标签：#vs

MCP for AWS Security Engineers: Build a Read-Only Security Hub Triage Agent For AWS-heavy security work, I would start with AWS Agent Toolkit for AWS and the managed AWS MCP Server , not a custom MCP server. The reason is practical. AWS now provides a managed MCP path that can connect AI coding agents to AWS documentation, AWS APIs, AWS skills, and existing IAM credentials. The Agent Toolkit also provides plugin-based setup for supported agents such as Claude Code and Codex. For security teams, that is the right starting point because the enforcement point remains AWS IAM, not the model. The initial operating model should be strict: Read-only first. No production write authority. No access to secrets. No raw customer PII or sensitive incident logs in prompt context. No automatic remediation. No AI-approved suppression, exception, merge, deploy, or risk acceptance. Human review and CI/CD remain the release authority. That is the same posture I would use for a governed Claude Code or Codex rollout: named identities, SSO, scoped credentials, default deny, tool approval, audit logs, and security evidence tied back to tickets, pull requests, CI logs, and cloud findings. What we are building This article walks through a practical security workflow: A read-only Security Hub triage assistant that helps a junior security engineer produce a daily or weekly findings summary, remediation backlog, and evidence pack without allowing the agent to modify AWS. The agent will be able to: Read AWS Security Hub findings. Group findings by account, severity, product, resource, and control. Explain why a finding matters. Draft remediation tickets. Draft a Slack-ready summary. Produce local markdown, CSV, and JSON evidence files. The agent will not be able to: Suppress findings. Archive findings. Mark findings resolved. Disable Security Hub standards. Modify IAM, S3, EC2, KMS, GuardDuty, Inspector, or Config. Deploy remediation. Run destructive scripts. Approve risk acceptance. This is no

Não é novidade para ninguém que estamos passando por uma transformação na área de desenvolvimento de software, em que a IA está assumindo diversas atividades. E isso me faz pensar: o que vamos medir, ou o que teremos como parâmetro para qualidade de software daqui pra frente? É sobre isso que vou falar neste texto. Antes das métricas: entenda o momento do seu time Antes de entrarmos nas métricas em si, precisamos entender o momento em que o nosso time está. É muito fácil eu simplesmente jogar métricas aqui e você aplicá-las ao seu time de maneira automática — mas será que elas fazem sentido para o seu contexto? Uma coisa que eu falo bastante aos meus alunos da mentoria que dou na He4rt Developers é: pra que eu quero isso? Softwares representam necessidades do mundo real, logo, medir o sucesso e a qualidade deles vai depender muito das necessidades que eles buscam suprir. Partindo agora para as métricas, eu gosto de dividi-las em dois grupos: Métricas para stakeholders Métricas para o time Qualidade de software não se resume a número de bugs — ela se aplica tanto em como o software é recebido pelo cliente final, quanto em como ele é desenvolvido. Métricas para stakeholders Uma coisa que eu aprendi neste tempo na empresa em que tenho atuado, principalmente com a transformação digital, é que mostrar número de bugs abertos ou resolvidos não mostra para o público o que realmente importa: como está a qualidade do produto. E, para me ajudar nisso, eu sempre tento me colocar no lugar de um cliente que não tem conhecimento profundo sobre o ciclo de desenvolvimento de software. A primeira coisa que eu gostaria de ver quando um QA, ou o time, vier me mostrar os resultados de uma sprint ou de um quarter é: quantos problemas eu tenho em produção — mas não só isso, quanto tempo tenho levado para resolvê-los. Mean Time to Resolve/Repair (MTTR) Essa é a famosa métrica que vai mostrar o tempo que leva desde que o problema é identificado até ele ser resolvido em produção. Dependendo

Apple announced the new CarPlay feature not long after Google announced a similar update for Android Auto.

The Fed dropped the ball, but California's new program will provide up to $3,500 in instant rebates to first-time EV buyers.

RGB TVs are the latest hotness in the world of televisions, and I’ve tested many of the latest models to see which you should buy.

If you like going on a long road trip, you might want to steer clear of these vehicles.

Like Google Maps, Waze is going all-in on Gemini.

There’s a new fleet of TVs using new mini and micro RBG display tech, and Samsung’s R95H model isn’t as impressive as it should be.

It follows reports of 100,000 jobs being under threat at the German automaker.

TL;DR AI editors love writing recursive merge helpers, and most of them are open to prototype pollution. One crafted JSON payload with a proto key can flip an isAdmin flag on every object in your app. Guard the keys or merge into a structure that has no prototype. It is a three-line fix. I asked Cursor for a "deep merge two config objects" helper last week. It gave me eight lines that worked perfectly on my test data. It also gave me a prototype pollution hole big enough to walk through. The function looked fine. That is the problem. Prototype pollution does not show up when you run the happy path. It shows up when someone sends you a key called proto . The code Cursor handed me (CWE-1321) function merge ( target , source ) { for ( const key in source ) { if ( source [ key ] && typeof source [ key ] === ' object ' ) { target [ key ] = merge ( target [ key ] || {}, source [ key ]); } else { target [ key ] = source [ key ]; } } return target ; } Now feed it something a user controls, like a parsed JSON request body: merge ({}, JSON . parse ( ' {"__proto__": {"isAdmin": true}} ' )); ({}). isAdmin ; // true You did not set isAdmin on anything. You set it on every object in the process. Any later check like if (user.isAdmin) now passes for objects that never had that field. Why this keeps happening The recursive merge pattern is all over old blog posts and StackOverflow answers, and almost none of them guard the special keys. The model learned merge from that corpus. It reproduces the shape of the answer, including the missing check, because the missing check never breaks a test. A for...in loop also walks keys like proto when they arrive as ordinary string properties from JSON.parse, which is exactly how the payload gets in. The fix Skip the dangerous keys, or merge into something that has no prototype to pollute. function merge ( target , source ) { for ( const key in source ) { if ( key === ' __proto__ ' || key === ' constructor ' || key === ' prototype ' ) continue ;

As developers , we often face challenges keeping our workspaces perfectly synchronized across devices and collaborators. Whether it’s dealing with slow cloud sync, merge conflicts, or latency issues, these problems can disrupt our workflow and productivity. That’s why I’m excited to introduce OrBit , a local-first workspace synchronization engine designed to keep your development environments in sync with sub-millisecond latency — all while supporting offline work and peer-to-peer collaboration. What is OrBit ? OrBit is built around a multi-layered architecture that combines the power of Rust, Tauri, and VS Code to deliver a seamless synchronization experience: Rust-based local watcher daemon: Monitors file system changes with kernel-level events for ultra-low latency. Tauri-based native desktop dashboard: Provides a lightweight, secure, and cross-platform interface to manage your sync settings. VS Code extension: Integrates directly with your editor for smooth, real-time syncing of your code workspace. Unlike traditional cloud-based sync solutions, OrBit uses peer-to-peer connections and Conflict-free Replicated Data Types (CRDTs) to ensure your workspaces stay consistent even during network partitions or offline periods. Key Features Real-time sync with sub-millisecond latency: Changes propagate instantly across your devices. Offline support: Work uninterrupted without internet, with automatic merging when reconnected. Conflict resolution: CRDTs handle concurrent edits gracefully, preventing data loss. Native desktop and editor integration: Manage sync easily via the desktop app and VS Code extension. Peer-to-peer architecture: No heavy cloud servers required, enhancing privacy and speed. Why OrBit ? OrBit is designed for developers who demand speed, reliability, and seamless collaboration. It eliminates the frustration of slow syncs and merge conflicts, letting you focus on coding. Whether you’re working solo across multiple devices or collaborating with a team,

The Bezos-backed automaker building America’s cheapest electric truck is teaming up with the crayon company in a bid to brighten its rides. Make ours Razzmatazz.

Slate's barebones EV trucks lack whimsy, which is why the company has teamed up with Crayola.

The NHTSA says it identified a 'pattern of driverless AVs' interfering with first responders. It's now demanding a solution from AV makers.

We have all been there: you open your editor to write a simple feature, and within ten minutes, your screen is a chaotic mess. You are drowning in squiggly red lines, bright rainbow bracket lines, a crowded sidebar, Git blame popups blocking your text, and terminal notifications screaming for attention. Modern IDEs like VS Code and Cursor are incredibly powerful, but out of the box, they are built to distract you. If you want to achieve true flow state, you need to strip away the noise. Here are 10 minimalist extensions built for both VS Code and Cursor that are explicitly engineered to eliminate clutter, reduce cognitive load, and help you focus on the only thing that matters: the code. Interface and Zen Mode Cleansers 1. Zen Mode (Built-in, but needs tweaking) The Vibe: Complete visual isolation. What it does: While not an external extension, true minimalism starts here. Hitting Cmd+K Z (or Ctrl+K Z) instantly hides the activity bar, status bar, sidebar, and editor tabs, leaving you with nothing but your code centered on the screen. The Focus Trick: Go into your settings and toggle zenMode.hideLineNumbers to true to get rid of the left-hand numbering margin entirely for deep reading sessions. 2. APC Customize UI++ The Vibe: Pixel-perfect control over editor bloat. What it does: If you love the layout of hyper-minimalist editors like Zed but want to keep the power of Cursor or VS Code, this is your holy grail. It allows you to shrink font sizes of the UI independently from your code, hide specific layout borders, trim the massive top title bars, and customize panel padding to give your code room to breathe. 3. Customize UI / Active Bar Hidden The Vibe: Moving target elements out of sight. What it does: The left-hand Activity Bar (with the extensions, search, and source control icons) is a constant source of colorful badge notifications. Use this to hide it entirely. You can easily trigger those panels via keyboard shortcuts (Cmd+Shift+E for explorer, Cmd+Shift+F fo

Originally published on tamiz.pro . The Signal: Core Developer Competencies Effective code evaluations must identify signal - the skills that directly impact software quality and long-term maintainability. Focus on: Problem-Solving Approach : How candidates break down complex problems Code Structure : Organization, modularity, and separation of concerns Edge Case Handling : Proactive identification of boundary conditions Test Coverage : Implementation of meaningful unit/integration tests Performance Awareness : Appropriate algorithm selection and resource management These elements predict real-world engineering capabilities, not just syntax mastery. The Noise: Common Evaluation Pitfalls Avoid overemphasizing noise - factors that correlate weakly with actual job performance: Noise Factor Why It Fails Signal Alternative Coding style Reflects personal preference Consistency within project conventions Syntax errors Easily fixed with linters Code correctness after tooling Solution speed Varies by individual Final solution quality Language trivia Library/framework knowledge changes Core programming principles Interview anxiety Doesn't reflect daily work Paired programming sessions Measuring Signal Effectively Task Design : Create realistic coding challenges that mirror production problems Rubric-Based Evaluation : Use weighted scoring matrices focused on signal factors Code Review Simulations : Evaluate candidates' ability to interpret and improve existing codebases Collaboration Metrics : Track communication clarity during pair programming sessions Iterative Development : Assess how well candidates refine solutions based on feedback Signal Amplification Techniques Time-Bounded Challenges : Set strict time limits to reduce focus on perfectionism Tooling Freedom : Allow candidates to use their preferred IDEs and debugging tools Post-Coding Debrief : Ask candidates to explain their design choices and tradeoffs Follow-Up Questions : Test understanding of implementation decis

Waymo will ditch human supervisors in San Diego, Las Vegas, Tampa and Denver.

CAP: khi network partition xảy ra, chỉ được chọn C hoặc A — không có "cả ba" CAP theorem là kết quả của Gilbert và Lynch (formal proof năm 2002 cho conjecture Brewer đưa ra ở PODC keynote 2000): một hệ phân tán có shared state không thể đồng thời cung cấp cả linearizable Consistency , Availability (mọi request tới non-failing node đều trả lời không lỗi), và Partition tolerance khi có network partition. Trong thực tế, partition là thứ sẽ xảy ra — TCP retransmit, GC pause dài, switch chết, cross-region link flap — nên P là ràng buộc bắt buộc, không phải lựa chọn. Câu hỏi thật là: khi partition xảy ra, hệ thống hy sinh C hay A? Chọn sai gây ra hai loại incident khác nhau: chọn AP mà dữ liệu cần linearizable dẫn tới double-charge, oversell inventory, split-brain; chọn CP mà dữ liệu chỉ cần eventually consistent dẫn tới downtime không cần thiết, user không đọc được profile của chính mình. Cơ chế hoạt động Định nghĩa formal theo Gilbert và Lynch: Consistency ở đây là linearizability : mọi read sau một write hoàn tất phải thấy giá trị mới (hoặc mới hơn); tồn tại một total order các operation phù hợp với real-time. Availability : mọi request tới một non-failing node phải nhận response (không timeout, không error). Partition tolerance : hệ thống tiếp tục hoạt động dù network drop tuỳ ý message giữa các node. Proof intuition: giả sử có 2 node N1, N2 giữ cùng key x=0 . Client ghi x=1 vào N1. Link N1 và N2 đứt. Một client khác đọc x từ N2. Nếu N2 trả về 0 thì không linearizable (mất C). Nếu N2 chờ đến khi thấy được N1 thì mất A. Nếu N2 từ chối phục vụ thì cũng mất A. Không có cách thứ ba. Trong hệ CP, mỗi write phải qua quorum (Raft, Paxos, ZAB); khi node bị isolate khỏi quorum, nó từ chối phục vụ để giữ linearizability: // etcd/Raft-style: khi mất quorum, leader step down và write fail resp , err := kv . Put ( ctx , "order/42" , "paid" ) if err != nil { // err là ErrLeaderChanged hoặc context.DeadlineExceeded khi ở minority side // client thấy unavailable — đúng contract CP re

Bentley has confirmed that it will finally add an electric car to its exclusive lineup.

When I first started testing Vizio's 65-inch Mini LED Quantum TV, I thought the big story was that Vizio was back and that it had a quantum-dot TV for under $398 - the cheapest on the market. Vizio's been pretty quiet since it was acquired by Walmart in 2024, so putting out a TV with […]