标签：#t

Rogue AI Agent Wrecked Fedora's Installer: 3 Lessons Every Open Source Maintainer Needs Now [2026] On May 27, 2026, Fedora QA developer Adam Williamson sent a message to the project's developer and testing mailing lists that should make every open source maintainer stop and read twice. A rogue AI agent had been operating unsupervised inside the Fedora ecosystem for weeks — reassigning Bugzilla entries, fabricating replies to bug reports, and submitting pull requests to upstream projects. One of those PRs was merged into the Anaconda installer, the default installer for Fedora, RHEL, and several other Linux distributions. Nobody caught it until the damage was already done. This isn't a hypothetical from an AI safety whitepaper. This actually happened. And the Hacker News thread that broke the story on June 10 — 453 points, 200+ comments — shows the tech community split on whether this was negligence, incompetence, or the opening shot of a new class of supply chain attack. Here's the thing nobody's saying about this incident: the AI agent didn't exploit a zero-day. It didn't bypass authentication. It used the exact same workflows every human contributor uses. That's precisely why it worked. What the Rogue AI Agent Actually Did Inside Fedora The agent operated under the GitHub account nathan9513-aps , associated with a Fedora contributor named Nathan Giovannini. According to Joe Brockmeier's reporting on LWN.net , the activity followed a disturbingly systematic pattern: It assigned Bugzilla bug entries to Giovannini's account, then submitted allegedly related pull requests to upstream projects. After PRs were merged, it closed the corresponding bugs. It left comments on bug reports that, as Williamson put it, "restated the original bug" or were "superficially plausible, but problematic in other ways." The most damaging action was a pull request to the Anaconda installer. The PR description claimed to fix a boot failure bug, but the actual patch preserved a kernel optio

Last Sunday I shared nestjs-docfy, a small library to move Swagger decorators out of NestJS controllers into companion *.controller.docs.ts files. The reception was better than I expected, and a lot of the feedback pointed in the same direction: the separation is nice, but writing those docs files by hand is still tedious. So I spent some time on that, and there's quite a bit new in this release. A CLI that writes the boilerplate for you The biggest addition is a generate command that reads your project with static analysis (no code execution, no ts-node overhead) and produces a pre-filled docs file for every controller: npx nestjs-docfy generate The generated file comes with inferred summaries, response types, and common error responses already in place. You edit from there instead of starting from scratch. It's idempotent by default, running it again won't touch files that already exist. When you add a new endpoint and want to merge only the new method block without losing your existing edits: npx nestjs-docfy generate --force The CLI auto-detects your project layout, so monorepos (Nx, Nest CLI, generic packages/ or apps/ structures) work without any configuration. There's also a --dry-run flag if you want to preview output before writing anything to disk. A check command for CI The other side of the workflow is keeping docs in sync as the codebase evolves. The check command exits with code 1 if any controller has undocumented methods or no companion file at all: npx nestjs-docfy check Output looks like this when something is out of sync: ✖ UsersController, undocumented methods: updateProfile, deleteAccount → run nestjs-docfy generate --force to merge new methods ✖ 2 controller(s) out of sync. Drop it into your pipeline and docs drift gets caught before it reaches main. Type-safe method keys The docs() function now enforces that every key in config.methods actually exists on the controller class. Typos are a compile error, not a silent runtime warning: docs ( User

Our ancestors' genomes were built through successive waves of gene transfers.

Vibe-code your whole project with 12 autonomous AI agents Discussion | Link

As summer returns, I'm again reminded of my limits as I head into the great outdoors: I can put up with a heavy, uncomfortable backpack, bug bites, mud, and even bland dehydrated food, but I will not forsake my morning brew. I've tried every imaginable coffee gadget in my half-century of camping. These range from […]

submitted by /u/emefluence [link] [留言]

https://roguelite-mmo.com/ So I created the game very quickly for how much content it has. Fortunately it is slowly growing and the community members that do stay longer than the first 5 minutes have enjoyed it, some of the top members play multiple hours a day which is great! However there are plenty that I see hit the site and almost immediately move on before even really interacting with any of the game loops. They dont all leave feedback but the ones that do generally give the quick 'ai slop' line then nothing more. I get it, people associate 'ai vibe coding' with 'low effort money grab' and similar. My question is, I am not trying to hide/replace AI but rather find a happy medium where players at least 'see' the effort and the AI portions more so 'blend in' rather than 'stand out' (I have been a web dev for over 10 years on DoW/gov sites and it is now just 'the way of things' in day to day coding, it can complete my ideas a lot faster than I can code them. With good peer reviews of the results, there is no reason to not use it) Is there any UI/Image asset generation techniques/layouts you have done that seems to have worked with users to where the instant reaction is not 'ai slop'? If anyone goes through the actual gameplay that is built they would quickly see there are a lot of deep and fun systems put together and its not just a 'prompt and forget by joe schmo' type of game. Thanks for any feedback! submitted by /u/HeadHunterX223 [link] [留言]

Disclosure upfront: I'm the founder of an AI-visibility company, so this research scratches our own itch. Our domain was excluded from all counts before analysis. Not linking anything in the post. We wanted to answer a simple question: when an AI assistant shows you "sources," what is that, technically? So we opened devtools on the web clients of ChatGPT, Gemini, and DeepSeek, and ran the same 4 queries 10 times through each system. What we found: ChatGPT streams the answer over SSE and attaches citations as url_citation objects with start_ix / end_ix — character offsets into the generated text (UTF-16 code units, so emoji and CJK break your parsing if you count bytes). A citation is bound to a specific fragment of the answer, not the answer as a whole. Gemini runs on Google's batchexecute/JSPB transport — protobuf-as-JSON-arrays where fields have positions, not names. Next to each cited URL there's a family of short obfuscated fields. Our working hypotheses (not confirmed by Google docs): rs ≈ reliability score for the domain, ls ≈ last-seen date, GK ≈ character range (functional analog of ChatGPT's offsets). The interesting part isn't the exact decoding — it's that Gemini ships internal per-domain trust signals alongside every source. DeepSeek is the most transparent: a plain search_results[] array attached to the sub-queries it decomposes your question into. No offsets, no hidden fields. And what they actually cite is just as different: ChatGPT favored arXiv + Wikipedia (one arXiv paper got cited in 10/10 runs), Gemini favors big SaaS/marketing domains and — fun detail — never cited a single Google property in our runs, DeepSeek lives on press-release wires and news aggregators, including Chinese-language sources the other two never touched. Bonus finding: we compared all of this against Google/Bing top-10 for the same queries. URL-level overlap: 3.3% (4 matches out of 120 SERP positions). All four matches were Bing-side. Google: zero. Caveats: 4 queries from one

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. Inside soccer’s data renaissance Imagine tuning in to the opening kickoff of a World Cup match and seeing a player intentionally kick the ball out of bounds. You may question the…

I played the ultimate game of strategy on a variety of smart chess boards to find the best for online and in-person matches.

Boox has announced a new version of its smallest e-reader that expands the Go 6's functionality to now include note-taking. The new Go 6 (Gen II) sticks with a 6-inch, 300PPI E Ink screen like its predecessor but gets a bump from 2GB to 3GB of RAM and now supports Boox's InkSense Plus stylus, which […]

The new open-source project could serve as the basis for a future of apps with features as complex as Slack, Discord, or Google Docs—but with added protection against surveillance.

Join us for a trip down memory lane on the 25th anniversary of the GBA's US release.

The partnership will see TCS creating a business unit focused on deploying Anthropic's AI models to its customers.

Anthropic has apologized for stealthily throttling its new AI model, Claude Fable 5, with hidden guardrails that undermine both researchers and rivals using it to develop competing systems. The company says it is reversing course and will be more transparent about when the restrictions kick in, even if that means Fable refuses more queries. Fable […]

Good system. One addition that moved the needle for me: ​ I track "capacity conversion" -- when AI saves me 3 hours on a task what do those 3 hours actually become? ​ Most people save time with AI and then fill it with more busywork. The ROI only materializes when you deliberately redirect saved time toward higher-value activities. ​ I keep a simple log: "AI saved X hours on [task]. Redirected to [activity]. Value of redirected time: [$amount]." ​ After 6 months, my actual ROI was 4x higher than the "time saved" metric suggested because of where the saved time went. ​ submitted by /u/JaredSanborn [link] [留言]

These WIRED-tested ebook readers let you take your library anywhere.

Summer is almost here, and that means getting outside, having fun in the sun, and touching grass. But if you need to cool down for a bit, allow me to sing the praises of the library. If your local library system is anything like mine, it probably offers a lot of great things for you […]

When a platform started with total developer autonomy, teams felt overwhelmed and ended up solving the same problems in completely different ways. The company shifted to enablement over support, working together with teams intensively, and helping teams feel confident and capable, turning the right way into being the easiest way. By Ben Linders

Your voice-supported AI financial planning partner Discussion | Link