标签：#vs

Just a few weeks ago the only midrange OLED options available were from LG and Samsung. But after Sony officially announced the Bravia 6 last week, Roku has now launched its first-ever OLED TV - the Roku Pro Series - which will be followed by the step-up Pro Series LX next month. The Roku Pro […]

The Slate Truck is affordable because you have to 'bring your own tech'.

JMGO's 4K 120Hz Iris Ultra Max all-in-one Google TV projector is now available outside China. It gets its name from a new dual-iris system that lets it produce an impressive 10,000:1 native contrast, according to JMGO. It boosts the contrast - always an issue with projectors - by placing two separate physical apertures (irises) along […]

Director Dave Green's live action/animated hybrid captures smart, subversive weirdness of the classic cartoons.

Visual-Inertial Odometry for Autonomous Robots A robot needs to estimate how it moves through the world. GPS is unavailable indoors, wheel odometry can slip, and LiDAR may not always be available. Visual-Inertial Odometry (VIO) combines cameras and IMUs to estimate motion. Basic Idea Camera ---> Visual Features ---+ | v State Estimator ^ | IMU ----> Motion Information ---+ | v Robot Trajectory The camera provides visual constraints. The IMU provides high-frequency motion measurements. Why Combine Them? A camera gives rich spatial information but can suffer from: Motion blur Low texture Poor lighting Slow frame rate An IMU operates at much higher rates but accumulates drift when integrated over time. Their weaknesses are complementary. Feature Tracking A simple visual pipeline might be: Image | v Feature Detection | v Feature Tracking | v Motion Estimation Feature types may include corners or learned visual features. IMU Prediction The IMU can predict how the robot's state changes between camera frames. Conceptually: Previous State | +--> IMU measurements | v Predicted State | +--> Camera observation | v Corrected State This is the prediction/correction pattern used by many estimators. Initialization VIO initialization is important because the estimator must determine quantities such as: Initial orientation Gravity direction Velocity Scale for monocular systems Sensor biases Poor initialization can cause instability later. ROS 2 Architecture /camera/image | v Visual Frontend ----+ | /imu/data ----------+--> VIO Estimator --> /odometry | +--> /tf Use consistent timestamps and calibrated camera-IMU extrinsics. Improving Robustness Useful techniques include: Rejecting outlier feature matches Monitoring IMU saturation Handling dropped frames Estimating sensor biases Detecting low-texture scenes Monitoring estimator health Evaluation Evaluate against a trusted trajectory where available. Useful metrics include: Absolute trajectory error Relative pose error Drift per dista

This is the second article in a series on time to revoke, following our piece on The Hacker News . The first explains how to measure the amount of time an exposed credential remains usable. This article focuses on the operational changes security teams can make to shrink that exposure window. TL;DR: Reducing time to revoke means addressing the operational blockers that keep exposed credentials valid after detection. Security teams need to validate which credentials still work, route them to the right owners, make revocation safer, and remove avoidable manual delays. Provider-specific runbooks, risk-based remediation paths, short-lived credentials, automation, and closure verification can all reduce the amount of time exposed access remains usable. Why time to revoke matters for AI-era non-human identity risk Every security team can find an exposed secret, but most can't tell you how long it kept working after they found it. Over 28.6 million new hardcoded secrets hit public GitHub in 2025, up 34% year over year, with AI-service secrets up 81% ( State of Secrets Sprawl 2026 ). AI-assisted development and agentic tooling cut both ways. Defenders find and triage more, but creation is outpacing governance. So while detection keeps up, revocation is where teams fall behind. And that disconnect is what this article is about. If an exposed credential remains valid, an attacker doesn't need to breach the same system twice. They can use it directly against any service that trusts the identity behind it, like a cloud console or a production database. And these credentials stay valid far longer than teams expect: 64% of secrets confirmed valid in 2022 were still valid when we retested them four years later. That is especially dangerous for non-human identities (NHIs). Service accounts and OAuth apps often run on long-lived tokens and deploy keys that no one rotates for months, sometimes years. Their access is broad, their ownership unclear. And because these identities keep cr

If you use Android Auto, you might be interested to know that there's a feature available on some phones that helps keep phone calls minimal while you drive.

Long-lived GCP service account keys are secrets that must be managed forever, are hard to rotate, and are easy to leak. Scaling Workload Identity Federation to 120+ production projects shows why it changes how machine identity is approached entirely: keys are secrets to manage, federated identities are trust relationships configured once, gated by attribute conditions. By Shijin Nair

Sometimes software development reaches a point where the tools designed to make your job easier start becoming part of the job. I ran into that with browser debugging. I wanted something that should have been simple: Set a breakpoint. Press F5. Debug my JavaScript. Instead, I found myself spending too much time thinking about development servers, browser launch configuration, debugger connections, ports, profiles, and the debugging environment itself. That led to a simple question: What if browser debugging could go back to convention over configuration? So I built CloudIDEaaS JavaScript Debugger . ⚡ The Goal: Press F5 and Debug The philosophy behind CloudIDEaaS is straightforward: Spend your time debugging your application instead of debugging your debugging environment. For a straightforward JavaScript or HTML project, I wanted the workflow to look like this: Set a breakpoint. Press F5 . Start debugging. Behind those three steps, CloudIDEaaS can start the local web server, launch Chrome, establish the debugging connection, configure your breakpoints, and then load the application. The important part is that you don't have to think about most of that. 🔴 Real Debugging Inside VS Code This isn't intended to replace Chrome DevTools or compete feature-for-feature with every large JavaScript debugging platform. It's focused on providing the debugging features I use most often directly inside Visual Studio Code: 🔴 Source and conditional breakpoints 👣 Step over, step into, and step out ▶️ Continue and pause 🔍 Local variables and object inspection 📚 Scopes and call stacks 🧮 Expression evaluation ⚠️ Exception breakpoint configuration 🌐 A built-in local web server One feature that was particularly important to me was startup breakpoints . The debugger establishes the connection and configures your breakpoints before loading the application, making it possible to catch JavaScript that executes during startup. 🧠 What's Actually Happening Under the Hood? Building the debugger a

If the sound you're getting through Android Auto is disappointing, there are several components and settings you should check.

Android Auto has several essential features enabled by default, but you may be surprised at how much it can really do.

I spent a week building an agent that upgrades dependencies and repairs what the upgrade breaks. Dependabot opens the PR and walks away; this one stays until the tests are green. The interesting part wasn't the repairs. It was that almost every serious bug I hit — in my code, in the harness, in my own agent — announced success while being wrong. The premise Detection is solved. Dependabot, npm audit and OSV all find the advisory. What nobody automates is the bit afterwards: the fix is a major version bump, the bump breaks your build, and now it's your afternoon. So: pull real advisories, spawn one subagent per vulnerable package, each on its own branch in its own sandbox. Bump, install, run the suite. If it breaks, read the failure and patch the source. Re-verify from a clean checkout. Open a PR and stop — merging is a human decision. That's the design. Here's what actually happened. 1. The advisories weren't where I looked My first scan found nothing. The manifest said js-yaml: ^3.13.1 , which sounds vulnerable, but ^3.13.1 resolves to whatever the latest 3.x is today — and that's patched. Vulnerabilities live in the resolved tree, not the manifest. Scan the lockfile, including transitive dependencies, or you scan nothing. All three advisories I eventually found were transitive dev dependencies that appear nowhere in package.json . A scanner that reads the manifest returns "you're clean" and is wrong. It doesn't error. 2. The agent caught itself The first proper scan reported 124 vulnerable packages out of 290. Then it said something I didn't expect: "Some results look suspicious — js-yaml@4.3.2 with 10 advisories, which is usually clean." It cross-checked OSV's batch endpoint against the single-query endpoint and found its own bug: it had nested version inside the package object instead of alongside it. The API silently ignored the version and returned every advisory ever filed for each package. Real answer: three. Not 124. The API didn't reject the malformed quer

If you use Claude Code for both work and personal projects, you've probably hit this: switching accounts means logging out, logging back in, and losing whatever session state you had. It's a small friction that adds up fast if you're context-switching several times a day. The fix is one environment variable: CLAUDE_CONFIG_DIR for both work and personal projects, you've probably hit this: switching accounts means logging out, logging back in, and losing whatever session state you had. It's a small friction that adds up fast if you're context-switching several times a day. Running Multiple Claude Code Accounts on Linux - Writing Run separate Claude Code accounts on Linux with CLAUDE_CONFIG_DIR — manual setup, an automation script, direnv auto-switching, and VS Code integration. sakibullah.me

If you're wondering if CarPlay works over Wi-Fi or Bluetooth, the answer is yes. It uses both at different times.

If you've tried an "agentic" AI coding tool recently, there's a good chance it asked you to switch editors entirely. Google's own agent-first IDE, Antigravity, launched in November 2025 with exactly that trade-off: full agentic power, but only inside its own dedicated desktop application. That trade-off just went away. Google has shipped Antigravity extensions for VS Code, Visual Studio, JetBrains, and Zed , bringing the same agent, the same review workflow, and the same account into the editor you've already spent years configuring exactly the way you like it. This post walks through what the VS Code extension actually is, how it fits into Antigravity's broader architecture, how to install and configure it, and most importantly; how its permission system keeps an agent that can read files, run terminal commands, and drive a real browser from doing anything you haven't explicitly allowed. By the end of this article, you will be able to: Explain how the extension relates to the full Antigravity 2.0 desktop app and the agy CLI Install and authenticate the extension inside VS Code Work through the agent side panel, implementation plans, and walkthroughs Configure the permission engine so the agent only does what you approve Lock down its browser subagent so it never touches your personal Chrome data New to Antigravity generally? Start with Google's own primer: Antigravity 2.0 Overview Prerequisites To follow along hands-on, you'll need: VS Code version 1.90 or later, on macOS, Linux, or Windows A Google Account on any Antigravity plan (the free tier is enough), or an enterprise account enabled for Gemini Enterprise About five minutes for the first-time sign-in and backend install You can also read this purely as an architecture and workflow walkthrough; every step is explained, not just shown. 1. Where the Extension Fits in Antigravity's Architecture It helps to know there are actually three doors into the same house: [ Antigravity 2.0 ] ── the full desktop app, a dedi

Claire McDonough is stepping down on October 30 to pursue a new opportunity, the company said in a filing on Thursday.

After unexpectedly showing up on a wall-mounting compatibility chart on Sony's site back in June, the company has announced the Sony Bravia 6 OLED TV. The TV sits below its other OLED TVs - the Bravia 8 and Bravia 8 II - as well as its Bravia 9 II and Bravia 7 II RGB LED […]

Test drivers for Waymo and Zoox sustained more than two dozen injuries in 2024 and 2025 from hard braking or other sudden movements made by the autonomous vehicles, according to a TechCrunch review of data submitted to OSHA.

drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-specific key leaks. The Problem: Generic Scanners Don't Speak Web3 You run gitleaks detect or trufflehog filesystem on your Solana/Ethereum repo. Green checkmark. You ship. Three months later: $2.3M drained from a private key committed in docker-compose.yml that neither tool flagged as high-confidence. Why? Generic scanners match patterns (regex/entropy). They don't understand web3 key semantics : Blind Spot gitleaks trufflehog drainscan BIP-39 checksum validation ❌ ❌ ✅ Offline address derivation ❌ ❌ ✅ Live balance checks ❌ ❌ ✅ Phantom JSON export detection ❌ ❌ ✅ Solana base58 seed (64-byte) Partial Partial ✅ Token-2022 extension context ❌ ❌ ✅ Entropy + context dedup Generic Generic Web3-aware SARIF 2.1.0 ✅ ✅ ✅ Benchmark: 500+ Web3 Repos Scanned Methodology : Cloned top 500 repos by stars from solana , ethereum , defi , web3 topics. Ran each scanner with default + aggressive configs. Manual verification of findings. Results Summary Metric gitleaks trufflehog drainscan Free Total findings 1,847 3,291 2,156 High-confidence true positives 312 401 687 Web3-specific true positives 89 112 487 False positive rate (high) 34% 41% 3% False negative rate (web3 keys) 73% 68% 4% Avg scan time (500 repos) 12m 47m 8m Key Finding: The 73% Gap Generic scanners missed 73% of web3-specific key types : Phantom/Solflare JSON exports (64-byte arrays) — gitleaks: 0, trufflehog: 12, drainscan: 234 BIP-39 mnemonics with valid checksum — gitleaks: 45 (many false), trufflehog: 67, drainscan: 156 (all validated) Solana base58 seeds — gitleaks: 23, trufflehog: 31, drainscan: 189 EVM keys in .env / .yaml / .toml context — gitleaks: 189, trufflehog: 223, drainscan: 298 Entropy-detected foreign-chain keys (Cosmos, Sui, Near, ed25519 hex) — gitleaks: 0, trufflehog: 0, drainscan: 87 Why drainscan Wins on Web3 1. BIP-39 Checksum Validation = Near-Zero Fal

This is a follow-up to an article we published in The Hacker News introducing time to revoke as a critical CISO metric. This version provides a practical guide for measuring it across exposed secrets and non-human identities. 👉 TL;DR: Time to revoke is a security metric that measures how long an exposed credential remains usable after it has been confirmed valid. Measuring it requires teams to record when a credential is validated and when its invalidation is confirmed. From that baseline, CISOs can track median and P90 time to revoke, the percentage of exposed secrets revoked within SLA, owner coverage, the percentage that remain valid after detection, and the incidents that require manual escalation. Detection is not the same as credential revocation Detection tells you when a credential was found. A remediation ticket tells you when work was assigned or closed. Neither tells you whether the exposed access was fully neutralized. For leaked credentials, "Did we find it?" is the first question. "How long did it remain valid?" is just as important, if not more so. If a leaked API key, cloud credential, service account token, OAuth secret, private key, or database connection string is still valid, it is a point of ingress. Until it is revoked, rotated, or otherwise invalidated, it remains a path an attacker can use. Credential rotation only counts when the exposed credential is disabled, expired, or otherwise rendered unusable. That makes time to revoke a critical CISO metric. It connects detection to business risk by measuring the exposure window security teams need to close. What is time to revoke in secrets remediation? Time to revoke measures how long an exposed credential remains usable after it has been confirmed valid. Time to revoke = confirmed invalidation timestamp − validation timestamp The clock starts when the organization verifies that the credential works and stops when it confirms that the credential can no longer be used. Closing a ticket, deleting a