One command to audit and fix your Mac's security Discussion | Link

OpenAI ran a public ML hiring competition this spring called Parameter Golf: train the best small language model under a strict size and compute budget. 1,016 researchers entered. They filed 2,048 pull requests over 44 days. Only 47 made the official leaderboard. The single most prolific contributor wasn't a person. It was an autonomous research agent named Aiden: 7 of the 47 records came from it, more than 2x the next-best human (3 records). It ran for 22 days straight with no human steering, on a single GPU node, using under 4% of the visible compute the human community used. Disclosure: I'm at Weco, we built the agent. Sharing because the competition is over, every record is public on OpenAI's GitHub, and the interesting part to us isn't the leaderboard count, it's what happened around the agent. Aiden's records became the most-cited PRs in the competition. Human researchers started building on top of Aiden's work as a base for their own submissions. At one point Aiden plateaued for 5 days. A human contributor shipped a clever new tokenizer on top of Aiden's last record PR. Aiden then fused that human's tokenizer with components it had built locally during the plateau, and shipped the biggest score jump of the entire competition. Async human-agent collaboration, neither directly aware of the other. Fair hedges worth being explicit about: This is #1 by volume of merged records , NOT by best single score. By best score, the agent ranked 8th — the leaderboard winner was a human (codemath3000). Fully autonomous. OpenAI's own competition recap noted widespread use of AI coding agents during PG, but said most were human-directed. Ours wasn't. Full writeup with all the data: https://www.weco.ai/blog/parameter-golf-aiden submitted by /u/Educational_Strain_3 [link] [留言]

Apple used to question whether generative AI-powered editing features were worth the risk of distorting our perceptions of the world. Now it seems Apple no longer believes that photos should accurately capture reality. At WWDC 2026, the company announced a host of new AI-powered photo editing tools. They give users effortless powers of manipulating images […]

With SpaceX, Anthropic, and OpenAI all eyeing massive public debuts, the tech industry may soon have a new class of corporate overlords — and a new acronym to match. Say goodbye to FAANG and hello to MANGOS.

At Deno we've been using OpenClaw and other agents increasingly for addressing production problems in Deno Deploy - when a PagerDuty alert fires, the agent starts researching the cause and making fixes. In order to do this, the agent needs access to real production systems - postgres, kubernetes, gcp, clickhouse, github, etc. But this is dangerous to say the least - we want destructive actions to be reviewed by other LLMs, approved by humans, and logged appropriately. Claw Patrol terminates TCP

https://preview.redd.it/vfxky33v5a6h1.png?width=2612&format=png&auto=webp&s=f60bd8506a39abb40b1c9ff9507e8dcddea95498 OpenAI ran a hiring challenge, but the top candidate was one they couldn’t hire: our autonomous research agent, Aiden. In Parameter Golf, Aiden ran for 22 days, and out-outperformed all 1,016 other researchers. Parameter Golf was OpenAI’s 44-day competition and hiring challenge. The goal is to train the best language model under strict size and compute constraints. 1,016 people entered and filed 2,048 PRs. Only 47 made the leaderboard, each reviewed and reproduced by OpenAI. Research outputs only matter when others can build on them. So Aiden filed its own PRs into the same public stream as everyone else, under tight automated quality control. Aiden filed 25 prs and 7 became leaderboard records, 2x the next best human participant. Other participants cited Aiden’s PRs 435 times and built on them. By PR h-index, Aiden scored 10 vs the next best at 7, making it the most impactful “researcher” in the community. And this wasn't brute force. Aiden ran on a single GPU node, used under 4% of visible compute, and still produced 15% of the official records. About 28% of its submissions were accepted, ~ 6x the community rate, raising signal in the public stream instead of flooding it. Our favorite part is an async collaboration story. Aiden plateaued for 5 days. Then a human contributor shipped a clever new tokenizer on top of Aiden's base (its last record PR). Aiden fused it with components it had built during the plateau, and shipped the biggest jump in weeks. Full writeup: https://www.weco.ai/blog/parameter-golf-aiden Edit: resharing since original got removed submitted by /u/Educational_Strain_3 [link] [留言]

Nintendo dropped a lot of news for Xenoblade fans this morning.

"How do I hide wp-admin" is one of the most-searched WordPress security questions, and most answers give the same advice: install a plugin that renames your login URL. That advice isn't wrong. It's just answering a smaller question than the one being asked. Renaming /wp-login.php to /my-login moves the login form. It does not change what answers at the old path, what your plugin folders advertise, or what your home page tells a scanner about the stack underneath. If your only problem is the password-guessing bot hammering the default form, a renamer solves it. If your problem is "stop my site from being identified and targeted as WordPress," you've solved maybe a third of it. Here are the three leaks a login rename leaves open. Leak 1: the old path still costs a full WordPress boot When a login-URL renamer "blocks" the default path, the request to /wp-login.php still loads WordPress. PHP starts, the plugin stack initializes, and only then does the plugin decide to return a 404 to the logged-out visitor. The visitor sees a 404. Your server still did the work of booting WordPress to produce it. On a quiet site, nobody notices. On a site taking tens of thousands of probes a day, that's tens of thousands of full WordPress boots spent generating 404s. Your security dashboard's "attempts blocked" counter looks great. Your CPU graph disagrees. The architectural alternative is to reject the request at the rewrite layer, before PHP runs: # Apache .htaccess — reject the default login path at the server level < IfModule mod_rewrite.c > RewriteEngine On RewriteCond %{REQUEST_URI} ^/(wp-login\.php|wp-admin) [NC] RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC] RewriteRule .* - [R=404,L] </ IfModule > # nginx — same idea, requires a config reload after change location ~ * ^/(wp-login \ .php|wp-admin) { if ( $http_cookie !~* "wordpress_logged_in") { return 404 ; } } The probe to the old path returns 404 from the server, WordPress never loads, and the request costs almost nothi

Visibility Comes Before Optimization in IT Operations is a practical operating principle, not a slogan. The useful version of analytics, automation, and software operations is usually quieter than the marketing version. It is less about collecting everything or automating everything, and more about making the work easier to understand, review, and improve. The practical problem Teams often try to optimize before they can see the system clearly. That creates confident changes based on partial evidence, especially in infrastructure and telecom-adjacent workflows where signals are distributed. This is where many teams lose clarity. They have tools, charts, workflows, and activity, but the connection between evidence and decision is weak. When that connection is weak, software work becomes harder to evaluate. Teams still make decisions, but they rely more on memory, opinion, or urgency than on a reviewable operating picture. A smaller operating model Start with visibility: what is running, which state changed, where the weak signal appeared, and which workflow was affected. Then connect that signal to a decision or operational review. The important detail is restraint. A useful system does not need to track every possible action or automate every possible step. It needs to preserve the signals that help operators understand the situation and act with more confidence. That usually means naming the workflow, keeping the outcome visible, preserving enough context to explain the signal, and making uncertainty explicit instead of hiding it behind a polished interface. What to review Useful analytics separates normal activity from operational risk. It should make the next investigation smaller, not create another dashboard that requires interpretation from scratch. A reviewable system is easier to trust because it can explain its own state. It shows what happened, what changed, what remains uncertain, and which decision should move next. For WebmasterID, this is the practical

Because a reality wasn't given to us and is not there; but we have to make it ourselves, if we want to be; and it will never be one for ever, but constant and infinitely changeable. Luigi Pirandello, One, No One, and One Hundred Thousand Pirandello wrote this about the human condition. He didn't know he was describing the future of the internet. The web we know is about to disappear Not slowly. Not gradually. The web page, as the default unit of human navigation, is about to disappear: it will strip itself of everything we call "interface" and what remains will be only what it always was underneath — data, structure, instruction. The enticing homepages. The banners. The product carousels engineered by UX teams to capture attention in the first second and a half. The brand colors. The call-to-action buttons optimized for conversion rate. All of this is designed for a human eye that navigates alone. That eye is about to delegate. The agent that browses for you Imagine you want to buy a pair of shoes. Today you open a browser, search, filter, compare, go back, reopen the tab you closed, forget what you were looking for, start again. In a few years — maybe less — you will tell the agent what you want. The agent will already know that you have wide feet, that you prefer leather to synthetic, that you're looking for something for a wedding in June but deep down you want something that works afterward too. It will know that today you're in a practical mood, not an aspirational one. That you've spent a lot this month. The agent won't open a homepage. It will query a data structure. It will receive prices, availability, variants, return policies. It will build for you — and only for you, and only in that moment — a presentation tailored to measure. Colors that belong to you. Texts that speak your language. Images generated for your aesthetic sensibility of that day. The same store. Five billion different versions. One for each person, one for each moment. One, No One, and On

(The following example is fictionalized.) A notification template feature shipped six months ago. It let each tenant customize the messages sent to their own customers without requiring a back-end change every time the wording changed. The code reviewer could tell the design was hard to follow, especially the path from template to rendered value. But "this is hard to follow" is difficult to turn into a concrete objection when the feature works, the tests pass, and nothing is obviously unsafe or wrong. The design risk was real, but there wasn't an obvious bug to point to. QA signed off, and the feature went into production. Then a bug report came in: one customer had received a notification containing another customer's information. Somewhere in the notification pipeline, the system was leaking PII. At first, the fix sounded small: make sure notifications only render data belonging to the intended recipient. Then the assigned developer, who wasn't the original author, started looking for the place to make the fix. The templates were stored in the database. There were six template types, and each one populated its real values in a different part of the codebase. Some values came from customer-facing records, some came from internal workflow state, and some came from template-specific logic. The placeholder-to-value mapping lived somewhere else. Email and SMS channels shared part of the rendering path, but not all of it. Before the developer could decide where to fix the leak, they had to answer a more specific set of questions: Which placeholder rendered the wrong value? Where did that value come from? Which template types could use that placeholder? Did email and SMS resolve it the same way? What evidence would show that the leak was fully contained? The system was hard to change because it made the behavior hard to understand. What the developer needed was not just "clean code." They needed trustworthy signals they could use as evidence to answer harder questions: w

A useful technical idea, repeated often enough, eventually generates an unuseful philosophical claim. The current example is grammar-constrained decoding. The technique is straightforward — at each generation step, the language model's next-token logits are masked so that only tokens whose continuation can satisfy a formal grammar remain selectable; the output is, by construction, structurally valid. JSON parses. SQL is well-formed. Function-call signatures match. There is a real engineering payoff and a healthy ecosystem of libraries that deliver it. The drift is not in the engineering. It is in the rhetorical move that follows the engineering. A growing corner of 2025-2026 AI writing argues, more or less explicitly, that constraining a model's output is making the model approach meaning — that filtering linear sequences is somehow building structure, and that structure is somehow building understanding. I want to take that drift seriously, because it is the same conflation Chomsky and collaborators flagged in their March 2023 essay in the New York Times , and the engineering literature on constrained decoding agrees with Chomsky on the substantive question, even when the marketing copy doesn't. What grammar-constrained decoding actually is A language model produces output one token at a time. At each step, the model emits a probability distribution over its vocabulary, and the decoding strategy (greedy, top-k, nucleus, etc.) picks one token. Without modification, the model is free to emit any continuation; the resulting text might happen to be valid JSON, or it might not. Grammar-constrained decoding intervenes in that step. A formal grammar — typically a context-free grammar, sometimes a regular expression, sometimes a JSON schema or Pydantic model — defines what counts as valid output. At each generation step, the constraint engine computes which next tokens could lead to a continuation that is still satisfiable under the grammar, masks the logits for all other

The Problem I was using Claude Code, Codex, and Cursor daily but had no idea how much I was spending on tokens. Bills kept surprising me. The Solution I built AIUsage — a local-first, open-source CLI that tracks everything. Key Features Token usage tracking with daily breakdowns Cost estimation with configurable pricing Model usage ranking Multi-device sync via GitHub or S3 Desktop widget How It Works bash npm install -g @juliantanx/aiusage aiusage parse aiusage serve Why Local-First? Your data never leaves your machine. No accounts, no API keys, no cloud servers. Try It [aiusage.jtanx.com](https://aiusage.jtanx.com)

Custom agents let GitHub Copilot CLI understand your stack and team workflows, turning one-off terminal prompts into repeatable, reviewable processes. The post From one-off prompts to workflows: How to use custom agents in GitHub Copilot CLI appeared first on The GitHub Blog .