标签：#r

I'm a long-time macOS user and I just want a change. Curious what people here actually use every day and what made you stick with it. Curious if you also switched from a Mac too. I'd like to get out of the "walled garden" ecosystem.

Shashua has been invited to take the chairman of the board seat.

Repo-native memory for coding agents Discussion | Link

TL;DR Croc GUI is a free desktop app for schollz/croc — encrypted peer-to-peer file transfer with drag-and-drop, QR codes (via getcroc.com ), and LAN mode. macOS, Windows, Linux. MIT licensed. Download: GitHub Releases Why I built this I send files with croc constantly. End-to-end encrypted, cross-platform, no vendor cloud. The CLI is perfect — until you're helping someone who doesn't have a terminal open. Croc GUI is the Send/Receive desktop app I wanted: same croc binary, clearer UX. What it does Send — drag files/folders, get a code phrase + QR link Receive — paste a code, pick a download folder Share — copy phrase, getcroc.com URL, or full croc … command Local-only — croc --local for LAN peers Zip — pack on send, unpack helper on receive Options — relay, port, proxy, overwrite, auto-confirm What it doesn't do Reimplement croc's crypto or protocol Upload anything to a GUI-specific cloud Claim to be an official schollz project Transfer engine: schollz/croc . Please sponsor schollz . Stack UI: React + TypeScript Shell: Tauri 2 (Rust) Engine: bundled croc binary per platform Dev quick start git clone https://github.com/interfluve-wav/croc-gui.git cd croc-gui/gui npm install npm run bundle:croc:download npm run tauri:dev Try it Platform Installer macOS (Apple Silicon) Croc_* (Apple Silicon).dmg macOS (Intel) Croc_*_x64.dmg Windows Croc_*_x64-setup.exe Linux .deb or .AppImage ⭐ Star on GitHub · 🐛 Issues

You built something. Tests pass. You're days from mainnet. Before you either skip security entirely (please don't) or spend weeks lining up a full audit, here's a self-check you can run in 20 minutes that catches the mistakes I see most often in first-time deployments. I run security reviews for small and new protocols, and the same handful of issues come up again and again. None of these need a tool — just your eyes and this list. 1. Who can call what? Open every external / public function that moves funds, mints, pauses, or upgrades. For each, ask: should a random address be able to call this? If not — is there an onlyOwner / onlyRole / require(msg.sender == ...) guarding it, in the function itself or in every internal function it calls? The classic bug isn't a missing modifier. It's a function that looks unguarded but delegates to a guarded internal one (fine), or one that looks guarded but the guard is in a branch a caller can skip (not fine). Trace the call, don't trust the signature. 2. The first-depositor trap (if you have a vault) If you mint shares from deposits (ERC-4626 or anything share-based), the first depositor can sometimes donate assets directly to the contract to inflate the share price, so the second depositor rounds down to zero shares and loses funds. Fix: virtual shares, a dead-shares mint at deploy, or a minimum-liquidity lock. OpenZeppelin's ERC-4626 handles this out of the box — a hand-rolled vault usually doesn't. 3. Reentrancy — but only the real kind Not every external call is reentrancy. It's a bug when an attacker-controlled call can re-enter and corrupt shared storage before you've updated it. Quick checks: Do you update state before the external transfer (checks-effects-interactions)? Is there a nonReentrant on functions that move value? Is the call target a trusted, immutable contract, or an arbitrary address the attacker supplies? A call to a protocol-owned contract, or a memory /local variable written after the call, is usually not

Claude Opus/Sonnet Voice Mode, Open-Weight Model Cost Savings, & GitHub AI Agent Security Today's Highlights This week's top stories focus on major commercial AI model updates, practical tools for cost-effective LLM deployment, and critical security vulnerabilities in AI-powered developer tools. Anthropic expands its multimodal voice capabilities to more powerful Claude models, while a new 'Show HN' project promises significant cost reductions with open-weight models. Claude’s voice mode is now available for Opus and Sonnet (The Verge AI) Source: https://www.theverge.com/ai-artificial-intelligence/970065/anthropic-voice-mode-claude-opus-sonnet-haiku-ai Anthropic has rolled out its voice mode capability to its more powerful Claude Opus and Sonnet models, extending a feature previously exclusive to the faster, lighter Haiku model. This enhancement allows developers to integrate advanced multimodal conversational AI into their applications, enabling real-time voice interactions with a higher degree of intelligence and nuance than previously possible. For instance, developers can now build voice agents that not only understand complex spoken queries but also provide sophisticated, context-aware responses, leveraging the deep reasoning and comprehensive knowledge base of Opus and Sonnet. This update significantly expands the potential for developers to create more natural and intuitive user experiences across various domains, from customer service and educational tools to interactive creative assistants. By making Opus and Sonnet accessible via voice, Anthropic is addressing a key demand for richer human-computer interaction, pushing the boundaries of what commercial AI APIs can offer in terms of multimodal capabilities. This move facilitates the creation of next-generation applications where seamless voice interaction is paramount, without sacrificing the underlying intelligence of the AI model. Comment: This is a huge step for building more capable voice-first applicat

Hi all, I've been on parental leave and while working on my garage door, I thought to myself... it would be great to open up this garage door from my phone without having to buy a bunch of expensive stuff. That snowballed into, I want the garage door buttons on my car's rear view mirror to trigger automations in home assistant. I went down a bit of a hardware rabbit hole and wrote a little writeup of my journey and a how-to. It's my first piece of public technical writing so I'm open to any feed

Many databases use B+tree indexes, but they all differ. It's a sorted structure. The leaf pages are logically sorted so that a specific key value belongs to one page. A lookup by value reaches a single leaf page and either directly finds an entry for that value or immediately knows there's no entry with that key. When a page becomes full, it is split into two pages, each covering its own dedicated range. To find the right page, an internal page holds the range of values for the pages below. This internal page can become full, and a new level is added above it. Finally, at the highest level, there's a single internal page that is the root. A lookup always starts at the root and goes down to the leaves, following the branches of internal pages. In a traditional B+tree lookup, the cost is proportional to the height of the tree because the search starts at the root and descends to a leaf: 1 page to read when all fits in one leaf that is also the root (0 levels of internal pages, total height is 1). With small keys, this level can typically index hundreds of rows. 2 pages to read when there's one root that can list all leaf pages (1 level of internal page, total height is 2). With small keys, this level can typically index tens or hundreds of thousands of rows. 3 pages to read when there's one level of branches under the root (so 2 levels of internal pages, total height is 3). With small keys, this level can typically index millions of rows. This means that finding one key within ten million rows may require traversing 3 index pages, where most of them are probably in cache given the small number of branches compared to the leaves. For a given index size, whatever the value you are looking for, it's always the same number of pages to read because the index is balanced (the commonly accepted meaning of the B in B+tree). This property is maintained because any page can split, but only splitting the root adds another level. I've described how the height of an index can incr

Ever chased a bug for days, only to discover the "bug" was actually the platform working exactly as designed? That happened to me building a client reporting pipeline. The lesson stuck. Here's what nobody tells you about pulling marketing data from multiple ad platforms: the hard part was never the dashboard. It was everything underneath it. The Setup That Looked Simple on Paper The brief sounded easy. Pull spend, clicks, and conversions from Google Ads and Meta. Store it. Display it in a chart. A junior dev could knock this out in a sprint, I figured. Reality disagreed. Google Ads API enforces operation quotas per developer token, and those quotas scale differently depending on account tier. Meanwhile, Meta's Marketing API throttles based on a rolling usage score tied to the ad account itself, not your app. Two platforms. Two completely different throttling philosophies. Neither documented in a way that made the actual limits obvious until you hit them in production. Where Things Actually Broke My first version polled every client account every hour. Fine for three clients. Then we onboarded client number twelve, and Meta started returning 429s intermittently. Not consistently — intermittently. That's the worst kind of bug. I initially assumed it was a code issue. Retry logic, maybe a race condition in my job scheduler. I spent three weeks going down that path. Eventually, I found the real cause: cumulative API call volume across all client accounts was tripping Meta's app-level rate limit, not the individual account limit. The fix wasn't more retries. It was a request queue with exponential backoff, plus a priority system so active dashboards refreshed before idle ones. Simple in hindsight. Expensive in dev hours. The Real Architecture Behind Multi-Platform Reporting If you're building this yourself, here's what a production-grade pipeline actually needs, based on what broke for me. A Queue, Not a Cron Job Don't just fire off API calls on a schedule and hope for t