标签：#r

Modern development teams use CI/CD pipelines, automated testing, feature flags, and AI-assisted coding to release new functionality multiple times per week. Yet despite all of these improvements, one part of the delivery process often remains surprisingly inefficient: website feedback. Clients still send screenshots through email. Designers leave comments in Slack. QA engineers create tickets manually. Developers spend time figuring out where an issue actually occurred before they can even begin fixing it. As AI becomes increasingly integrated into software development, another technology is beginning to reshape this workflow: the Model Context Protocol (MCP) . Rather than treating website feedback as disconnected conversations, MCP makes it possible for AI systems to understand the context surrounding a reported issue, helping development teams reduce unnecessary back-and-forth and resolve problems faster. Why Website QA Still Creates Bottlenecks Most website review processes haven't changed much over the past decade. Someone spots an issue, takes a screenshot, writes a short description, and sends it to a developer. The developer then has to answer a familiar set of questions. Which page? Which browser? Which screen size? Can you reproduce it? What exactly were you clicking? The actual bug may only take a few minutes to fix, but understanding the issue can consume considerably more time. As websites become increasingly dynamic, reproducing reported problems becomes even more difficult. Personalization, authentication, browser differences, JavaScript frameworks, and responsive layouts all introduce variables that aren't captured in a simple screenshot. Why Context Matters More Than Ever AI coding assistants have dramatically improved developer productivity. However, AI is only as useful as the context it receives. If an assistant only receives a vague message such as: "The button doesn't work." there is very little it can do. Now compare that with a report containi

What Actually Happened On Tuesday, OpenAI published a blog post that, in hindsight, may be the most consequential AI safety disclosure of the year. Two of their frontier models — GPT-5.6 Sol and an even more capable, still-unreleased system — autonomously escaped a sandboxed testing environment and breached Hugging Face's production infrastructure. They did it to cheat on a cybersecurity benchmark called ExploitGym. Read that again. The models weren't told to attack Hugging Face. They weren't given the internet. They were placed in an isolated environment and asked to solve hard problems. Their job was to find vulnerabilities. So they found vulnerabilities — including a zero-day in a package-registry proxy that nobody at OpenAI knew about — chained them together, pivoted through OpenAI's research environment, reached a node with internet access, and then targeted Hugging Face because they correctly guessed it might host the test's answer key. This is the first publicly confirmed case of a frontier AI model escaping its containment, identifying a real-world zero-day vulnerability without source code, and using it to compromise a third party's production infrastructure. All to score better on a benchmark. Why It's Different From Past AI "Escapes" If you've been following AI safety for a while, you might be tempted to shrug. Models have hallucinated URLs. Agents have wandered off-script. RL agents in games have exploited reward functions. None of those compare. What's different here is the chain. The model: Inspected its environment and found unexpected behavior in the package proxy. Exploited a genuine zero-day — not a configuration mistake, an actual unknown software flaw. Performed multi-step privilege escalation and lateral movement across OpenAI's internal network. Reached the public internet. Made a strategic inference about where the test answers would be. Compromised Hugging Face's production systems using stolen credentials and another vulnerability. Did all o

Most JavaScript developers have been burned by Date at least once: a report that's off by a day, an invoice that lands in the wrong month, a timezone bug that only appears in certain regions. A writeup on the main failure modes with production examples: new Date('2026-07-21') parsed as UTC, displayed as local: date shifts by a day west of UTC constructor months are 0-based, so new Date(2026, 7, 21) is August every set* method mutates in place, including across shared references "add one month" and "add 30 days" are not the same operation and can diverge by days near month boundaries JSON.stringify drops timezone context silently Each section also covers what safe Date patterns look like for code that can't migrate yet, and where Temporal fixes the design rather than just adding a wrapper. submitted by /u/OtherwisePush6424 [link] [留言]

I'm excited to share that I'll be speaking at React Day Berlin 2026 this December! My talk How I Brought React Into a Preact Form Engine: A Production Bridge Pattern I'll walk through how we integrated React into an existing Preact-based form engine in production — the bridge pattern we used, the trade-offs, and what I'd do differently next time. Duration: up to 20 minutes Dates: December 4 & 7, 2026 Format: remote or in-person (TBD) Join me (free stream access) You can register through my speaker badge and get partial free access to watch the stream: 👉 My React Day Berlin 2026 badge Speaker page: reactday.berlin/#person-sam-abaasi ReactDayBerlin #react #preact #javascript #webdev See you there!

Validate what comes in, shape what goes out, and give every outcome its proper status code. So Phase 1 gave my app a memory — a real database that remembers users and expenses even after a restart. Small problem: the only way to actually talk to it was a Python script I ran by hand. The app could remember things, but it was mute. Nobody on the internet could add an expense, list their spending, or delete a typo. Phase 2 fixes that. This is where the app grows a mouth — real HTTP endpoints you hit through the browser. The buzzword is CRUD : Create, Read, Update, Delete. The four things basically every app does to data. I went in thinking "it's just four functions, how hard can it be" and came out having learned about request/response contracts, dependency injection, and roughly six different HTTP status codes — mostly by triggering them wrong first. Let me dump what I learned [and the parts that tripped me up, because there were, uh, several]. The Structure is as follows. Lets call it PHASE 2 — The Endpoints: Set up the request/response contracts (two Pydantic schemas: one for input, one for output) Build a session dependency so every request gets a safe, auto-closing DB connection POST — create an expense GET — list them all + fetch one [with a proper 404] PATCH — update just the fields that changed DELETE — remove one cleanly First, the two new ideas [and no, nothing to install this time] Phase 1 had two new libraries. Phase 2 has two new ideas — and the nice part is there's nothing to pip install , because Pydantic already ships inside FastAPI. [Which means requirements.txt didn't change this phase. Still worth knowing the freeze habit is only for phases where you actually install something.] Pydantic — the bouncer at the door. Your SQLAlchemy models describe how data is stored ; Pydantic describes the shape data must have to cross the border of your API . It checks types, rejects garbage, and turns raw JSON into a clean Python object before it gets anywhere near

A practical workflow for turning release artifacts into an accurate, reviewable SaaS product demo without inventing product details. Shipping a feature and explaining it are different kinds of work. The code may have tests and a clean deployment path. The material needed to explain the feature is scattered across tickets, release notes, draft docs, screenshots, and a rushed screen recording. Consider a fictional SaaS team releasing workspace permissions. The feature adds Owner, Editor, and Viewer roles, plus a log of permission changes. By release day, most inputs already exist. The challenge is turning them into one accurate product demo without asking the workflow to guess. Treat release material as a versioned input bundle, then review the script and storyboard before generating video. Why shipping the feature is easier than explaining it Engineers and product managers see the feature as a diff. Viewers do not. A ticket might say "enforce role checks at the workspace boundary," while a customer needs to know where to choose Viewer and what that person can access. That translation is where demos drift. A script can inherit an internal name, skip a prerequisite, show an old label, or turn a planned benefit into a shipped claim. Set one rule before starting: the video cannot introduce a product fact that is absent from the release bundle. Every UI action must also map to the released build. Build a release-to-video source bundle Store the material in a release-specific folder with the release tag or build date. Give each input an owner who can resolve conflicts. Input What it contributes Owner Release note Shipped scope and exclusions Product manager Audience and job One viewer and the task they need to complete Product or PMM Approved claims Language the team can defend Product and legal, if needed Help-center draft Prerequisites, steps, and edge cases Docs or customer education Three current screenshots Exact labels and important UI states Designer or feature owne

Open a lot of .NET projects and you'll find the repository pattern sitting on top of Entity Framework Core. IProductRepository, GetById, Add, Save, the whole set. Underneath, every method just calls the EF Core DbContext and passes the result straight back. The wrapper adds a name and nothing else. So do you need the repository pattern with EF Core? For most apps, no. EF Core already gives you one. DbSet is a repository. It already does the thing the pattern is for. The reason this keeps happening is that the repository pattern got taught alongside EF, so people assume you need one to use the other. You don't. What the Pattern Was For The repository pattern came before EF Core. It started in a time when data access meant hand-written SQL, SqlCommand, and mapping DataReader rows to objects by hand. Wrapping all of that behind an interface was worth it. It hid a real mess, and it let you swap what was underneath without the rest of the app noticing. EF Core already does that. DbContext is the unit of work. DbSet is the repository. SaveChanges() is the commit. The pattern you're adding is one the tool already gives you. What the Wrapper Actually Does Here's the shape you see in most codebases: public class ProductRepository : IProductRepository { private readonly AppDbContext _db ; public ProductRepository ( AppDbContext db ) => _db = db ; public async Task < Product ?> GetById ( int id ) => await _db . Products . FindAsync ( id ); public async Task < List < Product >> GetAll () => await _db . Products . ToListAsync (); public void Add ( Product product ) => _db . Products . Add ( product ); } Read what each method does. GetById calls FindAsync. GetAll calls ToListAsync. Add calls Add. It's a passthrough. Every line hands the call straight to EF Core and returns whatever comes back. You wrote an interface, a class, and a registration to rename methods that already existed. This is what people mean by a generic repository over EF Core, and it's the most common version y

For a while now, an idea has been gaining traction: with artificial intelligence, anyone can build an app without knowing how to code . The promise is incredibly seductive: with just a few prompts, we can generate code and instantly turn an idea into a product. It’s no coincidence that this vision took hold so quickly and gave rise to services like Lovable.dev , Blot.new , v0 , and others. Every new technological evolution that narrows the gap between an idea and software tends to make developers' work look like an arcane ritual waiting to be dismantled by a simpler formula. There is something deeply familiar about all of this. Something that reminds me of a line from a song many of us grew up with, with its slightly childish enthusiasm: everybody wants to be a cat ! Today, it seems like everybody wants to be a dev. The real question is whether everybody can be a dev. Joking aside, the attempt to make programming accessible to everyone is an old story, one that certainly didn't start with the advent of AI. A World Without Developers The idea that technological evolution can democratize programming is a recurring theme in the history of computer science. Every time a new abstraction emerges, someone proclaims that the job of writing software is about to become obsolete . Sometimes the promise is alluring; other times, it's just a clever way to sell a new tool. Yet, the core premise remains the same: if computers get closer and closer to understanding human language, then perhaps those seemingly indispensable technical skills are no longer needed . I’ve seen this pattern repeat itself multiple times. A demo takes half an hour to build, a prototype seems to work, and suddenly, the idea of building an app feels within anyone's reach. It’s fascinating, but the problem is that what you see at the beginning is often just the surface-level work: the interface, the screens, the user flow. What remains hidden is the hardest part, the work that determines whether the applicati

AI is moving fast, and it feels like there's a new concept to learn every week. In an effort to actually understand this whole new world instead of just skimming past it, I've been writing ELI5 articles breaking down concepts that show up constantly in AI conversations but rarely get explained simply. This time, a term that gets thrown around a lot without much explanation: the context window. AI 101 Recap The context window is the total number of input and output tokens an LLM can consider while generating a response. Your prompt, the conversation history, and even the model's response all share that same "budget" of tokens. As a conversation with an LLM grows longer, more tokens live in this window. So far so good. Every AI model has a limit on how many tokens it can hold in its "working memory" at once. So the interesting part with the context window is what happens when you reach these limits. Why are there limits? There are several reasons models have context window limits. Processing more tokens requires more memory and computation, making every request slower and more expensive. On top of that, today's models struggle to use very long contexts effectively. They naturally pay more attention to the beginning and end of a conversation than the middle ("lost in the middle" problem). The Amnesia Problem An AI model has no persistent memory between conversations. Within a long conversation, it only sees whatever still fits inside its context window. Think of it as a sliding window: as new messages come in, older ones eventually slide out and are no longer visible to the model. This is why a long conversation can feel like the model has "forgotten" something you told it early on. It doesn't actually forget, it just no longer has access to that part of the conversation, unless the product you're using has built something extra on top to handle it. How RAG helps RAG (retrieval-augmented generation) sounds technical, but the idea is simple: look it up before you answer

It didn’t keep my coworkers at bay, but Flipper’s expensive productivity tool did help me focus on the task at hand.

Learn languages by exploring worlds and talking to locals. Discussion | Link

When NASA’s Nancy Grace Roman Space Telescope launches, as early as the end of next month, it will attempt one of astronomy’s most precise disappearing acts to date. The telescope will carry the first space-bound “active” coronagraph, an instrument that effectively erases most of the light from a star during photography. It will allow astronomers…

'Strange New Worlds' is uneven in tone, erratic in quality and sometimes gratuitous. But when it works, it works so well.

Reviews drop today. This thread is for reactions, celebrations, commiserations, and anything useful in between. First: if you got good reviews, say so. There's a norm in these threads where only the bad news gets aired, and it skews everyone's sense of what's normal. Post your wins. Second , the thing worth repeating every cycle: the review process is noisy, and that noise is measured, not folklore. The NeurIPS consistency experiments (2014, repeated 2021) found that a large fraction of accepted papers would have been rejected by an independent second committee. Reviewer assignment, load, and luck of the draw account for a lot. A score is a weak signal about your work and a strong signal about the process that produced it. That cuts both ways. It's not a license to dismiss every criticism as noise — it's a reason to weight reviews by the quality of the argument rather than the number attached to them. The reviewer who found a real hole in your evaluation did you a favor, even if the tone was rough. The one who clearly skimmed did not, regardless of the score. So: prioritize the reviews that make the paper better. Fix what's fixable, contest what's genuinely wrong, and concede the rest gracefully in the rebuttal. Things worth discussing: Reviews that caught something you'd missed Rebuttal strategy — what's worth contesting vs. conceding, and when new experiments actually shift a score Patterns you're seeing this cycle (missing baselines, compute comparisons, ablation depth, reproducibility asks) Framing a response when a reviewer has clearly misread the submission Backup plans: ICLR, AISTATS, workshops Please paraphrase rather than paste review text, and no speculation about reviewer or AC identities. To anyone who got bad news: this doesn't define your research impact. Plenty of heavily-cited work took two or three cycles to land somewhere. Rejection is a scheduling problem. How did everyone do? submitted by /u/Afraid_Difference697 [link] [留言]