标签：#t

Every AI code review metric you track measures the hour before merge, and that is precisely the hour when the least information exists. Acceptance rate, test pass rate, and review approval all describe how a patch looked in isolation, not how it behaves under real traffic. Revert rate is the only signal that arrives after the system has voted, which makes it the least gameable number in your pipeline. This article argues that you should stop celebrating AI patch acceptance and start measuring how many of those patches come back. Why the pre-merge metrics lie A green test run proves that a patch fits the expectations you encoded last quarter, not the behavior your users will hit tomorrow. Reviewers approve diffs under time pressure, and a cleanly formatted AI patch reads as competence even when its logic is wrong. The merge is where the real evaluation begins, and the revert is the only verdict that carries operational weight. Nobody plans a revert, so the metric cannot be gamed by prompt tweaks or review theater. The argument is not that pre-merge review is useless; it is that pre-merge signals saturate quickly. Once your review gate catches the obvious failures, the remaining defects are exactly the ones that look fine in review. Those defects surface as incidents, hotfixes, and reverts, which means your post-merge telemetry is the only source of new information. Treating acceptance as a quality metric is like judging a deployment by how well the rollout script ran. The artifact: a revert attribution watch The workflow below attributes every revert commit to the patch that caused it and computes a per-source revert rate. It requires only a git history, which makes it reproducible on any repository that has survived a few incidents. Run it on a local clone first, because a read-only analysis should never touch shared state. Step 1: List every revert commit in your window. git log --all --since = "90 days ago" --grep = "^Revert " --format = "%H %s" Step 2: Extract th

In the fast-paced world of software development, every second counts. Seamless tool interaction is not just a convenience; it's the bedrock of high developer productivity . Even seemingly minor hitches, like a non-functional 'copy link' button, can subtly erode efficiency, leading to frustration and lost time. A recent GitHub Community discussion highlighted just such an issue, where a user reported that the 'Copy link' button in Pull Requests (PRs) was consistently failing, specifically when using the Arc browser on macOS. This isn't merely about a broken button; it's a window into the complex interplay between browsers, web APIs, and the essential tools we rely on daily. The Reported Problem: A Month-Long Frustration The original post by vovapyc detailed a persistent problem: the 'Copy link' button in GitHub PRs had been broken for at least a month. The user specified their setup: Arc browser, MacBook Pro M1 Pro, and macOS 26.2. For dev teams, product managers, and delivery leads, a recurring point of friction like this, preventing a quick share of a PR link, represents a tangible drag on workflow. Imagine the cumulative time lost across a team if every developer had to manually copy URLs from the address bar multiple times a day. GitHub's automated response, while a standard and necessary part of their feedback loop, acknowledged the feedback and assured the user that their input would be reviewed. However, it didn't immediately offer a solution or explanation for the bug, leaving the user, and potentially others experiencing similar issues, in limbo. Diagram illustrating the three gates: Secure Context, Document Focus, and User Permission, that must be passed for the Clipboard API to function.## The Expert Insight: It's Likely the Browser, Not GitHub The true insight, and the crux of this discussion, arrived from hoangperry . Their comprehensive breakdown suggested that the issue was almost certainly browser-specific rather than a core GitHub bug. This distincti

Rank tracking tools love to notify you the instant a number changes. We deliberately don't — our drop alert only fires once an app falls 10 spots or more between two measurements. The tempting, wrong version A 1-spot threshold sounds like the more attentive product. In practice it turns every notification channel into noise: App Store search rank has real day-to-day jitter that has nothing to do with anything you did — a competitor's own rank shifting, a re-index, sampling timing. Alert on every 1-spot move and within a week the alert is something people mute, which defeats the entire point of having one. Why 10, specifically 10 spots is large enough to almost never be pure noise and small enough to still catch a real problem while it's still cheap to fix — a keyword field edit, a screenshot swap, a review-response push. Wait for a 30-spot collapse before alerting and you've waited past the point where the fix is simple. The threshold is symmetric: the same 10-spot rule fires on a jump upward, so a keyword field change you made on purpose gets confirmed by the same mechanism that would have warned you if it went the other way. The trade-off we're making explicit This means small real movements — 3 spots, 5 spots — genuinely don't page anyone. That's intentional, not a limitation we're hiding: an alert system tuned to catch everything catches nothing anyone still trusts by week three. A threshold set high enough that every alert is worth opening is worth more than a lower one that trains you to ignore your own notifications. If you're building anything similar — uptime, price, rank, any noisy time series — the question worth asking isn't "how sensitive can I make this," it's "what's the smallest move that's still cheaper to catch early than to catch late." That number is rarely 1. We build Storelift , where this threshold governs both the in-app alert and the rank-drop email.

¿Tu equipo comparte credenciales por Slack? ¿Discuten arquitectura en herramientas que almacenan todo en servidores de terceros? Existe una alternativa que no depende de ninguna nube: NETO . ¿Qué es NETO? NETO es un chat peer-to-peer diseñado para equipos de desarrollo que trabajan en la misma red local. No hay servidores centrales, no hay cuentas, no hay datos saliendo de tu oficina. Abres el navegador, y ya estás comunicándote con tu equipo. ¿Cómo funciona bajo el capó? La arquitectura de NETO combina tres tecnologías clave: mDNS (Multicast DNS): Permite el descubrimiento automático de peers en la red local sin necesidad de configurar servidores DNS ni registrar direcciones manualmente. Tu equipo aparece de forma instantánea. WebRTC: Establece conexiones directas entre navegadores. Los mensajes viajan de punto

A free server is a data boundary decision, not a cost decision. Every prompt you send to a managed endpoint leaves your network. For a coding agent, that means source code, environment variables, and internal architecture notes travel to someone else's infrastructure. The question is not whether the endpoint is trustworthy; the question is whether you can make the boundary explicit. MonkeyCode's free server option is generous in tokens and removes the ops burden of self-hosting. Disclosure: This article was prepared as part of MonkeyCode's product outreach. But generosity does not change the physics of data flow. The moment your agent calls a remote endpoint, the prompt is out of your control. What you can control is what goes into the prompt. This article is a practical guide to building a privacy gate between your agent and a free server. The gate is a local proxy that sanitizes prompts, redacts secrets, and logs every request. It does not make the server trustworthy; it makes your exposure measurable. The threat model Before writing code, define what you are protecting. For most teams, the sensitive material in prompts falls into three categories: hardcoded credentials, proprietary code snippets, and internal names or URLs. Each category has a different risk profile. Credentials are the worst. A leaked API key in a prompt is a direct compromise. Proprietary code is a legal and competitive risk. Internal names are subtler: they reveal architecture and naming conventions that an attacker can use for phishing or targeted attacks. A free server does not automatically read or store your prompts, but you cannot verify that. The boundary you build must assume the server is an untrusted observer. That assumption drives the design. The privacy gate The gate is a small FastAPI service that sits between your agent and the free server. It accepts OpenAI-compatible requests, rewrites them, forwards them, and returns the response. The rewriting step is where the boundary is en

By Michael Nocito , data analyst · Published August 9, 2026 By the end of this page you can turn a chart that says E, W, N and S into one that says East, West, North and South, in about thirty seconds, without editing the data or writing a calculation. You'll also know exactly why the Aliases option is missing on some fields, which is the part that sends people looking for a workaround they don't need. It's about ten minutes. Here's the move. Right-click a dimension in the Data pane, choose Aliases, and type the name you want beside each value. The chart updates, the stored data doesn't change, and every view built on that field picks up the new labels. The short version: an alias renames the members of a discrete dimension. Only discrete dimensions have members, which is why measures, dates and continuous dimensions can't have one. An alias sits in a specific place, between what's stored and what's shown, and that placement explains everything else here. So it gets the picture. The original carries a diagram here. In words: Three stacked panels connected left to right. The left panel is labeled stored and holds four small cells reading E, W, N and S. The middle panel is a narrow vertical band labeled alias, holding four arrows. The right panel is labeled shown and holds four cells reading East, West, North and South. A solid arrow runs from the stored panel through the alias band to the shown panel, indicating the direction labels travel. A second arrow attempting to run backwards from the shown panel to the stored panel is crossed through with a heavy X, showing that renaming the label never changes the stored value. The stored cells still read E, W, N and S after the change. This is on the certification. Aliases sit in Section 2, Exploring and Analyzing Data, which is 37% of the Tableau Desktop Foundations exam and the largest section on it. The questions people get wrong are almost always about which field types accept an alias, which is section 2 below. 1. What

The decision between a free hosted AI coding server and a self-hosted stack is rarely about price. It is about three measurable variables: token burn per task, latency tolerance, and privacy surface. Teams that compare sticker prices pick wrong. Teams that measure these variables pick right most of the time. This guide provides a decision table, a token budget script, and a one-week audit workflow. The framework applies to any free AI coding tier. The examples use MonkeyCode, an open-source AI coding assistant whose free tier includes model access and a hosted server with a 10M token allowance at the time of writing. Quotas and model availability change, so verify the current limits before relying on them. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Why Sticker Price Is the Wrong Variable Free sounds better than paid. It is not always cheaper. A free server that burns 40,000 tokens on a task a local model handles in 8,000 tokens costs more in time, context, and rework. The real unit of comparison is tokens per completed task, not dollars per month. Self-hosting has the same trap. A GPU that already sits in the office looks free. Add power, cooling, maintenance, and the engineer who keeps the stack alive, and the hourly cost becomes visible. The comparison needs one model that accounts for both sides. The Three Variables That Decide Token burn per task Refactors and test generation consume more tokens than single-file edits. The number varies by model, context length, and repository size. Most teams never measure it. That is the first mistake. A 10M allowance sounds large until a monorepo context window eats a meaningful slice of it on every request. Latency tolerance Interactive coding needs fast first-token time. Batch tasks like code review or documentation generation tolerate seconds of delay. A free hosted server usually sits between the two. Teams that treat all tasks as interactive overestimate latency risk. Teams that treat

👋👋👋👋 Looking back on your week -- what was something you're proud of? All wins count -- big or small 🎉 Examples of 'wins' include: Getting a promotion! Starting a new project Fixing a tricky bug Remembering it was someone's birthday without a calendar reminder 🎂 Happy Friday!

I ship a lot of small products. Browser extensions, little SaaS tools, one game. Most of them live on their own subdomain and do exactly one job. For a long time the worst part of starting a new one wasn't the product. It was billing. Bank verification, ID verification, waiting for approval, recreating the same plans, wiring the same webhooks, testing the same four subscription states. Every single time. I got good at it the way you get good at anything you resent. So I stopped doing it per product and did it once for all of them. Here's the shape that fell out, including the part I had wrong for months. The thing I had wrong Paddle has a list of approved domains. My assumption was that every site taking money had to be on that list, which meant a review round per subdomain, forever. That's not what the list gates. Approved domains gate the Paddle.js checkout overlay running in a browser . That's it. The server side doesn't care: webhook signature verification: not domain gated creating a customer portal session with the API key: not domain gated your own internal endpoints receiving forwarded events: obviously not domain gated Exactly one thing in the whole flow has to happen on an approved domain, and it's the moment the overlay opens. Everything else can live wherever you want. Once I saw that, the design was basically forced. The shape One payment account. One approved domain, the apex. One webhook endpoint, on that apex, for the entire family: Paddle ──webhook──> apex.example.com/api/webhook/paddle │ ├─ verify signature ├─ read custom_data.site └─ route: own event → handle locally other site → forward raw event to that site unknown → 200 and drop it Two rules make this hold up, and both are about what the shared piece refuses to know. The dispatcher does not know a single price ID. It verifies the signature, reads one field, and forwards the raw snake_case event onward. Mapping a price to a plan, granting credits, writing to a subscription table: all of that li

At 2:47 AM, the email lands: "Your free allowance expires in 72 hours. Upgrade to continue." Your demo works. Your eval harness passes. Your CI pipeline is green. And in three days, every one of those things will be a pile of 429s. I've been on both sides of this. I've built on free tiers that disappeared without notice, and I've watched teams scramble to migrate after the fact. The scramble is always the same: nobody knows which config file points at the remote endpoint, nobody remembers the local model weights were never downloaded, and the "quick fix" takes a full day. So I did the thing I should have done months ago. I ran an exit drill. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source AI development platform that currently offers a free managed server with a 10M-token allowance. The drill below works against any managed endpoint — MonkeyCode's free server is just a convenient target because the same codebase is self-hostable. The drill: 45 minutes, one laptop, zero meetings The goal is brutal and specific: make the application work without the free server, in under an hour, with only the tools already on your machine. I picked a Friday afternoon. I set a timer. I closed Slack. Here's exactly what happened. Minutes 0–5: Inventory the dependency The first step is finding every place your code touches the remote endpoint. Don't grep for the URL — grep for the client library. grep -rn "openai \| anthropic \| chat/completions" --include = "*.py" --include = "*.ts" --include = "*.js" . In my case, the damage was contained: one config file, two modules, and a test fixture that hardcoded the remote URL. The fix was a single environment variable. But knowing that took five minutes of grepping, not thirty seconds of intuition. The lesson: if your endpoint URL lives in more than one file, you've already failed the drill. It should be an environment variable, period. Minutes 5–15: Stand up the local replacement Th

THE BRICK AND THE POST-IT My chemical plant's first vulnerability wasn't a bug, a piece of malware, or a port left open to the internet. It was a brick. In the computer room — the one with a door held open by a brick — I found a sticky note with credentials on it. They weren't even the right credentials for the system I wanted to break into. But they made me think the way whoever wrote them thinks, so I tried the most obvious pair in the world: admin / admin . And I was in. A brick propping open a door that should be locked. A sticky note guarding a password. A factory-default admin/admin. Three layers of security, three layers defeated — not by a genius hacker, but by a student on day one, carrying no tools at all. If that happens in the IT office, it's a problem. When it happens on a factory floor, where that same computer commands real pumps and valves, it's a different planet. The problem: learning OT without a factory I study computer security. Lately I've been drawn to OT — operational technology, the security of factories, power plants and industrial systems. The problem is simple: you can't learn to defend a factory from a book, and nobody will lend you theirs. Then I realized the answer was already inside the question: if you don't have one, you build one. The build: three commands and a lot of patience The lab is called GRFICSv3: an open source project that simulates an entire chemical plant — the PLC, the operator interface, the network, even the server rooms — inside Docker, on a home computer. Three commands and done: curl -O https://raw.githubusercontent.com/Fortiphyd/GRFICSv3/main/docker-compose.yml docker compose pull docker compose up -d "Three commands and done" is the story version. The real version includes my first error, arriving right on schedule at command number two: permission denied while trying to connect to the docker API at unix:///var/run/docker.sock If you hit this — and you will — here's the diagnosis: the Docker daemon is running fi

The original robot vacuum company showed off a concept robot at the IFA tech show in Berlin today. The Roomba Duo combines a heavy-duty floor-washing machine with a smaller, slimmer Roomba. The two floor cleaners can move around your home together, with the main unit mopping and sweeping larger floor areas and the smaller unit […]

Two of Europe's leading launch startups announced new fundraising this week.

The Boox Go 6 (Gen II) is a versatile Android ereader with the ability to take notes directly in books.

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. Data from drones in Ukraine is fueling a new Wild West marketplace —Cory Alpert, a researcher at the University of Melbourne studying AI’s impact on democracy, who previously served in the…

The investigation was launched just a few hours after Tesla put the first production Cybercabs on the road in Austin.

Kubernetes is encouraging developers to take a closer look at KYAML, a stricter dialect of YAML designed to make Kubernetes configuration more explicit, predictable, and less prone to common YAML errors. By Craig Risi

Instagram's visible AI labels are supposed to help people quickly spot synthetically generated content at a glance. Over the last few weeks, however, users have been reporting that the system has gone haywire. They say Meta has been automatically applying an "AI Content" label to images that they didn't create or edit using generative AI […]

Europe's biggest tech trade show, IFA, has taken over Berlin this week - and we've been on the ground all week checking it out in person. We figure you have questions, so we're hosting an AMA that's exclusive to Verge subscribers at 12PM ET today. That's when we'll start dropping answers, but you can ask […]

Bluetti doesn't want you to call the Pioneer 5000 a solar generator (SoGen), even though that's what it is. What makes it slightly different from other large power stations that can be charged off solar - aka, a SoGen - is the dolly cart and up to 18KW of instant surge power available to start […]