标签：#p

Hyundai aims to deploy 25,000 Atlas robots starting with US factories in 2028.

If only someone could have predicted it.

Toyota's everyday small SUV should rarely require trips to the gas station.

This remarkably vivid home projector has deep inky blacks, without a five-figure price tag.

Your Mac tidies itself: screenshots, installers, Downloads Discussion | Link

The National Highway Traffic Safety Administration is also investigating the crash

Amazon Web Services has recently introduced AWS Continuum, a new integrated security platform to automate the discovery, enforcement, and remediation of security issues across codebases, dependencies, and applications. AWS Continuum launches with four agentic capabilities, aiming at the entire vulnerability lifecycle: penetration testing, code review, threat modelling, and code vulnerabilities. By Gianmarco Nalin

submitted by /u/dabluck [link] [留言]

The Problem If you’ve built a decent-sized NestJS application, you know the authorization dance. You start with basic Roles, then suddenly you need fine-grained permissions, then maybe some attribute-based access control (ABAC). Before you know it, your controllers are cluttered with @UseGuards(RolesGuard) , and your RolesGuard itself is a massive switch statement checking for every possible permission string. It's repetitive, hard to test, and honestly, a bit boring to maintain. The Solution: nestjs-permissions I got tired of reinventing this logic for every project, so I built nestjs-permissions . The goal was simple: Declarative, type-safe authorization that stays out of your way while keeping your code clean. Why use it? Decorator-Driven: No more complex metadata injection. Just wrap your routes. Type-Safe: Keep your permissions consistent across your frontend and backend. Framework-Native: It plays nicely with the standard NestJS Request lifecycle. Quick Start Getting started takes about 5 minutes. 1. Install it: npm install nestjs - permissions 2. Configure your module: import { Module } from ' @nestjs/common ' ; import { PermissionsModule } from ' nestjs-permissions ' ; @ Module ({ imports : [ PermissionsModule . register ({ // Your config here }) ], }) export class AppModule {} 3. Protect your routes: import { Get , Controller } from ' @nestjs/common ' ; import { RequirePermissions } from ' nestjs-permissions ' ; @ Controller ( ' dashboard ' ) export class DashboardController { @ Get ( ' admin ' ) @ RequirePermissions ( ' admin.read ' ) async getDashboard () { return ' Secret Admin Data ' ; } } What’s Under the Hood? Under the hood, nestjs-permissions leverages the NestJS Reflector to cleanly extract metadata from your route handlers. It automatically taps into the execution context, checking the incoming request against the required permissions without forcing you to write boilerplate guards for every module. When NOT to use it If you need hyper-complex, at

Last Tuesday I was deep in a session with an AI assistant, rewriting a caching layer that had been quietly leaking memory in production. We tried Redis first. It worked. Then I looked at the actual data volume (about 50MB, tops) and killed the idea, because spinning up a whole service to cache 50MB felt absurd. We landed on sqlite instead. Good call, I still think. Two days later a teammate opened the branch, saw cache_sqlite.py sitting next to a deleted cache_memory.py , and asked why we weren't just using Redis like the rest of our stack. I didn't have a good answer ready. The reasoning had lived entirely inside a chat session that was long gone by then. I remembered making the decision. I could not reconstruct it convincingly, and "trust me, we talked about it" is not a great answer to give a teammate, or future me, three months from now. That's the part most tooling misses with AI-assisted coding. The code survives. The diff survives. A wave of AI memory tools is racing to store more of what the code does , and a few (Selvedge, presence) are starting to chase the why too, which tells me the pain is real. But almost all of them are MCP servers you have to wire into a specific agent, with a database sitting beside your repo. What I wanted was dumber and more portable: the reasoning, and the approaches I tried and threw out, written in plain text I can read, next to the code, no matter which editor or agent produced it. Because that reasoning lives in a chat window, and chat windows end. You switch from Claude Code to Cursor, or you just close the laptop, and it's gone. The facts stay. The judgment behind them evaporates. This didn't feel like a hard problem, so I built a small thing called Alpheon to fix it for myself, the simplest possible version: one Python file, no server, no database , works off git so it doesn't care what editor or agent you use. Facts vs. reasoning Here's the distinction that clicked for me. A fact is "cache.py was modified, cache_sqlite.py

Hey friends! It's been a while since I tried to find open source projects to contribute to as I've been swamped with some projects myself. Someone approached me. They want to learn and start to contribute to open source. They're familiar with GitHub for their own projects, but never contribute to any open source project. They tried looking for beginners friendly issues on GitHub with no luck. Well, I immediately tried this myself and got overwhelmed with millions of issues only for JavaScript! So, I understand the struggle. 😅 If you're maintaining an open source project or know beginners-friendly open source projects that open to new contributors (preferably JavaScript, TypeScript, React, or NextJS), please send them my way in the comments below! 😊

Reasonable specs for a reasonable price.

Ever felt like the Next.js App Router is a super cool superpower, but sometimes it feels like we accidentally left a few things behind during the setup? It happens to the best of us! Building with the App Router is incredibly powerful, giving us server first capabilities and an asik developer experience. Yet, with great power comes a few hidden quirks that often sneak past our radar until runtime. Let's dive deep and spot those common pitfalls together, making sure our Next.js apps run smoother than a freshly brewed cup of coffee. The Great Divide Understanding Client versus Server Components One of the biggest paradigm shifts with the App Router is the clear distinction between Client and Server Components. This isn't just a fancy label it dictates where your code runs and what it can access. Forgetting this fundamental difference is a top contender for unexpected errors. Server Components by Default We often forget that, by default, all components in the App Router are Server Components. This is awesome because it means zero client side JavaScript for many parts of our UI, leading to blazing fast initial loads and better SEO. Server Components can directly access server resources like databases, file systems, or environment variables without exposing them to the browser. They run once on the server, generate HTML, and send it to the client. When 'use client' Becomes Our Best Friend The 'use client' directive is like waving a flag saying, "Hey, this component needs to run in the browser!" We use it when a component relies on browser specific APIs like window or document , handles user interaction like click events, or uses React Hooks such as useState or useEffect . The common mistake here is forgetting to add 'use client' to components that need interactivity, leading to build errors or hydration mismatches when the server rendered HTML doesn't quite match what the client expects. We might also accidentally try to import a server side utility into a client compone

Kalshi users betting on what President Donald Trump would say during his speeches were reportedly up against tough competition: the president's teleprompter operator. ABC News reports that federal investigators believe Gabriel Perez - Trump's teleprompter operator since 2016 - used inside information to make bets on Kalshi, a major prediction market platform that allows users […]

The Quest Begins (The "Why") I still remember the first time I walked out of a coding interview feeling like I’d just lost a lightsaber duel. The problem was a simple array‑rotation task, but I dove straight into typing, eyes glued to the screen, and barely said a word. When the interviewer asked, “What are you thinking right now?” I froze, mumbled something about “just trying to get it done,” and watched the seconds tick away. The feedback later? “Great coding skills, but we couldn’t follow your thought process.” That moment stung because I knew I could solve the problem—I just hadn’t learned how to show my thinking. After a few more silent attempts, I realized the interview isn’t a solo boss fight; it’s a co‑op mission where the interviewer wants to see how you navigate the terrain. If they can’t hear your internal monologue, they have no way to gauge your problem‑solving instincts, communication style, or ability to catch mistakes early. I went on a quest for a repeatable, low‑effort way to narrate my thinking without turning the interview into a monologue. What I found was a three‑step verbal framework that felt like unlocking a new Force power—simple, repeatable, and surprisingly effective. The Revelation (The Insight) The technique I now swear by is State → Plan → Execute . At each stage you say out loud exactly what you’re doing, using a tight, repeatable script. It’s not about over‑explaining; it’s about giving the interviewer a clear map of your mind. Here’s the exact wording I use, broken down by phase: State – Clarify the problem, assumptions, and constraints. “Okay, so we need to rotate an array to the right by k steps. I’m assuming k can be larger than the array length, so I’ll use modulo to normalize it. The array can contain any integers, and we should aim for O(n) time and O(1) extra space.” Plan – Outline the high‑level approach before writing a line of code. “My plan is to use the three‑step reversal algorithm: reverse the whole array, then reverse

Cyclosporiasis isn’t the only thing spreading across the US. So is anxiety about getting hit with it.

The company endorsed landmark AI transparency laws in California and New York last year, but its head of US state and local policy says they may already be outdated.

Metron was the Greek word for a measure: the standard you judge a thing against. It gives us metric, and metronome. Pick the wrong metron and everything you count against it comes out wrong, no matter how carefully you count. Ask most teams how they know AI adoption is working, and the answer is some version of: we’re shipping more. More PRs, more tickets closed, more velocity on the board. None of those numbers were ever measuring what people thought they were measuring. They were proxies, and bad ones, for whether the team was creating value. AI didn’t break that. It just made the proxies lie louder. An agent can produce PRs faster than any team can review them. It can close tickets all day. None of that tells you whether the thing built was worth building, or whether it fixed the actual problem, or whether anyone downstream is better off. Burning tokens isn’t the same thing as creating value. It just looks the same on a dashboard built to reward the first thing. The same DORA numbers I pointed at earlier are blunt about it: individual output climbs while delivery throughput and stability drop. Same bottleneck, counted at the wrong end . This is Theory of Constraints in one sentence: speeding up a step that wasn’t the bottleneck doesn’t speed up the system. It just piles more work in front of whatever the real bottleneck is. Implementation used to be the constraint. Now it isn’t. Review is. Coordination is. Making sure everyone agrees on what “done” even means is. Agents made the fast part faster and left the slow part exactly where it was, except now it’s buried under more output arriving to be reviewed by fewer people who understand any of it. Measuring individual speed after that shift is measuring the wrong clock. The team can be faster and worse off in the same quarter. The instinct, when this gets noticed, is to add another skill to the agent. Automate the review step too. Automate the coordination. Whatever’s slow, throw a capability at it. That doesn’t fix

Google is adding personalized AI avatars to Vids that let users create videos starring a digital version of themselves, alongside Gemini Omni-powered tools for generating and editing videos from prompts and reference images.

I built Commit Cron , a small GitHub Actions experiment that creates one automated commit every day. The project updates a text file with the latest execution time, commits the change using the github-actions[bot] account, and pushes it back to the repository. View the project on GitHub: Commit Cron How It Works The workflow runs every day at 10:00 AM Asia/Manila time. on : schedule : - cron : " 0 10 * * *" timezone : " Asia/Manila" workflow_dispatch : The workflow_dispatch trigger also lets me run the workflow manually from the GitHub Actions tab. The workflow checks out the repository, creates the bot directory when needed, and updates bot/last-run.txt : mkdir -p bot printf "Last automatic update: %s \n " \ " $( TZ = Asia/Manila date '+%Y-%m-%d %H:%M:%S %:z (Asia/Manila)' ) " \ > bot/last-run.txt The file contains a timestamp similar to: Last automatic update: 2026-07-17 10:03:24 +08:00 (Asia/Manila) After updating the file, the workflow configures the GitHub Actions bot identity and creates the commit: git config user.name "github-actions[bot]" git config user.email \ "41898282+github-actions[bot]@users.noreply.github.com" git add bot/last-run.txt git commit -m "chore: daily automated update" Before pushing, it pulls the latest branch changes with rebase: git pull --rebase origin " ${ GITHUB_REF_NAME } " git push origin "HEAD: ${ GITHUB_REF_NAME } " This helps prevent the push from failing when another commit is added while the workflow is running. Repository Structure . ├── .github/ │ └── workflows/ │ └── daily-commit.yml ├── bot/ │ └── last-run.txt ├── LICENSE └── README.md Why I Built It Commit Cron is a small demonstration of: Scheduled GitHub Actions workflows Manual workflow triggers Automated file updates Bot-generated Git commits Repository write permissions using GITHUB_TOKEN The workflow uses: permissions : contents : write This allows the built-in GitHub token to push the generated commit. Important Note The automated commits only confirm that the work