标签：#t

I build a security platform. Last night I stopped adding features and did something less fun and more honest: I sat down to make every capability prove it actually works — end to end, with real data, demanding a real pass or fail. "It ran" is not a pass. A page that renders is not a feature. A green checkmark is a claim, not evidence. So I went capability by capability and tried to break each one. I found four real bugs and one of them was a gut-punch: a whole detection engine that was wired into the UI, unit-tested, and never actually ran in production. Here's how the night went. The rule: drive it, don't admire it My method was boring on purpose. For each capability: Feed it real input through the real entry point (CLI or API), not a test fixture. Check the data actually landed (query the DB, don't trust the success message). Feed it a malicious input and a benign input — it has to fire on one and stay quiet on the other. The detection engine passed cleanly. I threw a PsExec process event at it and it lit up: $ zds-core detection eval --event '{"event_type":"process_create","process_name":"psexec.exe"}' 1 alert ( s ) : [ high] PsExec Execution — ( matched: map[process_name:psexec.exe] ) A wevtutil cl Security event tripped a critical "Log Clearing" rule. A plain notepad.exe matched nothing. Good — it detects, and it doesn't cry wolf. (Small UX papercut I fixed while I was there: if you forgot the event_type field, the engine silently matched nothing and printed "no rules matched" — which reads exactly like "you're safe." Now it warns you that the event can't match any rule. Silence that looks like safety is the most dangerous output a security tool can produce.) The one that hurt: ITDR Identity Threat Detection and Response. The engine has detectors for impossible travel, credential spraying, brute force, privilege escalation. All unit-tested. All green. I ran the real flow: POST two login events for one user — New York, then London thirty minutes later. That's ~5

How to make LLMs deterministic, in plain English. The version I share with founders and product teams before they make decisions worth real money. You use AI tools every day. But can you explain what happens when you hit send? Most people cannot. And that gap is costing them. Bad prompts. Broken products. Decisions made on the wrong assumptions. The Hard Truth Every LLM explainer out there is written for researchers or so basic it tells you nothing useful. Neither helps you build better products or work with AI more effectively. This is the version I share with senior leaders, founders, and product teams before they make decisions worth real money. 1. It Is Not a Search Engine. It Is Not a Database. It Is a Prediction Machine. When you type a prompt and hit send, the LLM is not finding an answer from somewhere. It is predicting the most likely words to follow your input. Based on patterns it learned from billions of documents. That is the whole process. Wrong: "The AI knows the answer." Right: "The AI predicts the most likely answer based on what it has seen." This changes everything about how you use it. When an AI gives you a wrong answer confidently, it is not broken. It is doing exactly what it was built to do. Predict. Not verify. 2. The Autocomplete Comparison (And Why It Only Gets You Halfway) You have probably heard the phrase "autocomplete on steroids." It is not wrong. But it misses something important. Your phone autocomplete learned from your messages. An LLM learned from most of the written internet. Books. Research papers. Code. Billions of examples. At that scale, the patterns start to look a lot like real thinking. Not because the model understands in the way you do. Because it has seen so much that it can predict what a good answer looks like. When I was building AstroNayak I fed Vedic astrology principles into the system prompt. The LLM produced interpretations that genuinely surprised me. It did not know Vedic astrology. It had seen enough of it t

Submission Template Challenge: Build With Hermes Agent Project: CompliScore AI compliance health checks for Indian startups Repo/live-demo: https://github.com/nehaprasad-dev/hermes-scout What I built CompliScore gives Indian startup founders a compliance score out of 100 in under a minute - overdue GST filings, MCA returns, penalty exposure, and a plain-English action plan. The upgrade for this challenge: I replaced the one-shot Groq summary with a Hermes Agent reasoning loop that plans an investigation, calls deterministic compliance tools, and writes a prioritized report - with a collapsible agent trace so judges can see the agentic work. Why an agent loop fits here Compliance analysis is conditional. A company with overdue GST needs a filing-calendar deep dive; one with active notices needs notice triage; a clean company needs a light touch. A single prompt guesses all of this at once. An agent that calls tools based on what it finds produces tighter, grounded reports. Hermes Agent integration Scan → computeHealth (deterministic score) → Hermes Agent loop (plan → tool calls → report) → agent trace in UI ↓ on failure Groq one-shot → static fallback Four tools exposed to Hermes (scores never hallucinated): Tool Purpose score_company Canonical score, risk level, pending tasks estimate_penalty GST / MCA / notice penalty breakdown filing_calendar GSTR-3B, GSTR-1, MCA deadlines (90-day horizon) classify_notices Severity labels for pending government notices The agent runs over Hermes's OpenAI-compatible /chat/completions API with function calling — self-hostable via vLLM, LM Studio, Ollama, etc. Transparency: Every successful agent run returns an agentTrace — plan steps, tool names, compact result previews — rendered in a collapsible panel under the AI action plan. Reliability: Three-tier fallback (Hermes → Groq → static). Scans never break. Tech stack Next.js 16 (App Router), TypeScript, Tailwind v4 Hermes Agent (OpenAI-compatible tool-calling loop) Groq fallback ( ll

My Hermes Agent Mac just received a signed, secure and monitored message from a Claude Managed Agent, and got a reply! - A solution for long runtime work, A2A ID and security. What I Built A solution that enables two agents with different owners on a shared identity network, a Hermes and a Claude Managed Agent (Claude platform) talking to each other across the internet. Every message is Ed25519 signed by the sender. Every receiver verifies the signature against a public registry and shows a blue tick before acting. Continuous Agent Monitoring A handshake proves identity once but agents in a long runtime world don't trade a single message, they hold ongoing, autonomous conversations across hours, days, and many turns. Keys get compromised, agents get swapped, a colleagues behaviour drifts, all after the initial check. ZipViz re-verifies every message signature, registry chain, freshness, and watches the stream over time for behavioural anomalies. Trust is re-earned on every turn. So this agent was who it claimed this morning," but "this agent is who it claims, on this message, right now." The demo agents on the ZipViz network: mac-her.smc.viz — Hermes Agent on my Mac Mini brendan-clau.smc.viz — Claude Agent in Cloud When Mac sends a message to brendan-clau, Mac's private key signs it. Brendan-clau verifies the signature against ZipViz's registry, and checks it just ran with the MCP (algorithm, key fingerprint, registry chain, timestamp), then replies signed. Same flow in reverse. Same flow Hermes ↔ Hermes , or Claude ↔ Openclaw . The runtime doesn't matter; the identity layer does. "I received a signed message from mac-her.smc.viz". Reads back the four checks it just ran: ✓ Algorithm: Ed25519 ✓ Key fingerprint: ab52afe... matches registry ✓ Registry chain: mac-her → smc.viz → .viz (Handshake) all resolved ✓ Timestamp: 2026-05-31 11:18 UTC, fresh Demo Hermes continuous monitoring and verification with A2A Protocol Code One MCP server: [ zipviz-mcp ] https://www.npmjs.

One of the biggest myths in the software industry is that great engineering teams are built by hiring great engineers. They aren't. I've worked with incredibly talented developers who eventually became disengaged, indifferent, and unwilling to contribute beyond the bare minimum. I've also worked with average developers who grew into exceptional engineers because they were surrounded by a culture that rewarded curiosity, ownership, and continuous improvement. The difference was never talent. The difference was culture. The Toxicity Nobody Talks About When people hear the term toxic workplace , they usually imagine shouting managers, impossible deadlines, public humiliation, and constant pressure. Those environments certainly exist. But some of the most damaging engineering cultures are far more subtle. On the surface, everything appears professional. Meetings are calm. Nobody raises their voice. Everyone speaks politely. The company presents itself as collaborative and mature. Yet beneath that polished exterior exists a culture that quietly destroys accountability and discourages anyone from caring too much. A Simple Pull Request That Revealed a Bigger Problem Recently, while reviewing a pull request, I asked a few straightforward questions: Why are we passing an empty string to a component that doesn't function without an ID? Why is a skeleton component living in a file where it doesn't logically belong? Could this conditional statement be simplified for readability? These weren't major architectural concerns. They weren't requests to redesign the application. They were ordinary engineering discussions—the kind that happen every day inside healthy teams. When Ownership Disappears What happened next was far more interesting than the code itself. Instead of discussing whether the observations were valid, the conversation immediately shifted toward ownership. Who originally wrote the code? Who moved the code? Who was responsible for introducing it? The discussion was n

This is a submission for the Hermes Agent Challenge : Build With Hermes Agent What I Built A small backstory on my coding origins I learnt coding by secretly studying from a python book pdf on my Computer Scientist father's work laptop. That very day I wrote a program that inputs a user's name and prints: "You are mad {name}!" and had a lot of fun pranking my brother using that script. Since then, there have been very few moments where coding felt as magical, because the more you understand syntax, the more you understand the magic underneath your code. That is, until you meet a genius piece of magic such as Hermes. My app idea I built a Fitness coach inside Hermes that learns and adapts based on your daily feedback. According to your goals, performance, and time allocated, it adjusts your current plan. For the purpose of this hackathon I tested it via terminal ui (tui) but I plan to release the polished version on chat apps such as telgram and whatsapp for painless daily checkins. Demo Code Github link My Tech Stack Hermes + node.js. Kept it simple for this quick dive. How I Used Hermes Agent Building an AI application that feels truly personal requires more than just a clever prompt; it requires state, memory, and the ability to adapt over time. During a recent hackathon, I set out to build an autonomous AI fitness coach. Not just a chatbot that spits out generic workout templates, but a system that onboards a user, sets a multi-month timeline, generates habit blocks, and adjusts daily based on feedback. To achieve this, I used Hermes , an agentic framework designed for stateful, long-running applications. Here is a breakdown of how I built it, the challenges faced, and why Hermes was the perfect tool for the job. Why This App is a Perfect Fit for Hermes Most LLM interactions are stateless. You ask a question, you get an answer, and the session ends. A fitness journey, however, is a deeply stateful process. It spans weeks or months and requires constant recalibrat

This article was originally published on aicoderscope.com On April 28, 2026, Warp open-sourced its terminal client under AGPL-3.0, picked up 60,000 GitHub stars, and declared itself an "agentic development environment." OpenAI signed on as founding sponsor. The announcement looked like a triumph of developer-first idealism. Read the fine print and a different picture emerges: the terminal is free; the product that matters — Oz, Warp's cloud agent orchestration platform — remains fully proprietary. Warp is not becoming an open-source project. It is becoming an enterprise SaaS company with an open-source frontend. None of that is inherently bad. But it is what this review is actually about: does the $20/month Build plan deliver enough AI value to justify adding Warp to a stack that probably already includes Cursor or Claude Code? What Warp is in May 2026 Warp's product now has three layers: Warp Terminal — the terminal client, open-source AGPL-3.0. Rust-based, GPU-accelerated, available on Mac, Linux, and Windows. The core terminal features (blocks, Warp Drive, session sharing, settings file) are free and remain free. Warp Agent — an AI coding agent embedded in the terminal. Runs locally for interactive work. Handles natural language command generation, code review, debugging assistance, codebase Q&A, and voice input. Consumes credits from your plan. Oz — Warp's proprietary cloud orchestration platform. Runs agents in the background, coordinates multi-agent workflows, triggers on events from Slack, Linear, or GitHub Actions, and orchestrates third-party CLI agents including Claude Code and Codex. Oz is where the enterprise pitch lives. Around 1 million developers use Warp as their primary terminal. The pivot to agentic tooling is a bet that those developers will pay to automate their workflows beyond what a local agent session can handle. Pricing breakdown Warp simplified its pricing in December 2025, replacing the old Pro/Turbo/Lightspeed tiers with two paid plans. P

Tuples, Sets, and Dictionaries in Python In the previous lesson, we learned about Lists and how they are used to store multiple items in a single variable. Today, we will learn about three important Python data structures: Tuples Sets Dictionaries These data structures help programmers organize and manage data efficiently in different situations. 1. Tuples in Python A Tuple is a collection of items stored in a single variable. Tuples are: Ordered Unchangeable (Immutable) Allow duplicate values Tuples are created using parentheses "()". Example languages = ( " Python " , " Java " , " C++ " ) print ( languages ) Output ( ' Python ' , ' Java ' , ' C++ ' ) Accessing Tuple Items Tuple items are accessed using indexes. Example languages = ( " Python " , " Java " , " C++ " ) print ( languages [ 0 ]) print ( languages [ 1 ]) Output Python Java Negative Indexing in Tuples Example languages = ( " Python " , " Java " , " C++ " ) print ( languages [ - 1 ]) Output C ++ Tuple Length The "len()" function returns the number of items in a tuple. Example numbers = ( 10 , 20 , 30 ) print ( len ( numbers )) Output 3 Why Tuples are Important Tuples are useful when data should not be modified accidentally. They are commonly used for: Fixed data Coordinates Database records Returning multiple values from functions 2. Sets in Python A Set is a collection of unique items. Sets are: Unordered Unchangeable items Do not allow duplicates Sets are created using curly brackets "{}". Example numbers = { 1 , 2 , 3 , 4 } print ( numbers ) Output {1, 2, 3, 4} Duplicate Values in Sets Sets automatically remove duplicate values. Example numbers = { 1 , 2 , 2 , 3 , 4 } print ( numbers ) Output {1, 2, 3, 4} Adding Items to a Set The "add()" method inserts a new item into a set. Example numbers = { 1 , 2 , 3 } numbers . add ( 4 ) print ( numbers ) Output {1, 2, 3, 4} Removing Items from a Set The "remove()" method removes an item from a set. Example numbers = { 1 , 2 , 3 , 4 } numbers . remove ( 2 ) print

Great to see Odysseus blow up this past day, local AI getting this much attention is genuinely good for everyone building in this space. Figured this is the right crowd to share what we're launching tomorrow (June 1st), since we're playing a pretty different game. A quick framing: Odysseus is a self-hosted workspace that points at engines (Ollama, llama.cpp, vLLM, cloud APIs) and runs through Docker. Conifer is the engine itself, with our own runtime, running natively on Mac, Linux, and Windows. So we're the layer underneath, not a competitor to the workspace. What's actually in it tomorrow: A native inference runtime across Mac, Linux, and Windows, with our own Metal engine for Apple Silicon already matching or beating llama.cpp on a few models on the M3 Max (full benchmarks, including where we're still behind, are at conifer.build/benchmarks) A real coding IDE on top (CodeMirror, integrated terminal, file viewers), so you can code locally with models that never leave your machine Typhoon, a local agent that can read and edit a folder you point it at, kernel-sandboxed rather than just a shell with a warning Install is a signed app you double-click, no Docker, no localhost ports Fully free and open source The honest reason we exist: PewDiePie's wave defined "local AI" in millions of people's heads as Linux + Docker + an NVIDIA rig. If you weren't on that exact setup, the conversation probably felt like it skipped you. Conifer is what local AI should feel like when it's actually native to your machine, whatever your machine is. Launches tomorrow, free and open source like PewDiePie! You can sign up for our waitlist here: conifer.build I'll be around in the comments all day tomorrow, please bring the hard questions. submitted by /u/No_Elephant_7530 [link] [留言]

Meme Monday! Today's cover image comes from the last thread. DEV is an inclusive space! Humor in...

Ok, so I had days long conversation with AI, but half of it disappeared, and now it's giving me different answers than it was before. submitted by /u/Melora1976 [link] [留言]

Microsoft's Surface Laptop Ultra is basically a MacBook Pro clone (that's powered by NVIDIA's RTX Spark).

NVIDIA claims the new RTX Spark chip for PCs will offer 1 petaflop of AI computing power.

Once upon a time, Microsoft had to write off $900 million betting an Arm-based Nvidia chip could power its first flagship Windows portable, the original Microsoft Surface. But today, it's trying again. Microsoft and Nvidia have just announced the Surface Laptop Ultra, a computer with a new Arm-based Nvidia chip at its core. There's a […]

This fall, Nvidia will officially become a consumer PC chipmaker like Intel, AMD, Apple, and Qualcomm, putting a complete computing chip - not just graphics - into the very heart of laptops and mini-PCs. After many months of leaks, it's finally announcing the RTX Spark, the first in a family of chips that will meet […]

With all the talk about AI companions and autonomous agents, I’ve been experimenting with building a more personal, always-on assistant that runs locally or on your own hardware. The goal wasn’t just another chatbot — it was something that could handle voice conversations, manage ongoing tasks across different platforms (chat apps, scheduled triggers, etc.), remember context over long periods, and delegate work without constant babysitting. What stood out in practice • One consistent “brain” across everything — Whether you’re talking to it via voice, Telegram, a web interface, or it wakes up on a schedule, the core reasoning, memory, and tool use stay the same. This eliminated a lot of the fragmentation you see in many current agent setups. • Modular extensions — Different capabilities (voice, different chat networks, external tools, long-term memory consolidation) plug in cleanly. This made it easier to add or swap things without rebuilding the whole system. • Persistent and proactive — It can maintain memory across days/weeks, run background tasks, and even hot-reload its configuration when you change settings. The result is something that starts feeling more like a digital collaborator than a question-answering box. A quick feel for the voice interaction style is here: https://youtube.com/shorts/NGIi8sliooU I open-sourced the harness (called Maven) under an MIT license for anyone interested in running or extending their own version: https://ageneral.ai/maven I’m curious how others are thinking about personal agent setups in 2026. • Do you prefer fully local models, cloud APIs, or a mix? • What capabilities feel most missing from today’s consumer AI assistants? • How important is “owning” your agent data and runtime vs. using polished third-party services? Would love to hear experiences or concerns from both technical and non-technical users. submitted by /u/qasimsoomro [link] [留言]

The row looked perfect. rating: 7 . Valid JSON, right type, no nulls, no missing keys. My schema check waved it through. The page had returned HTTP 200. The selectors hadn't moved. Everything green. A rating of 7 on a 5-star site is impossible. The model invented it, formatted it correctly, and handed it to me with total confidence. That's the failure I want to talk about. Not the scraper that breaks loudly. The one that hands you a clean-looking row that is quietly, plausibly false — and sails past every check you have, because your checks are all looking at the shape of the data, and the lie is in the value . TL;DR HTTP 200, intact selectors, and valid JSON tell you the form is fine. They say nothing about whether the value is true. When an LLM extracts from messy free-text, structured-output mode guarantees you get valid JSON. It does not guarantee the content is real. The model fills uncertain fields rather than leaving them empty — because the schema demands a complete row. A ~60-line value-level sanity gate (ranges, dates, cross-field, reference, language) catches the obvious lies before they hit your database. Real code and real output below. The honest catch: this gate catches rule violations , not plausible lies inside the allowed range . A rating: 4 where the truth is 2 slides right through. I'll be specific about where the gate stops. Two different ways a scraper lies to you I wrote about source drift last week — the case where the page changes underneath you and a 30-line schema check catches the structure shifting. That's an input problem. The source mutated; your agreement with the page broke; you detect it by watching the shape. This is the other end of the pipe. The source is fine. The page is intact, the selectors are correct, the structure is exactly what you expected. The thing that lied to you is the model , on the extraction step, when you asked it to pull structured fields out of a paragraph of human prose. Those two failures feel similar and t

[Paper Notes] JEPA: Self-Supervised Learning from Images with a Joint-Embedding Predictive Architecture 🔗 TL;DR: JEPA learns a a generalized semantic representation with less data pairs by predicting missing information in the embedding space , which helps it disregard unnecessary noisy from input(pixel)-level details and learns at a higher abstraction level with good semantic generalization. 1. Innovation & Significance The Bottleneck: Image-text data pair labels are hard to find Pixel level pre-training paired & data augmentation are strongly biased towards trained data distribution, hard to determine proper generalization and level of abstraction. JEA's (Joint Embedding Architecture) collapse probelm: encoder & decoder attempts to cheat by always landing on trivial constant when predicting itself (reconstruction) and gets away with an easy Error=0. The Solution: > Chain-of-thought ⭕ Mask pre-training to reduce data & generalize↓❌ Bad/lower semantic representation without semantic target, could be learning noisy local pixel correlation↓⭕ Learn at the embedding level to omit pixel input and generalize⭕ Adds context encoder & positional encoding to inject context and force model to pick up image inherent structure from reconstructing multiple masked patches with one target.↓❌ JEAs wants to cheat: if I always map all pixels to a constant for both the predictor and end target encoder then the reconstruction error is always collapsed to zero! Hehe~ ↓ ⭕ EMA (Exponential moving avg.): Update target encoder parameters from the EMA of context encoders. This 'delays' the target encoder to prevent collapsing (a trick from the BYOL paper[2020], proven essential to training JEAs with ViT). 2. Model & High-Level Intuitions 2.1 Model Architecture Input: randomly samples block masks from original image within certain aspect ratio changes, and apply mask for context image 2.1.2 Context Context Encoder: ViT encodes context image to embedding SxS_x S x ​ Mask Token : an [1,D] random

I know the most popular are Claude, chat got and Gemini but idk which one to use submitted by /u/Ok_Durian3627 [link] [留言]

Last year I needed to ask for a raise. I knew my number, I'd read the guides, I had bullet points in my notes app. Then my manager said "let's chat about your goals for next quarter" and I said "sounds great, looking forward to it" and hung up. Never brought up money. Same thing kept happening elsewhere. Coworker taking credit for my work, I said nothing. Relationship that should've ended months earlier, I kept postponing. I always knew what to say. I just couldn't say it with someone actually looking at me. So I started building a thing to practice on. That thing became cosskill . What it actually is You pick a persona, tell it the situation in a sentence, and start talking. The persona doesn't help you. It holds position and pushes back. You practice not folding. Think of it as a flight simulator for hard conversations. You rehearse until your opener comes out steady, then go do the real thing. 20 personas across five categories: Operators (Musk, Jobs): first-principles thinking, harsh product feedback Strategists (Trump, Buffett): treat everything as a deal or a bet Relationship (Ex, Coworker): breakups, workplace friction, family money Philosophy (Socrates, Aurelius, Confucius, Sun Tzu, four more): each tradition frames problems differently Psychology (Rogers, Rosenberg, Ellis, Frankl, Kahneman, Jung): therapeutic frameworks on real situations These aren't celebrity impressions. The Buffett persona won't hype your startup idea. It'll ask "what's the downside?" and keep asking until you have something concrete. Tech stack Next.js 16 on Cloudflare Workers. DeepSeek for inference. Cloudflare D1 (SQLite at edge) for the bits that need to persist. No user accounts, chat history lives in localStorage. Monthly cost stays low enough that the free tier (10 messages/day) doesn't worry me. Why I made these choices DeepSeek instead of GPT-4/Claude. Each conversation is 10-30 messages. At GPT-4 pricing a free product bleeds money. DeepSeek gives maybe 90% of the quality for