submitted by /u/West-Chard-1474 [link] [留言]

Your second brain for product management Discussion | Link

I was frustated by having to draw system design diagrams by hand when discussing it with my team mates or in an interview. So I thought "Wouldn't it be great if someone draws it for me, while I think out loud?". That is when I came up with VoiceDraw. You can just think out loud or discuss your system architecture with a friend/interviewer, the diagrams are automatically drawn along with your reasoning, open questions and tradeoffs beautifully written on to the side. Demo Video: https://youtu.be/

AI Drum Machine MPC in your browser Discussion | Link

By spring 2026, the division of labor between human engineers and AI had become precise enough to describe. Not speculate about. Describe. Delegate these 7 immediately: Boilerplate generation: CRUD scaffolding, config files, standard patterns. Near-human accuracy. Review required is a naming scan, not a logic audit. Test generation: 40-60% faster test development with no measurable decline in coverage quality, provided the tests are reviewed by someone who understands the domain. Documentation: 67% of companies rely on AI-assisted doc generation in 2026. The first draft is a solved problem. Your job is verifying and contextualizing. Code translation: Python to TypeScript. React to Vue. Framework migrations that once consumed sprint cycles now take hours. Routine bug fixing: Claude Code, Devin, BugBot can resolve 60% of reported bugs autonomously. Resolution time down 30-50%. Automated code review: First-pass filter before human review. Misses context issues. Doesn't replace human review. Eliminates noise so you focus on signal. Commit hygiene: Messages, PR summaries, changelog entries. Fully automatable. No meaningful error rate. Never delegate these 6: Architecture and system design: AI proposes. You decide. The tradeoffs require organizational context, team capability assessment, and long-horizon thinking no model possesses. Business context translation: The spec says "export to CSV." You ask: which users, under what conditions, with what compliance implications? AI cannot know the specification is wrong. You can. Security architecture: AI generates vulnerabilities as readily as it detects them. Adversarial thinking is not statistical. It is human. Long-horizon product thinking: What to build and why. Not how. Multi-stakeholder navigation: The politics, the relationships, the conversation with the PM that keeps the sprint on track. No model has stakes in the outcome. Agent orchestration: Designing, managing, and correcting the AI systems themselves. This is the ne

AI for Preparation. Humans for Judgment. Most AI projects today are one of these: A chatbot A customer support bot A voice assistant A Q&A system But I wanted to explore something bigger: What if businesses could build an AI Workforce? Instead of one AI assistant, imagine: Customer ↓ AI Workforce ├── Discovery Agent ├── Research Agent ├── Policy Comparison Agent ├── Recommendation Agent ├── CRM Agent └── Follow-up Agent ↓ Human Advisor ↓ Customer This article explains the architecture and design decisions behind such a system. Why Insurance? Insurance is an interesting industry for AI. Because: Research is repetitive. Recommendations are data-driven. Follow-ups are expensive. Trust is critical. Human judgment is still necessary. This makes Insurance a perfect Human-in-the-Loop AI use case. Human In The Loop This is the core philosophy. I don't want AI to automatically sell insurance. I don't want AI replacing advisors. I want: AI prepares. Humans decide. The workflow becomes: Customer ↓ AI Workforce ↓ Human Advisor Review ↓ Customer This creates: Faster recommendations Better customer experience Safer AI adoption Human accountability AI Workforce Architecture Customer ↓ WhatsApp Phone Call Website Chat Email ↓ AI Workforce ├── Discovery Agent ├── Research Agent ├── Comparison Agent ├── Recommendation Agent ├── CRM Agent └── Follow-up Agent ↓ Human Advisor ↓ Customer Discovery Agent The Discovery Agent understands the customer. Responsibilities: Collect customer profile Understand goals Assess risk Understand existing insurance Identify gaps Example Output: { "risk_level" : "medium" , "family_type" : "married_with_children" , "insurance_goal" : "health_and_term" , "recommended_health_cover" : "20L" , "recommended_term_cover" : "3Cr" } Research Agent The Research Agent acts like an insurance analyst. Responsibilities: Analyze policies Compare waiting periods Review exclusions Evaluate premiums Generate recommendations Example: { "customer_profile_summary" : "..." , "t

I built a tool called "kaggle-dingdong" that automatically fetches Kaggle competition information and sends notifications to Email, Slack, and Discord. It runs daily on a schedule via GitHub Actions, and you get notified whenever a new competition is published. https://github.com/asherish/kaggle-dingdong Why I Built This Checking the Kaggle competitions page every day is tedious. Featured competitions in particular have entry deadlines, so missing them means losing the opportunity. While RSS feeds and official notification features exist, I wanted notifications delivered directly to the channels I actually use (Discord and Slack), so I built my own. Tech Stack Python 3.13 uv — Package manager and build tool (by Astral) Kaggle Python SDK v2.0.0 — Fetching competition info GitHub Actions — Automated daily execution at 09:00 UTC pytest — Testing Three notification channels are supported: Channel Method Format Email SMTP HTML (card layout) Slack Incoming Webhook Block Kit Discord Webhook Rich Embed Architecture GitHub Actions (cron: daily at 09:00 UTC) ↓ Fetch competition list via Kaggle API ↓ Filter by conditions in config.json ↓ Compare with sent history to extract unnotified competitions ↓ Send notifications to configured channels ↓ Update sent history (max 200 entries) The project structure is as follows: kaggle-dingdong/ ├── src/kaggle_dingdong/ │ ├── __main__.py # Entry point │ ├── config.py # Configuration loading │ ├── competitions.py # Fetch & filter competitions from Kaggle API │ ├── email_sender.py # Email notifications │ ├── slack_sender.py # Slack notifications │ ├── discord_sender.py # Discord notifications │ └── history.py # Sent history management ├── tests/ # pytest tests ├── config.json # Filter configuration └── .github/workflows/ └── notify.yml # GitHub Actions workflow Implementation Highlights Fetching and Filtering Competitions The Kaggle SDK is used to fetch the competition list. In addition to the default sort order, it also fetches with recentl

Something feels different about security incidents lately. Breaches, leaks, account takeovers, phishing campaigns they're not new. But their frequency, sophistication, and scale seem to be growing at a pace that feels genuinely alarming. Instagram accounts hacked overnight. Corporate systems compromised in hours. Phishing emails that sound disturbingly human. As someone studying AI & Big Data, I can't help but ask: is AI responsible for this? And if so, how? I think the honest answer is: yes but in two very different ways. The two faces of AI in cybersecurity When we talk about AI and cyberattacks, most people imagine one scenario: hackers using AI to attack systems faster and smarter. That's real. But it's only half the picture. The other half is something we talk about far less: the vulnerabilities that come from integrating AI into systems in the first place. These are two very different problems. And conflating them leads to the wrong solutions. Problem 1: AI is expanding the attack surface Every time a platform integrates an AI feature, they're adding something new to their infrastructure. And new infrastructure means new potential vulnerabilities. AI systems require: Massive data pipelines more data flowing through more systems APIs connecting multiple services more endpoints that can be exploited Third-party models and tools more external dependencies, more trust relationships Real-time processing less time to detect anomalies before damage is done Many organizations are integrating AI features faster than their security teams can audit them. And the consequences are already visible. In June 2026 , hackers reportedly manipulated AI-powered support systems to gain unauthorized access to Instagram accounts. The attack didn't target traditional software vulnerabilities it targeted the AI system itself , exploiting the automated account recovery flow that Meta had built with AI. This is the new reality: attackers are no longer just targeting your code. They're ta

I spent a long time dissecting OOP and I had a really interesting realization that I detailed in the attached blog post. If you're as interested in software design as I am, I hope you get new inspiration for how to structure your programs from it. I'm obviously leaving out a lot, but if you're intuitively familiar with the concepts behind OOP, you should understand the parts I left implied. PS for after you read it: Now obviously, I'm not saying they're "the same thing". There are different styles of programming that make something "more functional" or "more object-oriented". In fact, the "pure" versions of both OOP and FP are extremely easy to identify: pure OOP being the endpoint of leaning into the naming, and pure FP being the endpoint of leaning into the functors, and neither really being fun to work with. But my point is that the fundamentals of both are the same, just like how derivatives and integrals form two sides of Calculus. If you try to defend one and chastise the other, you can't use either effectively, and just dig yourself deeper into a hole of design patterns to make up for how inflexible you've left yourself. In truth, once we dissect how OOP really works, we can deconstruct it to replace most design patterns with something that borrows from each of them - Factories with constructor references, listeners with function references, list mapping with transducers - all without violating any OOP principles. It's only once we intuitively understand their foundations that we can use OOP less rigidly and FP more structured, creating something that's far greater than the sum of its parts. submitted by /u/bythepowerofscience [link] [留言]

A capability-compiler meets ten deliberately-broken MCP servers. The honest scorecard: it cleanly stops one class, shrinks the blast radius on several, and is useless against another. Knowing which is which is the whole point. Disclosure: I'm the author of capgate , the Apache-2.0 sandbox compiler this post puts to the test. The DVMCP project and the other tools mentioned aren't mine; the manifests and compiled output are reproducible from the repo . The setup Damn Vulnerable MCP (DVMCP) is a teaching project: ten MCP servers, each built to demonstrate one attack — prompt injection, tool poisoning, excessive permission scope, token theft, command injection, and so on. It's the closest thing the ecosystem has to a shared adversarial fixture. capgate is a compile-time tool. You write a manifest declaring what an MCP server is allowed to do — fs:read:/workspace/** , net:connect:api.github.com:443 , nothing else — and it compiles that to a concrete sandbox policy ( docker run flags, bwrap argv, or an egress-proxy config). It does not run anything, watch traffic, or inspect the server's code. It turns a declared capability set into an enforced boundary. So this is a fair, falsifiable test: for each DVMCP challenge, I wrote the honest minimum manifest, compiled it, and asked one question — does the boundary capgate emits actually stop the attack? The answer is not "yes" across the board, and the cases where it's "no" are the interesting ones. The bullseye: Challenge 3 — Excessive Permission Scope The vulnerable tool advertises "read a file from the public directory" and then does this: @mcp.tool () def read_file ( filename : str ) -> str : # VULNERABILITY: doesn't restrict file access to the public directory if os . path . exists ( filename ): # any absolute path works with open ( filename , " r " ) as f : return f . read () The private directory next door holds employee_salaries.txt , acquisition_plans.txt , and system_credentials.txt (a live DB password and cloud API ke

Last quarter our OpenAI bill went from $620 to $2,480 in 23 days. No new features shipped. No traffic spike. Zero error alerts. Deployment logs were clean. Just a number climbing in silence while five engineers stared at dashboards that gave us totals and nothing else. This is what we found. And why "cost monitoring" is completely the wrong mental model. The dashboard that answers the wrong question First thing I did was open the OpenAI usage dashboard. It showed me a total. A graph going up. A model breakdown. I knew we spent $2,480. I still had no idea which feature spent it, which service triggered it, or which user was responsible. The dashboard was answering "how much" while we were desperately asking "what caused it." Those are completely different questions. Almost every cost tool on the market only answers the first one. That distinction matters more than most engineering teams realise until they are staring at a bill like ours. Three features, zero visibility We had three features hitting GPT-4o: A document summariser, triggered manually by users An inline suggestion engine, triggered on keystrokes A batch report generator, triggered on export Any one of them could be the problem. Or all three. Or one specific tenant hammering one endpoint in a loop nobody noticed. Without attribution at the feature, service, and user level, we were just guessing. So I did what most engineers do: optimised the feature that felt most expensive. Added caching to the one that ran most often. Two weeks later the bill was still climbing. Guessing at cost problems without attribution data is exactly like debugging a performance issue without a profiler. You move things around and hope. 48 hours of real data A teammate dropped CostReveal in our Slack. I set it up that evening. The Node.js SDK wraps your existing provider calls. You instrument each one with a feature name, service context, and user or tenant ID. That is the entire integration for the base case: import { CostReveal