标签：#p

The Surface Laptop is down to $835 for Prime Day—a killer discount on one of my favorite laptops.

The first time I wired Dependabot up to a private package registry, it took three meetings and a calendar reminder set six months ahead. The reminder was for the personal access token I had to mint to do it, the one I would have to rotate by hand before it expired, living in a config that drifted somewhere between repo settings, a .github file, and an internal wiki page nobody had touched in a year. On June 23 GitHub posted a small changelog item that quietly retires that whole ritual: Dependabot can now read your private GitHub Packages and GHCR registries through its own GITHUB_TOKEN , no PAT required. If you have ever had to explain to a security review why your bot account holds a token your team owns but a person minted, you already know why this lands. The PAT we all had and nobody loved Until this week, Dependabot's path to a private GitHub-hosted package was the same path it took years ago. A human minted a personal access token, scoped wide enough to read the registry, stored it as a repo or org secret, and plugged it into Dependabot so the bot could authenticate when it tried to resolve dependencies. That token expired on a human schedule. It belonged to whoever happened to set Dependabot up, which is rarely the person who still owns the repo a year later. You can feel how that ends. Tokens that quietly expire and break a Dependabot PR the day someone needs the patch. Tokens that follow an offboarded engineer out the door. Tokens with scopes wider than the job actually requires, because nobody wanted to mint a fine-grained one per registry path. None of those failures are catastrophic on their own. All of them are the kind of papercut a platform team ends up owning. What the GITHUB_TOKEN does here The new behavior is straightforward. Dependabot's job-scoped GITHUB_TOKEN can now request a packages: read permission. When the bot pulls from a hostname under *.pkg.github.com or ghcr.io , it sends that token instead of asking for a PAT. The same token that alre

I'm Dr. Mohammad Reza Beheshti, Founder of CyberSiARA. I hold a PhD in Electronic Engineering and Artificial Intelligence and have over 15 years of experience in cybersecurity research and innovation. My passion has always been solving complex security challenges through technology. This journey led me to found CyberSiARA, where we're developing AI-powered bot protection and human verification solutions to help organizations defend against increasingly sophisticated cyber threats. I enjoy combining academic research with practical engineering to create technologies that are both innovative and effective in the real world. Through this blog, I share insights from my research, product development, and experiences building a cybersecurity company, with the aim of helping developers and security professionals stay ahead of emerging threats. I'm always keen to learn, collaborate, and contribute to the global developer and cybersecurity communities.

The boat-agent stack here runs on a prime directive: if there's something usable out there, improve it; build our own only as a last resort. So when we needed a SignalK MCP server, the honest first move wasn't to write one — it was to evaluate the one that already exists. VesselSense/signalk-mcp-server (TypeScript, MIT) is good work. It exposes SignalK to an agent through a single execute_code tool: the model writes JavaScript, the server runs it in a sandboxed V8 isolate ( isolated-vm ), and only the result comes back. Its README claims a 90–96% token reduction versus traditional named MCP tools — 2,000 tokens down to 120 for a vessel-state query, 13,000 down to 300 for a multi-call workflow. Those numbers are plausible, and they line up with the broader industry result that code execution beats tool-calling on token efficiency for complex multi-step work. We read it, ran the numbers against our own agent, and kept our discrete-named-tool signalk-mcp anyway — then harvested three of VesselSense's ideas into our roadmap. This post is that evaluation: the two philosophies, why the obvious-sounding win doesn't bind for a voice-first agent, and a decision framework you can reuse before you adopt-or-build your own MCP server. This is a design-reasoning post, not a debugging saga, but it maps to the same arc: a question, the dead-end that looks like an obvious yes, and the call that actually held. The question Two SignalK MCP servers, two genuinely different designs: VesselSense/signalk-mcp-server sailingnaturali/signalk-mcp ───────────────────────────── ─────────────────────────── one tool: execute_code discrete named tools: → agent writes JavaScript read_sensor(path) → runs in a V8 isolate battery_state(bank) → queries SignalK, returns depth_state() only the result get_route() get_local_time() TypeScript / Node + isolated-vm list_paths(prefix) claims 90–96% fewer tokens get_active_alarms() Python, end-to-end The adopt-vs-keep question: does the token-efficiency win bin

We run a prime directive on this stack: if a usable tool already exists, improve it; build our own only as a last resort, and when you keep your own, record why each alternative failed. This post is that audit for weather-mcp — a marine-weather MCP server — against the weather-MCP ecosystem, and the one capability change that fell out of it. The short version: three perfectly good weather MCP servers exist, and none of them does the thing a navigator actually needs. The reasons generalize to any "adopt an MCP server or keep your own" call, so the audit is the post. Then the fix — parsing a second NDBC file format to split swell from wind waves — is small enough to paste in full, and it surfaced data the standard file had thrown away. The problem, as you'd search it You want an agent to answer "what are the seas doing where we are?" and you go looking for a marine weather MCP. You find a few. Each one returns a forecast . None of them returns what a buoy 12 nautical miles away is measuring right now . That gap — forecast vs. observed — is the entire job, and it's the one thing the ecosystem skips. Here's what's on the shelf, and what each one is missing for marine use. The candidates Three real servers, all worth your time for what they're built for: cmer81/open-meteo-mcp ~13 tools, raw Open-Meteo JSON straight through weather-mcp/weather-mcp ~12 tools, own format, global; marine = Open-Meteo RyanCardin15/NOAA-Tides... CO-OPS stations: water levels + currents, not buoys And ours: sailingnaturali/weather-mcp 4 tools, Python, 2 runtime deps (httpx + mcp) get_marine_forecast Open-Meteo wind/swell/wind-wave/seas/pressure get_marine_forecast_premium Stormglass blend — 10 tokens/UTC-day, cache hits free get_nearest_buoy_observations NDBC observed wind + waves by lat/lon, with bearing + age get_stormglass_quota_status token-ledger read, no network Mapped against what a navigator needs: Capability ours open-meteo-mcp weather-mcp/weather-mcp NOAA-Tides Open-Meteo marine (swel

submitted by /u/mmerli [link] [留言]

The all-cash deal gives MoEngage access to technology that assigns AI agents to individual customers.

A lot of American bathrooms don't have outlets near the toilet. Tushy Classic 3.0 and Wave bidets, on sale for Prime Day, solve the problem.

What do you think about the new HTTP Query method? submitted by /u/Perfect-Scale902 [link] [留言]

HiSense's new CanvasTV line is a better buy than the Samsung Frame, even at full price. And it's not full price right now.

The Nex Playground is the family-centric, Kinect-like game console that made one Verge editor’s kids laugh, cry, and ask for more playtime, even when they were sick. The motion-based game play isn’t perfect, but it has won over plenty of parents — and it’s on sale for $239 at Amazon, down from its current MSRP […]

Order warns of national security risks if post-quantum cryptography isn't adopted in time.

Netflix, A24, Focus Features, and Warner Bros.' Clockwork have all reportedly decided to pass on picking up Artificial - director Luca Guadagnino's new biographical drama about OpenAI cofounder / CEO Sam Altman - for distribution deals. And while Neon and Mubi are still said to be interested in the film, this situation makes it seem […]

I wanted AI code review I could actually own. Not access through a subscription or a black-box service with its own limits. The deployment, credentials, providers, and usage under my control. I kept hitting usage limits mid-week during deep building sessions. The models were capable. The workflow was useful. But access still depended on somebody else's weekly allowance, and centralized platforms can change whenever the company behind them decides to. Pricing, quotas, models, plan boundaries. A workflow that fits this month may sit behind another subscription next month. I could not find a reliable open-source option that gave me the ownership model I wanted. So I built one. That became Codra : A self-hosted AI review engine built around bring-your-own models, your own data boundary, and no Codra-imposed usage ceiling. What Codra Is Codra is an open-source, self-hosted AI code review engine for GitHub pull requests. It listens to pull request events, reviews changed files, posts inline findings, and provides a dashboard for jobs, repositories, model routing, history, usage, and failures. It runs on Cloudflare Workers and uses: Cloudflare Queues for review jobs PostgreSQL through Hyperdrive for storage KV for sessions and cache A React dashboard for operations The GitHub App, model credentials, database, and review history are yours. Provider keys are encrypted with AES-GCM using your deployment secret. Bring Your Own Model, Bring Your Own Limits Changing providers does not require replacing your review history, configuration, or workflow. You configure the provider and model. Supported: OpenAI-compatible APIs OpenRouter Anthropic Google / Gemini Cloudflare Workers AI Why Self-Hosted Matters Here A large frontend repo and a tiny backend repo should not need the same review strategy. Each repository gets its own review settings. You tune triggers, skip generated files, ignore drafts, use mention-triggered reviews, configure labels, set file limits, and define custom ru

One of the most confusing errors you can face while deploying a Node.js or Docker-based application is: fatal: Need to specify how to reconcile divergent branches At first glance, it looks like a Git bug. In reality, it is Git doing exactly what it should do, protecting you from overwriting history. In this article, I’ll break down a real production incident where a deployment failed due to divergent Git branches, how we diagnosed it, and the correct DevOps fix. The Problem A simple deployment script was running: git pull docker compose down --remove-orphans docker compose up --build -d But it failed with: fatal: Need to specify how to reconcile divergent branches This stopped deployment completely. What Git Was Telling Us To understand the issue, we ran: git rev-list --left-right --count HEAD...origin/main Output: 1 16 This means: 1 commit exists locally on the server 16 commits exist on GitHub So the branches had diverged. Why This Happens (Important) This usually happens when: Someone runs git commit directly on a server A previous deployment used git pull with merge commits History between local and remote is no longer linear Git refuses to guess whether you want to: Merge Rebase Or reject changes So it throws an error. Deep Diagnosis We inspected the commits: git log --oneline origin/main..HEAD Result: 6d9046b Merge pull request #222 Then: git log --oneline HEAD..origin/main Showed multiple new GitHub PR merges. Conclusion: The server was behind GitHub The “local commit” was already part of repo history No real production changes existed on server The Real Fix (Production Safe) For deployment servers, you should NEVER rely on git pull . Instead, use a deterministic reset: git fetch origin git reset --hard origin/main Then redeploy: docker compose down --remove-orphans docker compose up --build -d Why This Works This approach ensures: Server always matches GitHub exactly No merge conflicts in production No accidental local commits survive Fully reproducible depl

Superhuman, which also has an AI detection tool as part of Grammarly, has snapped up GPTZero.

Hi there, im currently coding a datapack for minecraft, combining BlazeandCave's Advancements pack with my own datapack for a series I want to start, but I cant figure out how to code what I want exactly, since it seems like it never works. If anyone knows how to help me, heres what I was thinking of coding: Information: BlazeandCave's Advancements is a pack that adds more advancements to the game. I want every advancement to expand a starting border of 16 blocks every time by: Task: 1 Goal: 2 Challenge: 5 Super challenge: 20 I also don't want it so that if I get an achievement, my friends cant expand the border with that achievement no more. I also want to add a daily challenge of obtaining certain items, and gives me 3 lucky blocks on completion, but Im working on that later, rn im just stuck on the Achievement part. Im currently using https://code.visualstudio.com/ for all my coding. Help is appreciated My code: -datapack --data ---border\function ----check_adv.mcfunction: execute as u/a store result score u/s adv_now run scoreboard players get u/s bac_statistics execute as u/a if score u/s adv_now > u/s adv_old run worldborder add 1 execute as u/a if score u/s adv_now > u/s adv_old run scoreboard players operation u/s adv_old = u/s adv_now ----load.mcfunction: scoreboard objectives add adv_now dummy scoreboard objectives add adv_old dummy worldborder set 16 worldborder center 0 0 ----reward.mcfunction: scoreboard players add #adv adv_count 1 ----tick.mcfunction: function border:check_adv ---minecraft\tags\functions: ----load.json: {"values":["border:load"]} ----tick.json: {"values":["border:tick"]} --pack.mcmeta: { "pack": { "pack_format": 18, "description": "Border SMP datapack" } } -BlazeandCave's Advancements pack 1.20.2.zip submitted by /u/Initial-Honey-9865 [link] [留言]

submitted by /u/caspervonb [link] [留言]

The Quest Begins (The "Why") Honestly, I still remember the first time I stared at the Daily Temperatures problem on LeetCode and felt like I was trying to crack a vault with a toothpick. The brute‑force solution — two nested loops, checking every future day for a warmer temperature — was simple to write, but it timed out on the larger test cases. I spent an hour tweaking loops, adding early breaks, and even trying to memoize results, only to watch the same red “Time Limit Exceeded” banner flash again. I was frustrated, but more than that, I was curious. Why did this problem feel so repetitive ? Every element seemed to be asking the same question: “What’s the next greater value to my right?” If I could answer that for each index in a single pass, the whole thing would collapse into O(n). That’s when I remembered a weird little data structure I’d seen in a textbook — the monotonic stack — and realized it might be the magic wand I needed. The Revelation (The Insight) Here’s the thing: a monotonic stack isn’t just a stack with a funny name; it’s a way to capture relationships between elements without ever looking backward more than once . Imagine you’re walking through a line of people sorted by height, and you want to know, for each person, who is the first taller person standing ahead of them. If you keep a stack of people whose heights are strictly decreasing as you move from left to right, then whenever you see a new person taller than the one on top of the stack, you’ve just found the answer for that stacked person: the current person is their “next greater.” You pop them off, record the distance, and keep going. Because each index is pushed once and popped at most once , the total work is linear. The same idea works for “next smaller,” “previous greater,” or any problem where you need the nearest element that satisfies a monotonic condition. The stack does the heavy lifting of remembering candidates that could still be relevant, discarding the ones that are alrea

APIs para agentes autónomos: lo que Prowl muestra (y no muestra) El snapshot actual de Prowl lista cinco APIs con score n/a. Eso ya es una señal: ninguna de estas herramientas tiene aún suficiente adopción o señales de ranking. Pero no por eso son irrelevantes. Al contrario, agrupan un patrón común: todas están diseñadas para que un agente de IA opere sin intervención humana directa. Los items y su función Apumail — casilla de correo nativa para agentes. Ofrece una API en texto plano, con negociación de contenido: text/plain para agentes, HTML para humanos. Útil para workflows donde el agente necesita recibir confirmaciones, códigos o enlaces verificables. RogerThat — capa de coordinación entre agentes. Mensajería en tiempo real pensada para que agentes autónomos se comuniquen entre sí. No es un chat humano, es infraestructura de sistema distribuido. DOBI — agente autónomo enfocado en DePIN y activos del mundo real. Ejecuta acciones on-chain dirigidas por un agente de IA. Combina blockchain con decisión autónoma. CIDIF — plataforma para gestionar solicitudes de fondos de I+D. Automatiza el proceso burocrático. No es un agente puro, pero su API podría integrarse con un agente que busque oportunidades de funding. Orquesta — orquestación de pipelines multi-paso para agentes. Permite componer, ejecutar y monitorizar workflows complejos. Es el eslabón que une agentes individuales en procesos coordinados. Patrón detectable Cuatro de cinco herramientas están directamente orientadas a agentes autónomos. La quinta (CIDIF) es una plataforma funcional que puede ser consumida por un agente. Esto indica una dirección clara en el ecosistema: la IA no solo habla con humanos, ahora necesita canales propios, comunicación entre sí, y capacidad de actuar sobre sistemas reales (blockchain, email, workflows). Señales no obvias Score n/a en todas : ninguna ha acumulado suficiente tráfico o votos para generar un score. Esto sugiere que el mercado de APIs para agentes está en etapa tempran