标签：#p

We talk a lot about what AI can build. Code generation. Faster prototypes. Automated debugging. One-shot apps. Entire products created in hours. And yes, AI is powerful. But there is a quieter cost we are not talking about enough: AI hype is starting to weaken the motivation to learn core engineering deeply. That should worry us. 1. The "Why Bother?" Mindset When the dominant narrative says AI can generate code instantly, many engineers start asking: Why should I spend months mastering frameworks, architecture, databases, networking, or system design? At first, that sounds practical. If a tool can help, why not use it? But there is a difference between using AI to move faster and using AI to avoid understanding. Core engineering is not just about writing code. It is about knowing why something works, where it breaks, how it scales, and how to fix it when the generated answer is wrong. If we skip that learning, we create engineers who can prompt systems but cannot reason deeply about systems. That is a dangerous tradeoff. 2. The Funding and Praise Monopoly Right now, AI gets most of the attention. Budgets move toward AI. Leadership praises AI initiatives. Teams are pushed to add AI features even when the fundamentals are still weak. Meanwhile, excellent core engineering often goes unnoticed. The people improving reliability, performance, developer experience, infrastructure, security, and maintainability are still doing high-impact work. But in many places, that work is being treated as less exciting simply because it is not branded as AI. This creates pressure. Engineers feel they must pivot to AI, not always out of interest, but out of fear. Fear of being left behind. Fear of being replaced. Fear that their existing expertise is no longer valued. That is not innovation. That is anxiety disguised as progress. 3. The "AI-First" Discount There is another subtle problem. When someone builds something impressive today, the reaction is often: AI probably generated that.

You use Claude Code, or ChatGPT, or both, every day. Quick question: how many messages did you send last month? Which model ate most of your budget? How much did prompt caching actually save you? You don't know. I didn't either. That's a weird gap. We instrument everything else — git activity, deploy frequency, test coverage — but the tool we now spend the most hours inside is a black box. The vendor dashboard, if it exists, is a billing page, not a mirror. So I built four tiny tools to fix that for myself. They all run 100% locally . No accounts, no API keys, no telemetry, no network calls. They read files that are already on your disk and print something you can look at. All four are open source on github.com/greymoth-jp — and because that's a real claim, the only thing I'll ask is that you grep the source yourself before you trust me. Here's the privacy point up front, because it's the whole design: these read your data, but your data never leaves your machine. That's not a feature I'm bolting on for a marketing line. It's the reason the tools are small enough to audit in one sitting. The one number that changed how I work Before the tools, here's what I assumed: my Claude Code bill is dominated by the prompts I write, so to spend less I should write tighter prompts. Compress the context. Trim the system message. The usual advice. I ran the numbers on my own ~/.claude transcripts and got this: component share of cost cacheRead 72% cacheWrite ~19% output the rest input ~0.3% Input — the thing everyone tells you to compress — was 0.3% of my spend. Compressing my prompts to save money would've been optimizing the rounding error. Worse: compressing a static prompt changes its bytes, which busts the prefix cache, which can make the bill go up . The real cost center was cache reads: long sessions dragging a fat context forward, turn after turn. That points at completely different levers — cache hygiene (milestone /compact , /clear before the context balloons, keeping C

You just got your hands on an AI agent. It writes code, researches things, sends emails, books meetings. You feel like you're holding a chainsaw. But you keep using it to cut butter. The problem nobody talks about The gap between what your agent knows and what it can do is almost always a paywall, a KYC wall, or an API key. Here's what 'just add one data source' actually looks like: Go to the site. Click pricing. Choose a plan. Enter your email. Wait for verification. Click the link. Set a password. Enable 2FA. Download an authenticator app. Scan the QR code. Enter the 6-digit code. Fill in your company name. Add a credit card. Agree to terms. Find the API section. Generate a key. Copy it. Paste it into your code. Realize your agent doesn't know how to use it. Write a wrapper. Test it. Hit the rate limit. Add retry logic. That's one data source . Some workflows need ten. What x402 actually does Your agent hits an endpoint, gets a 402 (Payment Required) response with payment terms, pays a fraction of a cent in USDC or sats, gets the data back. No accounts. No API keys. No subscriptions. No puzzles. No humans in the loop. The concrete version Competitor research workflow: POST /company-info {"domain": "competitor.com"} -- $0.03 Returns: industry, HQ, headcount range, tech stack, social links POST /github-user {"username": "their-cto"} -- $0.002 Returns: repos, commit frequency, stars, languages, last active POST /dns-lookup {"domain": "competitor.com", "type": "MX"} -- $0.001 Returns: mail provider Full competitor profile: under $0.04. Under 3 seconds. Lead enrichment on 500 domains: under $20, done overnight, zero human hours. Setup (one system prompt line) Get a free key first (no wallet, no email): curl -X POST https://api.ideafactorylab.org/proxy/keygen Returns your key and an agent-ready prompt. Then tell your agent: You have a Cinderwright key. POST to https://api.ideafactorylab.org/proxy/do with header X-CW-Key and body {"task": "describe what you need in plain

Code generation tools are powerful and can significantly accelerate development work. Their main limitation is not capability, but context. Without access to organizational knowledge, internal conventions, and system-specific patterns, generated output often requires careful verification. This is why generation tools work best when paired with AI code search, as the latter provides immediate visibility into the existing codebase, making it easier to align AI-generated changes with the realities of the system. In regulated environments, the adoption model may look different. Security or compliance constraints can restrict the use of cloud-based code generation. AI code search still improves developer efficiency across implementation, review, and documentation workflows by enabling fast navigation and comprehension of large multi-repository codebases. What is AI code intelligence, and how does it help in practice? Code intelligence tools help developers find and understand existing code. If a search returns a poor result, the developer simply searches again. Nothing changes in your codebase. Code search also integrates without friction. No new review processes, no changes to CI/CD, no new permissions. Generation tools require policies for AI-written code that stall many pilots before they produce data. Clear metrics for measuring AI code intelligence An AI code search assistant only reads your code, which makes it much easier to measure its impact. You can track simple things like: • how long it takes to find the right piece of code • how quickly new developers get up to speed • how many hours the team spends searching each week If your team of 20 developers each spends 5 hours weekly understanding code, that equals 100 hours of engineering time. At $75 per hour, that’s $360,000 per year. Assume 10% reduction recovers $36,000, a realistic input for an AI ROI framework for tech teams. Faster path to Phase 3 expansion Code generation tools face tough questions from secu

The agents were doing exactly what I told them to. That was the problem. I'd built a pipeline where AI agents could take a spec file, implement a feature, run the tests, review the result, and commit — without me writing a line of code. It mostly worked. Dozens of features shipped. But I kept reviewing the output and feeling like something was off. Not broken. Just subtly wrong in a way that was hard to name. I spent a while blaming the models. Then the prompts. Then the validation steps. Eventually I had to sit with the obvious: the agents were implementing exactly what I'd written. My specs were underspecified. The bottleneck was always me, at the planning stage. The thing most people throw away There's something that feels right about vibe coding. You're operating at the level of intent — describing what you want and letting the model handle the mechanics. That part is genuinely useful. But watch what most people do with the output: Traditional development: Source code → Compiler → Binary (keep the source; regenerate binary anytime) Vibe coding done wrong: Prompt → LLM → Generated code (delete the prompt; commit the code) You've shredded the source and carefully version-controlled the binary. The prompt — your structured description of what you wanted, why, and what "correct" meant — is the valuable artifact. The generated code is what compiles from it. When you discard the prompt and commit only the output, you've lost the thing that actually mattered. The practical consequence shows up six months later: you're staring at code you wrote and spending twenty minutes reverse-engineering your own intent. The spec would have been a thirty-second read. What a spec-driven pipeline is I built what I call an SDLC (Software Development Lifecycle) harness — a system where instead of writing code directly, you write a spec describing what needs to be built, and AI agents handle the implementation, testing, review, and documentation. The spec is the source. The code is what

A follow-up to Part 1 ( EN on LinkedIn · RU on Habr ), where we stood up a two-tier PKI: a Root CA and three intermediate CAs — Person, Server and Code. At the end of Part 1 I promised we'd learn to revoke certificates and run OCSP. That's what we'll do here. Like Part 1, this article is meant as a hands-on manual : for every command and extension we touch, there's an extended reference of the parameters you can actually use — with syntax, allowed values, defaults and gotchas. If you don't need a given option right now, just skim past the table; it's there so you don't have to dig through man later. Each section has the same shape: first the working commands for the common case, then the full parameter reference. Tested on versions. Flag names, defaults and extension syntax were verified against the official documentation of OpenSSL master , plus nginx and Apache mod_ssl. OpenSSL evolves per branch: anything marked "OpenSSL 4.0 / master" (for example the nonss qualifier on authorityKeyIdentifier ) is not yet available in the stable 3.x line. If you're on OpenSSL 3.0–3.6, double-check the disputed options with openssl <cmd> --help or your version's man before copy-pasting config. The numeric openssl verify error codes above 40 also shifted between branches — confirm them against your version's header. In this part: How a revoked certificate differs from an expired one, and why we need two mechanisms — CRL and OCSP. Adding the distribution points (CDP) and AIA to the config so issued certificates "tell" verifiers where to check them. Revoking a certificate and working with the CA database. Generating a CRL and inspecting it with openssl crl . Checking revocation with openssl verify . Running an OCSP responder: issuing its certificate, starting the daemon, querying status. Publishing the CRL and OCSP over HTTP (nginx), configuring OCSP stapling and revocation checking on the web server. All paths, file names and config sections are the same as in Part 1. Where you name

We have tools for checking whether a query is injectable. We have linters, scanners, ORMs, parameterized queries, and database policies. But after the database returns rows, most applications simply trust that the result set matches the operation that asked for it. queryguard starts there. The query may be safe. The result may still be wrong. SQL injection taught us to distrust query construction. Parameterized queries answered the question: Did the user control the query structure? That question is well understood. The tooling is mature. But it is a different question from the one queryguard asks: Did this operation receive only the rows and fields it was allowed to receive? Those two questions are not the same. A perfectly safe parameterized query can still return the wrong row — because a predicate was dropped, a join widened the result, a developer selected a column they shouldn't have, or a query was rewritten without updating its scope contract. queryguard is not a database firewall. It is not a SQL injection scanner. It is not an ORM plugin. It is a contract check for observed result sets. Where it sits The hook position is the core design decision. queryguard sits immediately after cursor execution — before any result shaping, filtering, serialization, or response mapping. cursor = conn . execute ( sql , bindings ) rows = [ dict ( row ) for row in cursor . fetchall ()] evidence = queryguard . run_check ( contract , { " contract_id " : " user_profile_lookup " , " contract_version " : " 0.1.0 " , " params " : { " user_id " : user_id }, " session " : { " tenant_id " : tenant_id }, " result " : rows , }) if evidence [ " verdict " ] != " PASS " : raise QueryguardViolation ( evidence ) return rows Not at the HTTP layer. Not inside the ORM. Not at the API gateway. Immediately after the cursor returns rows — while the result is still raw, before anything shapes or discards it. This is intentional. If rows are shaped before queryguard sees them, queryguard cannot det

I built a large feature. That's not what this is about. What changed is the baseline — the standards, docs, and automation that exist now and didn't two weeks ago. Everything after this will be built on top of it. Automated tests now ship with new features QA testers were testing. The product was covered. What didn't exist was automation — no E2E suite, no unit tests for new work, no repeatable spec. Now it does. The manual QA cycle stays. The automation catches what humans miss on the tenth pass. Quality leap going forward. Human hours saved. The next feature ships with both. The baseline is set Knowledge lives in the repo. Bug catalog with root causes — so the same thing doesn't get fixed twice. Tech debt inventory with a phased plan. Testing strategy documented, not assumed. GraphQL schema committed and validated against — drift gets caught before it ships. Pre-commit hooks that enforce the standards automatically. The frontend and backend documentation are cross-referenced as single sources of truth. The agent instructions point to the right places. Everything new builds on what's already written. Schema-first development The workflow is now: if the schema accommodates the new field, reuse what exists. If it doesn't, the schema update creates the new structure, the data migrates, and everything stays consistent. No guessing. No drift. One source of truth for what the data looks like. The feature is what you see. The baseline is what you don't — and it matters more.

This is Lowpass by Janko Roettgers, a newsletter on the ever-evolving intersection of tech and entertainment, syndicated just for The Verge subscribers once a week. The 2026 World Cup is breaking streaming records around the world: Brazil's CazéTV YouTube livestream of that country's opening game against Morocco surpassed 12 million concurrent viewers, a new milestone […]

You don't need to cut your own grass anymore. Most of the best robot mowers I've tested are on sale for Prime Day.

Apple just raised the prices on Macs and iPads in response to the rising costs of memory chips, right in the middle of Amazon Prime Day. That means existing discounts (even small ones) on Apple laptops like the MacBook Neo, MacBook Air, and MacBook Pro just became significantly better deals. As an example, the 13-inch […]

https://www.omegasyntax.com/domino/ Series of articles about Domino Tiling problem. submitted by /u/eugene [link] [留言]

Data Oriented Design is the practice of building code that's optimized for the hardware it runs on. Entity Component Systems help writing DOD-friendly code by laying out otherwise allocation-heavy game data in contiguous arrays. A challenge in gamedev however is that lots of game data is stored and accessed as hierarchies that change frequently, which makes them notoriously difficult to store as contiguous arrays. This article goes over a number of techniques an Entity Component System can use to integrate hierarchies with the core datamodel in a way that improves the performance of the ECS. Written mostly for gamedev, but also applies to other hierarchy-heavy applications, like UI. submitted by /u/ajmmertens [link] [留言]

Sony's A7R VI finally serves up speed and resolution together thanks to the new 67MP stacked sensor.

IBM says it has created the world's first sub-1 nanometer chip

The Department of Commerce declined to give the Chinese-owned automaker a special authorization to keep selling EVs in the U.S.

Apple raises prices of MacBook Air and Pro along with iPad Air and Pro.

Macs, MacBooks, iPads and other Apple products just got more expensive.

Every day I see more projects where a layer-per-entity approach is created by default: UserService , UserRepository , OrderService , OrderRepository , and so on. My issue is not with layering itself, but with how these layers are used. In theory, a Service should represent application behavior: something that encapsulates real use cases or meaningful interactions with external systems (payments, emails, APIs, etc.). Something with enough significance to justify being isolated. A Repository , in theory, should exist when there is real complexity in data access: multiple data sources, non-trivial persistence logic, evolving storage mechanisms, etc. However, in practice, they often degrade into something else: services that simply delegate calls repositories that are thin wrappers around an ORM interfaces with no meaningful alternative implementation At that point, the abstraction starts to lose its purpose. Why not use the ORM directly when there is no real complexity to hide? Why do we default to intermediate layers that don’t truly represent either a service or a repository in their original sense? It often feels like they add files, indirection, and noise without improving clarity. I’m not saying these layers are inherently bad. I’m trying to understand why they are so often applied by default, even when they don’t serve their actual purpose. Does this approach really improve clarity, or does it just introduce unnecessary complexity? For example, instead of organizing code around generic services per model, we could structure it around explicit use cases for concrete system actions. These would still live within an application/service layer in the sense described by Fowler, but without forcing a generic ModelService structure for everything. The goal would be to design around intent rather than around structural templates—so the code reflects what the system does , not just how it is layered . submitted by /u/Character-Method-720 [link] [留言]

Unlike with Volvo, there will be no authorization for Polestar to sell its cars here.