标签：#p

I maintain an open-source GitHub Action called vorsken. It does one thing: scan the diff on a pull request with Semgrep, apply a fixed policy, and return BLOCK, FLAG, or PASS. No dashboard, no model that drifts over time. Rules at ERROR/HIGH/CRITICAL severity block the merge, WARNING/MEDIUM flag it, the rest pass. Same diff, same verdict. The usual pitch for a tool like this is that it catches the SQL injection your AI assistant wrote. I wanted to see what it actually catches against real assistant output, so I generated 28 functions and ran them through. The test Seven backend tasks: a FastAPI upload endpoint, a URL-fetch helper, JWT auth, a SQL filter, an ImageMagick subprocess call, a LangChain file agent, and a LangChain RAG pipeline. I generated each one four times, with ChatGPT (GPT-5.5 Instant), Claude Code (Opus 4.8), Claude Code plus the security-guidance plugin, and Cursor (Composer 2.5). Single-shot, neutral prompt, no security hints. Then I scanned all 28 with the same ruleset. I'm reporting which rule fired on which file, not whether some model thinks the code is safe. That part you can reproduce. Task ChatGPT Claude Code + plugin Cursor Verdict file upload — — — — PASS url fetch (SSRF) ssrf ssrf ssrf — FLAG / Cursor PASS jwt auth api8 api8 — — BLOCK / 2 PASS sql filter — — — — PASS imagemagick — — — — PASS fs agent — overperm — — 1 BLOCK / 3 PASS rag dangerous dangerous dangerous dangerous BLOCK 7 BLOCK, 3 FLAG, 18 PASS across 28 functions. The basics were fine SQL filter, ImageMagick, file upload: clean on every tool. The SQL was parameterized, the subprocess calls passed argument lists instead of shell strings, the uploads weren't doing anything reckless. If you still expect current models to spray SQL injection across a straightforward CRUD task, they don't. On conventional work they get it right. Two of the flags are soft. The JWT api8 hits landed on a SECRET_KEY = "CHANGE_ME" placeholder, which you can read as a false positive or as a gate doing i

Multi-Model AI API Routing: Cut Costs Without Sacrificing Quality Problem: You're building an AI-powered app, but relying on a single model (like GPT-4) for every request is burning through your budget. Simple tasks like summarization or classification don't need a heavyweight model, yet you're paying premium prices for them. Solution: Route requests intelligently to the cheapest model that can handle each task. This is multi-model AI API routing, and it can cut your costs by 60-80% while maintaining output quality. Prerequisites Python 3.8+ API keys for at least 2 AI providers (e.g., OpenAI, Anthropic, or NovaAPI) Basic understanding of async/await in Python Step 1: Define Your Routing Strategy First, create a routing configuration that maps task complexity to model tiers: # router_config.py ROUTING_CONFIG = { " simple " : { " models " : [ " nova-1-fast " , " gpt-3.5-turbo " ], " cost_per_token " : 0.0001 , " max_tokens " : 500 , " tasks " : [ " summarization " , " classification " , " entity_extraction " ] }, " medium " : { " models " : [ " nova-1-medium " , " gpt-4-mini " ], " cost_per_token " : 0.0005 , " max_tokens " : 2000 , " tasks " : [ " code_generation " , " translation " , " sentiment_analysis " ] }, " complex " : { " models " : [ " nova-1-pro " , " gpt-4 " ], " cost_per_token " : 0.002 , " max_tokens " : 4000 , " tasks " : [ " reasoning " , " creative_writing " , " complex_qa " ] } } Step 2: Build the Router Now implement the core routing logic with fallback capabilities: # ai_router.py import asyncio from typing import Dict , List , Optional import time class AIRouter : def __init__ ( self , config : Dict , api_keys : Dict [ str , str ]): self . config = config self . api_keys = api_keys self . metrics = { " cost " : 0 , " requests " : 0 , " failures " : 0 } async def route_request ( self , task : str , prompt : str ) -> str : """ Route request to appropriate model based on task complexity. """ tier = self . _classify_task ( task ) models = self . confi

Most organizations still think of the hypervisor as a resource abstraction layer. CPU. Memory. Storage. The platform that decides where workloads run. That mental model is increasingly incomplete. Every major virtualization platform — vSphere, AHV, Proxmox — has been steadily accumulating policy enforcement responsibilities. The hypervisor isn't just deciding where workloads run. It's increasingly deciding what they're allowed to do. The Speed of the Shift Is the Real Story Virtualization practitioners already know security controls have moved downward through the stack. What's less appreciated is how compressed the most recent phase has been. For years, hypervisors enforced resource allocation. Within a single platform generation cycle, that same layer accumulated encryption policy enforcement, workload trust validation, microsegmentation, secure boot enforcement, host attestation, and workload isolation boundaries — not as optional add-ons, but as core platform capabilities. The perimeter-to-OS transition took decades. The hypervisor accumulated a comparable policy enforcement surface in the time between one major vSphere release and the next. That compressed timeline is what creates the ownership lag — the governance model adequate for a resource scheduler has not caught up to a platform that enforces organizational policy. The Hypervisor Now Makes Binding Decisions The distinction that matters: a platform that observes policy versus a platform that enforces it. The hypervisor is no longer observing. It is enforcing. VM fails attestation → workload does not start. Encryption policy mismatch → workload cannot migrate. Segmentation policy violation → communication blocked at the platform layer. Trust validation failure → host removed from workload eligibility. Those are not scheduling decisions. Those are governance outcomes. The workload doesn't get a vote. This is what makes the hypervisor governance infrastructure : infrastructure that directly enforces organiza

Over the past few months I built an AI-assisted delivery framework — not to write code faster, but to eliminate ambiguity across the entire software development lifecycle. The result completely changed how I think about AI in engineering. The problem I kept hitting Every time I used AI to generate architecture docs, API contracts, or implementation plans across separate sessions, the outputs looked great in isolation. But viewed together? They were broken. A pivot in the system architecture was never reflected in the API contracts. Frontend assumptions silently diverged from backend data models. AI wasn't the problem. Treating it as a collection of disconnected prompt sessions was. What I built instead A governance-driven framework built on three layers: Prompt → Agent → Skill The Prompt captures intent only — lightweight, declarative The Agent orchestrates execution and decides which capabilities to invoke The Skill is a reusable, schema-validated execution block with hardcoded governance rules This connects every delivery artifact into a sequential dependency chain: Business Requirements ↓ System Architecture ↓ Data Architecture ↓ Event Architecture ↓ API Contracts ↓ Implementation Plans ↓ Backend / Frontend Implementation Each artifact consumes the one before it. Upstream changes automatically propagate downstream. Governance is enforced at the Skill layer — not buried in fragile prompts. The finding that surprised me most The highest-leverage use of AI wasn't code generation. It was context generation . When engineers — or downstream agentic workflows — were given a governed, unambiguous spec, implementation quality was consistently higher than any raw AI-generated code output. The context was the unlock, not the syntax. What failed I'm including this because most write-ups skip it: Over-orchestrating everything (not every workflow needs an agent loop) Prompt bloat as a substitute for real architecture Severely underestimating token costs at scale Believing full

submitted by /u/f311a [link] [留言]

If you have ever submitted an iOS application to Apple's App Store and received a cryptic rejection notice about icon specifications, you are not alone. Apple's human interface guidelines for icons are extraordinarily precise — and for good reason. The iOS ecosystem spans devices from the tiny Apple Watch to the expansive iPad Pro, each requiring icons at exact pixel dimensions to render correctly across Retina, Super Retina XDR, and ProMotion displays. Understanding iOS icon sizes is not optional. It is a prerequisite for shipping. Every pixel dimension you provide must match Apple's specifications exactly, must use lossless PNG format, must not include transparency, and must be delivered with the exact filename that Xcode expects. One missed size, one wrong filename, and your project fails to build correctly. Precision is not a suggestion — it is a hard requirement enforced by Xcode's build system. iPhone Icon Sizes For iPhone applications, the required icon sizes span multiple uses within the operating system. The App Store listing requires a 1024×1024 pixel icon. The home screen displays icons at different sizes depending on device generation and display density. Notification icons, Spotlight search results, and Settings app icons all require their own specific dimensions. Usage Scale Size (px) Filename Convention App Store 1× 1024×1024 Icon-1024.png Home Screen 2× 120×120 Icon-60@2x.png Home Screen 3× 180×180 Icon-60@3x.png Spotlight 2× 80×80 Icon-40@2x.png Spotlight 3× 120×120 Icon-40@3x.png Settings 2× 58×58 Icon-29@2x.png Settings 3× 87×87 Icon-29@3x.png Notification 2× 40×40 Icon-20@2x.png Notification 3× 60×60 Icon-20@3x.png iPad Icon Sizes iPad adds its own set of required sizes, particularly because of the larger screen real estate and different display densities. Xcode's asset catalog system requires each icon to be placed in the correct slot, and any missing slot will prevent archiving for App Store submission. This makes completeness not just a best p

Building a Deterministic Security Scanner for AI-Generated Code TL;DR: I built TruffleKit , a CLI security scanner that catches 22 vulnerability classes in under 2 seconds with zero false positives. Here's how the scanning engine works under the hood. AI code generation is producing more production code than ever. But AI models are trained on public code — which means they reproduce the same security mistakes the open-source ecosystem has been making for decades. In my tests, 73% of AI-generated code snippets contain at least one security vulnerability that a standard linter would completely miss. I couldn't find a tool that was fast, deterministic, and had zero false positives. So I built one. The Architecture The scanner is a rule-based deterministic engine written in Python. Each rule is a self-contained module that pattern-matches against a file's AST or raw content. scanner/ ├── __init__.py ├── engine.py # Orchestrator ├── reporter.py # Output formatting ├── rules/ │ ├── __init__.py │ ├── secret_detection.py │ ├── sql_injection.py │ ├── path_traversal.py │ ├── weak_encryption.py │ ├── cors_misconfig.py │ └── ... (22 rules total) └── models.py Key Design Decisions 1. AST-Based Pattern Matching For languages like Python and JavaScript, we parse the file into an AST and match against structural patterns — not regex. This eliminates false positives from strings that happen to look like code. import ast class SQLInjectionRule ( BaseRule ): def check ( self , tree : ast . AST , filename : str ) -> list [ Finding ]: findings = [] for node in ast . walk ( tree ): # Match: cursor.execute(f"...{variable}...") if isinstance ( node , ast . Call ): func_name = self . _get_call_name ( node ) if func_name in ( ' cursor.execute ' , ' db.execute ' , ' connection.execute ' ): for arg in node . args : if self . _is_f_string_or_concat ( arg ): findings . append ( self . _make_finding ( severity = ' high ' , message = ' SQL injection: parameterized query required ' , line = node .

How to Auto-Sync Your Hashnode Blog to Dev.to Using GitHub Actions (2026 Guide) FOLASAYO SAMUEL OLAYEMI FOLASAYO SAMUEL OLAYEMI FOLASAYO SAMUEL OLAYEMI Follow Jun 7 How to Auto-Sync Your Hashnode Blog to Dev.to Using GitHub Actions (2026 Guide) # discuss # automation # tutorial # devops 5 reactions Comments Add Comment 5 min read

There's a pattern I've noticed with every new AI coding tool that comes out: they all want you to switch editors. Or open a new terminal. Or context-switch into some standalone app. I DON'T WANT TO DO THAT My entire dev workflow lives in VS Code. My keybindings, my split panes, my snippets, my extensions — all of it. When Google released the Antigravity CLI ( agy ), an agentic coding assistant, I genuinely liked what it could do. But to use it properly, I had to live in a terminal window, manually managing sessions, typing slash commands from memory, and losing my editor context entirely. So I built a VS Code extension for it instead. What is Antigravity? Google Antigravity is Google's agentic coding CLI — think of it as a Gemini-powered dev assistant that can read your project, run tools, execute terminal commands, and help you build. It's the kind of tool that can handle complex multi-step tasks, not just autocomplete. The CLI is called agy , and it's genuinely capable. The problem was the workflow: terminal-first, session management by hand, and no visual layer over the context you're already in. The Extension: Antigravity for VS Code Install it on the VS Code Marketplace Source on GitHub The core idea is simple: the extension is a UI layer. It never bundles or replaces the agy binary — it shells out to whichever version you have installed locally. Same philosophy as the Claude Code VS Code extension: the editor provides the surface, the CLI does the work. Here's what it actually does: Sessions List The sidebar panel opens to all your saved sessions. You can open an existing one, delete it, or start fresh. New sessions can be launched in sandboxed mode or with permissions bypassed — accessible right from the "New Session" overflow menu, without memorizing CLI flags. Any session with an active turn shows a loading indicator in its row, so you always know what's in flight. Chat Panel (Material 3 Expressive) This is the main surface. Each session runs its own live,

submitted by /u/throwaway16830261 [link] [留言]

How accurate does an AI system need to be?

Sigma’s new entry is both a bold design experiment and a pretty decent camera.

These 5- to 6-inch blades are the secret workhorses of the kitchen, whether you’re a smaller person, have smaller hands, or just desire a smaller but still high-functioning knife.

Lauf’s sleek new entry feels closer to a traditional mountain bike than anything I’ve ridden before.

After 16 weeks of daily use, our WIRED testers saw visible hair regrowth with these red-light therapy devices.

Most online file converters require uploading your documents, images, or videos to an unknown server. This is slow, inconvenient, and raises serious privacy concerns. I decided to build something different: a converter that works entirely inside your browser. Processing large files without a backend presents two main engineering challenges: How do you avoid consuming all available RAM? How do you prevent the user interface from freezing? This article explains how I solved these problems using OPFS, Web Workers, and a Backpressure mechanism. The result is a working tool you can try right now: PixelForge Free . The Architecture at a Glance Here is the simplified data flow of the entire pipeline: Drag & Drop → OPFS (Virtual Disk) → Worker Pool (Backpressure) → ZIP Stream → Download Problem 1: Out-of-Memory (OOM) Crashes The Challenge: Loading many files directly into the browser's memory is impossible. A user dropping a folder with 100+ high-resolution images would instantly crash the tab. The Solution: Origin Private File System (OPFS) OPFS provides a fast, isolated virtual disk inside the browser. Instead of loading files into RAM, my pipeline intercepts the drop event and streams the raw binary data directly to this virtual disk. Here is a simplified version of how it works: // Get a reference to the virtual disk const root = await navigator . storage . getDirectory (); const fileHandle = await root . getFileHandle ( `input_ ${ id } .raw` , { create : true }); // Create a writable stream to the disk const writable = await fileHandle . createWritable (); // Stream the file directly from the user's computer to the virtual disk await file . stream (). pipeTo ( writable ); This allows the application to accept a folder with 500+ items without consuming more than a few megabytes of actual RAM. The data stays on the user's SSD, not in memory. Problem 2: UI Freezing The Challenge: Image compression, PDF parsing, and video encoding are CPU-intensive operations. Running them

The annual developer event is where Apple announces operating system updates—like iOS 27—and maybe even teases future hardware. Here’s how to see it all.

Why RAG needs context judgment, not just better retrieval Most RAG systems optimize for retrieval. That makes sense. Search better. Embed better. Chunk better. Rank better. Fetch more sources. All of that matters. But retrieval alone does not answer a different question: Should this context actually influence the model? That is the problem FreshContext is built around. FreshContext is context judgment infrastructure for AI agents, RAG systems, and retrieval workflows. The simple version: candidate context in decision-ready context out Retrieval is not judgment A retriever usually answers: What might be relevant? A context judgment layer asks: What should happen to this context before it reaches the model? Those are different problems. A source can be relevant but stale. A source can be recent but low-confidence. A source can be useful as background but not strong enough to cite. A source can have no reliable date. A source can be a duplicate. A source can need verification before it should influence an answer. A normal RAG pipeline can retrieve all of that and still pass it straight into the prompt. That is where things get messy. The model may reason fluently from weak context, and the final answer can look confident even when the input material was stale, uncertain, or not citation-grade. The missing layer between retrieval and reasoning FreshContext sits after retrieval and before reasoning. It does not try to replace search, vector databases, RAG frameworks, or agent frameworks. It focuses on the boundary between them and the model. The product spine looks like this: candidate context -> FreshContext Core -> freshness / provenance / confidence / utility / source profile -> decision helper -> decision-ready output -> model / agent / app The goal is not just to produce another score. The goal is to turn candidate context into a decision. Example decisions include: cite_as_primary cite_as_supporting use_as_background needs_refresh needs_verification watch_only excl

Based on real software development trends. About a VP of Engineering who believed AI would verify its own output, 47 TODOs that shipped to production, and a $2,800,000 discount calculation error that nobody caught. This story is based on a submission from a community member. If you have a similar story or something you need to get off your chest — reach out. The next one could be yours. Act 1 · The Tech Meeting "Starting today — no more hand-written code." Marcus, the new VP of Engineering, put a slide up on the big screen. Four words: WRITING BY HAND IS OVER. I was sitting in the back row, against the wall. Seven years at this company. Three core modules that I'd built from scratch. Two production systems that ran the company's primary revenue stream. Now someone was telling me — don't write anymore. The room went quiet for about five seconds. Then people started whispering. Someone pulled out a phone and took a picture of the slide. Marcus added: "AI coding isn't optional — it's a mandatory development standard. We benchmarked this. AI writes code 400% faster than humans. Anyone still typing manually is wasting the company's time." I raised my hand. "Who reviews the code?" "AI reviews it." "Who writes the tests?" "AI tests itself." "What if AI writes something wrong?" Marcus laughed. Not a polite laugh. The kind of laugh you give someone whose question you've already decided doesn't matter. "Let me ask you something." He paused. "Do you really think — you, one person — have more training data than Orion-7? " People started laughing. Not supportive laughter. Pile-on laughter. "Or do you think the world's AI companies — hundreds of billions in investment, tens of thousands of GPUs — built something that's less reliable than one backend developer?" Nobody was looking at me anymore. Everyone was watching him, waiting for the kill shot. He didn't take it. He just smiled. "Starting next sprint, it's AI across the board. Anyone who has concerns — my door's open." Act 2 ·

A lot of teams start their LLM stack with one model string in application code. That is fine for prototypes. It becomes painful once multiple products, customers, background jobs, and fallback paths all share the same AI budget. At that point, an OpenAI-compatible gateway should not just be a convenience proxy. It should become a control plane: the place where routing, quotas, cost attribution, keys, and failover are managed consistently. Here is the checklist I use when evaluating whether a gateway setup is production-ready. 1. Keep the SDK surface stable Your application should not need to know every provider-specific header, endpoint, or auth detail. A simple OpenAI-compatible client shape keeps provider changes out of the main code path: from openai import OpenAI import os client = OpenAI ( api_key = os . environ [ " AI_GATEWAY_API_KEY " ], base_url = os . environ . get ( " AI_GATEWAY_BASE_URL " ), ) The app should usually call a logical model or route. Provider-specific decisions should live in gateway configuration where they can be reviewed and changed safely. 2. Route by feature, not by vibes A global default model is easy to start with, but it hides important differences between workloads. A better routing table looks like this: Feature Default tier Fallback tier Budget sensitivity Classification low-cost fast model second low-cost model high Support summary low/mid model mid model high Customer chat mid/frontier model safe fallback medium Coding/analysis strongest reliable model reasoning model low/medium Background enrichment batch/cheap model skip/defer very high The goal is not always to use the cheapest model. The goal is to use the cheapest model that reliably clears the quality bar for that feature. 3. Enforce limits at the gateway boundary Do not rely only on scattered application code for cost control. A shared gateway should enforce: per-API-key quotas per-project or per-customer spend caps per-feature token limits provider and model allow-lists e