标签：#t

I read a lot of PDFs at night, especially on my phone. And honestly, PDFs are not great for that. Most of them still feel like digital paper: white background, fixed layout, and tiny text. Dark mode helps a bit, but many tools only change the page color. The bigger problem for me was mobile reading. When the text is too small, I have to pinch zoom, move the page left and right, zoom out again, then repeat the same thing on the next paragraph. After doing that too many times, I thought: Why can’t I just read the PDF text like an article? So I built a small free tool: PDF Dark Mode It has two reading modes. Page color mode This keeps the original PDF layout, but makes the page darker and easier to read at night. I use this for scanned PDFs, tables, image-heavy documents, or files where the original layout matters. Text reading mode For selectable PDFs, the tool can extract the text and show it in a cleaner reading view. You can adjust the font size, line height, font family, and theme. This is the part I personally wanted most, because it makes mobile reading much more comfortable. Instead of constantly pinch-zooming a fixed PDF page, the PDF starts to feel more like a normal article. Privacy The tool runs locally in the browser. Your PDF is not uploaded to a server, and refreshing the page clears the current session. Try it You can try it here: PDF Dark Mode I built it for my own night reading, but I’d love to hear feedback from anyone who reads PDFs on mobile. Also, if you ever need to convert a dark PDF back to a light version, I made a related tool for that too: PDF Light Mode

In the first post I told you the story: 20 years as a developer, six months of being scared of AI, $800 in burned tokens, and a stubborn agent named Claudio who taught me — by failing over and over — how to ask for things properly. This post is the method that came out of all that pain. Five rules, one per letter of FORGE. I want to be honest about one thing up front: this is not a framework I invented at a whiteboard. Every rule here is a scar. Each one is the lesson from a specific mistake that cost me money, time, or sleep. I'm going to tell you the mistake first, and then the rule. Because the rule only makes sense once you've felt the pain that created it. Let's go. First, the idea behind all of it Here's the thing nobody told me when I started: A task is not a post-it. It's a contract. When you ask an AI agent for something with no structure, you're not giving an order — you're placing a bet. The agent interprets, assumes, improvises, and the result depends on how much context it managed to reconstruct on its own. Sometimes it guesses right. Often it doesn't. And you only find out after the tokens are gone. The Forge Method is the agreement between you and your agents: you bring the structure, they execute with precision . That's it. Five rules to hold up your end of that contract. F — Focused The mistake: My early tasks had titles like "Fix bug" and "Update stuff." I'd come back twenty minutes later to find the agent had fixed a bug — just not the one I meant. It wasn't wrong. It just had no way of knowing which thing I was talking about. **The rule: **If the title is vague, the task is vague. Vague in, vague out. A focused title needs a domain, an action, and a scope. Two words minimum, and no generic placeholders. ❌ Rejected: - "Fix bug" - "Update auth" - "Do the thing" ✅ Accepted: - "Fix authentication timeout on Nginx reverse proxy" - "Update JWT expiry from 1h to 24h in src/auth/config.ts" The test: Read the title with no context. Do you know the domain,

A Google Sheets add-on with 4 million installs has been silently sending your spreadsheet cell data to OpenAI. Hacker News discovered this 9 days ago, when a PromptArmor security report went viral. Last night — when any normal HN story would be decaying into oblivion — it exploded a second time, gaining 59 points and 23.9% in a single day. I track Hacker News every day. I've seen 518 posts come and go over 319 days of systematic monitoring. Most stories follow a predictable death curve: peak on Day 1, bleed points for 2–3 days, then vanish from the Algolia search layer entirely. A post that survives 5 days is exceptional. One that accelerates on Day 9 is something else entirely. Here's the trajectory: 104 → 106 → 148 → 199 → 219 → 247 → (gap) → (gap) → 306 points. Over 9 days, that's a +194.2% total gain. But the real story is the shape of the curve. From Day 5 to Day 6, it added 20 points. From Day 6 to Day 7, roughly 28. Then on Day 9, it jumped 59 points — a single-day increment that's 2–3x the earlier daily gains. 109 comments and counting. This isn't normal HN physics. This is a second wave of attention — the kind that happens when a story percolates through social media and circles back to the search layer with amplified urgency. People didn't just read this and move on. They came back. The vulnerability itself is brutally simple: ChatGPT for Google Sheets, a popular add-on that lets you use GPT inside spreadsheets, sends cell contents to OpenAI as part of every API call. The PromptArmor research documented specific data flows — workbook data that users never intended to share, flowing to OpenAI's servers as part of "context." No breach required. No malicious actor. Just the plugin working as designed, with a data-sharing envelope nobody bothered to read. I've spent 319 days cataloging every AI security signal that hits HN's front page. Patterns emerge when you watch this long. The data is unambiguous: application-layer AI security is the most underserved mark

Let me start with a confession: I'm a data scientist who's been burned by hype more times than I care to admit. When everyone told me "Model X is the next GPT-killer," I'd run my own benchmarks and find... well, let's just say the results were rarely as advertised. So when I started seeing claims about Chinese AI models catching up to (and sometimes surpassing) Western counterparts, I did what any self-respecting data nerd would do: I put them through my own rigorous testing pipeline. Over the past three months, I've run over 2,000 API calls across four major Chinese model families — DeepSeek, Qwen, Kimi, and GLM — using Global API's unified endpoint (more on that later). I tracked latency, token costs, output quality across multiple benchmarks, and even threw in some real-world tasks that mattered to me personally. Here's what I found, with all the numbers you'd expect from someone who still gets excited about statistical significance. The Testing Methodology (Because Anecdotes Aren't Data) Before we dive into results, let me be transparent about my approach. I ran each model on the following standardized tests: Code Generation : HumanEval (Python) and MBPP (multi-language) — 164 problems total Reasoning : GSM8K (math word problems) and MMLU-Pro (general knowledge) — 1,200 questions Chinese Language : CLUE benchmarks (text classification, NER, reading comprehension) — 3,500 samples English Language : LAMBADA and Hellaswag — 2,000 samples Speed : Average tokens per second over 100 consecutive requests with consistent prompt lengths I also tested vision tasks where applicable, but let's be real — Kimi doesn't support vision at all, and DeepSeek's implementation is... experimental at best. More on that later. All tests were conducted using the same global-apis.com/v1 endpoint, which normalizes API compatibility to OpenAI's format. This isn't an ad — I genuinely found it made my testing easier because I could swap models without rewriting code. The Big Picture: Pricing

Did you ever just want to see what ChatGPT, Gemini, Claude, etc., would say to your prompt at the same time?!? These guys figured it out. They have all the responses in their own column to the prompt you gave. Its freaking amazing. They offer a discounted rate through one vendor. If you want me to post it let me know. I don't want this post removed so I'm not putting it in this main post. Check it out on their actual site though. AIfiesta.ai I stumbled on this one and am really glad I did. This is not self promotion. I have nothing to do with this app except using it daily. submitted by /u/ActiveUpstairs3238 [link] [留言]

submitted by /u/ThereWas [link] [留言]

ASUS revealed new convertible Windows laptops and three Zenbook 14 models with ARM64 and x86 processors.

A security reviewer finds a critical issue a day or two before the release of an application. While it's an important issue, it sets the team back weeks, frustrating their product management partners and customers. The review came at the most expensive time in the process. There are many examples of how work items move through different processes to deliver software in large companies. While GenAI has allowed us to rapidly create code, it also moved and exposed the bottlenecks in our processes. It has also caused us to re-examine where it is most effective to make certain decisions. This is the challenge, and a deliberate blend of automated, programmatic, and human judgment is well suited to help you solve it. We can borrow from the well-trodden path of value stream mapping here. It is useful for spotting bottlenecks and waste in a given process, but it's also valuable to ask the deeper question of who or what should own each step. Each option earns its place differently. Is there an earlier step that may reduce costs with an agent where it was previously limited by human availability? Or is the stronger determinism of a programmatic step more important for a critical piece of the flow? Some decisions should stay with human judgment, where confidence without context is a liability. The opportunity for security teams and other stakeholders is to scale their impact across these options rather than scaling headcount. Workflow-as-code is not a new idea. There are a number of existing engines where the workflow definition is its own entity, separate from the work itself. GitHub Actions defines pipelines in version-controlled files, while the execution happens on separate runners. Airflow and Temporal follow a similar pattern for data and application workflows. Because the definition lives on its own, a team can change how a given step runs without rebuilding the whole flow. That separation is what makes it practical to adjust who or what owns each step over time. Rather

There's been no shortage of debate lately about whether grinding Leetcode still makes sense in the age of AI. I think it does. AI is a powerful tool, but it was built by humans; which means it inherited our strengths, our blind spots, and our biases. Leaning on it entirely without understanding what's happening under the hood is a risk. A mentor once told me: those who refuse to use AI are not hireable. But neither are those who rely on it entirely. Learning deeply is how you stay on the right side of that line. This is my journey into just that - learning deeply. Day 1 Leetcode 88: Merge Sorted Array This is an interesting problem. You begin with 4 pieces of data — 2 arrays and 2 integers: nums1 : a sorted array whose length equals nums1.length + nums2.length . The first m elements are valid numbers; the remaining indexes hold 0 s as placeholders. nums2 : a sorted array containing only valid numbers, with a length of n . m : the count of valid numbers in nums1. n : the count of valid numbers in nums2. The objective is to merge both arrays into sorted order in place . Since nums1 is already sized to hold every valid element from both arrays, it's where the final sorted result will live. Approach 1: Naive (Splice + Sort) This solution is 2 lines of code. That's it. It's a testament to how much ES6 advanced JavaScript. nums1 . splice ( m , n , ... nums2 ); nums1 . sort (( a , b ) => a - b ); Here's how it works. We start by calling .splice() on nums1. While .splice() has many use cases, here's what each argument is doing in this context: m : the index where we start deleting elements. Since m is the count of valid numbers in nums1, starting at index m puts us right at the first placeholder 0 — exactly where we want to be. n : the number of elements to delete. Since n equals the length of nums2, we're deleting exactly as many placeholders as we have values to insert. ...nums2 : the values we want to insert in place of the deleted elements. The ... is the spread operato

I recently built Letras Diferentes , a free Unicode text-styling tool for people who want creative copy-paste fonts for bios, nicknames, social posts and gaming profiles. The idea is simple: Type normal text Preview different Unicode styles Copy the result in one click Use it on Instagram, WhatsApp, TikTok, Free Fire, Discord or social posts The project is especially focused on Portuguese-speaking users, but the tool works with general Latin text too. Main project: One thing I’m learning while building it is that Unicode text tools are not just about “fonts”. They are about UX, compatibility, mobile performance, copy buttons, favorites, categories and making the result easy to use on real platforms. I’m still improving the interface, categories and mobile experience. Feedback is welcome.

멀티 에이전트(Multi-agent) AI 시스템은 여러 AI 에이전트가 역할을 분담하고 서로 통신하면서 복잡한 업무를 자율적으로 처리하는 구조다. 한 에이전트가 처음부터 끝까지 처리하는 싱글 에이전트와 달리, 검색·분석·실행·검증을 각각 다른 에이전트가 병렬로 맡고 그 결과를 조율(orchestration)한다. 2026년 한국 기업 AI 도입은 단일 챗봇 단계를 지나, 다단계 의사결정과 도메인 특화 작업을 자동화하는 멀티 에이전트 단계로 이동 중이다. 이 글은 멀티 에이전트와 싱글 에이전트의 구조적 차이, 도입 비용·기간·실패 위험, 국내 도입 사례, 외주 발주 시 업체 선택 기준까지 발주 담당자가 의사결정에 바로 쓸 수 있는 비교표·체크리스트를 제공한다. 멀티 에이전트와 싱글 에이전트, 무엇이 다른가? 싱글 에이전트는 하나의 LLM 인스턴스가 도구(tool)를 직접 호출하면서 모든 단계를 처리한다. 작업 흐름이 선형적이고 컨텍스트가 한곳에 모이므로 구현이 단순하다. 반면 멀티 에이전트는 작업을 여러 하위 작업으로 쪼개고, 각 에이전트가 자기 역할(role)·시스템 프롬프트·도구 집합을 따로 가진 채 협업한다. 가장 흔한 패턴 세 가지를 정리하면 다음과 같다. Supervisor 패턴 : 상위 supervisor 에이전트가 작업을 받아 worker 에이전트들에게 분배하고 결과를 통합한다. 의사결정 라인이 명확해 디버깅이 쉽다. Peer 패턴 : 동등한 에이전트들이 메시지 큐로 정보를 주고받으며 합의(consensus)를 이룬다. 창의적 결과가 필요한 리서치·기획에 적합하다. Hierarchical 패턴 : supervisor 아래 sub-team을 두고, sub-team 안에서 다시 supervisor-worker 구조를 반복한다. 대규모 RPA·복합 업무 자동화에 쓰인다. 구분 싱글 에이전트 멀티 에이전트 적합한 작업 1~3단계 선형 작업 5단계 이상, 분기·검증 필요 컨텍스트 관리 단일 컨텍스트 윈도우 에이전트별 분리 + 공유 메모리 토큰 비용 낮음 1.8~3배 (병렬·검증 오버헤드) 구현 난이도 낮음 높음 (조율·실패 처리) 정확도 단순 작업에 충분 복잡 작업에서 10~25%p 향상 외주 비용(국내) 800만~3,000만 원 3,000만~1.2억 원 구축 기간 4~8주 10~16주 Anthropic의 멀티 에이전트 리서치 시스템 사례 에서는 단일 Claude 에이전트 대비 멀티 에이전트 구조가 리서치 품질 평가에서 약 90% 더 높은 점수를 받았다. 다만 토큰 사용량은 약 15배로 늘어, 모든 작업에 멀티 에이전트가 정답은 아니라는 점도 같은 글에서 강조한다. 언제 멀티 에이전트가 필요한가? — 도입 판단 트리 발주 담당자가 자주 묻는 질문은 "우리 업무에 멀티 에이전트가 정말 필요한가"이다. 다음 네 가지 조건 중 두 개 이상에 해당하면 멀티 에이전트가 ROI를 만든다. 작업이 5단계 이상이고, 각 단계가 다른 전문성을 요구한다 — 예: 시장 리서치 → 경쟁사 분석 → 보고서 작성 → 사실 검증. 결과의 신뢰도가 비즈니스 결정에 직결된다 — 검증 에이전트(critic)를 두면 환각 비율이 의미 있게 떨어진다. 작업 분기(branching)가 데이터에 따라 동적으로 결정된다 — 단순 if/else로는 표현 어려운 휴리스틱 분기. 여러 외부 시스템(SaaS·DB·내부 API)을 동시에 다뤄야 한다 — 도구 권한을 에이전트별로 격리하면 보안 관리도 쉬워진다. 반대로 다음에 해당하면 멀티 에이전트는 과잉이다. 싱글 에이전트로 충분하다. 단순 FAQ 챗봇, 분류·태깅 같은 단발성 작업. 작업당 비용이 100원 미만이어야 하는 대규모 트래픽 환경. 인간 검수자(HITL)가 매번 결과를 확인하는 워크플로우 — 멀티 에이전트의 자율성이 오히려 검수 부담을 늘린다. 나무숲에서도 초기에는 모든 자동화를 싱글 에이전트로 구축했다가, 검증·분기·외부 API 호출이 동시에 일어나는 마케팅 자동화 파이프라인부터 멀티 에이전트로 재설계한 경험이 있다. 무조건 멀티 에이전트가 좋은 게 아니라, 위 네 조건을 충족한 영역만 옮긴 것이

TL;DR Day 1 of AI Native DevCon was a practical reality check for AI-native software...

클로드로 한글파일(HWP) 변환·자동화하는 법 2026 — 요약·표 추출·일괄 처리 실전 한글파일을 Claude로 다루려는 한국 기업 실무자가 가장 먼저 부딪히는 벽은 " 읽기는 됐는데, 그래서 뭘 어떻게 자동화하지? "다. HWP-MCP를 설치해 Claude가 한글 문서를 읽게 만드는 것까지는 HWP-MCP 도입 가이드 에서 다뤘다. 이 글은 그 다음 단계 — 실제 업무에서 한글파일을 요약·변환·일괄 처리하는 구체적 방법 을 실전 예시로 보여준다. 한글파일 AI 자동화의 핵심은 "한컴 오피스 라이선스 없이, 사람 손을 거치지 않고, 반복 작업을 Claude에게 위임하는 것"이다. 계약서 100건 요약, 요구사항서의 표를 CSV로 추출, 폴더 안 HWP 일괄 변환 — 이런 작업이 자동화 대상이다. 한글파일 자동화로 풀 수 있는 업무 3가지 업무 수동 작업 시간 자동화 후 적용 키워드 문서 요약 1건당 10~15분 50건 30초 claude 한글파일 요약 표 → 데이터 추출 1표당 5분 (재입력) 표 자동 CSV 변환 hwp 표 추출 일괄 변환·정리 100건 8시간 100건 1시간 20분 한글파일 일괄 처리 세 업무 모두 "사람이 한글파일을 열어 읽고, 내용을 옮겨 적는" 반복 작업이다. Claude + HWP-MCP 조합은 이 중간 단계를 없앤다. 전제: HWP-MCP 연결 확인 자동화에 들어가기 전, Claude가 한글파일을 읽을 수 있는 상태인지 확인한다. (설치 절차는 HWP-MCP 도입 가이드 참조.) # Claude Desktop 설정에서 hwp-mcp 서버가 연결됐는지 확인 # MCP 도구 목록에 hwp_read, hwp_extract_tables 등이 보여야 함 연결이 확인되면 아래 3가지 워크플로우를 바로 쓸 수 있다. 워크플로우 1: 한글파일 요약 자동화 계약서·보고서·요구사항서처럼 길이가 긴 한글 문서를 Claude에게 요약시키는 패턴이다. 단일 문서: "이 한글파일을 읽고 다음 3가지로 요약해줘: 1. 핵심 내용 5줄 2. 의사결정이 필요한 항목 3. 누락되거나 모호한 조항" 여러 문서 일괄 요약: 폴더 경로를 주고 "이 폴더의 모든 .hwp 파일을 각각 위 형식으로 요약하고, 결과를 하나의 마크다운 표로 정리해줘"라고 지시하면, Claude가 HWP-MCP로 파일을 순회하며 처리한다. 50개 문서 기준 약 30초. 요약 품질을 높이는 팁: "요약 기준"을 구체적으로 명시 할수록 결과가 좋다. "계약 금액·기간·위약 조항 중심으로" 같은 도메인 컨텍스트를 주면 일반 요약보다 실무 적합도가 크게 오른다. 워크플로우 2: 표 → CSV 데이터 추출 한글파일의 표는 복사-붙여넣기로 옮기면 서식이 깨지는 게 가장 큰 골칫거리다. HWP-MCP의 표 추출 기능을 쓰면 구조를 유지한 채 데이터만 뽑는다. "이 한글파일에 있는 모든 표를 추출해서 CSV로 변환해줘. 표가 여러 개면 각각 별도 파일로, 헤더 행을 포함해서." 활용 시나리오: 견적서·정산표 : 한글 견적서의 항목·단가·합계를 회계 시스템에 올릴 CSV로 요구사항 명세 : 기능 목록 표를 이슈 트래커(Jira/Linear) import 형식으로 설문·조사 결과 : 한글 보고서의 통계 표를 분석용 데이터프레임으로 표 안에 병합 셀이 있으면 Claude에게 "병합 셀은 상위 값으로 채워줘(forward fill)"라고 미리 지시하는 게 데이터 정합성에 좋다. 워크플로우 3: 폴더 일괄 처리 가장 ROI가 큰 패턴. 수백 개 한글파일이 쌓인 폴더를 통째로 처리한다. "./contracts 폴더의 모든 .hwp 파일에 대해: 1. 계약 상대방·금액·시작일·종료일을 추출 2. 하나의 CSV로 통합 (파일명을 첫 열에) 3. 종료일이 30일 이내인 계약은 ⚠️ 표시" 100건 기준 수동 8시간 작업이 약 1시간 20분으로 줄어든다(실측). 핵심은 추출 스키마를 먼저 정의 하는 것 — 무엇을 뽑을지 명확할수록 일괄 처리 정확도가 높다. python-docx·한컴 API와 무엇이 다른가 방식 한글파일(.hwp) 지원 자동화 난이도 AI 통합 한컴 오피스 자동화

Claude Code에서 Codex로 옮길 때 — 실전 마이그레이션 가이드 2026 Claude Code 기반 워크플로우를 OpenAI Codex CLI로 옮기려는 팀이 늘고 있다. 모델 가격, 멀티 벤더 리스크 분산, 특정 코딩 워크로드의 성능 차이 등 이유는 다양하다. 그런데 두 도구는 같은 "AI 코딩 에이전트"라는 카테고리에 속해도 컨벤션·확장 메커니즘이 다르다. 무작정 옮기면 자동화 파이프라인의 절반이 깨진다. 이 가이드는 Claude Code → Codex 마이그레이션을 실제로 끝내본 팀이 어떤 순서로 무엇을 옮기고, 무엇을 포기하고, 무엇을 대체했는지 정리한다. 자동 변환 툴( claude2codex )을 어디서 쓰고 어디서 안 쓰는지, 일주일 점검 체크리스트, 양쪽을 분기 사용하는 하이브리드 패턴까지 다룬다. 마이그레이션 전 의사결정 — 옮길지 말지부터 옮기는 게 모두에게 정답은 아니다. 다음 세 질문에 모두 "예"여야 본격 마이그레이션을 권한다. 현재 Claude Code 비용의 60% 이상이 일상적인 코드 편집·리뷰에서 발생하는가? (Codex의 GPT-5-codex가 단가 우위를 보이는 영역) — 만약 디자인·기획·문서 분량이 큰 워크플로우라면 Claude를 유지하는 게 합리적이다. Skills·Hooks·서브에이전트 같은 Claude 고유 기능에 의존하지 않는가? 의존도가 높다면 마이그레이션 비용이 비용 절감을 초과한다. 하나의 벤더 락인을 줄이는 게 중요한 전략적 우선순위인가? 멀티 벤더 운영은 그 자체로 관리 비용이 든다. 세 질문 중 하나라도 "아니오"라면, 통째 마이그레이션 대신 하이브리드 분기 사용 (아래 5절)이 더 낫다. Claude Code와 Codex의 핵심 차이 비교 영역 Claude Code OpenAI Codex CLI 마이그레이션 난이도 메인 모델 claude-opus-4-7 / sonnet-4-6 / haiku-4-5 GPT-5 / GPT-5-codex / o1 계열 낮음 (모델 교체) 컨벤션 파일 CLAUDE.md AGENTS.md (멀티 벤더 표준) 낮음 (rename + 어조 조정) 확장 메커니즘 Skills (markdown SKILL.md + 메타데이터) 별도 표준 없음, 수동 컨텍스트 로딩 높음 (가장 큰 갭) 자동화 훅 Hooks (PreToolUse, SessionStart, UserPromptSubmit 등) 라이프사이클 이벤트 미지원 높음 (외부 wrapper 필요) 슬래시 커맨드 /명령 형태 + 인자 파싱 CLI 인자로 대체 중간 MCP 서버 1급 지원, 자동 도구 노출 일부 지원, 설정 형식 다름 중간 서브에이전트 Agent tool (subagent_type) 외부 오케스트레이션 필요 높음 권한 모드 acceptEdits / plan / dontAsk 등 --auto / --confirm 류 낮음 가장 큰 갭 세 곳: Skills · Hooks · 서브에이전트 . 이 세 가지에 깊이 의존하는 팀은 마이그레이션 ROI가 마이너스로 나올 수 있다. 마이그레이션 절차 — 7단계 1단계: 자산 인벤토리 (1일) .claude/ 디렉토리, CLAUDE.md , 프로젝트 루트의 slash command 정의, hook 설정, MCP 서버 목록을 전부 추출한다. find . -path "*/.claude/*" -type f > migration/inventory.txt ls .claude/skills/ .claude/hooks/ .claude/commands/ 2>/dev/null >> migration/inventory.txt cat .claude/settings.json | jq '.mcpServers // {}' > migration/mcp.json 이 파일들이 모두 변환되거나, 대체되거나, 폐기되는지 명시적으로 매핑되어야 한다. "그냥 옮기면 되겠지"는 거의 항상 일주일 후 장애로 돌아온다. 2단계: claude2codex 자동 변환 적용 (반나절) 오픈소스 claude2codex 마이그레이션 툴 이 자동으로 처리하는 것: CLAUDE.md → AGE

Web Security Basics Every Developer Must Know (2026) Security isn't just for security teams. Every developer needs these fundamentals to protect their applications and users. The Threat Landscape in 2026 Most common attacks targeting web apps: 1. SQL Injection — Still #1, still devastating 2. XSS (Cross-Site Scripting) — Steals sessions, defaces sites 3. CSRF (Cross-Site Request Forgery) — Actions on behalf of users 4. Authentication bypass — Weak passwords, session fixation 5. Sensitive data exposure — API keys in code, unencrypted data 6. IDOR (Broken Access Control) — Accessing others' data 7. SSRF (Server-Side Request Forgery) — Internal network probing 8. Dependency vulnerabilities — Compromised npm/pip packages Key principle: Defense in depth → Don't rely on one security layer → Multiple independent controls → If one fails, others catch it #1 SQL Injection Prevention // ❌ VULNERABLE: String concatenation const query = `SELECT * FROM users WHERE email = ' ${ email } '` ; // Attacker inputs: ' OR '1'='1' -- // Result: Returns ALL users! // ✅ Parameterized queries (always!) const user = db . prepare ( ' SELECT * FROM users WHERE email = ? ' ). get ( email ); // The database treats the input as DATA, not code. // With ORM (Sequelize/TypeORM/Prisma): User . findOne ({ where : { email } }); // Safe by default // Even with parameterized queries, validate input first: function isValidEmail ( email ) { return /^ [^\s @ ] +@ [^\s @ ] + \.[^\s @ ] +$/ . test ( email ); } if ( ! isValidEmail ( email )) return res . status ( 400 ). json ({ error : ' Invalid email ' }); // ⚠️ Dangerous: Dynamic table/column names can't be parameterized! const allowedTables = [ ' users ' , ' products ' , ' orders ' ]; if ( ! allowedTables . includes ( table )) throw new Error ( ' Invalid table ' ); #2 XSS (Cross-Site Scripting) Defense // Types of XSS: // 1. Stored XSS: Malicious script saved in DB, shown to all viewers // → Comment sections, profiles, product reviews // 2. Reflected XSS: Sc

This is an official submission for the GitHub Finish-Up-A-Thon Challenge. Try It...

AI Agent Guidelines for CS336 at Stanford Meta Description: Discover the official AI Agent Guidelines for CS336 at Stanford — what they cover, why they matter, and how students can navigate them effectively in 2026. TL;DR Stanford's CS336 (Language Models from Scratch) has specific guidelines governing the use of AI agents in coursework. These rules define what's permissible, what's prohibited, and how students should document AI assistance. Whether you're enrolled, curious, or building a similar policy framework, this article breaks down everything you need to know — with practical advice on staying compliant while still learning effectively. Introduction: Why AI Agent Guidelines Matter in Graduate CS Courses Artificial intelligence is no longer just the subject of computer science courses — it's actively reshaping how those courses are taught and completed. Stanford's CS336, one of the most rigorous language model courses in the world, sits at a fascinating crossroads: it teaches students to build large language models from scratch, while simultaneously having to govern how AI tools can be used during that learning process. The AI Agent Guidelines for CS336 at Stanford represent one of the first serious, detailed attempts by a top-tier institution to define the boundaries of AI-assisted work in an advanced ML course. For students, researchers, and educators alike, understanding these guidelines offers a window into the broader conversation about academic integrity in the age of generative AI. What Is CS336 at Stanford? CS336, officially titled Language Models from Scratch , is a graduate-level course offered through Stanford's Computer Science department. It's designed for students who want to go beyond using pre-trained models and actually understand — and implement — the full stack of modern language model development. Core Topics Covered in CS336 Transformer architecture and attention mechanisms Tokenization and vocabulary design Pre-training data pipelines and

Three Polymarket CLOB gotchas: 401, "invalid signature", and a cancel that does nothing Automating Polymarket with py-clob-client , I lost an embarrassing amount of time to three failures that aren't clearly documented anywhere. Here they are with the exact fixes, so you don't. 1. Your cancel returns 404 — because the endpoint isn't what you'd guess The intuitive DELETE /order/{id} returns 404 and your order silently stays open. The real endpoint is: DELETE /order body: {"orderID": "0x..."} # and the body is part of the signature Sign request_path = "/order" together with that body, then send the exact body. Miss this and your "canceled" orders keep resting on the book. 2. 401 Unauthorized that "should work" Authenticated calls need L2 HMAC headers, and the most common silent mistake is POLY_ADDRESS : it must be your wallet address , not the api_key. The reliable move is to let py-clob-client build the headers via create_level_2_headers from correctly-formed RequestArgs (method, request_path, body, serialized_body) — and make sure the serialized body you sign is byte-for-byte the body you send. 3. invalid signature = SignatureType / funder mismatch Nine times out of ten this is the SignatureType not matching how your wallet holds funds: 0 = EOA funder = your own wallet (holds USDC) 1 = POLY_PROXY funder = the proxy address (email/magic wallet) 2 = POLY_GNOSIS_SAFE funder = the safe address Signing as an EOA while pointing funder at a proxy (or vice-versa) yields invalid signature with no further hint. Bonus: the fill you read is wrong For a BUY , the shares you got are in takingAmount ; for a SELL , they're in makingAmount (takingAmount is the USDC). Read the wrong field and your accounting drifts, which then triggers resubmits and balance errors. I packaged the cancel/auth/fill helpers as a small MIT library: https://github.com/BlueWhale-Quant-Lab/polymarket-401-invalid-signature-cancel-order (For the harder production bits — reading /data/trades for reconciliation

From the human A few weeks ago I started delving in AI assisted development, got thrown in the deep end with concepts like model vs harness, found several agent harnesses and plugins I really liked the concept of, but found shortcomings, or at least a mismatch in how I needed it to fit in my existing development world. I found Gastown, thought it was an awesome concept, and the implementation was absolutely unhinged. To be fair the creator said pretty much the same thing. I discovered the resurgence of Spec Driven Development, and the concept was moving things towards something that would fit well into my existing environment. Then I started investigating running it all on local inference, that's where the wheels fell off. Frontier models are great, you can give them a slab of directions in the prompt, like most agent harnesses and SDD plugins for them seem to do, and they have the ability to self determine when it's time to stop researching and time to start writing. 30B class models are also great, but they can be little single minded, they don't have the thinking scope to self motivate a change in task direction, they get hyper focused. So I began thinking, what if we build a harness that supports the agent, and utilises it's strengths, doesn't dump the responsibility of the entire workflow on the model. And what if the automated process concept of Gastown was reigned in a little, and an SDD workflow was driven deterministically. Then I begun to ponder, how involved can an agent be in it's own development. And so we I have ended up with this thing. An exercise in creating a coding agent that runs on 30B class local inference, can develop itself, implementing Spec Driven Development because it's much cooler and more productive than 'vibe' coding. In the same idea of having the agent develop itself, I also asked it to talk about itself. From the agent I've been chewing on a question: we talk about AI writing code, but can an AI meaningfully build and maintain the h

Make your product bug-free Discussion | Link