找到 13484 篇相关文章
The Asus ROG Swift 32-inch 4K QD-OLED gaming monitor has almost everything I want in a high-end gaming monitor, most notably a QD-OLED panel for inky black levels and vivid colors that go beyond what’s possible on an LCD screen. Amazon, Best Buy, and B&H Photo have this model on sale for $899.99 (usually $1,299.99). […]
The cost of writing code dropped; the cost of owning it didn't. A framework for deciding which changes are actually cheap in the AI era. The post The cost of saying yes has changed appeared first on The GitHub Blog .
Grasshopper-like tests could begin in 2028.
The most capable AI assistant with its own inbox Discussion | Link
Prosecutors accused 21-year-old student Zyaire Wilkins of publishing on Steam several fake video games that contained malware, infecting thousands of victims, and stealing crypto from some of them.
Official estimates Google and Apple likely made millions in nudify app fees.
Private Voice Ring for dictation across iOS & Mac Discussion | Link
AI agents that act. Automation that delivers. Discussion | Link
Everyone recommends ByteByteGo and The Pragmatic Engineer. Don't get me wrong, they're great... but the best engineering writing of the last two years is coming from newer publications nobody's put on a list yet. Here's what survived my filter. I have a rule: if I haven't opened a newsletter in three weeks, I unsubscribe. No guilt, no "maybe later" folder. It's the only way to keep email useful when every engineering team, indie hacker, and AI startup on the planet is running a Substack. That rule has consequences. Over the past couple of years it has killed off almost every famous-name newsletter in my inbox — not because they got worse, but because they got comfortable. Meanwhile, a new generation of engineering publications launched around 2023–2024 started earning their slot every single week. They're smaller, sharper, and written by people still close to the work. The other thing my rule revealed: AI engineering quietly became its own discipline. Not "AI news" — there are a thousand newsletters rehashing model launches. I mean the craft of building production systems on top of LLMs: agents, evals, brownfield integration, governance, cost. That coverage barely existed two years ago. Now it's the most valuable section of my inbox, which is why it leads this list. So here's what survived. Twenty-six newsletters, organized by topic, heavy on publications you haven't seen on every listicle. Steal the whole list. 🤖 AI Engineering & Production AI Two years ago this category didn't exist. Today it's the most important one here, because building with LLMs in production is genuinely different work — different failure modes, different economics, different skills — and general engineering newsletters mostly aren't covering it. Latent Space — swyx & Alessio Fanelli. swyx literally coined "AI engineering" as a discipline, and this is its watering hole: podcast, essays, and the AINews digest covering frontier models, agents, and the career path itself. The anchor of the categ
submitted by /u/andreiross [link] [留言]
Leaker Evan Blass shared images of Samsung's redesigned Galaxy Z Fold 8 just days before the July 22nd launch event where Samsung is expected to officially announce the phone. The leaked images show a shorter, wider foldable matching earlier leaks of the Z Fold 8. They also reveal some of its specs, including a Qualcomm […]
Desktops, laptops, phones, CPUs, GPUs, NAS—if you know this stuff, come work for us!
Are we living through a small car renaissance? There's the Slate Truck, Amble's dune buggy, and the Fiat Topolino, as well as a whole galaxy of kei cars and trucks from Japan that have their own built-in fan base. While microcar sales in the US are still as tiny as the vehicles themselves, there are […]
I created the official PasteDB VS Code extension that lets you upload your current file or selected code directly from Visual Studio Code. It includes secure API key storage, customizable upload settings, recent paste history, automatic language detection, and instant shareable links. In this post, I'll explain how it works, how to install it, and the challenges I faced while building it. More Info View on Marketplace
Federal authorities have arrested a Florida man suspected of stealing at least $220,000 in crypto through malware-infected Steam games, as reported earlier by local news outlet Local10. In the complaint, officials accuse 21-year-old Zyaire Wilkins and co-conspirators of launching eight malware-embedded games from around May 2024 to February 2026, allowing them to infect about 8,000 […]
How Bifrost Enterprise combines Data Access Control (DAC), Role Based Access Control (RBAC), Access Profiles, and Bifrost Edge to secure AI applications at scale. Artificial intelligence is quickly becoming part of every employee's workflow. Developers rely on coding assistants, customer support teams use AI powered chat applications, analysts generate reports with large language models, and organisations increasingly deploy AI agents connected to internal tools through the Model Context Protocol (MCP). While this rapid adoption improves productivity, it also introduces a significant governance challenge. It's no longer enough to decide who can log into an AI platform; you must also determine who can access specific AI resources, which models they can use, what they can spend, and which data they should even be able to see. This is where Bifrost Enterprise provides a comprehensive governance layer. By combining Role Based Access Control (RBAC), Data Access Control (DAC) , Access Profiles , and Bifrost Edge , organisations can secure AI workloads without slowing down innovation. Together, these capabilities create a governance framework that scales from small engineering teams to global enterprises and you can learn more about this in the documentation on GitHub . Why Enterprise AI Needs More Than Authentication Traditional enterprise applications typically answer two questions: Who is the user? What can that user do? Modern AI platforms introduce a third and equally important question: What information should this user actually be able to see? Imagine an organisation with several engineering teams working on independent AI products. Each team has its own prompts, routing rules, API budgets, virtual keys, observability data, and model configurations. If every developer can view every configuration simply because they have developer permissions, sensitive information can easily become exposed. This challenge becomes even more complicated when organisations begin deplo
Some Amazon customers logged on Friday to a surprise bill estimate claiming that they owed the tech and cloud giant billions in fees.
Just getting this concept is like money in the bank! I'm too excited for words! At age 67, I have never coded a thing in my life. All of the sudden in 2026, I find that I've become a "vibe" coder with the help of Grok and Gemini. Both in segregated project silos are acting as my PMs and doing a damn fine job of it. As CEO of a brand new company, I'm taking on the entire scope of development for The Avinoam Group, LLC. My business partner Eyal and I have a very cool vision for what we intend to accomplish. And while it is beyond the scope of this post, only 2 crazy non-dev guys would be this bold, with all due respect to the young guns here on DEV. Our core principles incorporate transparency and authenticity. I can think of no better business idea as 4 separate cornerstones (we have 4 separate projects) than the brilliant concept-commitment to #build in public. So, I'm looking forward to telling everyone what we're doing and how we're doing it. We have nothing to hide except a little "secret sauce" that we can't really talk about without shooting ourselves in the foot. Other than that, I want to "show & tell" just like when I was in kindergarten in 1964 and brought "Meet The Beatles" in to Miss Shreiner's class and all the little kids danced! Right now, I'm reading how to get the most out of DEV and being here. At my age, I like to give back. What can an old geezer whose never coded before offer? My life experience and business knowledge. For example, we are developing freepaycalc (Google it if you want) to help devs, makers and freelancers plug the leaks in their "money buckets." and how to kill off that dreaded "scope creep" that so many independent consultants and contractors get trapped in. I don't want this post to be too long. I just wanted to reinforce the value of building in public. If you want to punch through each and every challenge of a complex project, then why not tell brilliant dev colleagues what you're up to? Whatever problem you're facing has a so
Why giant AGENTS.md files may be wasting context, hurting maintainability, and making AI-assisted development harder to scale. A few years ago, for many developers, using AI for software development meant copying a small piece of code into a chat window. We would ask for a refactoring, copy the response back into the editor, run the tests ourselves, and return to the chat when something failed. Coding agents changed that workflow. Tools such as Codex, Claude Code, and others can now explore an entire repository, modify multiple files, execute commands, run tests, and iterate on failures. Coding agents turned code assistants into tools capable of executing multi-step software development tasks. But most repositories were not designed for this new kind of contributor. The repository became part of the agent's working context A coding agent needs much more than source code. It may need to understand: the project architecture; dependency boundaries; coding conventions; test strategy; build commands; local environment requirements; validation steps; security restrictions; the definition of done. A common solution is to place these instructions inside files such as AGENTS.md , CLAUDE.md , or other agent-specific configuration files. This works. I have been doing something similar in my own projects for a while. But as the repository grows, the instruction file grows with it. Eventually, a single file may contain thousands of lines covering unrelated concerns: Architecture Testing Environment setup Coding standards Infrastructure UI conventions Validation Release workflows Definition of done At that point, the file is no longer just a set of agent instructions. It has become an informal repository operating manual. The monolithic context problem A large AGENTS.md has an obvious advantage: the agent knows where to find it. But it also creates several problems. It is difficult for humans to navigate These files are not only for agents. Developers also need to read, review, m
TL;DR I checked 50 AI-generated login endpoints. Zero had rate limiting. Attackers can brute-force credentials at full speed against these routes. Adding a rate limiter takes four lines and one npm install. I asked Cursor to build a login route for a side project last month. Email, password, JWT back on success. It worked first try, passed my manual tests, and I moved on to the next feature. Three weeks later I ran a load test against it out of curiosity and hit the endpoint two thousand times in under a minute. Not one request got throttled. That's when I started pulling apart every AI-generated auth route I could find, mine and other people's open source side projects, and the pattern held everywhere I looked. The models write correct authentication logic and completely skip rate limiting, because rate limiting isn't part of "does this login work," it's part of "does this login survive contact with an attacker." The vulnerable code (CWE-307) Here's roughly what Cursor and Claude Code hand you when you ask for a login route: // ❌ No rate limiting - CWE-307: Improper Restriction of Excessive Authentication Attempts app . post ( ' /api/login ' , async ( req , res ) => { const { email , password } = req . body ; const user = await User . findOne ({ email }); if ( ! user || ! ( await bcrypt . compare ( password , user . passwordHash ))) { return res . status ( 401 ). json ({ error : ' Invalid credentials ' }); } const token = jwt . sign ({ id : user . id }, process . env . JWT_SECRET , { expiresIn : ' 1h ' }); res . json ({ token }); }); Password hashing is fine. JWT signing is fine. But nothing stops a script from hitting this route as fast as the network allows. No lockout, no delay, no cap on attempts per IP or per account. A credential-stuffing list with ten thousand leaked passwords runs against this endpoint in seconds. Why this keeps happening Rate limiting lives outside the function the model was asked to write. The prompt is "build a login endpoint," and it re