今日已更新 86 条资讯 | 累计 25636 条内容
关于我们

标签:#t

找到 12211 篇相关文章

AI 资讯

Google custom search api free limit: How to bypass the cap

Running out of API quota in the middle of a production deployment is a frustrating rite of passage. If you are using the Google Custom Search API, you have likely hit that 100 free daily queries wall. Once you do, your application throws a 403 Quota Exceeded error, stalling your features unless you link a billing card and risk uncapped charges of $5 per 1,000 queries. In my experience, relying on Google's default limits without safeguards is a major liability. Here is how I protect my cloud budget, stretch the free tier using Redis, and transition to scalable alternatives when 100 queries are no longer enough. Step 1: Enforce a Hard Billing Cap in GCP Never rely on email alerts alone; they do not stop API requests. If a recursive loop in your code or a malicious bot targets your search endpoint, your credit card will bear the brunt. To set up a hard stop: Log into your Google Cloud Console . Navigate to APIs & Services > Enabled APIs & Services . Select Custom Search API , then click the Quotas tab. Locate Queries per day and click the edit pencil icon. Set your maximum limit to 95 (not 100). Pro Tip: This 5-query cushion gives you a safe buffer for emergency local debugging without triggering paid overages. Step 2: Implement Redis Caching Middleware Over 40% of search queries in typical web applications are repetitive. Implementing a Redis database to cache these searches can cut your API consumption by up to 80%. Here is a simple Python middleware pattern to normalize queries and cache them with a 24-hour Time-To-Live (TTL): import redis import requests # Connect to local Redis instance cache = redis . Redis ( host = ' localhost ' , port = 6379 , db = 0 , decode_responses = True ) def fetch_search_results ( query , api_key , search_engine_id ): # Normalize input to avoid duplicate cache keys normalized_query = query . strip (). lower () cache_key = f " search:cache: { normalized_query } " # 1. Check local cache first cached_data = cache . get ( cache_key ) if cach

2026-07-19 原文 →
AI 资讯

Your LLM can't actually watch video. Here's the smallest fix (MIT)

Every model card says "multimodal". Then you hand the model a real video file and discover what that means in practice: ChatGPT reads the subtitle track, Claude doesn't accept video files at all. The model narrates a video it mostly never saw. I unpack viral videos daily for my own content work, so I couldn't route around this. I built a small tool instead. The mechanism claude-real-video converts a video into three things an LLM can genuinely read: Scene-aware sampled frames — ffmpeg scene scores decide where to sample, so you get a frame when the picture changes, not every N seconds. An --adaptive flag handles slow deformations (a real user bug report: fixed thresholds missed squash/stretch morphs entirely). A timestamped transcript — whisper by default; if faster-whisper is installed it runs in-process and several times faster, with automatic fallback. One MANIFEST timeline — frames and transcript merged into a single file, so the model follows the video in order instead of guessing from fragments. A --text-anchors flag force-samples frames at subtitle cues so on-screen text never falls between frames. Then you point any LLM at the output folder — Claude, GPT, Gemini, or a local model. No API of mine in the middle, everything runs on your machine. Usage pip install claude-real-video crv "video.mp4" -o out Honest limitations Not real-time — a 90-second video takes about 1–2 minutes all-in on an M-series Mac. Frame sampling can still miss motion between frames; the flags above patch the worst cases, both born from real GitHub issues. It's MIT, currently at 1,731 stars with ~8k installs last month, which taught me the problem was never just mine: https://github.com/HUANGCHIHHUNGLeo/claude-real-video

2026-07-19 原文 →
AI 资讯

The Problems with Modern Web Development

Before I critique modern web development, I want to make some points: I'm not discouraging anybody from web development. This is only my opinion and my experience of the story. Everyone has their own story. Part 1. Javascript JavaScript is known for being the web's language. It's used everywhere in the web, and can also be used to make external applications outside of web development. JavaScript has many flaws in its language, such as its comparison logic. JavaScript uses the "strict equality operator" that tries to solve its weird type coercions (e.g [] == ![] being true). Another flaw is that JavaScript has poor maintainability. JavaScript has a poorly managed type system that introduces errors without proper error handling. You cannot explicitly define what error you're trying to catch in the try-catch statement. try { functionThatThrowsError () } catch ( error ) { console . error ( error ); if ( error instanceof MyError ) { doSomething (); } } instead of modern languages: try { functionThatThrowsError () } catch ( e : MyError ) { print ! ( " error: ${e.message} " ) } This adds complexity to try-catch statements and makes it almost impossible to handle errors in a robust manner. Another issue with JavaScript's maintainability is the wording of the language. JavaScript has two keywords called undefined and null . In practice these should mean the same thing but it doesn't. An undefined variable is an uninitialized variable, or a function that doesn't return anything. Undefined: // Returns undefined function getName () {} // syntactically correct in JavaScript // but will cause undefined console . log ( getName ()); const myCoolObject = {}; console . log ( myCoolObject . property ); // still syntactically correct in JavaScript even though the property doesn't exist. Null: // Returns a null name function getName () { return null ; } // output: null console . log ( getName ()); const myCoolObject = { property : null }; console . log ( myCoolObject . property ); //out

2026-07-19 原文 →
开发者

Backend Development Isn't Just CRUD. Abeg Make We Talk True.

I don lose count of how many times I don see this kind yarns online: "Backend development na just CRUD. Everything else na decoration." And honestly? I sabi why people dey talk am. E no kuku wrong. E no just complete, na like when person say "cooking na just to heat food." Technically, e dey true. But e dey miss almost everything wey make am skill. Make I carry you waka through wetin I mean, using something wey all of us don do before: to order food for app. First, Wetin CRUD Really Be CRUD mean Create, Read, Update, Delete, na the four things you fit do to any piece of data. Operation Wetin e dey do Normally e go be Create Add new data POST /orders Read Fetch existing data GET /orders/482 Update Change existing data PATCH /orders/482 Delete Remove data DELETE /orders/482 You place order, that na Create. You check where the order dey, that na Read. You change delivery address before dem ship am, na Update be that. You cancel am, that one na Delete. Change "order" to "post", "message", or "appointment" and you don describe almost every app wey dey for your phone. If you dey new for backend work, to build small CRUD API na genuinely good way to learn. You go jam routing, HTTP methods, request validation, database, and ORM almost by accident. Na exactly why every bootcamp dey start you off with building Todo app. But see this thing, to build only the CRUD part of that food order na maybe 10% of the real engineering work. Make we follow that one order through everything else wey suppose happen. "Who Even Dey Ask?" — Authentication Somebody send this: DELETE /orders/482 Fine. But who you be sef? If anybody at all fit hit that endpoint, you no get API, you get public database with extra steps. Before any Create, Read, Update, or Delete happen, backend need answer one question first: who dey make this request? That one na authentication, JWT, session cookie, OAuth, whichever flavor you dey use. "Dem Get Permission Do That?" — Authorization Say two different people send tha

2026-07-19 原文 →
AI 资讯

Searchable isn't the same as connected: why team docs still make new hires ask 'why'

Every team doc tool these days is "searchable." Notion, Confluence, wikis — you can find any page in seconds. But search only tells you a document exists; it doesn't tell you how it connects to the five other docs that explain why it looks the way it does. New hires still end up pinging three people on Slack to reconstruct the reasoning behind a decision that's technically "documented" somewhere. This post is about the difference between a searchable knowledge base and a connected one — and why most teams have the first but assume they have the second.

2026-07-19 原文 →
AI 资讯

Protocol Buffers: Google's Data Interchange Format Continues to Evolve with Bazel 8+ Support and GCC 10 Testing

What Changed Protocol Buffers (protobuf), Google's widely adopted data interchange format, has undergone several recent updates focusing on build system integration, compiler support, and internal development processes. Key changes include the introduction of Bzlmod support for Bazel 8+, updates to the Bazel CI presubmit matrix, and the removal of older GCC versions from GitHub Actions testing in favor of GCC 10. Specifically, the project now explicitly supports Bazel with Bzlmod for Bazel 8 and newer versions, allowing users to specify protobuf as a dependency in their MODULE.bazel file. This modernizes the Bazel integration, offering an alternative to the traditional WORKSPACE approach. Concurrently, the .bazelci configuration has been updated to remove macOS (Intel Macs) from the presubmit matrix, revise Debian and Ubuntu distributions, and incorporate Bazel 9.x testing. In terms of compiler support, the .github workflow for C++ testing has been refined. GitHub Actions matrix entries testing GCC versions prior to GCC 10 (specifically 7.5, 9.1, and 9.5) have been removed, and a GCC 10.4 test has been added. This aligns the testing infrastructure with the project's current support matrix, ensuring compatibility with more recent compiler versions. Internal refactoring also occurred, such as the extraction of OptionInterpreter to option_interpreter.h and option_interpreter.cc from descriptor_builder.h and descriptor.cc respectively. Furthermore, the C# protobuf implementation saw a version update to 37.0-dev, indicating ongoing development across various language bindings. Technical Details The integration of Bzlmod for Bazel 8+ signifies a move towards a more modular and efficient dependency management system within the Bazel ecosystem. Developers can now declare a dependency on protobuf in their MODULE.bazel file, with an option to override the repository name for compatibility with existing WORKSPACE setups. This streamlines dependency resolution and build graph m

2026-07-19 原文 →
AI 资讯

DocuSeal: An Open-Source Alternative for Digital Document Signing and Processing

What Changed DocuSeal has emerged as an open-source platform for digital document signing and processing. This project offers a self-hostable alternative to commercial services, allowing organizations to manage document workflows, eSignatures, and form filling within their own infrastructure. The platform is designed to be accessible, mobile-optimized, and integrates with existing systems through APIs and webhooks. Technical Details DocuSeal provides a comprehensive set of features for digital document management. Key functionalities include a WYSIWYG PDF form fields builder that supports 12 field types, such as Signature, Date, File, and Checkbox. It accommodates multiple submitters per document and automates email notifications via SMTP. For file storage, DocuSeal offers flexibility, supporting local disk storage as well as cloud providers like AWS S3, Google Storage, and Azure Cloud. The platform implements automatic PDF eSignature generation and includes a mechanism for PDF signature verification, addressing security and compliance requirements. User management is integrated, and the UI is mobile-optimized, supporting 7 UI languages with signing capabilities in 14 languages. Integration with other systems is facilitated through a robust API and webhooks. Deployment options are varied, catering to different infrastructure preferences. DocuSeal can be deployed on cloud platforms such as Heroku, Railway, DigitalOcean, and Render. For containerized environments, Docker images are available, allowing for deployment via docker run commands. By default, the Docker container utilizes an SQLite database, but it can be configured to use PostgreSQL or MySQL by setting the DATABASE_URL environment variable. Docker Compose configurations are also provided, enabling deployment with custom domains and automatic SSL certificate issuance via Caddy. Pro features, available through commercial offerings, extend the platform's capabilities to meet business needs. These include compa

2026-07-19 原文 →
AI 资讯

REST API Design Best Practices: A Practical Guide for 2026

Every team builds APIs. Few build ones that survive their second rewrite. After inheriting three different REST APIs in as many years — one with endpoints named /getAllUsers , another that returned { "status": "ok" } for both success and 500 errors — I started keeping a list of the practices that actually distinguish robust APIs from ones that generate PagerDuty alerts at 3 AM. This guide distills six rules I've validated across production services handling tens of millions of requests. None are theoretical. All come with working code. 1. Resource-Oriented Naming — Not Action-Oriented The single biggest smell in a REST API is action verbs in URLs: # Bad — these are RPC, not REST GET /api/getUser?id=42 POST /api/createUser POST /api/deleteUser/42 POST /api/activateUserSubscription Resources are nouns, not verbs. The HTTP method is the verb: # Good GET /api/users/42 POST /api/users DELETE /api/users/42 POST /api/users/42/subscriptions # nested resource DELETE /api/users/42/subscriptions/active Key conventions that have held across every production API I've consulted on: Plural nouns : /users , not /user . Consistency with list endpoints ( GET /users = a list) makes singular feel like a bug. Kebab-case for multi-word resources : /order-items , not /orderItems or /order_items . It's URL-safe and matches what browsers expect. Nest at most two levels : /users/42/orders/7 is fine. /users/42/orders/7/items/3/addresses/9 is a cry for help. At that point, use a query parameter: /items?order_id=7 . Use query params for filtering, not path segments : /users?status=active&role=admin , not /users/active/admins . 2. Consistent Error Responses — The Contract People Actually Rely On Most API errors are parsable only by humans staring at a screen. That's a bug. Every error response should follow the same schema so clients can handle them programmatically: { "error": { "code": "USER_NOT_FOUND", "message": "User with id 42 was not found.", "details": { "resource": "users", "identifier"

2026-07-19 原文 →
AI 资讯

Zero Is Not a Score

The evals for my agent skills scored 0% for as long as I had records. Not low. Not noisy. Exactly zero, every skill, every run. And I believed it. For months I thought my skills were bad, because the number said so and the number never wavered. Then one night I actually read the harness. It had fallen back to the wrong auth token. Every call it made came back 401, and it quietly graded each one a failure. The skills never got a chance to fail on their own. I was not measuring them at all. I was reading a broken thermometer. Real weakness is jagged Here is what took me too long to see. When a system is genuinely bad, it scores 40% one week and 60% the next. It passes the easy cases and trips over the hard ones. It has good days. Incompetence has texture, because an incompetent system is still in contact with the world, and the world varies. A flat number has no texture. A flat number means the measurement stopped touching the thing being measured somewhere upstream, and what you are reading is the instrument's resting state. Doctors know this. A heart monitor drawing a perfectly straight line does not mean the patient is calm. Only a broken thermometer writes the same number every time. Key insight: A performance number with no variance is a reading of the instrument, not of the thing being measured. The same bug in three industries I run systems in advertising, in healthcare billing, and in agent operations, and the same shape shows up in all of them. In advertising I found a dashboard figure that had been hardcoded for two years. Nobody questioned it, because it looked right, and it looked right because it never moved. In agent operations, an account-rotation bug in one of my pipelines overwrote every real error with the same generic message, "no active accounts," so for a while every distinct failure in that system looked identical. And in the denial-assessment engine I run for a medical-billing operation, an agreement metric came back at 44.7%, alarmingly low, un

2026-07-19 原文 →
AI 资讯

I Used to Deride AI Assistants. Then I Met a Stack of Business Cards.

I used to deride the idea of an AI assistant from the moment they entered the picture (after seeing all the different *Claw variants). Why would regular people like me need an assistant? The best use case I had heard was: "Oh! It helps us decide whether I or my partner should drive the kids today!" Solving that sounded like a silly problem for an AI assistant to handle. Again, I didn't know any better because I didn't have that problem. I thought I could handle one-off tasks with just an AI subscription. What else was there? I only found the answer once I had a specific use case for it. I attended a business event, talked to a dozen people, and collected several business cards. I wanted to send each person a personalized email thanking them and continuing our conversation. If I were to do this manually, the process would look like this: open the email client, manually type in each email address from the business cards, ensure I typed everything correctly, compose my message, and again, make sure I didn't press "send" prematurely. Just thinking about it felt tedious. That is when the idea of an assistant started making sense. I fire up my coding agent(not a *Claw still), I take a single photo of all the business cards together. I ask the it to extract the names and email addresses. Then, I ask it to loop through the list and ask me what I want to send to each person. It creates drafts(which I still manually review - can't trust them enough), I say send, and then it sends them all automatically. It feels exactly like talking to a real assistant: you tell them what you want done, and it gets done without you having to press buttons or navigate a UI. That is exactly what I did; I simply gave it instructions using my voice. This makes me feel that having an AI assistant is indeed helpful. It might have also been useful to jump on this a little sooner, as I could have bought that Mac Mini at the older, lower price.

2026-07-19 原文 →
AI 资讯

A Hands-On Guide to kalbee: Your First Kalman Filter (and Beyond)

Everything you need to go from pip install to a working multi-object tracker, one runnable snippet at a time. kalbee is a Python library for state estimation — the art of recovering a clean signal (position, velocity, temperature, whatever you're measuring) from noisy sensor data. This guide walks through it from the ground up. Every code block runs as-is; copy them into a file and follow along. Install pip install kalbee The only runtime dependencies are NumPy and SciPy. Optional extras add object-detection ( pip install "kalbee[yolo]" ) and plotting ( pip install "kalbee[viz]" ) support. The one idea you need: predict and update Every filter in kalbee works the same way. You alternate between two steps: predict() — advance the state forward in time using a motion model ("where do I think the object is now?"). update(z) — correct that prediction with a new measurement z ("what does the sensor actually say?"). The filter tracks two things: the state x (your best estimate) and the covariance P (how uncertain that estimate is). You read them back via kf.x and kf.P . Your first filter Let's track an object moving at roughly constant velocity, measuring only its (noisy) position. Instead of hand-building matrices, we use kalbee's ready-made models : import numpy as np from kalbee import KalmanFilter , rmse from kalbee.models import constant_velocity , position_measurement_model dt = 1.0 # Motion model: state is [position, velocity] F , Q = constant_velocity ( dt = dt , process_var = 0.01 , n_dims = 1 ) # Measurement model: we observe position only, with noise variance 4.0 H , R = position_measurement_model ( order = 1 , n_dims = 1 , measurement_var = 4.0 ) # Simulate a noisy trajectory rng = np . random . default_rng ( 0 ) pos , vel = 0.0 , 1.0 truths , measurements = [], [] for _ in range ( 50 ): pos += vel * dt truths . append ( pos ) measurements . append ( pos + rng . standard_normal () * 2.0 ) # std 2.0 -> var 4.0 # Create the filter: start at zero with high uncert

2026-07-19 原文 →
AI 资讯

Building Resilient Real-Time Systems: WebSockets, Redis, and Strategies for High Availability

Originally published on tamiz.pro . Real-time systems are at the heart of modern interactive applications, from chat platforms to collaborative editing tools and financial dashboards. Delivering a seamless, low-latency experience while ensuring high availability and fault tolerance presents significant architectural challenges. This deep-dive explores how WebSockets, for persistent client-server communication, and Redis, for state management and pub/sub, can be combined with strategic design patterns to build resilient real-time systems. The Core Challenge of Real-Time Resilience The primary challenge in real-time systems is maintaining continuous connectivity and data flow despite inevitable network issues, server failures, or application restarts. A single point of failure can disrupt numerous active user sessions, leading to a poor user experience. Resilience, in this context, means the system's ability to recover gracefully from failures and continue operating, even if in a degraded state. WebSockets: The Foundation for Real-Time Communication WebSockets provide a full-duplex communication channel over a single TCP connection, enabling persistent, low-latency message exchange between client and server. Unlike traditional HTTP requests, WebSockets keep the connection open, eliminating the overhead of connection setup for each message. However, managing a large number of concurrent WebSocket connections and ensuring their availability across a distributed system requires careful design. WebSocket Server Scalability and Load Balancing Directly load balancing WebSocket connections using standard HTTP load balancers can be tricky because WebSockets are long-lived. Sticky sessions are often employed to ensure a client consistently connects to the same backend server. While this works, it can lead to uneven server load and complicates server replacement during failures. A more robust approach involves a dedicated WebSocket gateway layer that can manage connections and

2026-07-19 原文 →
开发者

Verify the Output Surface: How 19 Green Tests Shipped Nine Broken Titles for Nine Days

Originally published on hexisteme notes . I have a small pipeline that crossposts my notes to dev.to. It parses a Markdown file's front matter, builds a payload, and calls the dev.to API to publish. It has 19 gate tests, and every one of them was green the whole time it was shipping. It published nine articles. All nine went live with their titles broken — the front-matter quotes were sitting right there in the title, visible to anyone who looked, for nine days, and nothing in the pipeline noticed. I didn't notice either. A human had to open the dev.to profile page by accident before anyone found out. This is the postmortem, and the reason I'm writing it up as a general essay rather than just a fixed-bug log is that the root cause isn't specific to dev.to, or to Markdown front matter, or to Python. It's a category of mistake that any pipeline with an external endpoint on the other end can make: testing the payload you build, and never testing what the other system does with it. The pipeline that had "passed everything" The shape of it is ordinary. A draft file has YAML-style front matter — title: "Some Title" — because that's the convention. A parser reads the front matter and pulls out the title. A payload builder takes that title and a few other fields and assembles the JSON body for the dev.to API. The API gets called, dev.to accepts it, the article is live. Nineteen gate tests cover this path — the front-matter parsing and the payload/API contract of the pipeline's own code. All green, every publish. The gap is in what "parses the front matter" actually means. The parser isn't a real YAML parser. It's closer to line.partition(":") — split each line on the first colon, take the right-hand side as the value. That works fine for tags: testing, devops where there's nothing to unwrap. It does not work for title: "Some Title" , because the quote characters are part of the string on the right-hand side of the colon, and a partition-based parser has no concept of "this

2026-07-19 原文 →
AI 资讯

It Can Die in Its Sleep — Self-Healing launchd Jobs with Multi-Slot Firing and a Done-Marker

My previous piece, " Making a launchd Job Unload Itself ," built a job that runs exactly once and then unloads itself. This time it's the mirror image: a pattern designed around the assumption that the job will die mid-run — it fires several slots a day and delivers "retry until it succeeds, then quit immediately on success." Every morning I hand Claude Code the task of updating my Obsidian Vault, and it kept dying partway through — killed by macOS sleep, no network on wake, or a claude timeout. Instead of trying to prevent every failure perfectly, I decided "it can die overnight as long as it's done by the time I wake up" was the more realistic goal, and I redesigned around that. The problem: "started but didn't finish" piles up silently There are three ways a launchd job fails to run to completion. Lid-close sleep (on battery) — caffeinate -s only works on AC power. On battery, the job freezes the instant you close the lid, and gets reaped by timeout after wake. No network — right after wake, WiFi isn't connected yet. git push and claude's API calls time out. claude timeout — an ingest that chews through 28 hours of conversation logs doesn't fit in a single slot and times out (this happened three days in a row, 2026-06-11 to 13). All three can look like "the job started, exit code 0," so you notice late. Overall design: 4 slots + a done-marker The fix is simple: stuff multiple StartCalendarInterval entries into the plist, and at the top of the script check "if today's run already succeeded, exit 0 immediately." <!-- com.shun.vault-auto-ingest.plist (StartCalendarInterval excerpt) --> <key> StartCalendarInterval </key> <array> <dict> <key> Hour </key><integer> 4 </integer><key> Minute </key><integer> 55 </integer> </dict> <dict> <key> Hour </key><integer> 8 </integer><key> Minute </key><integer> 20 </integer> </dict> <dict> <key> Hour </key><integer> 10 </integer><key> Minute </key><integer> 45 </integer> </dict> <dict> <key> Hour </key><integer> 12 </integer><key>

2026-07-19 原文 →
AI 资讯

Looking for Contributors: Building FaultPlane, a High-Performance System Engine (Good First Issues Open!)

Why FaultPlane Exists Modern low-latency infrastructure demands bypassing heavy disk serialization. FaultPlane addresses this by implementing an eBPF-driven architecture designed for zero-copy memory management. We are building the core engine along with an interactive Next.js operations dashboard, and we need your expertise to accelerate development. Our Technical Stack Core Infrastructure: Go (Golang), eBPF, Kernel-space architecture, PCIe DMA abstractions Operations Dashboard: Next.js, Tailwind CSS, TypeScript Active Challenges (Good First Issues Available) We have organized our current roadmaps into highly accessible, well-documented GitHub issues. Contributors of all skill levels are welcome to claim tasks: Architecture & Documentation: Migration of repository references and architectural namespaces from AgentMesh to FaultPlane. Frontend Engineering: Implementation of a minimalist dashboard grid layout with command palettes, responsive sidebar navigation, and multi-region panel toggles. System Programming: Implementation of lock-free ring buffer memory allocators using sync/atomic flags, and eBPF sockmap TCP stream splicing. How to Get Your First Pull Request Merged Explore our current open tracker list: https://github.com/devloperdevesh/FaultPlane/issues Leave a comment on the issue you wish to claim, and it will be assigned to your profile immediately. If you require setup assistance or technical clarification, start a thread under our discussions tab or leave a query right here in the comments. Join us in building a high-performance open-source system engine.

2026-07-19 原文 →
AI 资讯

Write Your Exceptions Down

I had a rule with no exceptions. RETSBAN, my primary agent, runs local inference only: open models on my own hardware, no cloud, no fallback. If the GPU box is down, the agent is down. Then Mia, the agent that runs my marketing, needed a frontier model to do her job well. And I did something that felt strangely formal for a one-person company. I amended my own policy, in writing, with the date attached. No one was in the room Here is what took me a while to see. A human employee remembers the day you made an exception. They were in the room when you said fine, just this once. An agent was never in the room. There is no room. Every session starts cold from the files, and the files are the only memory the company has. So when the policy says local only, no exceptions, and reality contains an exception, one of two things happens. Either the agent obeys the file and blocks work I actually want done, or it notices the contradiction and starts guessing which side to trust. The guessing is the dangerous case. A rule that has been contradicted once, silently, is not a rule anymore. Every agent that loads it gets to decide, in every session, whether to believe it. You never see the deciding. You just see the drift. An exception that lives in your head does not bend a rule. It erases it. The amendment On 2026-04-23 I opened the policy file, a file literally named local_only_no_anthropic, and narrowed it instead of breaking it. The amendment names who is exempt: Mia, and only Mia. It says why: marketing work that needs capability the local stack does not have. It carries the date, and it points to the full model-topology doc for anyone, human or agent, who wants the whole picture. RETSBAN's constraint did not move an inch. Still local only. Still no fallback. Still down when the GPU box is down. That is the difference between an amendment and a repeal. An unwritten exception repeals the rule and hides the repeal. A written amendment narrows the rule and makes it stronger, beca

2026-07-19 原文 →
AI 资讯

Is your agent's grep tool a shell command?

When you give an LLM a tool, you hand it a real function and let it choose the arguments. Those tools are everything your agent can do to a real system: read a file, write to your database, send an email, run a shell command, delete data. They are your risk surface, and most teams have never looked at it in one place. So we did. We ran scan across a batch of popular open-source TypeScript AI agents. A few of the things it found, none of them exotic: A coding agent whose grep and glob tools, which sound read-only, actually shell out through execSync . Its bash tool passes a model-chosen string straight to spawn . Arbitrary command execution, behind three innocuous names. A query tool that fires an HTTP DELETE . A "query" that deletes. A calculator that runs eval on whatever the model types, in a widely-used agent framework. Arbitrary code execution behind the friendliest name in the box. A send-email tool that posts to an array of recipients, so the model chooses who gets mailed. The single most common finding, in almost every agent we scanned: a fetch tool aimed at whatever URL the model supplies. That is a door to your internal network (an SSRF surface). Notice the pattern. The dangerous tools are not named dangerous . They are named grep , query , calculator . A name is a claim. The code is the evidence. See your own agent's tools scan reads that evidence. One command, no install, no signup, no code change: npx @agentx-core/scan . It lists every tool the model can call and ranks each one by what it can do, from read-only up to destructive: 🔍 AGENTX SCAN (TypeScript · 3 files · 5 tools) =========================================================================== RISK TOOL GUARD WHY ---- ---- ------ ------------------------ high calculator yes calls `eval` lib/tools/compute.ts:4 high grep yes calls `execSync` lib/tools/system.ts:8 med sendEmail yes calls `mailer.send` lib/tools/io.ts:5 med fetchUrl yes outbound req to agent-controlled host (SSRF) lib/tools/io.ts:11 2

2026-07-19 原文 →
AI 资讯

Burning Out or Burning Bright: Navigating the Dark Side of Tech Enthusiasm

Introduction As developers, we're often drawn to the fast-paced and ever-evolving world of technology. The thrill of learning new skills, the rush of solving complex problems, and the satisfaction of building something from scratch can be incredibly exhilarating. However, this enthusiasm can sometimes tip into an unhealthy obsession, leading to burnout. The Psychological Impact of Constant Learning The tech industry is notorious for its fast pace, with new technologies and frameworks emerging every month. This creates a sense of FOMO (fear of missing out) among developers, who feel pressure to stay updated and relevant. The constant learning curve can be mentally draining, leading to feelings of anxiety and stress. Example: Consider the popular saying 'You can't be good at everything.' This is a crucial fact to acknowledge in our ever-evolving tech world. Example of prioritizing learning paths learning_paths = [ ' AI ' , ' Cloud ' , ' Cybersecurity ' ] priority_path = input ( ' What path do you want to prioritize? ' ) if priority_path in learning_paths : print ( ' Great choice! ' ) else : print ( ' Consider your options carefully. ' ) Environmental Factors: Workplace Culture and Resources The workplace culture and availability of resources can significantly impact a developer's likelihood of burnout. A toxic work environment, lack of support, or inadequate resources can exacerbate burnout, while a supportive and inclusive culture, mentorship, and access to resources can help mitigate it. Recognizing Early Signs of Burnout and Implementing Self-Care Burnout can sneak up on us, but there are early warning signs to look out for. If you're consistently feeling exhausted, disconnected from work, or struggling to focus, it may be time to take a step back and reassess your priorities. Implementing self-care practices, such as exercise, meditation, or hobbies outside of work, can help maintain a healthy work-life balance. ## Conclusion As developers, we need to acknowledge

2026-07-19 原文 →