标签：#m

I wrote about the Electricity Planning Engine a little while back, including a timezone bug that made a correct price look "not found" after a database round trip. A few days later, Alex Shev left this comment: Timezone bugs are brutal in planning engines because the result can look mathematically correct while being operationally wrong. Energy workflows especially need tests around boundaries, not just averages. That is a genuinely sharp way to put it, and it is not just a comment about the bug I already wrote about. It is a comment about how I test the project in general, and I did not like how well it applied once I went and checked. The part that stung a little "Looks mathematically correct while being operationally wrong" is exactly what the original timezone bug was. PriceSeries::priceAt() threw a clean "price not found" error, which is arguably the good version of that failure mode: loud, easy to catch, hard to ship. A quieter version of the same class of mistake, off by one hour instead of missing entirely, would not throw anything. It would just return a plan that looks completely reasonable and is wrong the entire time it runs. Alex's second point, boundaries over averages, is the one I actually had to go check rather than just agree with in the abstract. So I opened tests/Unit/Domain/Contract/PricingStrategyTest.php and looked at every hour used in every peak/off-peak assertion: new DateTimeImmutable ( '2026-07-18 14:00:00' ) // peak new DateTimeImmutable ( '2026-07-18 23:00:00' ) // off-peak new DateTimeImmutable ( '2026-07-18 05:00:00' ) // off-peak 14:00, 23:00, 05:00. Every single one comfortably inside its window. None of them anywhere near the actual transition. The off-peak slot in the config is 22:00 to 06:00 , and the comparison behind that lives in TimeSlot::contains() : // wraparound slot, e.g. 22:00 -> 06:00 return $minuteOfDay >= $this -> startMinuteOfDay || $minuteOfDay < $this -> endMinuteOfDay ; That >= versus < is exactly the kind of one-

I spent the last while building a prompt-injection detector trained on 78,000+ attack samples. Here's what surprised me, and why I ended up going the unfashionable route. The trendy approach is to use an LLM. I didn't. The default move in 2026 is "use an LLM to judge whether input is an attack." It's appealing because models understand nuance. But once you try to run it inline on every request, the problems pile up fast: Latency. You've added a full model round-trip to every single call. Hundreds of milliseconds, minimum. Cost. Your security bill now scales with your traffic. Every request pays the token tax. Non-determinism. The same input can get a different verdict tomorrow. Try explaining that in an incident review. It's jailbreakable itself. Your security model is an LLM, which means it's vulnerable to the exact attacks it's supposed to catch. So I built the boring version instead: deterministic regex plus classical ML (TF-IDF character n-grams into logistic regression). No LLM in the detection path. It runs in about 7ms, costs nothing per call, and is fully deterministic. What the data actually showed Here's the part I want to be honest about, because most vendors quote one number and hide the rest. Measured on public benchmarks the model was not trained on (held out, non-circular): Real-world, in-the-wild jailbreaks: 0.895 recall at 1.00 precision Obfuscated / evasion attacks: 0.799 at 1.00 precision A frozen external split: 0.804 recall, 0.48% false-positive rate Subtle roleplay-framed jailbreaks: 0.324 That last number is bad, and it's the most important one on the list. The honest read is that deterministic detection is excellent on real-world and obfuscated attacks and weak on subtle roleplay framing. That's a real gap, and pretending otherwise just means someone finds it later and trusts you less. The false-positive rate is a moving target One thing I didn't appreciate going in: FPR is completely traffic-dependent. The same model reads roughly: ~0.4% fal

A few months ago, I submitted a talk proposal to WordCamp US without really knowing what to expect. Today, I'm happy to say that it was accepted, and I'll be speaking at one of the largest WordPress conferences in the world. WordCamp US has always been one of the events I've looked up to in the WordPress ecosystem. As someone who has spent over a decade building content platforms with WordPress, contributing to open source, and working with teams across different countries, having the opportunity to share my experience on that stage is something I don't take for granted. My session is: Stop Blaming WordPress: Building a Real Editorial Workflow Without Leaving the Ecosystem Throughout my time working with WordPress, I've noticed a recurring pattern. When editorial teams struggle to publish content efficiently, WordPress often gets the blame. But after working with organizations of different sizes, I've learned that the CMS is rarely the real problem. The real challenges are usually: disconnected editorial processes; unclear content ownership; missing approval workflows; inconsistent governance; too much reliance on manual work. In this session, I'll share practical strategies for building scalable editorial workflows while keeping WordPress at the center of the ecosystem. The goal isn't to introduce another platform, it's to make the existing one work better. Speaking at WordCamp US is especially meaningful because I've been part of the WordPress ecosystem for many years. Being able to give something back to this community is an opportunity I'm genuinely grateful for. If you'll be at WordCamp US 2026 in Phoenix, I'd love to connect. 🎟️ Get your ticket: https://us.wordcamp.org/2026/tickets/ 💸 Use my speaker discount: speaker-friend20 during checkout for a discount on your ticket. See you at WCUS! 🚀

What questions should i prepare for during a technical interview for a live streaming deployments? (asking for a friend) submitted by /u/trouble_sleeping_ [link] [留言]

AI design tools have gone from generating blurry wireframe suggestions to shipping functional,...

I wanted to make a project for stardance hack club but I don’t know exactly what. I know a little bit of almost everything because im not decided what I want to really be good at yet. I know cpp pretty well, little bit of c#, some php, html, css, js. I also know basics of CAD, I like arduino, desktop apps and web apps. I don’t have any idea for anything that isn’t already there and is interesting. Pls help me submitted by /u/Blazej_kb [link] [留言]

I submitted an abstract to AAAI AISI and accidentally missed the field asking authors to nominate a reciprocal reviewer by the July 21 AoE deadline. At the time of submission, I knew that I personally did not meet the publication requirements to serve as a reviewer. After adding my graduate-student co-authors to the submission, I realized that one of them was qualified and could fulfill the reciprocal-reviewing obligation, but we overlooked the nomination field before the deadline because it wasn't a required field. As soon as we noticed, we added the qualified co-author to OpenReview as a potential reciprocal reviewer (edits were still accepted) and emailed the workflow chairs. He meets the publication requirements and is willing to complete the full reviewing load. The policy says that if a qualified author is available but no one is nominated, the submission may be desk rejected. The full paper deadline is in two days, and so far we have only received the automated response shown in the attached screenshot. Has anyone dealt with a similar situation at AAAI or another conference? Do you think this is likely to lead to a desk rejection, or are workflow chairs usually willing to correct this kind of administrative mistake when a qualified reviewer is available? submitted by /u/TheSupremeEgger [link] [留言]

OpenAI's ChatGPT Work materials have put a familiar enterprise question into sharper focus: how far can an AI assistant move from answering prompts to supporting coordinated, multi-step work? The supplied research identifies official OpenAI documentation covering capabilities, governance and enterprise rollout, but it does not establish a complete public feature list, pricing model or availability schedule. For prospective buyers, that makes disciplined evaluation more useful than assumptions about what the offering may eventually automate. The interest is understandable. A workplace AI product that can help teams turn requests into coordinated plans, reusable outputs or connected workflows could affect knowledge work well beyond individual chat sessions. But the available material does not substantiate specific claims about autonomous web or app generation, collaborative trip planning, or the exact scope of automation. Those scenarios should be treated as possible use cases to evaluate, not confirmed ChatGPT Work functionality. What the available ChatGPT Work materials establish The most reliable starting point is OpenAI's ChatGPT Work product page . According to the supplied research, OpenAI's official materials describe ChatGPT Work in the context of capabilities, governance and enterprise rollout . That framing matters because enterprise AI adoption is not solely a model-performance decision. It also involves how a tool fits existing systems, who can use it, what data it can access, and how organizations retain operational control. The research does not provide enough detail to verify particular integrations, permission settings, security certifications, pricing, regional availability or release dates. Enterprises should therefore avoid treating broad product positioning as a procurement specification. The practical question is whether the official documentation and commercial terms available at the time of evaluation answer the organization's specific requireme

There's something about a movie like The Room, Troll 2, or Fateful Findings that I find irresistible. These sorts of "so bad they're good" films are marvelous curiosities where ambition far outstrips resources, ability, and self-awareness to become something much greater than the sum of their parts. Champagne and Bullets (also released as GetEven and […]

A smart contract can't tell whether a submitted score came from a valid game or was simply made up. Dario Dash handles that by proving the run itself. I have been building Dario Dash , a small endless runner on Dusk. The game runs in the browser and does not require a wallet to play. After a ranked run, the browser can generate a Groth16 proof locally and submit the score to a smart contract. The contract does not trust the submitted score. It accepts it only after verifying the proof, binding it to the transaction sender and checking that the run seed has not already been used. The source is available on GitHub . What actually needs to be proven? A score by itself says almost nothing. A client could simply submit any number it wants. For Dario Dash, a valid run includes much more than the final score: the player movement and jump timing the seed-derived obstacle schedule obstacle clearance and collision windows item pickups damage and game-over conditions fireball kills transitions between Regular, Super, Fire and Cape forms the number of ticks played the resulting score The proof must establish that these rules were followed from the initial state until the claimed final state. It also needs to bind the run to the account submitting it, otherwise somebody could copy another player's proof. The architecture The repository is split into a few layers: dash_zk contains the deterministic game simulation used by the browser proving path. dash_core contains a separate 60 Hz simulation used by the RISC Zero path. dash_web exposes the Rust simulation to the browser through WebAssembly. zk_browser contains the Circom circuit and the JavaScript proof conversion code. contract verifies the proof and maintains the leaderboard on Dusk. web contains the playable Vite application. The important boundary is that the game logic is deterministic and integer-only. Floating point physics would be a mess to reproduce consistently across JavaScript, WebAssembly, the proof circuit and th

When good cameras got cheap, everyone predicted the death of professional photography. The prediction landed wrong. The low end died outright: stock libraries, cheap portraits, mass-event coverage went to anyone with a phone and a free editing app. The high end did better than ever — editorial work, photojournalism with access nobody else had, an aesthetic you could not reproduce by buying the same gear. The damage landed in the middle. Small weddings, corporate headshots, real estate listings, the steady unglamorous bulk of the market: not extinction, compression. Prices fell, volume moved to cheaper substitutes, and the survivors climbed up or specialized out. That compression is the cleanest map I know for what AI-assisted coding is doing to software work. And this half I know from inside: two decades leading dev teams, and now building AI tooling for them. The comfortable half of the argument The reassuring version of this is everywhere right now: you were never paid to type, you were paid to think, so AI just frees you to do the valuable part. It's not wrong. It's just the half that's easy to hear. The other half is about the market, not about you. Judgment, architecture, knowing what breaks in maintenance, deciding what not to build — a model that writes plausible code on command doesn't commoditize any of that. I have watched weeks of confusion land on people who could not read what a capable model generated; the gap was never the tool, and better AI autocomplete does not close that gap. But "judgment beats typing" answers only a question about skill and dodges the question about market structure. AI doesn't replace developers as a class; it commoditizes a segment. The segment it hits first is the same one the camera hit: the middle. The junior-to-mid tier that lived on CRUD apps, simple integrations, brochure sites, the standard internal tool with a form and a table behind it. That work was always implementation against a known spec, and implementation again

Headline: Next.js Middleware (middleware.ts at the project root) runs before every matched request — before cache, before rendering, before the route. That position makes it right for auth redirects, A/B cookie bucketing, and locale detection. Wrong for database queries and heavy imports. In 2026, Middleware on Vercel runs on Fluid Compute (standard Node.js), so the constraint is latency budget, not API availability. Key takeaways Middleware runs before every matched request — before cache, rendering, or route handler — the right layer for auth, locale, and A/B bucketing. Middleware can read requests, set cookies, redirect, rewrite, or return early — without the route running. DB queries and large packages add latency to every request. On Vercel in 2026, Middleware runs on Fluid Compute (standard Node.js). The constraint is latency: every added millisecond is paid on every matched request. Use matcher to scope Middleware to only the routes that need it; without it Middleware runs on every static asset request. Auth in Middleware = verifying a self-contained JWT without a DB call. Full session validation belongs in the route. I spent a long time only using Middleware for locale redirects. After shipping auth-protected routes and an A/B test, the full shape became clear. What is Next.js Middleware and where does it run? Middleware is exported from middleware.ts at the project root. It intercepts matched requests before route resolution, cache lookup, and Server Component execution. Returns one of four types: pass through ( NextResponse.next() ), redirect, rewrite (serve different content while keeping original URL in address bar), or a direct response. export function middleware ( request : NextRequest ) { return NextResponse . next (); } export const config = { matcher : [ ' /((?!_next/static|_next/image|favicon.ico).*) ' ], }; Without matcher , Middleware runs on every request including static files. On Vercel in 2026, Middleware runs on Fluid Compute — standard Nod

Encrypted data stored in cloud archives today will outlive the mathematical algorithms guarding it. In enterprise architectures that handle long-term records, like construction risk logs or employee compliance platforms, data retention schedules often span twenty to thirty years. When building cloud pipelines that move this information across services, we depend heavily on asymmetric encryption, which is a security method using one public key to lock data and a separate private key to unlock it. Standard public-key algorithms rely on mathematical problems that are nearly impossible for classical computers to solve within a reasonable human timeframe. Quantum computing changes this equation entirely. Quantum computers leverage quantum mechanics, the physical rules governing subatomic particles, to perform calculations at speeds fundamentally unimaginable with traditional silicon processors. While powerful quantum systems are still in development, the security threat to distributed systems exists today. Hostile actors do not need to crack modern security algorithms in real time. Through a pattern known as Harvest Now, Decrypt Later, adversaries can capture and store encrypted network traffic right now. They simply wait until future quantum hardware becomes capable of running the formulas required to decrypt that stolen history. For software architects, preparing for post-quantum cryptography, which refers to new mathematical encryption algorithms designed to withstand quantum attacks, is far more than a simple library swap. It is a deep distributed systems migration challenge. The primary operational hurdle is payload size and computational overhead. Quantum-resistant algorithms require significantly larger digital keys and payload headers than the standards we rely on today. When cryptographic payloads expand, every component of a distributed platform feels the ripple effect. Message queues experience higher bandwidth demands. Database indexes inflate. Memory consump

I recently tried to share an open-source project I've been working on called Open Vectorizer . It's a raster-to-SVG vectorization engine written in Rust. It runs locally, compiles to WebAssembly, has a reproducible benchmark suite, and competes surprisingly well with established tools like Potrace and VTracer. I wanted people to see it. More importantly, I wanted contributors. That's where things got weird. First, Hacker News Open Vectorizer felt like a natural fit for Show HN. It's open source. It's technical. There's an interesting algorithm behind it. There are benchmarks people can reproduce and argue about, which I'm told is approximately 73% of Hacker News' renewable energy supply. Except I couldn't submit a Show HN. Hacker News is temporarily restricting Show HN submissions from newer users because of a large influx of people unfamiliar with the community. Fair enough. Annoying, but understandable. So I tried Reddit. Then r/rust Open Vectorizer is written in Rust, so r/rust seemed like an even more obvious place to share it. The post was automatically removed. The subreddit now requires project submissions to certify that they do not contain significant AI-generated content . And that's something I can't honestly certify. Open Vectorizer has been developed with substantial AI assistance. So I didn't repost it. Then r/opensource Surely an MIT-licensed project actively looking for contributors belongs in an open-source community. Their rules include: All AI-generated content is low-effort and ban worthy. At this point I had to appreciate the situation. I had an open-source project. I wanted humans to contribute to it. And some of the communities containing exactly those humans didn't want me to tell them about it because machines had helped write it. Here's the problem I actually understand why these rules exist. AI has made it incredibly cheap to produce software-shaped objects. You can ask an agent to build a database, publish 20,000 lines to GitHub an hour l

On the latest episode of Equity, we discussed why Moonshot AI's Kimi seemed to panic Silicon Valley and Wall Street.

According to Mark Gurman, Apple is planning to reveal its first smart glasses at WWDC next June, with an expectation that they'll launch by the end of 2027. Part of the hold-up may be around the company's efforts to get its privacy features and messaging in order. Smart glasses in general, and Meta's in particular, […]

Herodotus wrote of a bird that lived five hundred years in Arabia, and when its life came to an end, it did not wait to be surprised by death. It built its own nest of cinnamon and myrrh, set the nest and itself alight, and let a new bird rise from what the fire left behind. The Hestia argued for tending a fire that must never go out. That’s true, and it isn’t the whole truth. Teams end. People leave. Companies get acquired, reorganized, shut down, and five years from now some part of this whole model will probably look as dated as the practices it was written to replace. No amount of tending prevents that. Pretending otherwise is its own kind of Alexandria , a slow decline dressed up as continuity, right up until the fire goes out anyway and nobody chose the moment. The bird in Herodotus doesn’t get caught by surprise. It builds the pyre itself. Chooses the moment, gathers what matters, and burns deliberately, trusting that what rises afterward carries the shape of what came before, not because the fire preserved the old bird whole, but because starting over was never the same thing as starting from nothing. That’s the part tending alone can’t promise. A team that’s about to be split up can hand its shared model to whoever inherits the work on purpose, the way a rep in the Boule carries a decision back instead of leaving it to travel however it happens to travel. A team about to lose its most experienced person can spend the weeks before that departure making sure the framing, not just the conclusions, made it into someone else’s head, the way the Mimesis argued a junior actually learns. None of that stops the ending. It decides what the ending leaves behind. This series doesn’t get to end with a fire that never goes out. Nothing does. It gets to end with the only thing actually inside anyone’s control. Build the pyre on purpose. Choose what goes into the fire. References The Myth of the Phoenix: Rebirth and Renewal : Greek Mythology, on Herodotus’s original accoun

The CI job just hit 28 minutes. Again. You pull up the duration report expecting to blame a bloated integration test or a slow environment spin‑up. Instead the longest stage stares back at you: a collection of Cucumber feature files that haven’t caught a real bug in months. Maybe years. They run on every commit, green circle after green circle, while your team mutters about slow pipelines and nobody dares touch them. Most teams treat those scenarios like documentation. “They describe the system,” someone once said, as if a Gherkin file were a legal contract. Others cling to the sunk cost: a year ago a whole squad spent two sprints writing them, polishing the grammar, aligning step definitions. Deleting them would feel like admitting waste. Experienced engineers see it differently. They treat a scenario that never fails as a liability you’re paying for on every push. Not neutral. Liable. Compute cycles, developer attention, flake‑debugging time, and the quiet toll it takes on trust in the pipeline. The principle is blunt: if a test hasn’t failed in the last few sprints, you’re already paying its full cost and receiving nothing in return. That doesn’t mean you delete everything green. But it does mean you audit with the same seriousness you’d use for a memory leak. What the green wall actually costs The damage is not abstract. A pipeline bloated with stale scenarios hurts you in five concrete ways. First, feedback slows. Every extra minute between push and result stretches the loop that tells a developer they’re safe to merge. Multiply across a team and you’re losing hours per week to waiting. Second, flakiness increases. When you have many scenarios, a single unstable environment variable can produce a handful of failures that are not regressions at all. Engineers learn to retry, then to ignore. Third, confidence erodes. If half the suite is ceremonial, a genuine failure might be dismissed as “just another flaky test” until it reaches production. Fourth, maintenance

The manager opens your portfolio. Your resume says you have five years of automation experience. The README lists Selenium, Playwright, Appium, Jenkins, Docker, Kubernetes. He scrolls. There is no code. The browser tab closes. This is you. Not because you lack skill—you have it—but because your public proof reads like a shopping list. The tools you name say nothing about how you think when a flaky test fails at 2am, or how you convince a developer that a bug is real. If you’re serious about landing a role that demands more than record-and-playback, you need to stop treating your portfolio like a keyword bingo card. Here are three mistakes that kill your chances instantly, and exactly how to fix them. Mistake 1: Tool jockeying Listing every automation framework you’ve heard of is a reflex. A hiring manager sees "Proficient in Cypress, Playwright, Selenium, WebDriverIO" and assumes you ran npm init once in each and called it done. Most testers frontload tools because they’re scared of the empty space where code belongs. Experienced testers show one test, deliberately written, with a comment that explains a trade-off they chose. The difference is not volume. A single 30-line script that handles a login flow with a purposeful wait strategy teaches more about you than a six-tool résumé. I’ve deleted my own old projects after re-reading them and realizing they said nothing about why any assertion existed. That quiet cringe is the signal you’re ready to improve. What you ship in your portfolio must answer one question: "What did this person decide, and why?" Move your tool list to a footnote. Let a real test carry the message. Mistake 2: The perfect test trap A portfolio full of green builds is a trap. Every team knows that real automation breaks: the CI node runs slow, the third-party API throttles you, the DOM renders a fraction of a second late. Showing only passing tests hides how you handle the ugly parts of the job. Most testers polish every assertion until it’s spot

Most people think the SDET title means you are automatically more valuable than a manual tester. The SDET writes Playwright scripts. The SDET configures CI pipelines. The SDET talks about page objects and retry strategies. The manual tester clicks through screens and writes bug reports. Here is the truth I have watched play out across teams: the manual tester who can write a SQL join will consistently outperform the SDET who cannot. Not because SQL is magic. Because SQL is the shortest path to understanding what the system actually stores, not what the UI shows you. The problem with automation-first thinking I have seen SDETs spend three sprints building a test suite that validates every button, every dropdown, every error toast. The suite passes in CI. The suite passes in staging. The suite passes in production. And the bug still ships. Why? Because the test checked that the UI rendered correctly. It never checked that the database actually saved the right record. The SDET wrote assertions against DOM elements, not against data. The manual tester, meanwhile, ran a simple query. Saw the order status was "pending" when it should have been "confirmed." Filed a bug with the exact SQL that proved the issue. The developer fixed it in ten minutes. That is not a story about manual versus automated. That is a story about data literacy versus UI obsession. What a SQL join gives you that a locator never will A Playwright locator tells you something is on the screen. A SQL join tells you something is true. When you write page.getByText('Order confirmed') , you are testing that the frontend displays those words. You are not testing that the backend actually confirmed the order. You are not testing that the payment gateway returned success. You are not testing that the inventory decremented. A SQL join connects those dots. SELECT o . id , o . status , p . status AS payment_status , i . quantity AS remaining_stock FROM orders o JOIN payments p ON o . id = p . order_id JOIN invent