Share the menu with Ava and see what each dish may look like Discussion | Link

PostgreSQL 19 Beta has been announced, with general availability expected in September, following the project's yearly major-release cadence. This release introduces native SQL Property Graph Queries (SQL/PGQ), concurrent table repacking to reclaim storage without downtime, and a broad set of performance, observability, and administration improvements. By Renato Losio

Audio insight that predicts voice AI performance Discussion | Link

Every food delivery app has the same promise: you tap a button, food shows up at your door. Testing...

Never miss a competitor's move Discussion | Link

Respond.io, one of Malaysia startups to watch, uses AI agents to handle high volumes of customer inquiries and charges per convo, not per seat.

Shadow AI is the unapproved use of AI tools at work. Here is what it actually is, why it creates security and compliance exposure, and how Bifrost Edge brings it under control at the endpoint. Somewhere in your company right now, someone is pasting a customer list into a personal ChatGPT account to clean up an email. A developer has a coding agent pointed at a repo that still has live credentials in it. Someone in marketing wired up an MCP server they found over the weekend so their assistant can pull from a CRM. None of it shows up anywhere the security team can see. That is shadow AI: people using AI tools for work faster than anyone can govern them. It is rarely reckless. The tools are genuinely useful, they are one click away, and most people have no real sense of what happens to the text they paste into them. The scale is what tends to surprise teams. A 2025 UpGuard report found that more than 80% of workers use unapproved AI tools , security professionals included, and that half use them regularly. This is not a fringe behavior at the edges of the org. It is most people, most days. What counts as shadow AI Shadow AI is any AI tool used for work without security review or central oversight. It is the AI version of shadow IT, except it moved faster and the data leaving the building is often more sensitive. It usually shows up in four shapes: Consumer chat apps used with work data: ChatGPT, Claude, and the rest, on personal accounts. AI inside the browser, where a prompt box is one tab away at all times. Coding agents in the terminal and IDE, which can read source, run commands, and touch infrastructure. MCP servers, the external tools an AI app connects to so it can read files, call APIs, and take actions. The first two leak data outward. The last two are more interesting, because they let an AI tool do things, often with whatever access the employee already has. Why it is an actual security problem, not just a policy headache The risk is not that AI is dangerou

submitted by /u/andrewcairns [link] [留言]

Cursor just shipped Composer 2.5 and Composer 2.5 Fast. We benchmarked both across 11 engineering skills, 5 scenarios per skill, averaged across three independent LLM judges. The fast model scored higher, ran 32% quicker, and costs exactly the same. If you are reaching for Composer 2.5 over Composer 2.5 Fast, you are paying the same price for a slower, slightly worse model. Here is the full picture. TL;DR Composer 2.5 Fast scores 92.7% with skill context. Composer 2.5 scores 92.1%. Fast wins. Both are ahead of gpt-5.5, gpt-5.4, and the previous Composer 2. The fast model completes scenarios in 59 seconds on average. The regular model takes 87 seconds. Where They Land in the Benchmark We ran 6 models across 11 skills, scoring each run with three independent judges and averaging the results. Here is where the full leaderboard sits: Model Avg baseline Avg with-skill Lift opus-4-7 80.8% 93.4% +12.6 composer-2.5-fast 79.6% 92.7% +13.1 composer-2.5 79.0% 92.1% +13.1 composer-2 74.2% 89.6% +15.4 gpt-5.5 75.5% 89.4% +13.9 gpt-5.4 74.1% 89.3% +15.2 gpt-5.3 65.5% 83.9% +18.4 gpt-5-codex 68.7% 78.7% +10.0 Composer 2.5 Fast sits 1.3 points behind opus-4-7 and 3.3 points clear of everything else. That is a meaningful gap. The previous Composer 2 sits alongside gpt-5.4 and gpt-5.5 at roughly 89-90%. Cursor has moved its own model up a full competitive tier in a single release. The Fast model seems better. Normally a "fast" variant trades quality for speed. Composer 2.5 Fast does not do that. It scores 0.6 points higher than the regular model while running 28 seconds faster per scenario (59s vs 87s on average across 110 scored runs). The per-skill breakdown shows where the differences accumulate: Skill 2.5 with-skill 2.5-fast with-skill Winner documentation 97% 98% fast fastify 99% 94% 2.5 init 87% 86% 2.5 linting 98% 99% fast node-best-practices 95% 95% tie nodejs-core 98% 98% tie oauth 92% 89% 2.5 octocat 95% 96% fast skill-optimizer 98% 98% tie snipgrapher 93% 93% tie typescrip

I wanted to see how far an autonomous coding agent could get unattended. The constraint that makes this hard isn't code generation — it's that each session starts with zero memory of the last. So the design problem is state, not prompting. Setup A cron-scheduled task fires hourly, 11pm–7am (~8 runs). Each run is a fresh agent session. No shared context, no carryover. State lives entirely on disk: the working tree, the git history, and two files — BUILD_SPEC.md (the immutable goal/architecture) and PROGRESS.md (an append-only decision + status log). The run loop Every session does the same thing: Read BUILD_SPEC.md, then PROGRESS.md, then git log --oneline. Reconstruct "where are we" from the files themselves (the code is the source of truth, not the narrative). Do one unit of work. Commit. Append to PROGRESS.md: what changed, why (chosen X over Y because Z), and the exact next step. Commit granularity = checkpoint granularity. Worst case on an interrupted session is losing one unit, and the next run re-derives it. The "why" lines matter as much as the diffs — without them a later session re-litigates settled decisions. Guardrails The agent was allowed to build, test, and commit locally. It was explicitly not allowed to deploy, push to a remote, or touch secrets — those get written into PROGRESS.md as "needs human" items instead. This boundary is what makes unattended runs safe to leave alone. What came out A working full-stack monorepo: a pure TS scheduling engine (with property tests), multi-tenant auth, a Drizzle/Postgres schema, server-side re-validation, and publish/share/export flows. Across the runs it cleared its own stale git lock, and one session caught and fixed an off-by-one in a labeling layer that spanned five files. The takeaway The leverage wasn't the model writing code. It was designing a process where progress is durable across total context loss — externalize state, checkpoint constantly, log decisions not just actions, and fence off irreversible o

Last year I was on a team that pushed 40 million events per day through Kafka. We had consumer lag alerts, rebalancing incidents, and a whole runbook for when the broker got behind. I understood how to operate Kafka. But I did not understand how Kafka works. So I built a tiny one. No dependencies. No Zookeeper. No JVM. Just Python and the core ideas. Here is what I learned. The Three Things Kafka Actually Does People say "Kafka is a message queue." That is not quite right. Kafka is a distributed commit log . It has three jobs: Accept writes from producers and append them to a log Let consumers read from any offset in that log Remember where each consumer group is up to That third one is the thing that makes Kafka different from a traditional queue. A queue forgets a message once it is consumed. Kafka remembers. You can replay. You can have 10 different consumer groups reading the same topic at different speeds. The code to implement this is smaller than you think. brokelite: A Message Broker in 120 Lines import threading import time from collections import defaultdict from typing import Dict , List , Tuple class Partition : """ Append-only log for one partition of a topic. """ def __init__ ( self ): self . _log : List [ Tuple [ int , bytes ]] = [] # (offset, message) self . _lock = threading . Lock () self . _next_offset = 0 def append ( self , message : bytes ) -> int : with self . _lock : offset = self . _next_offset self . _log . append (( offset , message )) self . _next_offset += 1 return offset def read_from ( self , offset : int , max_count : int = 100 ) -> List [ Tuple [ int , bytes ]]: with self . _lock : return [ ( off , msg ) for off , msg in self . _log if off >= offset ][: max_count ] def __len__ ( self ): return self . _next_offset class Topic : """ A topic is just N partitions. """ def __init__ ( self , name : str , num_partitions : int = 3 ): self . name = name self . partitions = [ Partition () for _ in range ( num_partitions )] def route ( self , k

The problem IAM wildcards and public S3 buckets keep slipping through Terraform code review. Tools like Checkov and tfsec exist but they live in CI, require config files, and developers ignore the output because it's not where they're working. What I built TerraWatch is a GitHub App that scans every pull request that touches .tf files automatically. If it finds a security issue it blocks the merge and posts the exact code fix as a PR comment. The developer sees something like this in their PR: ⚠️ PUBLIC_S3_BUCKET - main.tf (Line 6) Severity: HIGH Risk: S3 bucket allows public read access. Fix: acl = "public-read" acl = "private" block_public_acls = true restrict_public_buckets = true They copy the fix, push, and the merge unblocks automatically. How it's different No YAML, no CI config - installs in 2 minutes via GitHub App Fixes are hardcoded diffs, not AI generated Nothing auto-applied - you review every fix No Checkov dependency - own lightweight rules engine Only reads changed .tf files in the PR, never your full codebase 29 rules covering S3 public access, IAM wildcards, open ports (SSH/RDP/MySQL/Postgres), unencrypted EBS/RDS, public databases, hardcoded secrets, EKS public endpoints, CloudTrail disabled, IMDSv1, and more. Try it Free during beta - terrawatch.dev Also launching on Product Hunt today if you want to show some support!

Cross Platform, Local First AI powered Note Taking App Discussion | Link

description: While most people chase political bets, these traders are dominating daily temperature...

Welcome to this week's Top 7, where the DEV editorial team handpicks their favorite posts from the...

description: Weather markets on Polymarket have become one of the hottest and most consistent...

Agentic QA Pipelines: Why Your Test Scripts Are Already Obsolete You wrote the test. You maintained the test. The app changed. You rewrote the test. If that loop sounds familiar, you're not alone — and in 2026, you're also not competitive. Agentic QA pipelines are replacing script-based test automation not because AI is smarter than your QA engineers, but because describing goals is faster than maintaining instructions. Here's what's actually changing, why it matters, and how forward-thinking teams are shipping without the script debt. The Script Maintenance Tax Is Killing Velocity Traditional test automation follows a simple premise: write explicit instructions, run them, check results. It worked when applications changed slowly and test environments were stable. In 2026, neither is true. AI-generated code ships faster. Features change in days. UI components regenerate. And every change breaks a percentage of your carefully maintained test scripts — creating a maintenance tax that grows proportionally with your automation coverage. Quash's 2026 State of QA Automation Report found that teams spending more than 30% of QA bandwidth on script maintenance are shipping 2.4x slower than teams that have automated that maintenance layer away. The irony: the more test coverage you write, the more you're paying the tax. What Agentic QA Actually Means (Without the Buzzwords) An agentic QA system doesn't follow a script. It follows a goal. Instead of: Click the login button Enter " testuser@example.com " in the email field Enter "password123" in the password field Assert redirect to /dashboard An agentic QA agent receives: Goal: Verify that a registered user can successfully authenticate and access their dashboard. Context: Auth flow supports email/password and OAuth. Dashboard loads user-specific data. The agent then: Explores the auth flow autonomously Generates test scenarios, including edge cases it infers from the UI Executes tests, reads failures, and adapts to UI changes

xAI shipped the Grok Build Agent Dashboard on June 15, 2026, and it changes how multi-session coding actually works. Eight parallel agents — four on Grok Code 1 Fast, four on Grok 4 Fast — all visible on one screen. Sessions sorted by state automatically. Sub-agents rolled up under the session that launched them. Reply to a blocked session without ever leaving the dashboard view. If you are already running Grok Build (launched June 5, 2026 in beta), this is a meaningful upgrade. If you are evaluating coding agents and parallel execution is part of your decision criteria, the Agent Dashboard is the most developed TUI for multi-session work in any terminal coding agent right now. Here is exactly what it does and when to use it. How to Open It Two ways in. From your shell: grok dashboard Or from inside any Grok Build session: /dashboard The keyboard shortcut Ctrl+ also opens the dashboard from any active session. Closing the dashboard does not close your sessions — they keep running. When you reopen it, every session is still there in whatever state it was in when you left. That last point matters. The dashboard is a view, not a session manager. Sessions have independent lifetimes. You can close the dashboard, switch to a different terminal, do other work, and come back to a batch of completed or paused sessions waiting for your attention. Session States and the Sorting Logic Every session in the dashboard shows one of three states: working , awaiting input , or idle . The dashboard sorts them automatically, with sessions waiting for your input at the top. Working sessions come next. Idle sessions sit at the bottom. The practical result: open the dashboard and the first thing you see is your blocker queue. Sessions that need you are at the top. Everything else is running or done. You do not have to mentally track what state each terminal is in — the sort does that for you. Selecting any row shows the session's latest output inline, without opening the full conversation

While you're manually checking if YES + NO = 1 , quantitative systems are solving massive constraint satisfaction problems across thousands of correlated markets in milliseconds. The Hidden Reality of Prediction Market Arbitrage You see a market where YES is trading at $0.62 and NO at $0.33. You think: There's $0.05 of arbitrage here . You're right. What you don't see is that by the time you place both orders, professional systems have already: Scanned 17,000+ conditions Detected dozens of correlated mispricings Calculated optimal position sizes (with fees & slippage) Executed everything in parallel Moved on to the next opportunity Between April 2024 and April 2025, quantitative traders extracted $39,688,585 in guaranteed arbitrage profits from Polymarket. The top individual wallet made $2,009,631.76 across 4,049 trades — an average of $496 guaranteed profit per trade . This wasn't gambling. This was mathematics. Why Simple "YES + NO = 1" Checks Fail Most retail traders stop at basic price sum checks. That's not enough. Markets are logically dependent. Example: "Will Trump win Pennsylvania?" → YES: $0.48 "Will Republicans win Pennsylvania by 5+ points?" → YES: $0.32 If the second outcome happens, the first must be true. These dependencies create arbitrage opportunities that simple addition cannot detect. This is known as the marginal polytope problem — projecting prices onto the set of arbitrage-free probability distributions. The Scale of the Computational Challenge For any event with n binary conditions, there are 2ⁿ possible outcome combinations. 2024 U.S. elections: 305 markets → tens of thousands of pairs 2010 NCAA tournament: 63 games → 2⁶³ ≈ 9.2 quintillion combinations Brute force is impossible. Smart systems use constraints instead. Real example : Duke vs Cornell basketball market 7 possible win counts per team → 14 conditions. Instead of checking 16,384 combinations, 3 linear constraints were enough. Research found that 41% of 17,218 conditions showed sing

A delivery page that feels as finished as the work Discussion | Link