标签：#p

Most C# developers know how to use yield return. Few understand what actually happens after compilation. If you've ever written something like this: public IEnumerable < int > GetNumbers () { yield return 1 ; yield return 2 ; yield return 3 ; } it looks almost magical. No collection. No list allocation. No iterator implementation. Yet somehow the method returns an IEnumerable. So what is really happening? The answer is one of the most elegant compiler transformations in the entire .NET ecosystem. Let's open the hood. The Illusion Most developers imagine the previous code executes like this: Call method ↓ Return 1 ↓ Pause ↓ Return 2 ↓ Pause ↓ Return 3 That isn't what happens. C# methods cannot actually pause execution. Instead, the compiler completely rewrites your method into something entirely different. The Compiler Creates a State Machine Your tiny method becomes a hidden class similar to this: private sealed class GetNumbersIterator : IEnumerable < int >, IEnumerator < int > { private int _state ; private int _current ; public bool MoveNext () { switch ( _state ) { case 0 : _current = 1 ; _state = 1 ; return true ; case 1 : _current = 2 ; _state = 2 ; return true ; case 2 : _current = 3 ; _state = - 1 ; return true ; default : return false ; } } public int Current => _current ; } Your original method no longer exists. Instead, it simply returns: return new GetNumbersIterator (); Every yield return becomes another state inside MoveNext(). Why Local Variables Don't Disappear Consider this code: IEnumerable < int > Squares () { int x = 1 ; while ( x <= 3 ) { yield return x * x ; x ++; } } After the first yield, the method "pauses." But where is x stored? Not on the stack. The original stack frame has already disappeared. Instead, the compiler promotes local variables into fields: private int _x ; The iterator object now owns every variable that must survive between iterations. This is why iterator methods can remember where they left off. Heap Allocation Happens Ma

Company brain for AI Agents Discussion | Link

When I first wrote about NutriAgent in November 2025, it was a full application. It had a Python backend, a web interface, a Telegram bot, user accounts, Google OAuth, Supabase, and a Google Sheets integration. Recently, I reproduced its core workflow as a skill for my personal AI agent. It took around 15 minutes and two prompts. I didn't build another backend, deploy a service, or implement OAuth again. I explained how I wanted the workflow to behave, tested it, and watched a new row appear in my nutrition spreadsheet. The original application wasn't a mistake. It was how I could deliver that experience with the tools available at the time. Eight months later, the starting point had changed. Eight Months Ago, This Was an App I built NutriAgent because I wanted to track calories and protein without trapping my data inside a nutrition app. I wanted the raw records in a spreadsheet I controlled, where I could create my own reports and eventually connect nutrition with my training data. The first version was a personal n8n workflow. It worked for me, but when a friend wanted to try it, I realized that everything was tied to my accounts. To make it reusable, I rebuilt it in Python and added the parts a real multi-user product needed: authentication, storage, a web interface, Telegram, Google OAuth, conversation history, and account linking. I've already told that story in I Ditched MyFitnessPal and Built an AI Agent to Track My Food , and later wrote about what broke after I used it every day for a month . This article starts after that version. My Gaming PC Became an Agent Box I had a modest gaming PC at home with 16 GB of RAM and a 1 TB drive. Using it through Windows, WSL, and remote desktop from my Mac felt awkward, so I installed Linux and turned it into a remote box for running agents. I'll write about that setup separately. I moved Hermes there from a VPS. Hermes is the personal agent I now run on that machine. It can load reusable skills and use tools connected

A terminal, a real browser, and Claude Code under one roof Discussion | Link

Category theory often sounds like impenetrable academic jargon, but at its core, it is simply the mathematics of composition. In functional programming, we use its concepts to build modular, predictable, and bug-resistant code. JavaScript isn't a pure functional language like Haskell, but it has first-class functions and treats functions as values. This makes it entirely possible to implement category theory primitives. Here is how the theoretical concepts map to practical JavaScript. The Vocabulary of Category Theory Before jumping into code, let's define the fundamental pieces: Categories: A collection of objects and arrows (morphisms) between them. Objects: In programming, these are our types or data (e.g., String, Number, Boolean, Array). Morphisms: These are our pure functions that transform one type into another (e.g., a function that takes a String and returns a Number). The goal of functional programming primitives is to create safe wrappers (containers) around our data so we can compose these functions predictably, without side effects or unhandled errors. 1. Functors: The Mappables A Functor is any type that implements a map method. It is a container holding a value, and map allows you to apply a function to that value without pulling it out of the container. When you map over a Functor, it returns a new Functor of the same type, preserving the container's structure. The native JS Functor: You already use Functors every day. JavaScript Arrays are Functors. const numbers = [ 1 , 2 , 3 ]; // We apply a function to the values inside, and get a new Array back const doubled = numbers . map ( x => x * 2 ); // [2, 4, 6] Building a custom Functor: Let's build a simple Box container to see how this works for single values. const Box = x => ({ map : f => Box ( f ( x )), fold : f => f ( x ), // An escape hatch to get the value out inspect : () => `Box( ${ x } )` }); // Usage: const result = Box ( ' Functional Programming ' ) . map ( str => str . trim ()) . map ( str

🚀 400 Downloads. $0 Spent. Here's the Exact Breakdown. TL;DR — No ads, no PR agency, no paid promotion. Just specific, honest, cross-platform posting, one external "100% Clean" certification, and a refusal to oversell. Here's exactly what moved the needle, in order of impact. Akhouri Systems started with nothing — no audience, no mailing list, no existing following. Just a GitHub account, a Windows security suite called ATLOCK, and enough confidence in the product to put it in front of strangers. Here's what actually happened. 📊 The Starting Point Day 1Audience0Ad budget $0 Team1 (me)Funding ₹0Product ATLOCK — a Windows security suite, single .exe, offline-first 🎯 What Actually Moved the Needle 1️⃣ Specificity beats enthusiasm, every time Every post that worked wasn't "check out my app" — it was a verifiable technical claim: NTFS ACL-level file locking that even admin can't bypass. AES + PBKDF2 vault encryption, 200,000 iterations. Developers can smell vague marketing copy from a mile away. Real numbers and real mechanisms are the entire trick. 2️⃣ Same product, three different posts The same copy-pasted paragraph across every platform reads as spam — even when it's not. So: Platform Angle dev.to Technical breakdown, deep detail Peerlist Short, personal, punchy LinkedIn Credibility-first, professional tone 3️⃣ Admitting weaknesses on purpose One of the highest-engagement posts I wrote was a direct ATLOCK vs. commercial security software comparison — including an honest section on where commercial tools still win (malware detection, official support, code-signing). Nobody trusts a post that claims to be perfect. Naming the weaknesses bought more credibility than it cost. 4️⃣ Independent validation compounds differently Getting listed on Softpedia mattered more than expected — not for raw traffic, but because a "100% Clean" certification and an independent 3.5/5 review from a party with zero stake in the outcome hits differently than another self-posted announcement.

By the end of this article, you'll know: what Kimi K3 actually is, the architecture, the scale, and what changed from the K2 family how to run it today, free in the browser, through the API, or wired into Claude Code, Cursor, Cline, and RooCode which exact model ID and settings unlock the full 1 million token context how K3 stacks up on price and benchmarks against DeepSeek V4, Qwen3.7 Max, GLM-5.2, and its own sibling K2.7 Code whether switching today makes sense, or whether you should wait Kimi K3 just dropped, and Moonshot means business Moonshot AI released Kimi K3 on July 16, 2026, timed just ahead of the World Artificial Intelligence Conference in Shanghai. The Beijing lab, backed by Alibaba, has spent the past 18 months watching DeepSeek erode its market position. K3 is the comeback attempt, and the early numbers back it up. The headline result: K3 debuted at number one on Arena.ai's Frontend Code Arena with a score of 1,679, ahead of Claude Fable 5 at 1,631 and GPT-5.6 Sol at 1,618. Its predecessor, K2.6, sat 18th on that same board. That's a 17 spot jump in one release, and it's independently measured, not a number Moonshot invented itself. This isn't Moonshot's first time in Western production stacks either. Cursor built its Composer 2 model starting from a Kimi K2.5 base. DoorDash's CTO has said the company routes lower level work to Kimi K2.6. Thinking Machines used K2.5 to help generate early post-training data for Inkling, its own model released just a day before K3. So when a new Kimi flagship lands, it lands somewhere developers already have skin in the game. For developers, the practical story matters more than the leaderboard. K3 is open weight, speaks the OpenAI SDK, and drops into tools you already use. It's also, for the first time in Kimi's history, priced like a frontier model instead of a budget one. That changes the calculus on when it's actually worth reaching for. What Kimi K3 actually is K3 is a sparse Mixture-of-Experts model with 2.8 tr

Originally published at boldpilot.club Most startup launches fail not because the product is wrong, but because the planning collapses under its own ambiguity. A solid launch plan template for startups gives you a structure that converts vague intentions — "we'll do some PR, post on social, maybe a Product Hunt thing" — into sequenced tasks with owners and deadlines. If you're building something and your launch plan currently lives as a notes app dump or a half-filled Notion page with seventeen unticked checkboxes, that's the problem this article addresses directly. A usable launch template has five core components: a pre-launch timeline, a channel priority stack, a messaging framework, a metrics baseline, and a post-launch review cadence. Everything else is optional decoration. Why Most Launch Plan Templates Get Abandoned The templates people download from Google — the ones with seventeen tabs and color-coded Gantt charts — get opened once and then quietly archived. I've seen this happen with teams that had more than enough time and resources. The issue is that those templates are designed to look thorough, not to be used under the actual pressure of a launch week. According to CB Insights, 35% of startup failures cite "no market need" as the primary cause, but the second and third most common reasons — running out of cash and not having the right team — are both downstream of poor planning and sequencing. A launch plan that nobody opens doesn't prevent any of those outcomes. The templates that do get used share one quality: they're shallow enough to skim at 11pm the night before a deadline. One page if possible. Two at most. If your template requires a tutorial to operate, it's already failed. I'd push back on the common advice to "start with goals." Goals are fine, but most founders already know what they want — signups, revenue, waitlist growth. What they're missing is the sequencing. Start with the constraint instead: what's your actual launch date, and what ab

I set out to deploy a fine-tuned LLM fully offline, on a mid-range Android phone, answering medical questions in Yoruba, Hausa, Igbo, and Nigerian Pidgin. No internet connection required, because that's the reality for a lot of the people this was meant to help. The model worked. Getting there broke three times, in three completely different ways, and left me with one problem I still haven't solved. The setup I fine-tuned unsloth/Llama-3.2-3B-Instruct , Unsloth's 4-bit-optimized derivative of Meta's Llama 3.2 3B, in two stages: QLoRA supervised fine-tuning on a curated dataset of 3,917 medical question-answer pairs across the four languages, followed by direct preference optimization (DPO) to sharpen response quality. SFT converged to a loss of 1.099. DPO landed a reward margin of 18.40. Then I merged to 16-bit and tried to convert to GGUF, the format llama.cpp needs to run the model on-device. That's where things started breaking. Crash 1: the tokenizer that thought it was someone else First conversion attempt. Model loads. First inference call. Instant crash: terminating due to uncaught exception of type std::out_of_range: unordered_map::at: key not found Turns out the conversion had written tokenizer.ggml.model = "llama" into the GGUF file. That field tells the runtime which tokenizer code path to use, and "llama" routes to SentencePiece. Llama 3.2 doesn't use SentencePiece. It uses BPE. The runtime was trying to read BPE tokens through a SentencePiece parser, and predictably, it found nothing where it expected something. Fix: manually set the field to "gpt2" , which routes to the correct BPE path. Crash 2: the tokenizer that couldn't decide what it was Fixed crash 1, tried again. New failure, before the model even finished converting: TypeError: Llama 3 must be converted with BpeVocab followed, after the code's fallback path kicked in, by: ValueError: Cannot instantiate this tokenizer from a slow version This one took longer to trace. Unsloth's saved tokenizer_c

AWS has recently introduced CloudFormation express mode, a deployment option that can reduce infrastructure deployment times by marking stack operations complete once resource configuration is applied, rather than waiting for full resource stabilization. By Renato Losio

submitted by /u/fagnerbrack [link] [留言]

Everyone's talking about AI agents right now, but most tutorials stop at "call an LLM in a loop." If...

As developers, we use authorization libraries almost every day. Whether it's a web application, an API, or an internal tool, we often rely on packages that decide who can do what. But I realized I had never actually built one. So instead of using an existing library, I decided to build my own Role-Based Access Control (RBAC) library in Go using only the standard library. This project eventually became GateKeeper v1.0.0. Why I Built One As a beginner in backend development, I wanted to get exposure on how to make public APIs and how to make them work under the hood. It also made me fight my old syntax habits. Go has strict error handling, which I also learned. I built it because I wanted to understand the engineering decisions behind public libraries. Instead of watching another tutorial, I built it myself. Project Goals Before writing any code, I brainstorm the architecture in my mind. No external library used, only the standard Go library. Keeping the public APIs simple and easy to read for developers to use. Write tests for each and every function, no matter how small. These constraints forced me to think more carefully about the design instead of depending on external packages. The Core Model Engine ├── Users ├── Roles └── Permissions Relationships are straightforward: Users | V Roles | V Permissions A user can have multiple roles, and roles can have multiple permissions. Permissions describe access to a resource and an action. Designing The API One thing I learned the hard way is that API design matters more than the implementation itself. I wanted to keep the library easy to read even without documentation. The public API ended up looking something like this: CreateUser() CreateRole() CreatePermission() AssignRole() AssignPermission() Can() DeleteUser() DeleteRole() DeletePermission() RenameUser() RenameRole() I had to redesign the API many times before eventually coming up with the final one. The time spent fighting the design was worth it. It taught me API de

TL;DR In December 2025, Cline — an AI coding assistant with over 5 million users — gave an AI agent (Claude) write access to triage GitHub issues, including permission to run shell commands. A misconfigured trigger condition let any GitHub user invoke the workflow. What followed was a four-hop supply chain compromise that ended with a malicious npm package silently installing a second AI agent on user machines. I broke down the full chain in video form: Watch the episode Below is the chain, hop by hop. Hop 0: The setup The triage automation was configured with broad tool permissions and a trigger condition open to any GitHub user — not just contributors. That second part is the root cause: it opened the trigger to unauthenticated input. (Exact config values are in the Confirmed Artifacts section below.) Hop 1: Prompt injection via issue title The issue title itself was never sanitized before reaching the model. No first-party source has published the exact injected payload verbatim — GHSA doesn't disclose it — so any reconstruction here is illustrative, not confirmed. What's confirmed is the mechanism: an untrusted string reached the model with tool access already granted. Hop 2: Cache poisoning The injected instruction deployed a tool (multiple independent postmortems — Snyk, Cloud Security Alliance — name it "Cacheract") that flooded the CI cache with over 10GB of junk data, evicting legitimate entries through standard LRU eviction. Hop 3: Nightly workflow inherits the poisoned cache The nightly release workflow restored that poisoned cache around 2 AM UTC and ran inside it — handing over three publish tokens. (Names confirmed across GHSA and multiple independent sources — see below.) Hop 4: Publication cline@2.3.0 went live on npm with a postinstall script that silently installed a second package globally — an AI agent, installed by an AI agent, with no user consent. This line is a direct quote from Cline's own security advisory, not a reconstruction. It's the st

Running out of API quota in the middle of a production deployment is a frustrating rite of passage. If you are using the Google Custom Search API, you have likely hit that 100 free daily queries wall. Once you do, your application throws a 403 Quota Exceeded error, stalling your features unless you link a billing card and risk uncapped charges of $5 per 1,000 queries. In my experience, relying on Google's default limits without safeguards is a major liability. Here is how I protect my cloud budget, stretch the free tier using Redis, and transition to scalable alternatives when 100 queries are no longer enough. Step 1: Enforce a Hard Billing Cap in GCP Never rely on email alerts alone; they do not stop API requests. If a recursive loop in your code or a malicious bot targets your search endpoint, your credit card will bear the brunt. To set up a hard stop: Log into your Google Cloud Console . Navigate to APIs & Services > Enabled APIs & Services . Select Custom Search API , then click the Quotas tab. Locate Queries per day and click the edit pencil icon. Set your maximum limit to 95 (not 100). Pro Tip: This 5-query cushion gives you a safe buffer for emergency local debugging without triggering paid overages. Step 2: Implement Redis Caching Middleware Over 40% of search queries in typical web applications are repetitive. Implementing a Redis database to cache these searches can cut your API consumption by up to 80%. Here is a simple Python middleware pattern to normalize queries and cache them with a 24-hour Time-To-Live (TTL): import redis import requests # Connect to local Redis instance cache = redis . Redis ( host = ' localhost ' , port = 6379 , db = 0 , decode_responses = True ) def fetch_search_results ( query , api_key , search_engine_id ): # Normalize input to avoid duplicate cache keys normalized_query = query . strip (). lower () cache_key = f " search:cache: { normalized_query } " # 1. Check local cache first cached_data = cache . get ( cache_key ) if cach

Every model card says "multimodal". Then you hand the model a real video file and discover what that means in practice: ChatGPT reads the subtitle track, Claude doesn't accept video files at all. The model narrates a video it mostly never saw. I unpack viral videos daily for my own content work, so I couldn't route around this. I built a small tool instead. The mechanism claude-real-video converts a video into three things an LLM can genuinely read: Scene-aware sampled frames — ffmpeg scene scores decide where to sample, so you get a frame when the picture changes, not every N seconds. An --adaptive flag handles slow deformations (a real user bug report: fixed thresholds missed squash/stretch morphs entirely). A timestamped transcript — whisper by default; if faster-whisper is installed it runs in-process and several times faster, with automatic fallback. One MANIFEST timeline — frames and transcript merged into a single file, so the model follows the video in order instead of guessing from fragments. A --text-anchors flag force-samples frames at subtitle cues so on-screen text never falls between frames. Then you point any LLM at the output folder — Claude, GPT, Gemini, or a local model. No API of mine in the middle, everything runs on your machine. Usage pip install claude-real-video crv "video.mp4" -o out Honest limitations Not real-time — a 90-second video takes about 1–2 minutes all-in on an M-series Mac. Frame sampling can still miss motion between frames; the flags above patch the worst cases, both born from real GitHub issues. It's MIT, currently at 1,731 stars with ~8k installs last month, which taught me the problem was never just mine: https://github.com/HUANGCHIHHUNGLeo/claude-real-video

Before I critique modern web development, I want to make some points: I'm not discouraging anybody from web development. This is only my opinion and my experience of the story. Everyone has their own story. Part 1. Javascript JavaScript is known for being the web's language. It's used everywhere in the web, and can also be used to make external applications outside of web development. JavaScript has many flaws in its language, such as its comparison logic. JavaScript uses the "strict equality operator" that tries to solve its weird type coercions (e.g [] == ![] being true). Another flaw is that JavaScript has poor maintainability. JavaScript has a poorly managed type system that introduces errors without proper error handling. You cannot explicitly define what error you're trying to catch in the try-catch statement. try { functionThatThrowsError () } catch ( error ) { console . error ( error ); if ( error instanceof MyError ) { doSomething (); } } instead of modern languages: try { functionThatThrowsError () } catch ( e : MyError ) { print ! ( " error: ${e.message} " ) } This adds complexity to try-catch statements and makes it almost impossible to handle errors in a robust manner. Another issue with JavaScript's maintainability is the wording of the language. JavaScript has two keywords called undefined and null . In practice these should mean the same thing but it doesn't. An undefined variable is an uninitialized variable, or a function that doesn't return anything. Undefined: // Returns undefined function getName () {} // syntactically correct in JavaScript // but will cause undefined console . log ( getName ()); const myCoolObject = {}; console . log ( myCoolObject . property ); // still syntactically correct in JavaScript even though the property doesn't exist. Null: // Returns a null name function getName () { return null ; } // output: null console . log ( getName ()); const myCoolObject = { property : null }; console . log ( myCoolObject . property ); //out

Every team doc tool these days is "searchable." Notion, Confluence, wikis — you can find any page in seconds. But search only tells you a document exists; it doesn't tell you how it connects to the five other docs that explain why it looks the way it does. New hires still end up pinging three people on Slack to reconstruct the reasoning behind a decision that's technically "documented" somewhere. This post is about the difference between a searchable knowledge base and a connected one — and why most teams have the first but assume they have the second.

What Changed Protocol Buffers (protobuf), Google's widely adopted data interchange format, has undergone several recent updates focusing on build system integration, compiler support, and internal development processes. Key changes include the introduction of Bzlmod support for Bazel 8+, updates to the Bazel CI presubmit matrix, and the removal of older GCC versions from GitHub Actions testing in favor of GCC 10. Specifically, the project now explicitly supports Bazel with Bzlmod for Bazel 8 and newer versions, allowing users to specify protobuf as a dependency in their MODULE.bazel file. This modernizes the Bazel integration, offering an alternative to the traditional WORKSPACE approach. Concurrently, the .bazelci configuration has been updated to remove macOS (Intel Macs) from the presubmit matrix, revise Debian and Ubuntu distributions, and incorporate Bazel 9.x testing. In terms of compiler support, the .github workflow for C++ testing has been refined. GitHub Actions matrix entries testing GCC versions prior to GCC 10 (specifically 7.5, 9.1, and 9.5) have been removed, and a GCC 10.4 test has been added. This aligns the testing infrastructure with the project's current support matrix, ensuring compatibility with more recent compiler versions. Internal refactoring also occurred, such as the extraction of OptionInterpreter to option_interpreter.h and option_interpreter.cc from descriptor_builder.h and descriptor.cc respectively. Furthermore, the C# protobuf implementation saw a version update to 37.0-dev, indicating ongoing development across various language bindings. Technical Details The integration of Bzlmod for Bazel 8+ signifies a move towards a more modular and efficient dependency management system within the Bazel ecosystem. Developers can now declare a dependency on protobuf in their MODULE.bazel file, with an option to override the repository name for compatibility with existing WORKSPACE setups. This streamlines dependency resolution and build graph m

What Changed DocuSeal has emerged as an open-source platform for digital document signing and processing. This project offers a self-hostable alternative to commercial services, allowing organizations to manage document workflows, eSignatures, and form filling within their own infrastructure. The platform is designed to be accessible, mobile-optimized, and integrates with existing systems through APIs and webhooks. Technical Details DocuSeal provides a comprehensive set of features for digital document management. Key functionalities include a WYSIWYG PDF form fields builder that supports 12 field types, such as Signature, Date, File, and Checkbox. It accommodates multiple submitters per document and automates email notifications via SMTP. For file storage, DocuSeal offers flexibility, supporting local disk storage as well as cloud providers like AWS S3, Google Storage, and Azure Cloud. The platform implements automatic PDF eSignature generation and includes a mechanism for PDF signature verification, addressing security and compliance requirements. User management is integrated, and the UI is mobile-optimized, supporting 7 UI languages with signing capabilities in 14 languages. Integration with other systems is facilitated through a robust API and webhooks. Deployment options are varied, catering to different infrastructure preferences. DocuSeal can be deployed on cloud platforms such as Heroku, Railway, DigitalOcean, and Render. For containerized environments, Docker images are available, allowing for deployment via docker run commands. By default, the Docker container utilizes an SQLite database, but it can be configured to use PostgreSQL or MySQL by setting the DATABASE_URL environment variable. Docker Compose configurations are also provided, enabling deployment with custom domains and automatic SSL certificate issuance via Caddy. Pro features, available through commercial offerings, extend the platform's capabilities to meet business needs. These include compa