标签：#t

We've all been there. Your first encounter with authorization looks something like this: if ( user . role === " ADMIN " ) { // allow access } It works. It's simple. It ships fast. And then, three months later, your application has grown, requirements have shifted, and you're staring at a codebase where authorization logic is scattered everywhere—APIs, services, UI components—like a puzzle that nobody remembers how to solve. The truth is: this approach doesn't scale. Not because it's inherently flawed, but because it conflates two very different concepts that should never be mixed. The Core Mistake: Confusing Identity with Capability Here's the problem we're actually trying to solve. As your application grows, you inevitably end up writing code like this: if ( user . role === " BRANCH_MANAGER " || user . role === " SYSTEM_ADMIN " ) { // allow access } Then a stakeholder asks: Can we create a hybrid role? Or: We need Auditors who can export reports but not edit records. And suddenly your role logic explodes into an unmaintainable mess. The fix isn't adding more conditions. The fix is understanding that roles and permissions answer fundamentally different questions. Roles Define Identity Roles are categories of users. Examples: SYSTEM_ADMIN CLIENT BRANCH_MANAGER AUDITOR Roles answer: Who is this user? They establish high-level authorization boundaries. Examples: Staff Portal vs Customer Portal Internal Admin Area vs Public Application Employee Features vs Client Features Think of roles as identity labels . Permissions Define Capability Permissions represent atomic actions. Examples: LOAN_APPROVE USER_DELETE REPORT_EXPORT ACCOUNT_EDIT Permissions answer: What can this user actually do? Your application should not constantly ask: What role are you? Instead, it should ask: Do you have permission to perform this action? Because: Users have Roles Roles contain Permissions Code checks Permissions That distinction changes everything. Always Decouple Identity from Capability T

OpenRouter is a unified API gateway to hundreds of language models from providers such as OpenAI, Anthropic, Google, and Meta. You use one API key and one billing surface, and swap models by changing a provider/model slug. OpenRouter exposes a Chat Completions -compatible HTTP API. This post shows three Node.js integration paths: the official @openrouter/sdk , the openai package with baseURL , and the Vercel AI SDK with @openrouter/ai-sdk-provider . For deeper patterns on each stack, see the Chat Completions API , OpenAI Responses API (OpenAI direct only), and Vercel AI SDK posts. Prerequisites OpenRouter account API key Credits or billing enabled as needed Node.js version 26 Install packages for the path you use: @openrouter/sdk ( npm i @openrouter/sdk ) openai ( npm i openai ) ai and @openrouter/ai-sdk-provider ( npm i ai @openrouter/ai-sdk-provider ) Configuration Read credentials from the environment in production. Variable Purpose OPENROUTER_API_KEY Bearer token from OpenRouter settings OPENROUTER_MODEL Default model slug, for example openai/gpt-5.5 OPENROUTER_SITE_URL Optional site URL sent as HTTP-Referer for rankings on openrouter.ai OPENROUTER_SITE_TITLE Optional app name sent as X-OpenRouter-Title Model IDs use the provider/model format, for example openai/gpt-5.5 , anthropic/claude-opus-4.8 , or google/gemini-3.1-flash-lite . Browse the full catalog at openrouter.ai/models . The examples below use openai/gpt-5.5 , matching the model in the other LLM posts in this series. Override it with OPENROUTER_MODEL when you want a different model. @openrouter/sdk OpenRouter's official TypeScript SDK is type-safe and generated from the OpenAPI spec. Client setup import { OpenRouter } from ' @openrouter/sdk ' ; const client = new OpenRouter ({ apiKey : process . env . OPENROUTER_API_KEY , httpReferer : process . env . OPENROUTER_SITE_URL , appTitle : process . env . OPENROUTER_SITE_TITLE , }); Basic integration const response = await client . chat . send ({ chatReques

I use AI tools all day for work and the thing that drives me crazy is starting a new chat window.If I don't paste a massive block of text about my current project stack, my writing guidelines, and what I'm trying to do, the model just defaults to that generic, robotic corporate speak. But keeping a sloppy text file on my desktop and copying it in over and over feels incredibly stupid.Even worse is that ChatGPT custom instructions don't format right when you try to move them over to Claude or DeepSeek. They just drift or start ignoring instructions after a few prompts. How are you guys managing your background data across different browser tabs? Are you just dealing with the text dumps or is there a way to actually lock this context in permanently so it doesn't get messed up? submitted by /u/alazar_tesema [link] [留言]

E-signatures API for your app averaging ~3¢ per envelope Discussion | Link

submitted by /u/ThereWas [link] [留言]

The messaging giant announced that it disrupted a phishing campaign targeting its users with NSO’s spyware.

Short answer first: use Supabase if you want Postgres plus auth, realtime, storage, and a dashboard as one managed bundle. Self-host Postgres – or use a managed Postgres – if you mostly need a database and your app already handles its own auth and logic. The choice is not really "Postgres vs Supabase". It's whether you need the extra layers Supabase puts on top of Postgres. Supabase is not a database Supabase runs on PostgreSQL, but it's a stack of services around it: Postgres – the actual database Auth – user signup, login, JWT tokens Realtime – live updates over websockets Storage – an S3-style file store Edge Functions – serverless functions Studio – dashboard + auto-generated REST/GraphQL API So "self-host Postgres or use Supabase" compares a plain database to a full backend. The honest question: do you need those extra layers, or just the database underneath them? A quick test: You use Supabase Auth, Storage, and Realtime → Supabase earns its place. You use one of them → it's replaceable. You use none and treat it as "Postgres with a nice dashboard" → you want plain Postgres. Side-by-side comparison Factor Supabase (managed) Self-hosted Supabase Plain Postgres (managed or self-hosted) Database engine PostgreSQL PostgreSQL PostgreSQL Built-in auth Yes Yes No (bring your own) Realtime / websockets Yes Yes No File storage Yes Yes No Dashboard + auto API Yes Yes No (use any SQL client) Backups Managed (limits by plan) You manage Managed or you manage Cost shape Metered, grows with usage Server cost + your time Database only Self-host effort None High (many containers) Low–medium Lock-in Medium–high Medium Very low The lock-in point decides it for many teams. Your data is standard Postgres in every option ( pg_dump portable). The lock-in is everything else: Auth tokens, Storage paths, Supabase-specific RLS policies, Edge Function code. The more Supabase-specific features you adopt, the harder the exit. When each option wins Pick managed Supabase when: You're startin

Apple's WWDC nears: Here's what you can look forward to.

Field journal of Dr. E. Rempel, Department of Minority Neurological Studies, University of New Carthage (A work of fiction. "Allism" is a real term used by some autistic people to describe the neurological profile of the non-autistic majority.) March 3, 2089 I have now spent three months embedded with an allistic community in the outer provinces. Allism, for those unfamiliar, is a rare neurological variant affecting approximately 1% of our population. My colleagues at the University have long debated its origins and persistence. After direct observation, I am no more certain of the answers, but I have accumulated a remarkable set of field notes. The allistic subjects I have observed appear, on the surface, entirely functional. They hold jobs, maintain relationships, raise children. And yet their neurological profile diverges from the norm in ways that are at once fascinating and bewildering. March 11, 2089 The most immediately striking feature of the allistic profile is their relationship with information. Where a typical individual experiences the sharing of useful knowledge as a basic social reflex, the allistic subject appears to require an elaborate ritual before any information exchange can occur. Approach an allistic subject directly with a piece of useful data and observe what happens. Rather than receiving it, they freeze. A threat-assessment process appears to engage, entirely pre-consciously, before the content of the communication can be evaluated at all. One subject described it to me as feeling "strange" when a stranger approached with unsolicited information, though she could not articulate why. I have learned to preface all information exchanges with what my translator calls "the preamble ritual" — a sequence of social signals that appears to deactivate the threat response and allow communication to proceed. The exact form varies, but typically involves eye contact, a softening of posture, and verbal acknowledgment that one is about to speak. Only the

In multi-turn agent loops, the full context re-sends on every API call. A tool result added at turn 3 gets billed again at turns 4, 5, 6, 7... forever. Most of it is never read again. Standard observability tools tell you the total token count. They never tell you what's in there or how much of it is waste . That's what ContextLens fixes. What it does ContextLens is a diagnostic profiler for LLM agent context windows. It: Decomposes the context window into regions: system prompt, tool schemas, tool results, retrieved chunks, user messages, assistant messages Tracks which blocks get re-billed across turns using SHA-256 content hashing Runs 5 waste detectors and ranks findings by dollar cost Prints a concrete one-line fix for each finding Renders an interactive D3 treemap report as a self-contained HTML file No API key required. Works offline on saved traces. The five detectors Detector What it finds Duplicate Same block re-sent verbatim across multiple turns Near-Duplicate >85% Jaccard similarity between distinct blocks Stale Tool Result Tool output never referenced by a later assistant message Unused Tool Schema Tool defined every turn but never called Redundant Retrieval Retrieved chunk with <15% overlap with model output ---Run the built-in demo (simulates a 30-turn agent loop, no API key needed): python -c "import contextlens; contextlens.demo()" python examples/demo.py Live capture — Anthropic import anthropic import contextlens as cl client = anthropic.Anthropic() with cl.capture_anthropic(client, model="claude-3-5-sonnet-20241022") as collector: for turn in range(20): client.messages.create( model="claude-3-5-sonnet-20241022", max_tokens=1024, system="You are a helpful assistant.", messages=build_messages(turn), ) report = cl.analyze_trace(collector.build_trace()) print(f"Recoverable waste: {report.recoverable_tokens:,} tokens (${report.recoverable_cost_usd:.4f})") Live capture — OpenAI import openai import contextlens as cl client = openai.OpenAI() with cl.ca

Automatically organize, rename, and manage files with AI Discussion | Link

The Pro 6E was Eero’s top-end mesh Wi-Fi router back in 2022, and it’s still a solid pick if you want fast, reliable Wi-Fi coverage around your multi-room or multi-story abode. It can also deliver beyond gigabit wired speeds if your internet plan supports it. Ahead of Prime Day 2026, Amazon and Best Buy have […]

This weekend, AgentTrust ID went live in production. As of today, all five SDKs are published: pip install agenttrustid npm install @agenttrustid/sdkgo get github.com/agenttrustid/sdk/go cargo add agenttrustid # Maven / Gradle # id.agenttrust:agenttrustid:0.3.0 The SDKs are open source under Apache 2.0 at github.com/agenttrustid/sdk . The hosted platform is running at app.agenttrust.id in a controlled beta. Why I built this AI agents broke the assumptions that machine-to-machine security was built on. An API key answers one question: who is calling. It asks it once, at the door. An agent decides its next action at runtime, from context nobody wrote by hand. The same agent that summarized a document a second ago might now try to email it, delete it, or chain a task to another agent. A credential that only proves identity has no opinion about any of that. Agents need a decision at the action boundary : should this specific action happen, right now, on whose behalf . Answered at runtime, every time, with an audit trail and a kill switch. What's running Everything below is live in production today, not a roadmap: Per-action authorization. Every consequential action passes a pre-flight check. The Guardian pipeline routes each action by risk: deterministic rule checks for the common path, a policy engine for mutations, and AI-backed review for destructive operations. Fail-closed where it counts. Opaque, instantly revocable tokens. Credentials are at_ references with no standing authority of their own . The server decides on every use, so revocation is one call, effective immediately. Scoped delegation. When one agent hands work to another, the grant narrows instead of copying : subset scopes, independent TTLs, independently revocable, bounded chain depth. Read-only sessions with time-boxed elevation. Sessions start safe and rise only on approval, for a bounded window, then revert on their own. One model across surfaces. MCP tools, agent-to-agent calls, and direct API inte

https://www.youtube.com/watch?v=VD9zEKQEJxo 这视频深入拆解了人工智能强化学习之父、图灵奖得主理查德·萨顿（Richard Sutton） 在2026年5月共同发表的一篇仅有7页、零算法、零跑分的哲学立场论文。这篇论文提出了 “行动认知 AI”（Enactive Artificial Intelligence，简称 Enactive AI）的概念，并在科技界和资本圈引发了巨大震动（甚至让红杉、英伟达、谷歌联合下注了11亿美元成立新公司）。 视频从 核心概念、哲学脉络、理论内在矛盾、认知科学质疑 以及 产业界的三路对赌 五个维度，极其详细地复盘了视频的所有核心内容： 一、 什么是“行动认知 AI”（Enactive AI）？ 视频强调，全网很多地方都把 Enactive （行动认知/生成认知）和 Generative （生成式 AI，如 GPT、Sora）混淆了，但两者的底层逻辑恰恰相反 [ 00:50 ]： 生成式 AI（Generative AI）： 核心是 续写和预测 。通过已有画面或文本，被动地去预测下一帧、下一个词长什么样 [ 01:07 ]。 行动认知 AI（Enactive AI）： 核心是 在互动中现生成认知 。认知不是大脑被动接收信号并建立静态世界模型，而是“你动了手，世界才向你显现” [ 01:47 ]。 > 举例： 人去拿杯子，不是眼睛先拍下一张静态照片让大脑去死算距离、角度 [ 01:53 ]，而是手往前探的过程中，随着角度、光影的实时动态变化，杯子的形状和可抓取性才在动作里一点点“长出来” [ 01:59 ]。 感知和行动硬死在一起，无法拆分。 这套理论源自认知科学中的 自创生（Autopoiesis）与自主性（Autonomy） [ 02:21 ]。它认为智能体应该像生物一样自我维持、组织，由内在生存需求去塑造感知，而不是一个干等着外部指令输入输出的机器 [ 02:24 ]。 二、 萨顿为什么要发这篇哲学论文？ 萨顿并不是一时性起，这是他为了对抗当前“大模型路线”打出的最后一张哲学底牌： 2019年《苦涩的教训》： 主张人类手写规则干不过堆算力、让机器自己学的通用方法 [ 02:47 ]。 2024年《大世界假设》： 真实世界远比静态内部模型复杂，智能体必须在运行中实时学习 [ 02:59 ]。 2025年《经验时代》： 人类数据是有限的，AI 必须靠自己生成自己的经验长大的 [ 03:12 ]。 2025年9月： 直指整个 AI 行业走错路，大模型堆数据去超智是死路一条 [ 03:19 ]。 这篇论文补上了最后一把火： 之前的论证全是算力、数据和复杂度的“机械账” [ 03:25 ]。而这一次，他第一次把强化学习（RL） 和 认知科学（行动认知）接在了一起，从本体论层面证明： 大模型路走不通，认识世界这件事本身，就只能通过行动和互动的经验来发生 [ 03:39 ]。 为此，2026年初论文共作者创办了 Ineffable Intelligence 公司，号称要造出完全不需要人类数据、靠自己学习的 AI，直接拿到了红杉、英伟达、谷歌 11 亿美元的巨额融资（估值 51 亿美元） [ 03:55 ]。 三、 论文隐藏的两大致命致命逻辑“回旋镖” 视频话锋一转，指出萨顿借来的这套哲学地基里，埋着两根砸中他自己的“大柱子”： 柱子 1：砸中了萨顿的“奖励假设”（自相矛盾） [ 04:35 ] 强化学习的号称教条： 奖励假设（Reward Hypothesis），即所有目标、意图都可以写成“最大化外部给定的标量分数” [ 04:53 ]。David Silver 甚至喊出“奖励就够了” [ 05:13 ]。 行动认知哲学的教条： 自主性（Autonomy），即什么是好坏、成败，标准必须从智能体随时会散架的“物理组织和生存危机”中自发长出来，不能由外部权威操控 [ 05:27 ]。 裂缝： 标准强化学习的奖励函数（Reward Function）是人类设计者用代码硬塞进去的（他律） [ 05:55 ]；而生物判断好坏是为了顶住熵增、维持结构不崩（自主） [ 06:11 ]。论文里作者自己也承认：强化学习的评估标准依然由外部奖励定义 [ 06:38 ]。 内驱动机能救场吗？ 比如好奇心驱动或求知驱动。视频认为不能，因为诸如“优化预测误差”的总结优化目标，依然是人类在架构层死死规定好的，根本不是智能体出于生存忧关的自发需求。没有真正的生命威胁，就没真正的意义生成 [ 07:12 ]。 柱子 2：砸中了萨顿自己的《苦涩的教训》 [ 07:49 ] 萨顿当年痛骂：研究者总忍不住把人类以为的思考结构（比如语法树、手工特征检测器）硬塞进 AI 架构里，这长期必被碾压 [ 08:13

Why This Deserves More Attention Than It Gets Credential leaks are one of the most common and preventable security incidents in software. Bots actively scan GitHub for newly pushed API keys, database URLs, and private credentials — and they find them within minutes of a commit going public. Rotating compromised credentials is painful, and in some cases the damage is done before you even realize what happened. This isn't just an enterprise problem. It happens on solo side projects, open-source repos, and internal tools at startups. And the root cause is almost always the same: someone treated secrets like regular configuration and didn't have a clear strategy for keeping them out of version control, logs, and error messages. The patterns in this guide aren't bureaucratic overhead. They're the minimum viable approach for any app that talks to a real database or a real API. What Environment Variables Actually Are An environment variable is a key-value pair that lives in a process's environment — a set of values the operating system makes available to any running program. Every process inherits the environment of the process that spawned it. In Node.js, you access them through process.env : const port = process . env . PORT ; const dbUrl = process . env . DATABASE_URL ; In Python: import os port = os . environ . get ( ' PORT ' ) db_url = os . environ . get ( ' DATABASE_URL ' ) The core idea — and the reason env vars are the standard approach — is that they decouple what the app does from where it runs . The same application code can point at a local development database or a production cluster. The code doesn't change; only the environment does. This is the heart of the 12-Factor App principle: store config in the environment, not in the code. The .env File: What It Is and What It Isn't In local development, you don't set environment variables by hand before every terminal session. Instead, you use a .env file — a plain text file at the root of your project with one key

The narrative around the major models today seems amazing on the face of it. Consider this article from Anthropic describing how far Claude has come and how much Anthropic code agents write now: When AI builds itself \ Anthropic If you are new to software and systems engineering or if you have only a superficial knowledge of it, then you may have missed the most important line in that article. So, I'm going to point it out to you. This is it: “Good code” means two things: it works, and it is written in a manner that allows another engineer to understand it and build upon it. Why is that line the most important? Because, that definition is, by far, the lowest bar I've ever seen an experienced software or system engineer set for "good code." There is so much more to engineering software than that. We care, for example, about total cost of ownership. So, we learn from work on technical debt, originated with Ward Cunningham, that quick fixes create future maintenance costs, that system complexity increases engineering effort, and that architectural debt often dominates long-term ownership costs. From Kent Beck, we learned how to avoid tangling our architectures, when he told us to "Make the change easy, then make the easy change." Many of our industry's luminaries warned us off of complexity, including Fred Brooks, John Gall, Sandi Metz, and more. Others have taught us that it isn't about the code itself. For example, Rob Pike taught us how important it is to get the data models right and Melvin Conway taught us about the impact of human communication on system design. These are but a few examples of the maxims every engineer needs to know, and understand, to build cost-effective, quality software and systems that meet functional and non-functional requirements. And this is where the model of AI agents building independently falls down. For engineers, we don't think about these specific rules every time we write code. We develop the "muscle memory" over time. We are int

The FTX co-founder is serving a 25-year sentence, doled out in 2024.

The popular wildfire tracking app is adding flood monitoring to its platform. It’s the first new disaster alert on the service, with many more to come.

I have 4 years of experience as a React Native and Node.js developer. I am comfortable with REST APIs, async/await, JSON, MongoDB, authentication, and shipping production apps. I am based in India. What I have learned so far: I recently completed an AI/LLM course that covered: • Pydantic (validation, models, serialization) • LLM theory (transformers, embeddings, attention, tokenization) • OpenAI and Gemini API integration • Prompt engineering (zero-shot, few-shot, CoT, persona prompting) • Prompt formats (ChatML, Alpaca, INST) • Ollama for local LLMs • FastAPI basics • Hugging Face model deployment • Agentic AI fundamentals — built a basic CLI coding agent What I understand conceptually: I understand that an AI agent = LLM brain + tools (Python functions) + agent loop + memory (messages list). I understand RAG, vector databases, the difference between fine-tuning and RAG, and how to structure a backend with Node.js calling a Python AI agent service when needed. What I want to do: I want to transition into Agentic AI / AI Engineer roles in India. I am not looking to become an ML researcher or train models. I want to build production AI agent systems — connecting LLMs to real business data, building tools, RAG pipelines, and shipping real products. My specific questions: 1. Is my current foundation strong enough to start building real agent projects or do I have gaps I am missing? 2. What should my learning roadmap look like for the next 3–6 months given my background? 3. Which frameworks should I prioritise — raw OpenAI API first, then LangChain/LangGraph, or jump straight to frameworks? 4. What kind of projects should I build for a strong portfolio targeting ₹20–35 LPA roles in India? 5. Any specific subreddits, communities, or resources beyond YouTube that helped you in this transition? My planned first 3 projects: • Simple agent with web search + calculator tool (no DB) • Agent connected to MongoDB with RAG • Full FastAPI backend wrapping the agent with a React fr

submitted by /u/techhunter_2026 [link] [留言]