标签：#us

One of our agents ran a test suite. The suite takes four minutes. The MCP client's idle timeout is sixty seconds. You can see where this is going. At second sixty the client cancelled the call. The process kept running — nobody told it to stop — while the model, holding a cancellation where its test results should be, did the reasonable thing and ran the suite again. Two test suites, same directory, racing each other over the same build artifacts. The second one failed with a locking error, the model reported the tests as broken, and the tests were fine. In another session the same model, burned before, developed a workaround: run the build, then call sleep 240 , then look. A tool call that does nothing, held open for four minutes, so that a different tool call might have something to show. The model had reinvented polling, badly, because we hadn't given it anything better. I build octofs , an open-source MCP filesystem server, and this incident set the agenda for eleven releases in two weeks (0.10.1 through 0.14.1). The principle behind them is one I keep coming back to: an MCP server's real interface is every string it hands back to the model. These releases apply it to the slowest string of all — the one the model waits for. The shell is now event-driven. Commands start in the foreground, move to the background on their own if they outlast ten seconds, and the client gets a notification when they finish. Nothing blocks, nothing gets killed, nothing runs twice. First fix: prove the call is alive The sixty-second cancellation had a shallow cause and a deep one. The shallow one: a shell call is silent by nature. A build that's compiling says nothing on the wire for minutes, and to an MCP client silence is indistinguishable from a hung server. So 0.10.2 added liveness heartbeats — while a command runs in the foreground, octofs emits a progress notification every ten seconds, well below any sane idle timeout, so a single missed beat can't cancel the call. That stopped

Believe it or not, the Tesla Cybercab is coming. Nearly two years after Elon Musk first unveiled the gold-tinted, gull-wing door sporting, steering wheel-free two-seaters as the future of Tesla's autonomy efforts, the company is finally putting them into operation as part of its robotaxi service in Austin, Texas. Public rides are here, and as […]

The electric-auto maker will officially debut its steering-wheel-free robotaxi on Thursday. But building the vehicle is the easy part.

At least three of the first 32 Rassvet satellites likely suffered outright failures, and more may be in trouble.

Meet the AI police who can make or break careers—in publishing and beyond.

A portfolio website should make it easy for a potential client to answer three questions: What do you...

My hot take is: Telling people that they have to build endlessly is very, very, very bad advice. If...

If your AI application suddenly becomes 300–500ms slower after adding an AI gateway, the first...

Every time I tried to explain technical debt to a business leader early in my career, I watched their eyes glaze over at roughly the same word. I would talk about coupling, legacy modules, and refactoring, and they would hear a developer asking for time to tidy up code that already worked. From where they sat, it sounded like a hobby. The system ran, customers paid, revenue arrived. Why would anyone spend money making invisible internals prettier when there were features to ship and deadlines to hit? The breakthrough, for me, was to stop explaining the engineering and start describing the finance, because technical debt is a loan whether anyone chose to take it or not. Every time we shipped a shortcut to hit a date, we borrowed speed today against effort tomorrow. That is often a completely rational trade. Getting to market fast can be worth far more than a clean design nobody ever sees. The problem is not the borrowing. The problem is that this loan accrues interest silently, and the business had been making payments for years without ever seeing the statement. That interest shows up in ways leaders actually feel, once you connect the dots for them. It is why a feature that used to take a week now takes a month. It is why every change risks breaking something unrelated, so nothing ships without a nervous weekend. It is why new hires take half a year to become productive in a codebase that only its veterans can navigate. None of that reads as "debt" on any report, but it is the compounding cost of shortcuts taken long ago, paid daily by everyone who touches the system. Framed that way, the conversation finally changes. I stop asking for permission to clean things up and start presenting a financial choice. We can keep paying this interest indefinitely and watch our delivery speed keep bleeding out, or we can pay down some principal now and get that velocity back. Sometimes the honest answer is to keep carrying the debt, and that is fine. What is not fine is carrying

Have you ever read a job posting and your heart just sings the song of "HIRE ME PLEASE!!!", yeah,...

Pessoal, eu quase mandei uma lista de 23 "vulnerabilidades" pra mantenedores de código aberto. XSS, CORS, CSP, um SVG suspeito. O modelo tinha devolvido volume. Eu sentia que tinha trabalhado. Aí parei. Se eu fosse o cara do outro lado da issue, eu levaria isso a sério? A conta virou quando eu parei de pedir "audita meu código". Passei a escrever o contrato antes de abrir o repo. Direção (o que o modelo pode afirmar) e disciplina (o que ele não pode). Isso não deixa o LLM mais inteligente. Controla o comportamento. Em segurança, isso é o que separa auditoria de lista. O que você leva daqui: o contrato (esqueleto), por que o scanner não substitui hunt, e as três portas pra não colar relatório no tracker. Os repos no meio são prova. Não são o ponto. Tabela de Conteúdo 1. Direção e disciplina não deixam o modelo mais inteligente 2. O scanner vê o que está. O hunt vê o que falta 3. Silêncio também é resultado 4. As três portas 5. O que você monta amanhã 1. Direção e disciplina não deixam o modelo mais inteligente Esse é o ponto que eu demorei pra aceitar. O modelo já conhece OWASP. O que muda é o que ele tem permissão de afirmar. Sem isso, "audita meu código" devolve XSS fantasma, CORS, CSP, um SVG. Volume. A pergunta de segurança some: disto aqui, o que vira issue, o que vai pro e-mail privado, o que é silêncio? Direção amarra três coisas antes da leitura: Padrão externo. OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante em uma frase, falsificável. "Webhooks deveriam ser autenticados" é opinião. "Todo handler de webhook de entrada verifica autenticidade do remetente antes de mutar estado" é hunt. Formato único. Finding, observação e hipótese não misturam. Disciplina é o que corta o teatro. O texto que o modelo vê antes de abrir arquivo: Padrão: OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante: uma frase, falsificável. Relatório: finding, observação e hipótese não misturam. Sem arquivo:linha → não é finding. CWE inv

Mushroom is a tiny pixel creature that lives on your Mac . It can tell when you are actually at the desk, so it nudges you to drink, move and rest your eyes at the moments that help, and stays quiet when they would not. Made for people who sit at a Mac for hours. Developers, designers, writers, students, anyone whose focus is the problem and the job at the same time. Mushroom can do lots of things: https://www.getmushroom.app/features Pricing: https://www.getmushroom.app/pricing If you've seen Mushroom elsewhere, please let me know where. If you miss a feature, please tell me. I'm open for feedback and suggestions. Personal comment: I have created Mushroom because I wanted a very simple way to set up a quick reminder. You just type what and when in one sentence, and your reminder is set. Over the course of weeks, it evolved into a whole set of features. I'd like to thank Michael K. Graves for helping with ideas and suggestions, and I'd like to thank Caz-Bee for providing the graphics. Thank you for giving my post attention.

On July 11, 2026, I started building a project inspired by link-in-bio platforms. The idea was pretty straightforward: Create a profile → customize it → add your links → share it. So I built Rizzzler. And right now, it has 11 users. Yep. 11 😂 Not exactly the kind of number you'd put on a startup pitch deck. But those 11 users actually made me think about the project in a completely different way. The problem I noticed 🤔 I started looking at how people were using Rizzzler. And I noticed something: People would create their profile... Then disappear. Some wouldn't come back for a week. Some wouldn't even check the app for weeks. And eventually I realized something obvious. Why would they? Rizzzler was primarily a profile website. Once you've created your profile and shared your link, what reason do you have to open it again? You don't. That got me thinking: What else can we actually do with a profile? I didn't want Rizzzler to become something people set up once and completely forget about. I wanted the profile to actually do something. And that's where I got a pretty crazy idea. What if Rizzzler became more than a profile? I've used services that let you log into other applications using their account. For example: Sign in with GitHub. That got me thinking: What if Rizzzler could do something similar? Instead of Rizzzler only being a place where you create a profile... What if developers could use Rizzzler as an identity provider? And suddenly I had a new idea: Sign in with Rizzzler That was probably the craziest idea I've had for this project so far. And I decided to build it. I built my own OAuth 2.0 system 🔐 I started building the OAuth 2.0 mechanism, the developer-side integration, and the documentation. I also created a developer docs page so developers can understand how to integrate Sign in with Rizzzler into their applications. I've tested the mechanism locally, but there's an important distinction: It hasn't been properly tested by a real third-party applica

If you approach generative models as ""networks that create images,"" the field quickly turns into a collection of disconnected architectures. A more useful developer mental model starts one level lower: What probability structure could have produced the data, and how can we represent, learn, and infer that structure without making the computation impossible? That question connects autoregressive models, VAEs, flow-based models, GANs, and diffusion models. Their architectures look very different, but they all respond to the same underlying tension: high-dimensional data distributions are difficult to represent, learn, normalize, sample from, and reason about. Generative modeling can therefore be organized around three interacting problems: Representation: How do we represent a complex high-dimensional joint distribution? Learning: How do we make the model distribution approach the data distribution? Inference: Given an observation, how do we reason backward about hidden variables or the process that generated it? Once these three pieces are connected, the major families of deep generative models become much easier to understand. From prediction to distribution learning A discriminative model usually begins with a prediction problem. Given an input x , predict the most likely output y : f ( x ) = y ar g max ​ p ( y ∣ x ) The model focuses directly on the conditional relationship required for prediction. A generative model asks a broader question. Instead of learning only the path from x to y , it models the probability structure from which the data arises. For class-conditional modeling, for example, we can model p ( x ∣ y ) together with the prior p ( y ) and recover the posterior using Bayes' rule: p ( y ∣ x ) = p ( x ) p ( x ∣ y ) p ( y ) ​ In unsupervised generative modeling, the target becomes the data distribution itself. We assume the training samples come from some unknown distribution: x 1 ​ , x 2 ​ , … , x N ​ ∼ i.i.d. p data ​ ( x ) The model then construc

So, my fiance wanted a health and fitness app, to track meals, exercise routines, manage upcoming...

AI coding tools can write a function in seconds. The harder question is whether that function...

We’re a small team building Sealshot, a free and open-source screenshot app for macOS. We started working on it because screenshots often become disposable files. We use them for bug reports, QA, documentation, support, and security work, but later they can be hard to find or reuse. They can also accidentally contain sensitive information such as emails, API keys, tokens, internal URLs, or customer data. Sealshot is built around a simple idea: Treat screenshots more like documents than temporary images. It supports: region, window, and scrolling capture screen recording editable annotations OCR and searchable screenshot archives sensitive information detection before sharing encrypted local storage local metadata generation Everything is processed locally on the Mac. It’s open source and free, and we’re still actively improving it. We’d really appreciate feedback, especially from developers, QA engineers, support teams, and people working in security. Website: https://seal-shot.com/ GitHub: https://github.com/ldeng83/Sealshot

September is full of opportunities to expand your knowledge of the night sky. Mark your calendars.

The company will give select partners early access to its Astra AI model—so they have time to shore up their defenses.

Apple is hosting its iPhone release event next week, which is rumored to feature the first-ever foldable iPhone.