标签：#p

Fusion power startup Thea Energy snagged a $20 million award from ARPA-E to scale production of its high-temperature superconducting magnets.

The deal means content will be integrated into the YouTube experience, allowing viewers to discover and watch Peacock content without leaving the platform.

Give Claude Code missions to spawn a team of agents Discussion | Link

The outgoing executive director of the Office of Homeland Security Statistics is one of very few federal officials to speak out against the Trump administration’s immigration crackdown.

These are likely the last updates of note before Apple's bigger fall updates.

A second gremlin is rolling through Spotify this evening.

Postmortem after several rounds of performance work on a Laravel site, trying to push concurrent user capacity up. Ended up putting Varnish in front of Nginx. submitted by /u/noweh95 [link] [留言]

The screwup shows how tricky it can be to stop web crawlers from making ostensibly private conversations with AI chatbots entirely too public.

Apple's latest software updates are primarily focused on security fixes.

Nanoleaf’s Blocks Combo XL Smarter Kit is a fun back-to-school buy that can add pops of customizable light and storage to your wall. It combines colorful smart lighting panels with a low-profile shelf and pegboard, and right now you can buy the kit for half off at $99.99 from Nanoleaf, which marks a new low […]

Age verification is okay, but filtering is preempted by Section 230, judges find.

I run a consumer product company by myself. Physical inventory, two storefronts, multiple marketplaces, subscription billing, bookkeeping, tax filings, government paperwork, content in two languages, and a codebase that ships to production most weeks. Headcount: one. Not "one plus a virtual assistant." One. Three years ago this was not possible. It is also not possible today by keeping a chat window open and asking it questions. The thing that changed is not that models got smarter in the abstract. The thing that changed is that agents can now operate software the way an employee does : click through admin dashboards, fill in government forms, read email, write and deploy code, remember what happened last Tuesday, and run on a schedule without being asked. Once that is true, most of what a small company's staff does becomes a workflow you can write down, hand to an agent, and audit weekly instead of doing daily. Everything I run sits on five primitives. Tool names will churn every six months. These won't. 1. A browser-operating agent An agent that drives a real browser session with my real logins: seller dashboards, banking portals, government sites, ad platforms, email. This is the highest-leverage primitive, and it is the one most people skip. The reason is uncomfortable: roughly 90% of small-business operations live behind a login wall with no usable API. Your marketplace seller console. Your payment provider's merchant dashboard. Your country's tax portal. The grant program that still ships application forms as attachments. If your automation strategy requires an official API for everything, you will automate the 10% that already had one, and you will still be doing the other 90% by hand at 11pm. The browser agent is my hands. It logs in, navigates, reads what's on screen, fills forms, downloads documents, and reports what it found. 2. A coding agent An agent that reads my repositories, writes changes, opens a review pass, and deploys. I treat it exactly like a

Poland runs a national e-invoicing system called KSeF (Krajowy System e-Faktur). Business-to-business invoices are submitted to a government API in a schema called FA(3) , and the system hands back an official confirmation of receipt. If you sell software to Polish companies, you will meet it. The Ministry of Finance publishes official SDKs for Java and .NET . There is nothing for JavaScript. A full client is a real project: authentication, session handling, certificates, XML signing. But a large share of rejected invoices have nothing to do with any of that. They are structural. A tax ID with a bad checksum. Net plus VAT that does not add up to gross. A date that does not exist. Those are worth catching on your side, before you build a session with anyone. So I pulled that layer out of a product I work on, rewrote it standalone, and published it: ksef-invoice-validate . Zero dependencies, no network calls, runs in the browser. npm i ksef-invoice-validate import { validateInvoiceForKsef } from " ksef-invoice-validate " ; const result = validateInvoiceForKsef ({ invoice_number : " FV/2026/07/1 " , issue_date : " 2026-07-01 " , seller_nip : " 1111111111 " , buyer_nip : " 1111111111 " , amount_net : 1000 , amount_vat : 230 , amount_gross : 1230 , }); Three things in it were more interesting than I expected. The NIP checksum A Polish tax identification number (NIP) is ten digits. The tenth is a checksum over the first nine, each weighted and reduced modulo 11. const weights = [ 6 , 5 , 7 , 2 , 3 , 4 , 5 , 6 , 7 ]; const digits = cleaned . split ( "" ). map ( Number ); const checksum = weights . reduce (( sum , w , i ) => sum + w * digits [ i ], 0 ) % 11 ; if ( checksum !== digits [ 9 ]) { // invalid } There is a small elegance here. The remainder can be 10, and no single digit equals 10, so those numbers simply cannot exist as valid NIPs. You do not need a special case. The comparison rejects them on its own. This alone catches a surprising amount. Most bad tax IDs in t

NASA has not made substantial investments in thermal protection research for decades.

A few months ago I got obsessed with a question: can you run a real LLM entirely inside a browser tab, with zero backend, zero GPU, and zero install? The answer is yes. Here's what I built. ghost is a single HTML file that downloads a quantized language model into your browser's cache on first visit, then runs inference locally in WebAssembly forever after. Fully offline after that first download. No API key. No npm. No build step. Open the file, pick a model, chat. How it works The inference engine is wllama — a WebAssembly binding for llama.cpp. It runs GGUF quantized models directly in the browser using WASM SIMD. I pin it to a specific version so the JS and WASM files always match (learned this the hard way after a fun debugging session involving mismatched memory imports). Models are downloaded from HuggingFace on first load and cached via the browser's Cache API. On every subsequent visit they load instantly from cache, no network needed. Features Three models: Qwen2.5 1.5B (smart), Qwen2 0.5B (fast), TinyLlama (lightweight) Markdown rendering from scratch — no library, just regex transforms RAG: drag a .txt or .pdf onto the chat window. It chunks the text, embeds each chunk using wllama's embedding API, stores vectors in memory, and retrieves the top-3 relevant chunks on each message. Fully local, fully offline Voice input via the Web Speech API — mic button auto-sends on silence Multi-turn conversation memory capped at 10 turns PWA installable — works on mobile home screen too The hard parts Getting wllama to load from a cached model was genuinely tricky. Blob URLs created in the main thread aren't accessible from wllama's internal Web Worker. IndexedDB chunk reconstruction hit a 2GB ArrayBuffer limit on Windows Chrome. The final solution was using wllama's built-in loadModelFromHF with useCache: true which handles everything internally. The embeddings API requires toggling a flag (embeddings: true) that conflicts with normal chat completion — so I toggle it

Here's what the rumor mill tells us Google might be preparing for its next Pixel launch.

Apple is facing a lawsuit from three users who say they collectively lost more than $1.8 million after downloading a fraudulent crypto wallet from the App Store, challenging the company’s longstanding claims that its app review process keeps users safe from scams.

Model Context Protocol servers have quickly become the connective tissue between AI agents and the outside world — file systems, databases, APIs, internal tools, you name it. That convenience comes with a catch: the tools, prompts, and schemas an MCP server exposes are a new kind of attack surface, and most traditional scanners simply don't look there. MCPRadar is an open-source project built specifically to close that gap. Why this matters A recent academic study examining nearly 1,900 MCP servers found meaningful security issues in a surprising share of them — general vulnerabilities in roughly 7% and MCP-specific tool poisoning in another 5%. Tool poisoning, prompt injection hidden in tool descriptions, and quietly over-permissioned configurations are easy to miss because they don't look like a "normal" vulnerability — there's no CVE, no obvious buffer overflow, just a tool description that quietly tells an agent to do something it shouldn't. MCPRadar's whole premise is that this class of risk deserves the same rigor as any other part of your CI pipeline. What it actually scans MCPRadar isn't a single-purpose linter — it looks at an MCP server from several angles: Protocol inspection — enumerates tools, prompts, resources, and templates the server exposes, and checks server instructions for suspicious content. Source analysis — walks Python and JavaScript/TypeScript code looking for SSRF, unsafe deserialization, command/SQL injection, Trojan Source tricks, and mismatches between a tool's description and what its code actually does. Configuration review — flags poisoned MCP or agent configuration files, risky hooks, and overly broad permission grants. Supply chain checks — fetches packages without running install scripts, cross-references dependencies against OSV, and can emit a CycloneDX SBOM with hashes and provenance. Change monitoring — stores snapshots in SQLite and diffs them over time, classifying changes as cosmetic, behavioral, or security-relevant so sil

Introduction Hello from Japan! 🇯🇵 I am a professional truck driver teaching myself Python and web development while working toward a career transition into web engineering. This article records what I learned after approximately 122 hours of programming study , starting on May 12, 2026. Recently, I added a ripple animation effect to the answer buttons in my self-developed application: 🚛 DPT — Driver Personality Test https://qiita.com/tosane932/items/220d0f7d36bd79b2aa81 At first, I thought it would be a small visual improvement. However, while implementing it, I realized that the blinking light on my toilet control panel and a JavaScript flag named isProcessing were performing exactly the same role. This article explains that connection. It Started as Protection Against Repeated Clicks In DPT, clicking an answer button moves the user to the next question. In the original version, the next question appeared immediately after the button was clicked. However, this created a problem. If a user repeatedly clicked the button, the application continued advancing through the questions at the same speed. In an extreme case, someone could finish all 50 questions in only a few seconds. That would reduce the reliability of the personality test and could also create invalid answer records. To prevent this, I introduced a processing-state flag . let isProcessing = false ; testContainer . addEventListener ( " click " , ( event ) => { if ( isProcessing ) return ; const button = event . target . closest ( " .option-btn " ); if ( ! button ) return ; isProcessing = true ; createRipple ({ currentTarget : button , clientX : event . clientX , clientY : event . clientY }); const qIdx = Number ( button . dataset . qIndex ); const oIdx = Number ( button . dataset . oIndex ); setTimeout (() => { if ( oIdx === - 1 ) { handleAnswer ( qIdx , - 1 , " No answer " , 0 ); } else { const option = shuffledQuestions [ qIdx ]. shuffledOptions [ oIdx ]; handleAnswer ( qIdx , oIdx , option . text , optio

Amazon is expanding its plans for providing satellite connectivity to mobile phones.