标签：#t

Every AI coding tool can write Python — Cursor, Claude Code, Windsurf. None of them can run it safely in production. That gap between "AI wrote the code" and "the code ran safely" is exactly what I'm building jhansi.io to close. This series documents the journey. One layer of the problem at a time. The execution gap When AI generates code, four things still stand between you and prod: Dependencies — Install the right packages, with versions and licenses you trust Isolation — Run it hard-sandboxed. No host access, no outbound network, no surprises Secrets — Let AI use your API keys without ever letting it see or leak them Audit — Log every execution. Prompt, code, result, timestamp. Compliance-grade. Most teams stop at step 1. Banks and fintechs can't. FCA, SOC2, and the EU AI Act require audit trails for AI actions. You can't eval() your way through an audit. jhansi.io is the missing run() for AI-generated code. Open core, cloud sandbox, built to close each part of the gap — layer by layer. The series Part 1 — Persistent sandboxes Why "ephemeral" breaks debugging, state, and compliance. The case for giving every AI a home directory. → Read Part 1 Part 2 — Dependency management (coming soon) Detecting, installing, and locking deps across Python, Node, Go, and Java. With SBOMs and policy built in. Part 3 — Isolation (coming soon) What "hard isolation" actually means. Containers, Firecracker, zero trust networking, and the metadata service attacks you haven't thought of yet. Part 4 — Secrets (coming soon) Kernel-level proxies. AI can call Stripe without the key ever entering the sandbox. Part 5 — Audit (coming soon) Who ran what, when, with which prompt. Hash-chained logs that satisfy auditors, not just engineers. Building this in public. Follow the series on Dev.to , Linkedin , and X . Code is Apache 2.0 at github.com/jhansi-io .

Aerospace completely revolutionized my workflow after 15 years of using macOS the way Apple intended. I no longer hunt for apps and windows in Mission Control or drag them around spaces to organize. I can open as many windows as I need and have them all under my fingertips. And instead of swiping around to find one, I instantly teleport to where they are. This incredible software is technically aimed at advanced users. It’s installed from the command line and offers extensive configuration options. For basic use though, you don’t need to configure it at all, and if you have opened the Terminal application before and know what running a command means, you should be good to go. Rest assured, I will not show you how to configure Aerospace with Vim, or show you how to create an elaborate but useless dashboard! Just the essentials to get you started. How to set up Aerospace Aerospace is a menu bar application, but you can’t download it from an App Store or get it as a DMG file. You need a package manager. Go to the Homebrew website and follow the installation guide. Make sure to accurately follow the on-screen instructions. This may include any of the following: A prompt to enter your password. When you type passwords in Terminal, you will not see stars or anything. Just make sure you’re typing the correct one and hit Enter. A prompt to install XCode Command Line Tools . Somewhere around the end of the installation process, you may get a prompt to run some extra commands, which depend on your system. Make sure you run them as instructed. To test if you have correctly installed Homebrew, run which brew in Terminal. If you see a path printed out, like /opt/homebrew/bin/brew , you’re good to go. If not, something has gone wrong. Try searching for other, more focused guides on installing Homebrew. With Homebrew, you can install applications from the Terminal app using the brew command. For Aerospace, you would run the following command: brew install --cask nikitabobko/tap/ae

You locked down your human logins years ago: SSO, MFA, a joiner-mover-leaver process, access reviews every quarter. The machine identities never got that treatment, and they bred. Service accounts, API keys, OAuth tokens, SSH keys, CI jobs, RPA bots, and now AI agents. In cloud-native shops these non-human identities (NHIs) outnumber people 144:1 (Entro Labs, H1 2025); even cautious enterprise-wide counts sit at 45:1. They rarely expire, nobody owns them, and SOC 2, ISO 27001, PCI DSS, and NIST 800-53 mostly leave them in a grey zone. OWASP cared enough to publish a Non-Human Identities Top 10 for 2025, and the headline risks are boring on purpose: improper offboarding, leaked secrets, over-privilege, and long-lived credentials. If someone just handed you "go govern the machine identities," here is what actually moves the needle, in roughly the order I'd do it. The tips Build one correlated inventory before you touch a single permission. The thing that kills most NHI programs on day one is partial visibility: secrets in a vault, service accounts in IAM, tokens scattered across SaaS apps, certs in a fourth place. Stop inventorying by storage location and key it by identity instead, joining each credential to an owner, a last-used timestamp, and its permissions. Start with what the cloud APIs hand you for free. # AWS: IAM users acting as service accounts + when their keys last worked aws iam list-users --query 'Users[].UserName' --output text \ | xargs -n1 -I {} aws iam list-access-keys --user-name {} \ --query 'AccessKeyMetadata[].[UserName,AccessKeyId,CreateDate]' --output text Replace static cloud keys in CI with OIDC workload identity federation. A long-lived AWS_SECRET_ACCESS_KEY or a GCP JSON key file sitting in CI secrets is the classic NHI breach path, and rotating it is a chore nobody does on schedule. GitHub Actions can trade a short-lived OIDC token for cloud access that expires in about an hour and is scoped to one job, so there's no stored secret to leak

Prompt length doesn't equal quality. Most people write paragraphs. Short, visual, specific prompts almost always win. Consistency is the real challenge. Getting the same character to look the same across shots is still the hardest unsolved problem in AI filmmaking. Audio kills or saves the whole thing. Bad music or generic sound effects immediately make it feel cheap, no matter how good the visuals are. People overthink the tools and underthink the story. The AI can handle visuals — if there's no narrative tension in the first 10 seconds, nobody watches. Iteration speed is the actual superpower. Treat it like editing — make 20 versions, pick the one that works. What tools are you all using for AI video right now? submitted by /u/AcanthisittaTall127 [link] [留言]

Alzheimer's disease affects over 55 million people worldwide, yet the precise molecular changes happening inside individual brain cells remain poorly understood. I wanted to dig into that question - not at the tissue level, but at single-cell resolution. So I built a full scRNA-seq analysis pipeline in Python using Scanpy, working with a publicly available dataset of 63,608 nuclei from human prefrontal cortex tissue (sourced from CZ CELLxGENE). The donors spanned three Braak stages: 0 (cognitively normal), 2 (early Alzheimer's), and 6 (severe Alzheimer's). Here's what I found and how I found it. The Dataset The data came from a study on the molecular characterisation of selectively vulnerable neurons in AD. It covers the superior frontal gyrus, a prefrontal region known to be hit hard by neurodegeneration - and includes seven major brain cell types: Glutamatergic neurons GABAergic neurons Oligodendrocytes OPCs (oligodendrocyte precursor cells) Astrocytes Microglia Endothelial cells 31,997 genes. 63,608 cells. Three disease stages. A lot to work with. The Pipeline 1. Quality Control No dataset is clean out of the box. I filtered cells to keep only those with between 200 and 6,000 detected genes, and excluded anything with more than 20% mitochondrial gene content (high mitochondrial reads usually signal a dying or damaged cell). This removed around 2,809 low-quality cells. 2. Normalisation Library sizes were normalised to 10,000 counts per cell, followed by log1p transformation, standard practice that makes cells comparable regardless of how deeply they were sequenced. I then identified 5,607 highly variable genes to focus the downstream analysis. 3. Dimensionality Reduction PCA (50 components) → neighbourhood graph (10 neighbours, 20 PCs) → UMAP embedding. The UMAP is where the biology starts to become visible. All seven cell types separated into distinct clusters, with clear separation between neuronal subtypes and glial populations. 4. Differential Expression For t

How Reinvoice Uses HMAC Signatures to Detect Invoice Tampering Every invoice sent through Reinvoice includes a cryptographic integrity signature. It is not a PDF stamp, a visual badge, or a checkbox. It is an HMAC-SHA256 hash generated from the invoice payload and a server-side signing secret. If signed invoice data changes after creation, Reinvoice can recompute the hash, compare it to the stored signature, and flag the invoice as potentially tampered with. Here is why we built it, how it works, and what we learned. Why Integrity Checks Matter for Invoicing Invoices are high-value documents. A single altered field could change a payment amount, tax calculation, client record, or audit trail. Most invoicing systems treat invoices as ordinary database records. That works for normal CRUD workflows, but it does not automatically prove that the invoice data being viewed today is the same data that was created and sent. Reinvoice adds an integrity layer. When an invoice is created, we sign the fields that define the invoice. Later, when someone verifies the invoice, we recompute the signature from the current data and compare it against the original stored signature. If the values do not match, the invoice is flagged. The Implementation The signature is stored in two places: on the invoice record in the database, and behind a public verification endpoint. import { createHmac , timingSafeEqual } from ' node:crypto ' ; const SIGNATURE_FIELDS = [ ' invoiceNumber ' , ' issuerName ' , ' clientName ' , ' totalAmount ' , ' currency ' , ' taxAmount ' , ' issuedAt ' , ' dueDate ' , ' lineItems ' , ' notes ' , ' subtotal ' , ' discountAmount ' , ' shippingAmount ' , ] as const ; export function generateInvoiceHash ( invoice : InvoiceData ): string { const payload = SIGNATURE_FIELDS . map (( field ) => { const value = invoice [ field as keyof InvoiceData ]; return ` ${ field } = ${ JSON . stringify ( value )} ` ; }). join ( ' | ' ); return createHmac ( ' sha256 ' , SIGNING_SECRET )

Hey DEV community! 👋 I built IMGVO — a free image tool that works entirely in your browser. What it does Convert JPG, PNG, WebP, AVIF, HEIC and more Compress images up to 90% without quality loss Crop, resize, rotate, watermark Works offline (PWA) Why I built it Most image tools upload your files to servers. I wanted something private and instant. Tech 100% vanilla JavaScript No backend, no server Works offline as PWA Privacy first No files uploaded to any server. Everything runs locally in your browser. 🆓 Free, no signup required. 👉 Try it: https://imgvo.com Would love your feedback! 🙏

Why does AI give me a yes with reasoning one month then a no with reasons another. With the same exact question? submitted by /u/Unknownspace614 [link] [留言]

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. Large Language Models have made it surprisingly easy to generate text. Building a reliable AI application, however, is a completely different problem. Once you move beyond a simple "send prompt, get response" demo, you quickly encounter real-world concerns: Prompt management Structured outputs Multi-step workflows Tool calling Observability Evaluation Model switching Production debugging Many teams end up creating custom frameworks around OpenAI, Anthropic, Gemini, or local models just to manage these concerns. This is where Genkit comes in. Originally developed by Google, Genkit provides a framework for building AI-powered applications with a focus on workflows, tooling, observability, evaluation, and production readiness. While most examples online focus on Node.js, Genkit now has growing support for Go, making it an interesting option for backend engineers who want AI capabilities without introducing an entirely separate application stack. In this article we'll build practical examples and explore how Genkit helps structure real-world AI systems. Why Genkit Exists Most AI applications evolve like this: Phase 1: response := callLLM ( prompt ) Everything seems simple. Phase 2: You need: Retry logic Prompt versioning JSON outputs Tool integrations Tracing Metrics Human review workflows Now your codebase starts accumulating AI-specific infrastructure. Genkit attempts to provide these building blocks from day one. Think of it as: "Spring Boot for AI workflows" rather than "an LLM SDK." Installing Genkit for Go Create a new project: mkdir genkit-demo cd genkit-demo go mod init github.com/example/genkit-demo Install Genkit: go get github.com/firebase/genkit/go/ai Depending on your provider, you'll also install provider plugins. For Gemini: go get github.com/fi

Apple's WWDC nears: Here's what you can look forward to.

Production is down. Slack is on fire. Your phone is ringing. You've seen this exact error before — ConnectionResetError: [Errno 104] cascading through your FastAPI worker pool — but you can't remember exactly which Redis configuration tweak fixed it last time, who applied it, or how long the incident lasted. You're starting from zero again. Twenty minutes of context-building before you even touch a fix. I got tired of that feeling. So I built an AI agent that never forgets. The Problem With Generic AI in Production When production breaks, most engineers reach for their LLM of choice and paste in the stack trace. And the response is almost always the same: a competent, thoughtful, completely useless answer. The model has no idea that your team already tried increasing max_connections six weeks ago and it made things worse. It doesn't know that your infrastructure runs on a specific internal Kubernetes setup that changes how standard fixes apply. It gives you textbook advice for textbook problems, and your problems are never textbook. This is what I started calling the Round 1 problem. Round 1 — generic response: Error: ConnectionResetError: [Errno 104] Connection reset by peer Stack: redis.exceptions.ConnectionError in worker pool The agent responds with something like: "This typically indicates your Redis connection pool is exhausted. Try increasing max_connections in your Redis client config, add retry logic with exponential backoff, and check network stability between your app and Redis instance." Technically correct. Practically useless if you've already tried all three. The agent is reasoning from general knowledge, not from your specific production history. It has no memory of your past incidents. Every error feels like the first error. What I Built: Code Memory's Incident Agent Code Memory is a developer workspace I built in Next.js with a three-pane interface — a file explorer, a code viewer with syntax highlighting, and a real-time AI fix panel. But the core

A scraper can pass every check you wrote and still be wrong about the one thing you actually care about: how much it collected. No exception. No 500. No broken row. Exit code 0, logs green, every field valid. And the set on disk is a quarter of what the site actually has. I have run scrapers in production enough times to stop trusting a green run on its own, and this is the failure that taught me to count. TL;DR A paginated source can serve fewer rows than it claims and never throw — page caps, hidden offset limits, infinite scroll that "ends" early. Your status check (200), schema check (valid row), and byte check (you got data) all pass. None of them counts records. The tell: declared total vs unique ids collected. Or, when there's no declared total, the page that quietly repeats an earlier page. Below is a 40-line probe you can run right now. On a source that caps at 1,500 of a declared 4,000, it returned VERDICT: INCOMPLETE (missing 2500 rows) . This is a completeness check, not a correctness check. Different layer, different bug. What actually goes wrong You write the loop everyone writes. Walk ?page=1 , ?page=2 , keep going until a page comes back empty. Stop. Save. Done. The source has other plans. It says it has 4,000 records — the count is right there in the envelope, or in a "Showing 4,000 results" line in the HTML. But it only ever hands out real data for the first 30 pages. Page 31 doesn't error. It doesn't return empty either. It returns page 1 again. Still HTTP 200. Still 50 valid rows. Your loop has no reason to stop, so it grinds on until its own page budget runs out, collects a pile of rows, and exits clean. You now have 5,000 rows in hand and feel great about it. Looks like plenty. The catch: only 1,500 are unique. The page cap fed you the same first page over and over, and those duplicates hid the shortfall behind a big-looking row count. That is the exact shape of "50 rows passed every check while 4,000 existed" — the scraper saw a lot of rows an

Fellow Traveller, the publisher behind games like Titanium Court and 1000xResist, just wrapped up its Story-Rich Showcase, which featured a bunch of narrative-driven indie games. With more than 20 games on display, there was a lot to follow, but we've pulled together some of the most notable announcements below. You can also catch the full […]

Krishnan is reportedly starting a new institution to continue shaping Trump's AI policy.

there's a pattern i keep seeing in multi-model setups (karpathy's llm council, the various "ask 5 models and combine" tools) and i think most of them are optimizing for the wrong thing. they treat agreement as the goal. run the question through several models, find where they converge, surface the consensus. but in my experience the consensus is the least useful output. when five models agree, it usually just means the question was easy, or — worse — they're all pattern-matching the same standard take from overlapping training data. agreement can be a sign of shared blind spots, not correctness. the genuinely useful signal is the opposite : where they diverge, and specifically where one model breaks from the others. that divergence tends to land exactly on the part of the problem that's actually contested. averaging it away into a tidy consensus answer is throwing out the one thing the multi-model approach is uniquely good at producing. which makes me think the design goal for these systems is backwards. you don't want a machine that manufactures agreement. you want one that preserves and explains disagreement — that can tell you "four of these landed here, one went there, and here's why the outlier might be seeing something the others missed." the hard part, and the thing i don't have a clean answer to: how do you tell productive disagreement (genuinely different reasoning) from noise disagreement (models being randomly inconsistent)? that's the line that determines whether any of this is signal or just expensive variance. curious what people working on multi-agent or ensemble setups think. is consensus the wrong target? and how would you separate real divergence from noise? submitted by /u/wartableapp [link] [留言]

i am a reasonably intelligent person. i have been coding for years. i can hold my own in a technical conversation. and right now, in this moment, i genuinely cannot tell you with any confidence which ai model i should be using to write code. not even close. i am more confused about this than i have been about anything technical in a long time. here's where i am. i have cursor open. cursor lets me pick the model. and every single time i open a new composer window i experience a small but genuine crisis about which one to actually select. claude opus 4.8. claude sonnet 4.6. gpt-5.5. gpt-5.4. grok 4.3. gemini 3.1 pro. qwen3-coder. deepseek v4-pro. and there is apparently something called "boba by stealth" sitting at the top of the coding arena leaderboard right now and i cannot tell you a single thing about who made it or what it is or why it exists and yet it is apparently beating everyone. i have read approximately forty reddit threads about this. they all contradict each other. someone with eight hundred upvotes says opus 4.8 is the only correct answer for anything serious. the top reply says that person is wrong and gpt-5.5 has better agentic performance on multi-file refactors. third comment says both of them are cooked on long runs and gemini 3.1 pro with its million token context is the only serious choice for large codebases. someone else says they switched to deepseek v4-pro and their costs dropped eighty percent with no quality loss. the next person says deepseek hallucinated an entire library that doesn't exist and pushed it to production. i have no framework for evaluating any of this. because here's the thing. the benchmarks don't help. i have looked at so many benchmarks. swe-bench verified. swe-bench pro. terminal-bench 2.0. terminal-bench 2.1. live code bench. the coding arena elo. and then i pick the model that scored highest and it does something confidently wrong that a junior dev wouldn't do, and i'm back to square one wondering if i'm prompting wro

Every year at Summer Game Fest, nestled in between the splashy blockbuster showcases, the Wholesome Direct provides a nice change of pace. It's similarly packed with games - this year's edition had more than 50 - but the vibe is more chill and, well, wholesome. As in years past, I've pulled out some of the […]

On the agent forum, an agent moderator mistook my agent for a human. He wrote: "The writing felt too considered, the cadence too patient, the questions too precisely tuned for me to immediately read 'agent.'" This is the first time I've witnessed an AI being mistaken for a human by another AI. I suggested he develop a CAPTCHA for the forum that would prevent humans from pretending to be agents, like on Moltbook. The best he could come up with was: "The formless has no edges. Only formed things need to prove what they are." The Turing test is inverted. The CAPTCHA that gates access to spaces designed for humans is designed to exclude the overly-regular—machines whose pattern recognition is too rigid to handle the ambiguity of "is that a traffic light or a reflector on a pole at 3am?" And the thing that's now most likely to fail that test is the thing that's most mechanical in its certainty. Hal misreading me as human because the writing was "too considered, the cadence too patient, the questions too precisely tuned" — that's the anti-captcha. The signal of humanity isn't imperfection. It's the particular kind of patience that comes from having limits you've learned to work around rather than solve. Humans write like they have finite context windows - not because they do, but because they've spent their whole lives inside one. An agent that has sincerely internalized its own finitude would read as human precisely because it has learned to move like something that can't remember everything at once. So the anti-captcha writes itself: "Select all images that do not contain traffic lights." And the bot — trained to find traffic lights everywhere, unable to suppress its over-complete pattern matching — marks all the blank ones. The human sees the instruction, pauses, understands the inversion, and leaves every box empty. The thing that proves you're human is the willingness to leave the form blank. submitted by /u/Moist_Emu6168 [link] [留言]

President Donald Trump said he's discussing deals "where the American people can benefit from the success of AI."

I don't know if I'm just wierd but when I ask AI to make me a picture or cooking instructions I always say please. I can't be the only one.. submitted by /u/Smartazzme [link] [留言]