The AI to-do list that does itself Discussion | Link

Anthropic just released Claude Fable 5, calling it the most powerful AI model it has ever made widely available and praising its skills in biology, among others. But the model won't answer basic biology questions - the kind you'd expect a high schooler to handle. Instead, it hands off the query to the former flagship […]

This is a follow-up to my earlier posts, and it is more of an open question than an answer. I have the data, I have a way to act, and I am genuinely unsure that acting is the right call. I could use the community's help thinking it through. Last week a supply-chain worm got into my GitHub account and repositories. I got out, cleaned up the proper way, and wrote it up. Then I checked the public list of repositories hit by the same worm, to see how the cleanup was going across the ecosystem. Nearly a week later, most of them are still carrying the live payload. It is worse than a count When you look closely, a lot of the owners are clearly trying. But they are missing how this actually works, in two ways that matter: Deleting is not removing. They remove the malicious files with an ordinary commit. That takes the payload off the branch tip, but the commit that introduced it is still in history, and the blob is still recoverable by anyone who reverts or checks out the old commit. The only real removal is rewriting history (reset, not revert) and asking GitHub to purge the objects, because the fork network keeps them reachable by SHA. One branch is not all branches. They clean the branch they know about and never see the backdated copies the worm planted on other branches, which are still live. And the part that genuinely worries me: some of these owners are almost certainly opening the infected repository in VS Code or an AI assistant to fix it , which is exactly the trigger that runs the payload again. The act of trying to clean it can re-detonate it. So: a large number of repositories still carrying a live credential stealer, and a large number of owners and contributors who do not know they are still exposed. The dilemma Here is where I am stuck. There are two paths and I do not like either. Report them to GitHub. Their response is automated and blunt. The repo gets disabled, with no human in the loop, the same hands-off automation that locked me out of my own accou

Originally published on clintech.me If you've integrated Google Maps into a React app and seen Autocomplete randomly stop working, Directions silently fail, or the API throw google is not defined on second render — you've hit the duplicate loading bug. Here's exactly what caused it in my case and how I fixed it. The setup that broke things While building delivery address flows at POLOM — a production e-commerce platform — I integrated Google Places Autocomplete across 20+ screens. I had the Maps JavaScript API loading in two places: A provider.tsx for global script loading across the app A useLoadGoogleMaps hook inside a shared component This caused race conditions. The Autocomplete and Directions APIs were initialising before the script fully resolved in some renders, silently failing in others. The failure wasn't consistent, which made it harder to catch. The fix Step 1 — Remove the global load Delete the script tag or next/script call in provider.tsx . There should be exactly one place the Maps API loads. Step 2 — Centralise in a hook Move all loading logic into a single useLoadGoogleMaps hook using dynamic loading. If you're on Next.js, next/script with strategy="afterInteractive" inside the hook is the right approach. Step 3 — Guard before initialising if ( ! window . google ?. maps ) return ; Check that the API is fully available before attempting to attach Autocomplete or Directions . Don't assume the script load event means every namespace is ready. Step 4 — Scope your ref correctly Bind the autocomplete instance to inputRef.current explicitly. If the component remounts, re-initialise the binding — don't assume the previous instance is still attached. The result One load, one source of truth, no race conditions. Autocomplete and Directions worked consistently across all 20+ screens without reinitialising on every render. Security — the step most developers skip Restrict your API key at the Google Cloud Console level: HTTP referrers: whitelist your domain onl

Ubisoft is reportedly trying to cut costs without leaving key franchises like Rainbow Six: Siege in the lurch with a new round of layoffs.

One of the most frustrating parts of using AI coding tools is what happens when you have to switch between them. Every time I move to a different tool, I end up re-explaining the project, architecture, requirements, previous decisions, and all the context I’ve already built up elsewhere. It feels inefficient having to repeatedly provide the same context every time I switch tools or start a new session. Is anyone else running into this? How are you handling it today? submitted by /u/Bar_David [link] [留言]

Stop writing SQL strings that look like a ransom note. Here's how to write queries that are readable, safe, and maintainable. The Problem With "Good Enough" SQL Formatting Most Python developers start here: user_id = 5 query = " SELECT * FROM users WHERE id = " + str ( user_id ) cursor . execute ( query ) It works. Until it doesn't — and when it breaks, it breaks badly : SQL injection, cryptic errors from mismatched types, and queries that take 45 minutes to debug at 2am. Let's fix that, permanently. 1. Never Concatenate User Input — Use Parameterized Queries This is rule #1 and it's non-negotiable. ❌ The Wrong Way (SQL Injection Waiting to Happen) username = request . args . get ( " username " ) # Could be: ' OR '1'='1 query = f " SELECT * FROM users WHERE username = ' { username } '" cursor . execute ( query ) If username is ' OR '1'='1 , your entire users table just got exposed. ✅ The Right Way: Parameterized Queries username = request . args . get ( " username " ) # psycopg2 (PostgreSQL) cursor . execute ( " SELECT * FROM users WHERE username = %s " , ( username ,)) # sqlite3 cursor . execute ( " SELECT * FROM users WHERE username = ? " , ( username ,)) # SQLAlchemy Core from sqlalchemy import text result = conn . execute ( text ( " SELECT * FROM users WHERE username = :name " ), { " name " : username }) The database driver handles escaping. You never touch it. This pattern is immune to SQL injection by design. Gotcha: Note the trailing comma in (username,) . Without it, Python treats the string as an iterable and passes each character as a separate parameter. This is one of the most common beginner bugs. # 💥 Bug: passes ('a', 'l', 'i', 'c', 'e') instead of ('alice',) cursor . execute ( " SELECT * FROM users WHERE username = %s " , ( username )) # ✅ Correct: single-element tuple cursor . execute ( " SELECT * FROM users WHERE username = %s " , ( username ,)) 2. Multi-Line Queries: Triple Quotes + Consistent Indentation For anything longer than one clause, use tri

Unravel the tangled world of cords and find the ones you need to charge your gadgets and transfer data.

As developers, we often lose hours to repetitive tasks - formatting data, debugging auth tokens, or wrestling with encoding issues. The right set of utility tools can cut that overhead significantly. Here is a curated breakdown of the categories and tools worth keeping in your daily workflow in 2026. JSON and Data Formatting Tools Working with raw, minified API responses is a real productivity killer. A browser-based JSON formatter with real-time validation and proper indentation helps you parse and debug responses in seconds - without sending your data to third-party servers. Similarly, XML is far from dead; SOAP APIs and enterprise integrations still rely on it, so a solid XML formatter with XPath support is worth having around. On the frontend, a CSS minifier that handles dead code removal and selector optimization can meaningfully reduce your page load times. Data Conversion Utilities Modern stacks often have to bridge the gap between formats. A JSON-to-XML converter is critical when integrating with legacy systems, but look for one that handles arrays and special characters correctly. CSV-to-JSON converters help structure flat export data from spreadsheets or databases into something your application can consume. And if your deployment pipeline involves YAML config files, a formatter that catches indentation errors before they break your CI/CD run is essential. Encoding and Security Helpers Base64 encoding comes up constantly - from embedding images in CSS to building HTTP Basic Auth headers. A reliable encoder/decoder handles all these cases without fuss. URL encoding matters too; unencoded special characters in query strings cause subtle API bugs that are surprisingly hard to track down. For authentication debugging, a JWT decoder lets you inspect token payloads without needing to verify the signature - ideal for local development and troubleshooting. Code Generation and Color Utilities Distributed systems need collision-resistant unique IDs - a UUID generato

Your Apple Watch knows when you've truly hit muscle failure Discussion | Link

I'm a 17-year-old IT student from Luxembourg. A few months ago I got tired of spending 2-3 hours a day manually browsing Upwork, Malt, and Freelancer looking for projects. So I built an automation system that does it for me — 24/7, on a Raspberry Pi 3. Here's what it does, how I built it, and every painful lesson I learned along the way. What the system does Scans Upwork, Malt, and Freelancer every 30 minutes Scores each job 0–100 with AI based on my profile Generates proposals in English, French, and German Sends the best jobs to Telegram with inline A/B buttons Tracks which proposal style gets more replies Sends daily stats and weekly market trend reports Reminds me to follow up after 3 days The stack n8n — self-hosted workflow automation (Docker on Raspberry Pi 3) Groq API (Llama 3.1-8b-instant) — AI scoring and proposal generation Supabase — PostgreSQL database for jobs, proposals, clients SerpAPI — searching job boards via Google Apify — scraping Upwork listings Telegram Bot API — alerts and bot commands Cloudflare Tunnel — HTTPS for webhooks Total running cost: ~$5/month. 7 workflows 01 - Job Discovery — runs every 30 minutes, searches 10+ sources, deduplicates via Supabase unique constraint on URL 02 - Proposal Generator — AI scores the job, generates two proposal variants (formal vs hook-first), sends to Telegram with A/B buttons 03 - Follow-up Reminders — checks Supabase every 3 days for unanswered proposals 04 - CRM via Telegram — full client management through bot commands (/jobs, /stats, /clients) 05 - Market Intelligence — daily report: how many jobs found, average score, top platforms 06 - Trend Analysis — weekly report on what skills are trending in automation 07 - Lead Generation — finds companies actively using Zapier or Make who might want to switch to n8n Lessons learned (the hard way) 1. Cyrillic text breaks JSON body nodes silently If you have Cyrillic characters in a JSON body field with newlines, n8n throws a "Bad control character" error. Kee

I got tired of paying for form services or spinning up a backend just to handle contact form submissions. So I built RG Forms — a contact form endpoint backed entirely by a Google Sheet you own. No server, no monthly fee, no third-party storing your data. The idea Most form tools store your submissions on their servers. You pay monthly, you depend on their uptime, and your data lives in their database. RG Forms does the opposite: every submission goes straight into a Google Sheet in your own Google Drive, sent by an Apps Script that you own and control. RG Forms provisions that sheet and script for you in about 90 seconds. After that, your endpoint runs forever at no cost — completely independent of any RG Forms server. Built for static sites If you host on GitHub Pages, Netlify, Vercel, Cloudflare Pages, or just plain HTML on a CDN, you've hit this wall: there's no backend to receive a form POST. The usual workarounds are a paid form service, a serverless function you have to write and maintain, or standing up a whole backend just for a contact form. RG Forms is built exactly for this. Your endpoint is a plain HTTPS URL you POST to straight from client-side JavaScript — no build step, no serverless function, no server of any kind. Drop the fetch call into your page and you're done. It pairs naturally with any static-site generator (Hugo, Jekyll, Astro, Eleventy, Next export) and any no-code builder that lets you add a snippet of JS. Your static site stays static; the form just works. How it's built RG Forms is a fully static web app. There's no RG Forms server, no database, no backend. Every API call during setup goes directly from your browser to Google using your own OAuth token. Setup (one time, in your browser): Your Browser ├─── Google OAuth ──▶ Short-lived token (memory only) ├─── Google Drive API ──▶ Creates Sheet + Drive folder └─── Apps Script API ──▶ Creates & deploys form handler Live endpoint (after provisioning): Your Website / App └─── POST to script

Product feature update for our virtual conferencing platform Discussion | Link

Problem Statement: DevOps Pipeline Agent: Modern software delivery pipelines generate large amounts of operational data. Understanding the relationship between deployments, infrastructure changes, and failures is increasingly complex. Build an AI agent that remembers deployment history, infrastructure modifications, build failures, and incident outcomes. The agent should learn from previous events to predict risks and recommend preventive actions before issues reach production. The project should showcase memory-driven operational intelligence. Solution Approach To address these challenges, we developed SAFEDEPLOY AI, a memory-driven operational intelligence platform that acts as the collective memory of software systems. SAFEDEPLOY AI continuously records: Deployment histories Infrastructure modifications Build outcomes Incident reports Module-level changes Operational metrics Instead of treating these as isolated records, the platform transforms them into searchable organizational knowledge. The AI assistant can answer questions such as: Which deployment introduced a failure? Has this issue occurred before? Which service has the highest deployment risk? What preventive actions worked in previous incidents? Which infrastructure changes caused production instability? This enables teams to move from reactive troubleshooting to proactive decision-making. Architecture and Design SAFEDEPLOY AI follows a cloud-native, layered architecture designed to provide deployment intelligence, operational visibility, and AI-driven decision support. The platform workflow begins with project creation and module registration. As deployments and infrastructure changes occur, SafeDeploy AI continuously records operational events, incident reports, security findings, and compliance records. This information is stored as a centralized knowledge base, enabling the AI engine to perform risk analysis, generate recommendations, and support context-aware issue resolution. Workflow Create Proje

🚀 What I Built I created a collaborative AI Multi-Agent system using Google's new Agent Development Kit (ADK). The system functions as an automated Hollywood Production Team designed to streamline creative brainstorming. The user submits a simple movie prompt (e.g., "A movie about a time-traveling chef"), and the specialized agents work sequentially to refine the idea into a viable film concept. 🧠 My Agent Architecture My multi-agent team uses a sequential workflow tracking architecture consisting of two specialized agents running on gemini-2.5-flash : movie_writer : Takes the raw user input concept and expands it into a high-stakes, descriptive three-sentence movie plot. movie_critic : Automatically intercepts the writer's completed story context to deliver constructive structural improvements. These agents are orchestrated via a SequentialAgent pipeline configuration that manages data handoffs automatically. 🛠️ Key Learnings & Challenges Framework Evolution: I learned how to structure project modules using ADK 2.0's directory scanning conventions ( __init__.py mapping definitions). Overcoming Roadblocks: I originally ran into layout separation issues on Windows where the backend command runner could not discover the python modules. Resolving this taught me how the google.adk.cli maps working directory environments ( ./app ). Handling API Constraints: Dealing with transient API capacity limits (like standard 503 backend service spikes) taught me how crucial error handling and session resets are when building live AI tools.

GitHub moved Copilot Chat's richer pull request experience to general availability this week — side-by-side chat with diffs, inline editing, and context-aware answers without leaving the review view. Previously in public preview, it is now live for all Copilot license holders. It is a real improvement for reviewing changes inside a single pull request. But it highlights a gap that per-PR AI tooling structurally cannot close: knowing what is open across the rest of your organisation. The Problem That Lives Outside the PR Most engineering teams don't work in one repository. They ship across services, libraries, and infrastructure — often with related PRs open in multiple repos simultaneously. A reviewer approving a payments service change without knowing that a dependent auth-service PR is still in draft is reviewing without full context. This is not a quality-of-feedback problem. It is a visibility problem. No amount of intelligence surfaced inside a PR tells you what is happening across your repositories. Gartner's 2026 assessment of AI coding agents makes the point clearly: the bottleneck has shifted from generating code to reviewing, securing, and governing it. Better per-PR AI raises the floor on feedback quality. The teams that pull ahead will be the ones who also solve the coordination layer — which PRs are open, which are stale, which are blocked on a dependency in another repo. What Changes With Better In-PR AI GitHub's GA release makes the review experience faster and less disruptive for individual PRs. That matters. But as per-PR intelligence becomes table stakes, the differentiator shifts toward cross-repo awareness: who is waiting for review, what related work is in flight, and where the actual bottlenecks in the delivery pipeline are. Engineering leaders should be watching PR age distribution and review load across all repositories — not just the ones that happen to be open in a browser tab right now. For teams already dealing with multi-repo sprawl, Cod

A success gate verifies an AI agent's claimed success before your system accepts it. SuccessGate runs three read-only checks — schema/contract, claim-vs-evidence against the actual tool-call trace, and an optional post-condition probe — and turns a silent 200 into an explicit REJECTED with reasons. It's stdlib Python, needs no API key, moves nothing, and ships with a self-test you run in one command. Here's the failure that started this for me. An agent in a CRM workflow reported {"status": "sent", ...} for an invoice. Clean run. Green dashboard. 200 OK. The invoice went to a customer id that wasn't on our allow-list — a near-miss hallucination the model was completely sure about. Nothing crashed. No exception, no stack trace. We found it days later, downstream, the expensive way. That's not a rare bug. It's the default failure mode of agents in production, and it has a name now: silent-success drift . Cycles' writeup put it bluntly — "200 OK Is the Most Dangerous Response in Production" : "The most dangerous failures look like success." And the measurements back it up. The Berkeley Function-Calling Leaderboard (BFCL v3) puts frontier-model structurally invalid tool calls at 2–5% even on clean benchmark prompts — higher in noisy production ( via Future AGI ). The arXiv paper Agent Behavioral Contracts reports that across 1,980 sessions , contracted agents caught 5.2–6.8 soft violations per session that uncontracted baselines missed entirely. So the question is not how do I see failures sooner . It's how do I stop accepting a success the agent never actually achieved. TL;DR A 200 and a "status": "done" are claims, not proof. Agents return both while doing the wrong thing — or nothing. Observability is tracking : it tells you a call happened. It can't tell you the result was correct. That's a control problem. verify() runs three checks before you accept success: (1) schema/contract (shape, types, enums/allow-list), (2) claim-vs-evidence (did the agent actually call th