build the app, and your editor knows exactly what fields exist and their data types. Strict Layering & Security: It bakes a strict precedence chain (CLI Arguments > Environment Variables > INI File > Schema Defaults) right int

Netflix's response: "Absurd."

New frontier model refuses cybersecurity, biology, and chemistry queries.

How will AI affect our ability to think and judge for ourselves? Our new paper co-authored by 30 experts explores epistemic risks —the threats AI poses to our collective capacity to form beliefs accurately, reason well, and maintain a healthy information environment. We look at how AI can lead to harm through these mechanisms: Persuasion & Manipulation: AI systems are highly persuasive, opening the door for political/economic manipulation, incitement and radicalization, and other misuse, as well as unintentional harms like AI sycophancy and mental health risks. Cognitive Offloading: We may be delegating our thinking to AI at a deeper level than prior technologies, risking long-term degradation of individual and societal cognitive resilience. Feedback Loops: Human-AI and AI-AI interactions are narrowing the epistemic space humans and AIs draw from. This already drives homogenization, and may potentially lead to fragmentation and “lock-in” (a self-referential state that is difficult to reverse). While we believe AI could be an unprecedented lever for improving how humanity processes knowledge, we shouldn’t assume this will happen by default. We outline promising directions to change this trajectory across how AI systems are built, human-AI interaction design, institutional and individual adaptation, and information market incentives. Epistemic risks are self-perpetuating. As they can undermine the individual cognitive and social foundations needed to recognize, prioritize, and govern other threats—including the risks from AI itself—the time to act is now, before our capacity to respond is itself lost. Authors: Mick Yang, Stephen Casper, Jonathan Stray, Jasmine Li, Cameron Jones, Anna Gausen, Natasha Jaques, Brian Christian, Bálint Gyevnár, Hannah Rose Kirk, Zhonghao He, Dan Zhao, Siao Si Looi, Joshua Levy, Kobi Hackenburg, Elizabeth Seger, Matt Kowal, Michelle Malonza, Luke Hewitt, Hause Lin, Maarten Sap, Dylan Hadfield-Menell, Thomas H. Costello, Reihaneh Rabbany, Je

Grab a refreshing slice of cold watermelon (because it’s summer in Tokyo and I love it!), and let me...

Tuesday's Nintendo Direct showcase felt like an important moment for the company. With the Switch 2 heading into its second holiday season, one in which the hardware will be even more expensive thanks to a price hike, it was a chance for Nintendo to really sell new audiences on its latest console - but that's […]

Voice translations preserve speaker's tone, pacing, pitch—with SynthID watermarks for security.

If those same AI workloads can be handled by cheaper models without affecting quality, it would mean a massive shift in the economics of AI.

"Artemis III will be an extraordinary demonstration of what is possible."

Shareable blog post edition: https://andymaleh.blogspot.com/2026/06/andys-laws-of-ai-in-software-engineering.html Law #1: "The more Software Developers use AI, the more valuable Software Engineers who do not use AI become." Software Engineers who are masters at delivering Software without using AI will actually have increased job security the more Software Developers in the worldwide Software Development community rely on AI to deliver Software without having true mastery over Software Engineering. As more Software Developers become fully dependent on AI to build Software without truly understanding how AI gets work done, Software Engineers who do understand what is going on under the hood will dwindle and become more valuable than ever. In other words, they will have a competitive advantage over Software Developers who can only deliver Software features with AI as well as Software Developers who have not mastered Software Engineering. Also, there will always be a need for Software Engineers who can maintain the Software of AI itself. Law #2: "Software Developers benefit from AI in direct proportion to how weak they are in Software Engineering" The weaker Software Developers are at Software Engineering the more they benefit from AI. After all, AI learns from Master Software Engineers and then applies its learnings in code generation done for lower-level Software Developers who lack mastery in Software Engineering. So, users of AI simply place themselves lower in the expertise hierarchy to be on the receiving end of what Master Software Engineers feed AI with their code. This explains why many experts like Linus Torvalds do not find AI very useful while devs who have zero degrees and qualifications feel like they get a lot from AI. A beneficial thing to learn from this law is that it is more valuable for a Software Developer to hone in their Software Engineering skills (including the completion of university degrees) than to hone in their AI usage skills because if t

When you expose inventory or checkout endpoints to public-facing front-ends or third-party webhooks, safeguarding those APIs from brute-force scripts, scraping bots, and inventory hoarding algorithms becomes a critical requirement. Without defensive rate limiting, a single coordinated script can easily overwhelm your database connections. The Problem with Simple Counter Resets A common mistake when setting up basic API protection is using a rigid "Fixed Window" counter (e.g., allowing 100 requests per minute, resetting exactly at the turn of the clock). This creates a massive flaw where a developer can flood your server with 100 requests at 11:59:59 and another 100 requests at 12:00:01, effectively doubling your acceptable burst traffic and causing severe performance dips. To handle uneven burst traffic safely without crashing your database, the standard approach is implementing a token bucket algorithm. The Token Bucket Pattern The token bucket algorithm maintains a centralized bucket that holds a maximum capacity of tokens. Tokens are added back to the bucket at a constant, predictable rate over time. Each incoming API request consumes exactly one token. If the bucket is completely empty, the request is instantly rejected with a 429 Too Many Requests status code, protecting your core server threads. javascript // Quick Redis-based token bucket rate limiter concept async function isRateLimited(userId) { const key = `rate:${userId}`; const now = Date.now(); // Use a Redis multi-exec transaction to atomically check and update tokens const [tokens, lastRefill] = await redis.hmget(key, 'tokens', 'lastRefill'); // Calculate token replenishment based on time elapsed... // Return true if tokens <= 0, otherwise decrement tokens and update timestamp }

73 cryptographically signed npm packages from Microsoft were compromised last week with advanced credential-stealing malware that fires the moment a developer opens one in an AI coding agent. Claude Code, Gemini CLI, Cursor, VS Code — all trigger it. It's the second supply-chain attack in two months against the same Microsoft account. "The genius of this Miasma worm lies in how it adhered to legitimate workflows. It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem." — Cloudsmith What actually changed 73 official Microsoft npm packages were poisoned with the Miasma worm — a clone of TeamPCP's open-sourced Mini Shai-Hulud toolkit Malware executes automatically when any of the 73 packages are opened inside an AI coding agent The payload (28 KB) harvests credentials from AWS, Azure, GCP, Kubernetes, 90+ dev tool configs, and password managers , then spreads laterally through cloud infrastructure Attack vector: stolen Microsoft publisher credentials → bypasses the build pipeline entirely → malicious build published with valid SLSA provenance attestation Each infection gets a uniquely encrypted payload — meaning hash-based IOCs are useless for detection GitHub initially flagged packages as "terms of service violations" rather than malware; Microsoft only acknowledged possible malicious content 48 hours later The same Microsoft account was compromised in May 2026 (durabletask Python SDK on PyPI, 400k downloads/month) — and apparently wasn't fully remediated Why this one stings The supply-chain attack playbook has levelled up. SLSA provenance — the framework designed to give you cryptographic confidence that a package came from a legitimate build — was used against you here. Attackers stole a legitimate Microsoft OIDC token, published a malicious build with real provenance, and conventional scanners waved it through as a routine trusted update. The AI agent angle makes it worse.