标签：#p

Here is the bet we made: build software memory-first, not model-first , and it will outperform. Everyone else is racing to wrap the next model. We did the opposite. We built the memory layer first, the routing first, tool-calling, now the recursive engine, then let the model be a swappable part. Today that bet has a name: Backboard Development Studio . It starts with the R-CLI , a coding harness now in open beta. The headline result? It beats frontier models using open ones. Keep reading, the numbers are below and there is a promo code at the bottom. Test it. The beta is open. Two lines and you are running. # macOS / Linux curl -fsSL https://app.backboard.io/api/cli | bash # Windows (PowerShell) irm https://app.backboard.io/api/cli/windows | iex Get your API key: https://app.backboard.io Promo code: DEVTOCLI for credit toward inference while you put it through its paces. Find the Promo submit in the top right corner of the billing page. The hypothesis, stated plainly Model-first thinking says: pick the smartest model, prompt it well, hope it remembers. Memory-first thinking says: give the system real persistence, real routing, real recall, and a "smaller" model will outwork a "smarter" one that forgets everything between turns. We believed the second one. So we built it. The R-CLI is powered by our memory algorithms (the same ones that rank #1 on LoCoMo and LongMemEval ) and runs on Backboard's unified API: memory, routing across 17,000+ models , RAG, and stateful threads behind one key. Then we tested it in public. That part did not go quietly. The numbers we're getting on internal test runs this week 92% on Terminal Bench 2.1 running Codex 5.5 70% on Terminal Bench 2.1 running GLM 5.1 , an open-source model Up to 30% fewer tokens and up to 90% lower cost than the closed harnesses 0% of your code used to train anyone's model <-- Please read the T's & C's of your fav harnesses... Read that second line again. An open model, inside our harness, posting numbers that go

This field test was against Kubernetes. The issue was Kubernetes #138728: https://github.com/kubernetes/kubernetes/pull/139545 The issue involved the watch cache path around initial events. The useful diagnostic boundary was: watch cache consistency work → read lock hold time → initial event delivery That matters because cache paths in Kubernetes are not just storage details. They sit between stored state and the clients watching that state. If too much work happens while a cache lock is held, the system may still be logically correct, but the operational path can become more expensive, more blocking, or harder to scale than it needs to be. The local repair candidate is intentionally narrow. It does not redesign the watch cache. It does not change the broader storage model. It does not rewrite WatchList behavior. The patch focuses on reducing how much work happens while the watch-cache read lock is held. For ordered stores, the repair keeps the cheap snapshot boundary during interval construction, but defers full ordered list materialization until the interval is consumed by the watcher path. In plain terms: Take the necessary cache boundary under lock. Do not do heavier list materialization there if it can be safely deferred. The local patch touched only the watch-cache interval implementation and its focused tests. Local validation passed for the relevant cacher tests, store tests, full cacher package tests, and diff hygiene. Status: draft PR opened for maintainer review Field Test #013 Project: Kubernetes Issue type: watch-cache / initial-events behavior Boundary: cache consistency work under lock vs bounded watcher consumption Result: narrow local repair candidate and focused test coverage Status: local proof prepared; no public PR or comment opened yet This field test matters because it shows Scarab operating inside a major distributed systems platform. The bug shape was not a simple crash. It was not a UI issue. It was not a configuration mismatch. It was a me

At some point, a monolith starts working against you. In my case, Finovara was a single Spring Boot application handling everything (authentication, transactions, limits, piggy banks, notifications, activity logs, currency conversion) The bigger it got, the harder it was to change anything without worrying about something else breaking. So I broke it apart. This post is about the first three pieces I extracted: the API Gateway , the activity-log-backend , and a shared module called contracts-backend . The Old Structure Everything lived in one Spring Boot app. The activity log — which tracks everything a user does in the app (expenses added, limits changed, logins, account changes) — was tangled up with the core business logic. Adding a new type of activity meant touching the same codebase responsible for transactions, security, and everything else. The New Structure finovara-backend/ ├── api-gateway/ ├── activity-log-backend/ ├── contracts-backend/ └── core-backend/ Four modules (there will be more). Each with a clear responsibility. API Gateway The gateway is the single entry point for every request coming from the frontend. It runs on port 8888 with SSL enabled and uses Spring Cloud Gateway (WebFlux-based). Routing is simple and declarative: routes : - id : activity-log-backend uri : ${ACTIVITY_LOG_URL} predicates : - Path=/api/account-activity/**,/api/archive-activities/** - id : notification-backend uri : ${NOTIFICATION_BACKEND_URL} predicates : - Path=/api/notification-settings/** - id : core-backend uri : ${CORE_BACKEND_URL} predicates : - Path=/** Activity log routes go to activity-log-backend . Notification routes go to notification-backend . Everything else falls through to core-backend . The gateway also handles CORS centrally — https://localhost:5173 is the only allowed origin, with credentials support. No individual service needs to worry about CORS anymore. One thing worth noting: the gateway uses use-insecure-trust-manager: true for the HTTP client. Th

At some point, a monolith starts working against you. In my case, Finovara was a single Spring Boot application handling everything (authentication, transactions, limits, piggy banks, notifications, activity logs, currency conversion) The bigger it got, the harder it was to change anything without worrying about something else breaking. So I broke it apart. This post is about the first three pieces I extracted: the API Gateway , the activity-log-backend , and a shared module called contracts-backend . The Old Structure Everything lived in one Spring Boot app. The activity log — which tracks everything a user does in the app (expenses added, limits changed, logins, account changes) — was tangled up with the core business logic. Adding a new type of activity meant touching the same codebase responsible for transactions, security, and everything else. The New Structure finovara-backend/ ├── api-gateway/ ├── activity-log-backend/ ├── contracts-backend/ └── core-backend/ Four modules (there will be more). Each with a clear responsibility. API Gateway The gateway is the single entry point for every request coming from the frontend. It runs on port 8888 with SSL enabled and uses Spring Cloud Gateway (WebFlux-based). Routing is simple and declarative: routes : - id : activity-log-backend uri : ${ACTIVITY_LOG_URL} predicates : - Path=/api/account-activity/**,/api/archive-activities/** - id : notification-backend uri : ${NOTIFICATION_BACKEND_URL} predicates : - Path=/api/notification-settings/** - id : core-backend uri : ${CORE_BACKEND_URL} predicates : - Path=/** Activity log routes go to activity-log-backend . Notification routes go to notification-backend . Everything else falls through to core-backend . The gateway also handles CORS centrally — https://localhost:5173 is the only allowed origin, with credentials support. No individual service needs to worry about CORS anymore. One thing worth noting: the gateway uses use-insecure-trust-manager: true for the HTTP client. Th

So far I've only been running openclaw agents and had a steep learning curve. "self-improvement" became a very attractive term on this journey. So I took a dive into Hermes Agent, the self-improving agent runtime from Nous Research. One of the first things I wanted to understand was a risk: what actually happens when you install a community skill? Skills are code and instructions that the agent will execute, and Hermes pulls them from an open ecosystem. So I read the install path in the source - instead of blindly trusting the docs. What I found is better than I expected in one way and structurally limited in another. What Hermes already has on board Hermes does not install external skills blindly. Every externally-sourced skill goes through a real gate before it lands on disk. In hermes_cli/skills_hub.py , the install flow is: fetch → quarantine → scan → policy decision → install or block-and-audit. The scan lives in tools/skills_guard.py and runs regex-based static analysis for known-bad patterns: secret exfiltration ( curl interpolating $API_KEY / $TOKEN / $SECRET ), reads of credential stores ( ~/.ssh , ~/.aws , ~/.gnupg , ~/.kube , and Hermes's own ~/.hermes/.env ), destructive commands, persistence, and obfuscation. If the scan blocks an install, the quarantined copy is deleted and the event is written to an audit log. This is more than most agent tooling ships with. If you remember the wave of malicious skills that hit competing ecosystems, a chunk of that class of attack would be caught here before anything ran. Someone thought about this. The part that doesn't scale imo The scanner produces a verdict — safe , caution , or dangerous . That verdict is then combined with a trust level to decide whether to install. The trust levels and their policies look like this: INSTALL_POLICY = { # safe caution dangerous " builtin " : ( " allow " , " allow " , " allow " ), " trusted " : ( " allow " , " allow " , " block " ), " community " : ( " allow " , " block " , " bloc

Every headless WordPress conversation starts the same way — someone draws an architecture diagram with arrows pointing from a REST API to a shiny Next.js frontend, and it looks clean. Too clean. This is a post about what happens when you close the whiteboard and open the actual codebase. The Stack Decision: GraphQL vs. REST vs. Direct MySQL This is usually the first fork in the road. For this build, the client already had a well-indexed WooCommerce site. The product catalog, slugs, and taxonomy structure were already doing heavy SEO work. So the constraint was simple: nothing about the data layer changes, only how we consume it. WPGraphQL was a real option — but it meant adding a plugin dependency to a WordPress install we were actively trying to slim down. The WP REST API was already there, no installation required, and exposed exactly what we needed: products, categories, pages, and media — all queryable by slug. The decision: WP REST API, consumed server-side via Next.js fetch in Server Components. // Fetching a product by slug — preserving the existing URL structure const res = await fetch ( ` ${ process . env . WP_API_BASE } /wp/v2/product?slug= ${ params . slug } &_embed` , { next : { revalidate : 3600 } } ); const [ product ] = await res . json (); No new dependencies on the WordPress side. The legacy install runs as a lean shell — no active theme, minimal plugins, just the REST API and the data. The Site Kit Problem: Bridging Familiar Workflows This is where most migrations quietly fail the client. The previous team lived inside WordPress admin. Google Site Kit gave them traffic stats, Search Console data, and Analytics — all surfaced in a UI they knew. Ripping that away and telling them "just use Google Analytics directly" is a workflow regression, not an upgrade. The pivot here was building a lightweight admin dashboard as part of the Next.js project — not a full replacement for Site Kit, but a mirror of the metrics they actually checked daily: Page views

10 Prompt Patterns I Use Every Single Day Last Tuesday I spent 40 minutes arguing with Claude about a database schema before I realized I had never told it what I already tried. I described the problem, it gave me the same three suggestions I had already ruled out, I pushed back, it apologized and gave me variations of the same three suggestions. The entire session was garbage because I started from zero instead of from where I actually was. I closed the tab, rewrote my first message, and had a working solution in six minutes. That gap — between how most people prompt and how it actually works when you treat the model like a collaborator who needs real context — is what this post is about. Pattern 1 & 2: Lead With What You Already Tried, and State the Constraint That Binds You These two patterns are almost always used together, so I won't pretend they're separate. When you describe a problem without the history of your attempts, you are forcing the model to rediscover your dead ends. Every developer knows this frustration: you explain a bug, get back a solution you tried on Monday, explain you tried that, get a variation, explain that too — it's a recursive waste. The fix is brutal honesty upfront: "I need X. I already tried A and B. A failed because [specific reason]. B is off the table because [constraint]. Don't suggest either." The constraint layer is the other half. Models are optimists by default. They will give you the architecturally clean, perfectly testable solution that requires three new dependencies and a refactor of your auth layer. Unless you tell them you are shipping in two days, can't add dependencies, and the code needs to be readable by someone who last touched Python in 2019. Constraints aren't limitations on the answer — they are the answer. Front-load them or you will spend the session rejecting suggestions that are technically correct but situationally useless. Pattern 3 & 4: Output First, Reasoning After — and Diff Only, Not Rewrites Two sid

Those ousted included ADA journal editor-in-chief Steven Kahn and former ADA president Desmond Schatz

Hey everyone, I need 12 more testers to complete the 14-day closed testing requirement on the Google Play Store for my game, Sugar Fall: A Whimsical Adventure with a Dark Twist! 🍩👻 Anyone can join immediately. Please support an indie dev! ✅ Step 1: Join the Google Group https://groups.google.com/g/cos-alpha-testing-team/ 📥 Step 2: Download the Game (Google Play Store) https://play.google.com/store/apps/details?id=com.crackorigins.sugarfall 🤝 Mutual Help: Please leave a comment below with your app links and a screenshot after downloading mine. I will test your app/game back immediately and keep it for 14+ days. Thank you so much for your support! 🙏 submitted by /u/anyboy1 [link] [留言]

Even with Lockdown Mode, ChatGPT could be still vulnerable to prompt injections, but the goal is to reduce the likelihood that sensitive data gets shared in the process.

View, monitor, and analyze 1.8M+ US jobs Discussion | Link

As a web developer, I've noticed that many beginners spend months watching tutorials but struggle when it's time to build something from scratch. That's one reason I started building WebCoDeveloper — a place where I can share practical web development knowledge, real coding examples, and solutions to problems I've faced while working on projects. My goal isn't to create another tutorial website. It's to build a resource that helps developers move from "I watched a video about it" to "I actually built it." I'm curious: What's the biggest challenge you faced while learning web development? Understanding JavaScript? React/Next.js concepts? Building projects? Finding quality learning resources? Getting your first developer job? I'd love to hear your experiences and learn what resources have helped you the most.

Every AI coding tool can write Python — Cursor, Claude Code, Windsurf. None of them can run it safely in production. That gap between "AI wrote the code" and "the code ran safely" is exactly what I'm building jhansi.io to close. This series documents the journey. One layer of the problem at a time. The execution gap When AI generates code, four things still stand between you and prod: Dependencies — Install the right packages, with versions and licenses you trust Isolation — Run it hard-sandboxed. No host access, no outbound network, no surprises Secrets — Let AI use your API keys without ever letting it see or leak them Audit — Log every execution. Prompt, code, result, timestamp. Compliance-grade. Most teams stop at step 1. Banks and fintechs can't. FCA, SOC2, and the EU AI Act require audit trails for AI actions. You can't eval() your way through an audit. jhansi.io is the missing run() for AI-generated code. Open core, cloud sandbox, built to close each part of the gap — layer by layer. The series Part 1 — Persistent sandboxes Why "ephemeral" breaks debugging, state, and compliance. The case for giving every AI a home directory. → Read Part 1 Part 2 — Dependency management (coming soon) Detecting, installing, and locking deps across Python, Node, Go, and Java. With SBOMs and policy built in. Part 3 — Isolation (coming soon) What "hard isolation" actually means. Containers, Firecracker, zero trust networking, and the metadata service attacks you haven't thought of yet. Part 4 — Secrets (coming soon) Kernel-level proxies. AI can call Stripe without the key ever entering the sandbox. Part 5 — Audit (coming soon) Who ran what, when, with which prompt. Hash-chained logs that satisfy auditors, not just engineers. Building this in public. Follow the series on Dev.to , Linkedin , and X . Code is Apache 2.0 at github.com/jhansi-io .

Aerospace completely revolutionized my workflow after 15 years of using macOS the way Apple intended. I no longer hunt for apps and windows in Mission Control or drag them around spaces to organize. I can open as many windows as I need and have them all under my fingertips. And instead of swiping around to find one, I instantly teleport to where they are. This incredible software is technically aimed at advanced users. It’s installed from the command line and offers extensive configuration options. For basic use though, you don’t need to configure it at all, and if you have opened the Terminal application before and know what running a command means, you should be good to go. Rest assured, I will not show you how to configure Aerospace with Vim, or show you how to create an elaborate but useless dashboard! Just the essentials to get you started. How to set up Aerospace Aerospace is a menu bar application, but you can’t download it from an App Store or get it as a DMG file. You need a package manager. Go to the Homebrew website and follow the installation guide. Make sure to accurately follow the on-screen instructions. This may include any of the following: A prompt to enter your password. When you type passwords in Terminal, you will not see stars or anything. Just make sure you’re typing the correct one and hit Enter. A prompt to install XCode Command Line Tools . Somewhere around the end of the installation process, you may get a prompt to run some extra commands, which depend on your system. Make sure you run them as instructed. To test if you have correctly installed Homebrew, run which brew in Terminal. If you see a path printed out, like /opt/homebrew/bin/brew , you’re good to go. If not, something has gone wrong. Try searching for other, more focused guides on installing Homebrew. With Homebrew, you can install applications from the Terminal app using the brew command. For Aerospace, you would run the following command: brew install --cask nikitabobko/tap/ae

You locked down your human logins years ago: SSO, MFA, a joiner-mover-leaver process, access reviews every quarter. The machine identities never got that treatment, and they bred. Service accounts, API keys, OAuth tokens, SSH keys, CI jobs, RPA bots, and now AI agents. In cloud-native shops these non-human identities (NHIs) outnumber people 144:1 (Entro Labs, H1 2025); even cautious enterprise-wide counts sit at 45:1. They rarely expire, nobody owns them, and SOC 2, ISO 27001, PCI DSS, and NIST 800-53 mostly leave them in a grey zone. OWASP cared enough to publish a Non-Human Identities Top 10 for 2025, and the headline risks are boring on purpose: improper offboarding, leaked secrets, over-privilege, and long-lived credentials. If someone just handed you "go govern the machine identities," here is what actually moves the needle, in roughly the order I'd do it. The tips Build one correlated inventory before you touch a single permission. The thing that kills most NHI programs on day one is partial visibility: secrets in a vault, service accounts in IAM, tokens scattered across SaaS apps, certs in a fourth place. Stop inventorying by storage location and key it by identity instead, joining each credential to an owner, a last-used timestamp, and its permissions. Start with what the cloud APIs hand you for free. # AWS: IAM users acting as service accounts + when their keys last worked aws iam list-users --query 'Users[].UserName' --output text \ | xargs -n1 -I {} aws iam list-access-keys --user-name {} \ --query 'AccessKeyMetadata[].[UserName,AccessKeyId,CreateDate]' --output text Replace static cloud keys in CI with OIDC workload identity federation. A long-lived AWS_SECRET_ACCESS_KEY or a GCP JSON key file sitting in CI secrets is the classic NHI breach path, and rotating it is a chore nobody does on schedule. GitHub Actions can trade a short-lived OIDC token for cloud access that expires in about an hour and is scoped to one job, so there's no stored secret to leak

Alzheimer's disease affects over 55 million people worldwide, yet the precise molecular changes happening inside individual brain cells remain poorly understood. I wanted to dig into that question - not at the tissue level, but at single-cell resolution. So I built a full scRNA-seq analysis pipeline in Python using Scanpy, working with a publicly available dataset of 63,608 nuclei from human prefrontal cortex tissue (sourced from CZ CELLxGENE). The donors spanned three Braak stages: 0 (cognitively normal), 2 (early Alzheimer's), and 6 (severe Alzheimer's). Here's what I found and how I found it. The Dataset The data came from a study on the molecular characterisation of selectively vulnerable neurons in AD. It covers the superior frontal gyrus, a prefrontal region known to be hit hard by neurodegeneration - and includes seven major brain cell types: Glutamatergic neurons GABAergic neurons Oligodendrocytes OPCs (oligodendrocyte precursor cells) Astrocytes Microglia Endothelial cells 31,997 genes. 63,608 cells. Three disease stages. A lot to work with. The Pipeline 1. Quality Control No dataset is clean out of the box. I filtered cells to keep only those with between 200 and 6,000 detected genes, and excluded anything with more than 20% mitochondrial gene content (high mitochondrial reads usually signal a dying or damaged cell). This removed around 2,809 low-quality cells. 2. Normalisation Library sizes were normalised to 10,000 counts per cell, followed by log1p transformation, standard practice that makes cells comparable regardless of how deeply they were sequenced. I then identified 5,607 highly variable genes to focus the downstream analysis. 3. Dimensionality Reduction PCA (50 components) → neighbourhood graph (10 neighbours, 20 PCs) → UMAP embedding. The UMAP is where the biology starts to become visible. All seven cell types separated into distinct clusters, with clear separation between neuronal subtypes and glial populations. 4. Differential Expression For t

How Reinvoice Uses HMAC Signatures to Detect Invoice Tampering Every invoice sent through Reinvoice includes a cryptographic integrity signature. It is not a PDF stamp, a visual badge, or a checkbox. It is an HMAC-SHA256 hash generated from the invoice payload and a server-side signing secret. If signed invoice data changes after creation, Reinvoice can recompute the hash, compare it to the stored signature, and flag the invoice as potentially tampered with. Here is why we built it, how it works, and what we learned. Why Integrity Checks Matter for Invoicing Invoices are high-value documents. A single altered field could change a payment amount, tax calculation, client record, or audit trail. Most invoicing systems treat invoices as ordinary database records. That works for normal CRUD workflows, but it does not automatically prove that the invoice data being viewed today is the same data that was created and sent. Reinvoice adds an integrity layer. When an invoice is created, we sign the fields that define the invoice. Later, when someone verifies the invoice, we recompute the signature from the current data and compare it against the original stored signature. If the values do not match, the invoice is flagged. The Implementation The signature is stored in two places: on the invoice record in the database, and behind a public verification endpoint. import { createHmac , timingSafeEqual } from ' node:crypto ' ; const SIGNATURE_FIELDS = [ ' invoiceNumber ' , ' issuerName ' , ' clientName ' , ' totalAmount ' , ' currency ' , ' taxAmount ' , ' issuedAt ' , ' dueDate ' , ' lineItems ' , ' notes ' , ' subtotal ' , ' discountAmount ' , ' shippingAmount ' , ] as const ; export function generateInvoiceHash ( invoice : InvoiceData ): string { const payload = SIGNATURE_FIELDS . map (( field ) => { const value = invoice [ field as keyof InvoiceData ]; return ` ${ field } = ${ JSON . stringify ( value )} ` ; }). join ( ' | ' ); return createHmac ( ' sha256 ' , SIGNING_SECRET )

Hey DEV community! 👋 I built IMGVO — a free image tool that works entirely in your browser. What it does Convert JPG, PNG, WebP, AVIF, HEIC and more Compress images up to 90% without quality loss Crop, resize, rotate, watermark Works offline (PWA) Why I built it Most image tools upload your files to servers. I wanted something private and instant. Tech 100% vanilla JavaScript No backend, no server Works offline as PWA Privacy first No files uploaded to any server. Everything runs locally in your browser. 🆓 Free, no signup required. 👉 Try it: https://imgvo.com Would love your feedback! 🙏

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. Large Language Models have made it surprisingly easy to generate text. Building a reliable AI application, however, is a completely different problem. Once you move beyond a simple "send prompt, get response" demo, you quickly encounter real-world concerns: Prompt management Structured outputs Multi-step workflows Tool calling Observability Evaluation Model switching Production debugging Many teams end up creating custom frameworks around OpenAI, Anthropic, Gemini, or local models just to manage these concerns. This is where Genkit comes in. Originally developed by Google, Genkit provides a framework for building AI-powered applications with a focus on workflows, tooling, observability, evaluation, and production readiness. While most examples online focus on Node.js, Genkit now has growing support for Go, making it an interesting option for backend engineers who want AI capabilities without introducing an entirely separate application stack. In this article we'll build practical examples and explore how Genkit helps structure real-world AI systems. Why Genkit Exists Most AI applications evolve like this: Phase 1: response := callLLM ( prompt ) Everything seems simple. Phase 2: You need: Retry logic Prompt versioning JSON outputs Tool integrations Tracing Metrics Human review workflows Now your codebase starts accumulating AI-specific infrastructure. Genkit attempts to provide these building blocks from day one. Think of it as: "Spring Boot for AI workflows" rather than "an LLM SDK." Installing Genkit for Go Create a new project: mkdir genkit-demo cd genkit-demo go mod init github.com/example/genkit-demo Install Genkit: go get github.com/firebase/genkit/go/ai Depending on your provider, you'll also install provider plugins. For Gemini: go get github.com/fi

Apple's WWDC nears: Here's what you can look forward to.