标签：#us

SoundCloud has launched a new beta feature that allows artists on the audio streaming platform to sell music directly from their profiles, instead of diverting fans to purchase from third-party services like Bandcamp and Beatport. The feature aims to give listeners a better way to support the musicians behind their favorite songs, because SoundCloud isn't […]

Robot bodies are waiting for their AI brains to catch up.

GitHub热门项目 | 日報管理リポジトリ | Stars: 133 | 13 stars today | 语言: Rust

GitHub热门项目 | Mission control for your AI agents | Stars: 406 | 108 stars today | 语言: Rust

The startup came out of stealth with $6 million in seed funding and a plan to use LLMs and cybersecurity know-how to make AI queries coherent.

A solid observability setup usually comes down to three pieces working together: something that collects metrics, something that exposes system-level metrics, and something that visualizes it all. Here's what each one does and how to install them. The Theory: How This All Fits Together Before installing anything, it helps to understand the model, because it's a bit different from how logging or alerting tools usually work. Pull, not push. Most people's first instinct is "the app should send its metrics somewhere." Prometheus flips that around — it pulls metrics on a timer instead. Every target (a machine, a service, an app) exposes a simple HTTP endpoint, usually /metrics , that just returns plain text numbers. Prometheus visits that endpoint every N seconds (the "scrape interval") and saves whatever it finds, with a timestamp attached. Nothing gets pushed to Prometheus — Prometheus goes and asks. This means for anything to show up in Prometheus, it has to satisfy one requirement: something has to expose a /metrics endpoint Prometheus can reach. That's the whole game. Everything else in this stack exists to satisfy that one requirement or to make the data useful afterward. Why Node Exporter exists. Your operating system doesn't naturally speak Prometheus's language — it doesn't expose CPU/memory/disk stats as a /metrics endpoint by default. Node Exporter's only job is to read stats the OS already tracks (via /proc and /sys on Linux) and republish them in the text format Prometheus expects, on port 9100. It's a translator, not a monitoring tool by itself — it collects nothing, decides nothing, alerts on nothing. It just answers "what does this machine look like right now?" whenever asked. Why Prometheus itself is separate. Prometheus doesn't know anything about CPUs or memory — it has no idea what it's scraping. It just knows: "go hit this list of URLs on a schedule, and remember what comes back." The intelligence is in the config (which targets to scrape, how often)

Debian is polling its developers on how to handle AI-assisted contributions, with options that range from broadly permitting them to banning them outright. Whatever the outcome, I think this is one of the more consequential governance conversations in open source right now, and not for the reason the headlines suggest. The framing everyone reaches for is philosophical. Is generated code authored? Is it derivative? Does using a model make you less of a contributor? Those are real questions and I do not have confident answers to them. But if I imagine actually being a Debian maintainer, my problem is not philosophical at all. It is that my queue is full and my reviewing hours are finite. The bottleneck was never writing code Volunteer projects have always been constrained by review capacity, not by supply of patches. The scarce resource is someone knowledgeable enough to say "this is correct, this fits our conventions, I will own the consequences if it breaks." Assistants change the ratio between those two things dramatically. The cost of producing a plausible patch has fallen much faster than the cost of evaluating one. That asymmetry is the whole story. A project can absorb a lot of contributors when each contributor's output is roughly proportional to their understanding. It struggles when someone can submit a large, fluent, superficially reasonable change to a subsystem they have never read. I want to be careful here: plenty of experienced maintainers use these tools well, and their patches are better for it. The failure mode is not the tool. It is the decoupling of confidence from comprehension. Why detection is the wrong axis A ban sounds like a clean answer, and I understand the appeal. But I am skeptical it can be enforced in a way that means anything. You cannot reliably detect generated code, especially after a human has edited it, and especially for the kind of small idiomatic patch that makes up most of a distribution's traffic. A rule you cannot enforce d

Every so often a post reminds me that the most dangerous line of code in a system is the one that looks like it could not possibly be wrong. This week's version: calling .lower() on a string can be a security vulnerability. If your first reaction is skepticism, mine was too. Lowercasing is the plumbing of programming. We do it to normalize usernames, compare header names, canonicalize domains, and check things against blocklists. It feels like arithmetic. The problem is that case conversion is not a character-by-character mechanical operation. It is a linguistic one, defined by Unicode, and it has behavior that surprises almost everyone who has not been bitten before. Case is not symmetric, and not always local Two examples that break the mental model. Turkish has a dotless i, and correct locale-aware conversion maps between letters differently than English does, which means "the same" string can lowercase into two different results depending on locale settings. And there are characters outside ASCII whose lowercase form is an ASCII character, meaning a string that contains no k at all can become one that does after normalization. Sit with that second one for a moment, because it is the security-relevant shape. If you validate a string, then normalize it, you have validated something that no longer exists. Your check ran against one value and your system acts on another. That is the classic time-of-check versus time-of-use bug, except the mutation is not caused by an attacker racing you. It is caused by your own normalization call, quietly doing what the spec says it should do. I want to be careful not to overstate the specifics here, since the exact behavior depends on language runtime, Unicode version, and locale configuration. The generalizable lesson is what interests me. The pattern to look for in your own code Anywhere a string travels through this sequence, there is potential for trouble: Accept input. Check it against a rule: an allowlist, a blocklist, a com

I read a short argument this week that tooltips need a delay before they appear, and then, once you are obviously working your way along a toolbar, they need to drop that delay entirely. It is a tiny piece of interface behavior. It stayed with me longer than most architecture posts I read this month. Partly because it is correct, and partly because it is not really about tooltips. It is about the fact that timing is something you design, the same way you design spacing or color. Most teams treat it as a leftover. We pick 200ms because it felt fine on a fast laptop. Or we pick zero because zero seems honest. Or we inherit whatever number shipped inside the component library we installed on day one and never revisit it. Then the product feels twitchy or sluggish, and the bug report says "it feels weird," which is the hardest class of bug there is. Two different users living in the same hands What makes the tooltip case interesting is that a single person switches modes mid-interaction. When my cursor is crossing the screen on its way somewhere else, a tooltip that fires instantly is noise. It flashes, it covers content, it makes the interface feel jumpy for no reason. The delay exists to filter accidental passes. But the moment I stop and read one tooltip, I have declared intent. I am now surveying. If the next four icons each make me wait 500ms, the interface is punishing me for exactly the behavior it was trying to encourage. The delay was a filter for accidents, and I stopped having accidents. So the right behavior is stateful: wait at first, then trust me until I leave the neighborhood. That is the whole insight, and it generalizes further than hover states. The same pattern, wearing other clothes Once you see it, this shape is everywhere: Autocomplete that should debounce while you are typing a word, then feel instant once you have paused and are clearly evaluating results. Confirmation dialogs that make sense the first time you delete something and become a wall

Pet owners, rescue agencies, and wildlife groups are calling for new safeguards as AI makes it harder to tell whether animals, from polar bears to house cats, are real or fake.

Runable says 60%–70% of its 1 trillion-plus token usage in the last 90 days came from paying customers.

Because "we'll be in touch" is not an observable state. I submitted a job application recently. It...

2024 was the year AI was everywhere. The ads, the praise, the feeling that something had already been decided without me. I am in my fifties. I had to decide whether to watch or take part. I decided to take part. I started with VS Code, on a paid plan. I did not have to think about what to build. Something had been sitting in my head for years: an automated trading system. I have lived fifty years, and while raising children the money got tighter, not looser. Financial freedom was moving away from me, not toward me. So I wanted to make money with automated trading. I think the idea first arrived in my mid-forties. That is why the decision to take part came so quickly. Whatever I said out loud would simply get built. That was the hope I walked in on. I do not really know how to code. But the AI would handle that part, so I trusted it. Where the illusion first cracked A year inside VS Code taught me that two names mattered: GPT and Claude. I used them in turn. I used them one at a time. Two problems. First, even on a paid plan the usage ran out fast. Faster than I expected. The road ahead was long and I was sitting still, waiting for a quota to reset. The second one was worse. The explanations were excellent. The results were not. That is where the illusion cracked for the first time. I still could not let go, so I paid for more. Adding Cursor bought me some headroom. And a different problem showed up immediately. Switch the model and it wants to start over Change the model, and it wants to rewrite everything from the beginning. Handed code written by a different AI, it would rather replace the whole thing than edit it. That is when I understood that switching AI mid-project is a bad idea. Everyone talks about pricing. Almost nobody talks about this one. And this is the one that actually held me back. I spent a lot of time fighting the tool. In the end I paid for Claude's hundred-dollar plan, and from then on I worked with Claude. What I gained: the job nobody wanted

The strongest candidate I ever voted no on solved the problem in eleven minutes. Clean. Optimal. Caught the edge case I normally have to hint at twice. Then I opened my notes to write the scorecard and found one line: "Solved it. I have no idea how." That is the short version of why strong engineers fail coding interviews. Not because they can't code. Because nothing they did survived the trip from the room to the scorecard. The interview is not the thing being graded. The document I write forty minutes later is the thing being graded, and you are not in the room when it gets read. TL;DR Strong engineers fail coding interviews mostly on signal density , not correctness. A silent correct answer scores lower than a narrated near-miss. Interviewers score 3-4 rubric axes (problem solving, coding, communication, and for senior roles, judgment) and each axis needs quotable evidence , not vibes. The decision happens in the debrief , where ambiguity defaults to no. "Lean hire" across the board is a rejection at most companies. The most common senior failure is solving a senior problem like a junior : no scoping, no tradeoffs, no failure modes, no tests. Fix it by talking in sentences your interviewer can transcribe verbatim: assumption, tradeoff, complexity, test. What do interviewers actually score in a coding interview? Not "did you get the answer." Almost every structured loop I've been part of scores a fixed rubric, and correctness is one box inside one axis. Here is roughly what the form looks like: Axis What it's really asking What lands on the scorecard Problem solving Did you scope before you built? "Asked whether input fits in memory before choosing an approach." Coding Would this survive code review? "Named things well, extracted a helper, no off-by-one." Communication Could I follow you in real time? "Told me the plan first, then coded the plan." Judgment (senior+) Do you know what breaks in prod? "Unprompted, called out the retry storm risk." Notice what every r

I just started a blog and published my first blog post about Logical Volume Management. I'm new to documenting my work, so I'd really appreciate any feedback on the content, clarity, or writing style in general. This site is a mix of a blog and a portfolio. Since I'm new to all of this, it would be great to get some feedback on whether this post works well just as a blog post, or if it actually holds up as a portfolio project too, before I keep writing more. www.mvtechblog.com Thanks in advance.

The $200 million extension comes just months after the physical AI startup reached a $2 billion valuation.

📝 Originally published (in Japanese) at forge.workstyle.tech . When building voice-based AI interactions in the browser (avatars, voice bots, streaming AI), you’ll inevitably hit pitfalls stemming from audio physics and browser implementation quirks. This article compiles 16 traps I encountered during product development , organized in a symptom → cause → solution lookup format . No need to read from top to bottom—jump straight to the symptom you’re facing. Echo and Self-Response Issues 1. Avatar Responds to Its Own Voice (Despite echoCancellation: true ) Symptom : TTS audio is picked up by the mic, and STT recognizes it as user speech, creating a self-response loop. Cause : AEC (Acoustic Echo Cancellation) requires a reference signal (the "sound to cancel"). Only the browser's official playback paths ( <audio> / WebRTC receiver tracks) serve as references. Custom playback via Web Audio API does not reliably function as a reference . Solution : Return TTS audio from the server as a WebRTC remote track and play it via an <audio> element. This eliminates echoes without text-matching workarounds (tested: 99 seconds of continuous speech with speakers on, zero false user turn detections). 2. Echoes Are Gone, but Speaking Simultaneously with the Avatar Distorts My Voice and Causes Misrecognition Symptom : Only during dual speech, proper nouns get mangled (e.g., "社員数" → "シャインズ"), especially at word beginnings. Cause : Fundamental AEC trade-off. To cancel echoes, AEC suppresses/distorts near-end (user) audio during dual speech. Solution : Mitigate in three layers: ① Increase mic Opus bitrate and enable FEC (see Pitfall 13) ② Provide vocabulary hints to STT (see separate article: use "recent avatar speech" as initial_prompt , not a dictionary) ③ Instruct LLM: "Input is STT transcription with potential errors. Interpret unnatural words as phonetically similar terms and add confirmation prompts." 3. Can’t Suppress Audio from Other Apps (Music, Videos) Symptom : Audio/lyrics fr

The company's new fundraising total now stands at $232 million.

"[P]eople are not familiar with this disease and don’t fully understand the potential severity."

Privilege escalation attack grants "full control" and freedom from Meta's servers/apps.