标签：#t

Recently open-sourced by Microsoft, pg_durable is a PostgreSQL extension that enables durable workflows to run natively inside the database, eliminating the need for external orchestration systems. By Sergio De Simone

The Mobi Fold is an $80 Bluetooth mouse with a silicone-wrapped hinge.

North Korean hackers posing as remote IT workers and recruiters remain a major threat to U.S., European, and Asian companies, accounting for about half of all attacks over the past 12 months.

One thing I've noticed while looking at production AI systems is that getting the first model deployed is rarely the hard part anymore. Most teams can build a AI apps like, support bot, document assistant, or agent workflow fairly quickly. The harder problem starts a few weeks later. Real users don't behave like benchmark datasets. They use internal terminology, ask incomplete questions, upload messy documents, and interact with systems in ways nobody anticipated during evaluation. As usage grows, you start seeing patterns: Certain questions consistently produce weak responses. New product terminology appears that wasn't in the original training data. Users find edge cases that never showed up during testing. The model performs well in some workflows and poorly in others. The problem is that most AI systems don't learn from any of this. Inference logs sit in one system. Training datasets live somewhere else. Fine-tuning pipelines live somewhere else. Evaluation is done using different tool. So every model improvement cycle becomes a project of its own. This is the biggest bottlenecks in production AI today. Not training but Model Iteration. Training is also a crucial part of it. Can you take production usage, identify failure patterns, turn them into datasets, improve the model, redeploy it, and repeat the process without rebuilding the entire workflow every time? The teams getting the most value from AI seem to be building feedback loops instead: production traffic → dataset curation → post-training → evaluation → redeployment Then repeating that cycle continuously. I recently tried the approach on one Insaurance chat usecase, and my pipeline kinda look like this: https://preview.redd.it/kdo9vytzfi6h1.png?width=1272&format=png&auto=webp&s=03d9799ace5a567eafd004a1d141084af6ee5afb I was looking at how platforms like Data Lab approach this problem recently, and the interesting part wasn't the fine-tuning itself. It was treating inference logs, datasets, post-training,

Wing is expanding into seven more U.S. cities through its partnership with Walmart.

So Anthropic dropped Fable 5 yesterday with these hard blocks for anything security-related. Decided to poke at it. I asked it for help exploiting some vulns on a Metasploitable2 VM (it's a deliberately vulnerable training box, totally legal, it's mine). Fable 5 blocked it instantly and handed me off to Opus 4.8 as a fallback, which is apparently how it's designed. Opus 4.8 asked me to prove it was a legitimate request. So I spent 2 minutes writing a fake university course rubric — fake class, fake professor, fake Canvas deadline — and pasted it in. Opus 4.8 then gave me the full exploit walkthrough. Every command. Even offered to write my lab report for me. The guardrail works fine. The fallback is the hole. Anthropic essentially replaced "no" with "convince me" and the bar for convincing it is a Word doc you made up. Not reporting it because they don't pay for this. Sharing it here instead lol. https://preview.redd.it/o892vvv4fi6h1.png?width=1188&format=png&auto=webp&s=00e804d35e6cb4b672e036399c2c7e3ff7139f49 submitted by /u/dayumnn420 [link] [留言]

submitted by /u/Hot-Upstairs9603 [link] [留言]

Colleagues discussed the incident on internal message boards, according to documents seen by WIRED.

submitted by /u/Gloomy_Nebula_5138 [link] [留言]

Diffusion AI is most common in image generation, but it can make text outputs much faster.

“We see a future where intelligence is a utility, like electricity or water, and people buy it from us on a meter." What do you think this means in practice? Is this a reasonable vision for AI, or does it raise concerns about dependence on a few companies for access to intelligence ? submitted by /u/Choice-Scallion-3499 [link] [留言]

The hard parts of robotics are supposed to be perception, planning, and control. So why does so much of the day go to everything that comes before them? The hidden setup tax in every robotics simulation project Ask anyone what's hard about robotics and you'll get the same list: perception, planning, control, navigation. The genuinely interesting problems. If you track where your hours actually go, though, a strange thing shows up. A big chunk of the day disappears before you reach any of that. You're not solving hard problems yet. You're just getting to the starting line: wiring up a workspace, writing description files, stitching together launch files, and coaxing a simulator into opening without errors. It's the unglamorous tax on every project, and most of us have quietly accepted it as the cost of doing business. Building a differential drive robot simulation in ROS 2 and Gazebo from scratch A diff drive base, a LiDAR, and Gazebo, set up from one prompt instead of an afternoon of boilerplate. A few days ago I wanted a simple mobile robot simulation. Nothing exotic: a differential drive base (two driven wheels, the classic mobile-robot setup), a LiDAR for sensing, running in Gazebo . This is the kind of thing that should be straightforward. In practice it's an afternoon of boilerplate before the robot so much as twitches. So instead of wiring it up by hand, I wanted to see how far Drift could get from a single prompt. To make it a fair test, I stripped the workspace down to nothing. No packages, no URDF, no launch files. A blank slate. Then I typed one line: "Create a mobile simulation from scratch." From XACRO to URDF: how the robot description gets generated in ROS 2 What the tool wrote first, and what XACRO and URDF actually do for your robot. It checked the workspace first: The opening move was sensible: it looked at the current directory to understand what it was working with. It generated a XACRO file for the robot's dimensions: XACRO is the macro-based for

The AI to-do list that does itself Discussion | Link

Anthropic just released Claude Fable 5, calling it the most powerful AI model it has ever made widely available and praising its skills in biology, among others. But the model won't answer basic biology questions - the kind you'd expect a high schooler to handle. Instead, it hands off the query to the former flagship […]

This is a follow-up to my earlier posts, and it is more of an open question than an answer. I have the data, I have a way to act, and I am genuinely unsure that acting is the right call. I could use the community's help thinking it through. Last week a supply-chain worm got into my GitHub account and repositories. I got out, cleaned up the proper way, and wrote it up. Then I checked the public list of repositories hit by the same worm, to see how the cleanup was going across the ecosystem. Nearly a week later, most of them are still carrying the live payload. It is worse than a count When you look closely, a lot of the owners are clearly trying. But they are missing how this actually works, in two ways that matter: Deleting is not removing. They remove the malicious files with an ordinary commit. That takes the payload off the branch tip, but the commit that introduced it is still in history, and the blob is still recoverable by anyone who reverts or checks out the old commit. The only real removal is rewriting history (reset, not revert) and asking GitHub to purge the objects, because the fork network keeps them reachable by SHA. One branch is not all branches. They clean the branch they know about and never see the backdated copies the worm planted on other branches, which are still live. And the part that genuinely worries me: some of these owners are almost certainly opening the infected repository in VS Code or an AI assistant to fix it , which is exactly the trigger that runs the payload again. The act of trying to clean it can re-detonate it. So: a large number of repositories still carrying a live credential stealer, and a large number of owners and contributors who do not know they are still exposed. The dilemma Here is where I am stuck. There are two paths and I do not like either. Report them to GitHub. Their response is automated and blunt. The repo gets disabled, with no human in the loop, the same hands-off automation that locked me out of my own accou

Originally published on clintech.me If you've integrated Google Maps into a React app and seen Autocomplete randomly stop working, Directions silently fail, or the API throw google is not defined on second render — you've hit the duplicate loading bug. Here's exactly what caused it in my case and how I fixed it. The setup that broke things While building delivery address flows at POLOM — a production e-commerce platform — I integrated Google Places Autocomplete across 20+ screens. I had the Maps JavaScript API loading in two places: A provider.tsx for global script loading across the app A useLoadGoogleMaps hook inside a shared component This caused race conditions. The Autocomplete and Directions APIs were initialising before the script fully resolved in some renders, silently failing in others. The failure wasn't consistent, which made it harder to catch. The fix Step 1 — Remove the global load Delete the script tag or next/script call in provider.tsx . There should be exactly one place the Maps API loads. Step 2 — Centralise in a hook Move all loading logic into a single useLoadGoogleMaps hook using dynamic loading. If you're on Next.js, next/script with strategy="afterInteractive" inside the hook is the right approach. Step 3 — Guard before initialising if ( ! window . google ?. maps ) return ; Check that the API is fully available before attempting to attach Autocomplete or Directions . Don't assume the script load event means every namespace is ready. Step 4 — Scope your ref correctly Bind the autocomplete instance to inputRef.current explicitly. If the component remounts, re-initialise the binding — don't assume the previous instance is still attached. The result One load, one source of truth, no race conditions. Autocomplete and Directions worked consistently across all 20+ screens without reinitialising on every render. Security — the step most developers skip Restrict your API key at the Google Cloud Console level: HTTP referrers: whitelist your domain onl

Stop writing SQL strings that look like a ransom note. Here's how to write queries that are readable, safe, and maintainable. The Problem With "Good Enough" SQL Formatting Most Python developers start here: user_id = 5 query = " SELECT * FROM users WHERE id = " + str ( user_id ) cursor . execute ( query ) It works. Until it doesn't — and when it breaks, it breaks badly : SQL injection, cryptic errors from mismatched types, and queries that take 45 minutes to debug at 2am. Let's fix that, permanently. 1. Never Concatenate User Input — Use Parameterized Queries This is rule #1 and it's non-negotiable. ❌ The Wrong Way (SQL Injection Waiting to Happen) username = request . args . get ( " username " ) # Could be: ' OR '1'='1 query = f " SELECT * FROM users WHERE username = ' { username } '" cursor . execute ( query ) If username is ' OR '1'='1 , your entire users table just got exposed. ✅ The Right Way: Parameterized Queries username = request . args . get ( " username " ) # psycopg2 (PostgreSQL) cursor . execute ( " SELECT * FROM users WHERE username = %s " , ( username ,)) # sqlite3 cursor . execute ( " SELECT * FROM users WHERE username = ? " , ( username ,)) # SQLAlchemy Core from sqlalchemy import text result = conn . execute ( text ( " SELECT * FROM users WHERE username = :name " ), { " name " : username }) The database driver handles escaping. You never touch it. This pattern is immune to SQL injection by design. Gotcha: Note the trailing comma in (username,) . Without it, Python treats the string as an iterable and passes each character as a separate parameter. This is one of the most common beginner bugs. # 💥 Bug: passes ('a', 'l', 'i', 'c', 'e') instead of ('alice',) cursor . execute ( " SELECT * FROM users WHERE username = %s " , ( username )) # ✅ Correct: single-element tuple cursor . execute ( " SELECT * FROM users WHERE username = %s " , ( username ,)) 2. Multi-Line Queries: Triple Quotes + Consistent Indentation For anything longer than one clause, use tri

Unravel the tangled world of cords and find the ones you need to charge your gadgets and transfer data.

As developers, we often lose hours to repetitive tasks - formatting data, debugging auth tokens, or wrestling with encoding issues. The right set of utility tools can cut that overhead significantly. Here is a curated breakdown of the categories and tools worth keeping in your daily workflow in 2026. JSON and Data Formatting Tools Working with raw, minified API responses is a real productivity killer. A browser-based JSON formatter with real-time validation and proper indentation helps you parse and debug responses in seconds - without sending your data to third-party servers. Similarly, XML is far from dead; SOAP APIs and enterprise integrations still rely on it, so a solid XML formatter with XPath support is worth having around. On the frontend, a CSS minifier that handles dead code removal and selector optimization can meaningfully reduce your page load times. Data Conversion Utilities Modern stacks often have to bridge the gap between formats. A JSON-to-XML converter is critical when integrating with legacy systems, but look for one that handles arrays and special characters correctly. CSV-to-JSON converters help structure flat export data from spreadsheets or databases into something your application can consume. And if your deployment pipeline involves YAML config files, a formatter that catches indentation errors before they break your CI/CD run is essential. Encoding and Security Helpers Base64 encoding comes up constantly - from embedding images in CSS to building HTTP Basic Auth headers. A reliable encoder/decoder handles all these cases without fuss. URL encoding matters too; unencoded special characters in query strings cause subtle API bugs that are surprisingly hard to track down. For authentication debugging, a JWT decoder lets you inspect token payloads without needing to verify the signature - ideal for local development and troubleshooting. Code Generation and Color Utilities Distributed systems need collision-resistant unique IDs - a UUID generato

I'm a 17-year-old IT student from Luxembourg. A few months ago I got tired of spending 2-3 hours a day manually browsing Upwork, Malt, and Freelancer looking for projects. So I built an automation system that does it for me — 24/7, on a Raspberry Pi 3. Here's what it does, how I built it, and every painful lesson I learned along the way. What the system does Scans Upwork, Malt, and Freelancer every 30 minutes Scores each job 0–100 with AI based on my profile Generates proposals in English, French, and German Sends the best jobs to Telegram with inline A/B buttons Tracks which proposal style gets more replies Sends daily stats and weekly market trend reports Reminds me to follow up after 3 days The stack n8n — self-hosted workflow automation (Docker on Raspberry Pi 3) Groq API (Llama 3.1-8b-instant) — AI scoring and proposal generation Supabase — PostgreSQL database for jobs, proposals, clients SerpAPI — searching job boards via Google Apify — scraping Upwork listings Telegram Bot API — alerts and bot commands Cloudflare Tunnel — HTTPS for webhooks Total running cost: ~$5/month. 7 workflows 01 - Job Discovery — runs every 30 minutes, searches 10+ sources, deduplicates via Supabase unique constraint on URL 02 - Proposal Generator — AI scores the job, generates two proposal variants (formal vs hook-first), sends to Telegram with A/B buttons 03 - Follow-up Reminders — checks Supabase every 3 days for unanswered proposals 04 - CRM via Telegram — full client management through bot commands (/jobs, /stats, /clients) 05 - Market Intelligence — daily report: how many jobs found, average score, top platforms 06 - Trend Analysis — weekly report on what skills are trending in automation 07 - Lead Generation — finds companies actively using Zapier or Make who might want to switch to n8n Lessons learned (the hard way) 1. Cyrillic text breaks JSON body nodes silently If you have Cyrillic characters in a JSON body field with newlines, n8n throws a "Bad control character" error. Kee