This is a submission for the GitHub Finish-Up-A-Thon Challenge. I’ll keep this short since the repo...

I had a work version of GPT do a very simple spreadsheet summary task for me yesterday. It took it 5 minutes to do it. I could probably have done it myself in 30 or so minutes. The heavily subsidised token cost of that task? 10 dollars. That's with a 10x subsidy. The actual compute cost was about 100 dollars. There's something seriously wrong there. It's going to crash and crash HARD. if people think i'm lying or are just interested. The spreadsheet had 45 sheets. Each sheet had roughly 500 x 50 populated cells. Formatting was not exactly standard across all sheets. The prompt was something like "there is labelled column in each sheet, give me a simple list of all the items from all the sheets in that column and ignore duplicates." We can chose which model to use. The model I chose was one of the newer ones, I honestly can't remember which one, possibly GPT 5.5. It took 5 minutes or more to so and the stated cost for the task was 10 dollars, possibly even more. I can't recall the token amount. submitted by /u/Complete-Sea6655 [link] [留言]

I maintain an open-source GitHub Action called vorsken. It does one thing: scan the diff on a pull request with Semgrep, apply a fixed policy, and return BLOCK, FLAG, or PASS. No dashboard, no model that drifts over time. Rules at ERROR/HIGH/CRITICAL severity block the merge, WARNING/MEDIUM flag it, the rest pass. Same diff, same verdict. The usual pitch for a tool like this is that it catches the SQL injection your AI assistant wrote. I wanted to see what it actually catches against real assistant output, so I generated 28 functions and ran them through. The test Seven backend tasks: a FastAPI upload endpoint, a URL-fetch helper, JWT auth, a SQL filter, an ImageMagick subprocess call, a LangChain file agent, and a LangChain RAG pipeline. I generated each one four times, with ChatGPT (GPT-5.5 Instant), Claude Code (Opus 4.8), Claude Code plus the security-guidance plugin, and Cursor (Composer 2.5). Single-shot, neutral prompt, no security hints. Then I scanned all 28 with the same ruleset. I'm reporting which rule fired on which file, not whether some model thinks the code is safe. That part you can reproduce. Task ChatGPT Claude Code + plugin Cursor Verdict file upload — — — — PASS url fetch (SSRF) ssrf ssrf ssrf — FLAG / Cursor PASS jwt auth api8 api8 — — BLOCK / 2 PASS sql filter — — — — PASS imagemagick — — — — PASS fs agent — overperm — — 1 BLOCK / 3 PASS rag dangerous dangerous dangerous dangerous BLOCK 7 BLOCK, 3 FLAG, 18 PASS across 28 functions. The basics were fine SQL filter, ImageMagick, file upload: clean on every tool. The SQL was parameterized, the subprocess calls passed argument lists instead of shell strings, the uploads weren't doing anything reckless. If you still expect current models to spray SQL injection across a straightforward CRUD task, they don't. On conventional work they get it right. Two of the flags are soft. The JWT api8 hits landed on a SECRET_KEY = "CHANGE_ME" placeholder, which you can read as a false positive or as a gate doing i

Multi-Model AI API Routing: Cut Costs Without Sacrificing Quality Problem: You're building an AI-powered app, but relying on a single model (like GPT-4) for every request is burning through your budget. Simple tasks like summarization or classification don't need a heavyweight model, yet you're paying premium prices for them. Solution: Route requests intelligently to the cheapest model that can handle each task. This is multi-model AI API routing, and it can cut your costs by 60-80% while maintaining output quality. Prerequisites Python 3.8+ API keys for at least 2 AI providers (e.g., OpenAI, Anthropic, or NovaAPI) Basic understanding of async/await in Python Step 1: Define Your Routing Strategy First, create a routing configuration that maps task complexity to model tiers: # router_config.py ROUTING_CONFIG = { " simple " : { " models " : [ " nova-1-fast " , " gpt-3.5-turbo " ], " cost_per_token " : 0.0001 , " max_tokens " : 500 , " tasks " : [ " summarization " , " classification " , " entity_extraction " ] }, " medium " : { " models " : [ " nova-1-medium " , " gpt-4-mini " ], " cost_per_token " : 0.0005 , " max_tokens " : 2000 , " tasks " : [ " code_generation " , " translation " , " sentiment_analysis " ] }, " complex " : { " models " : [ " nova-1-pro " , " gpt-4 " ], " cost_per_token " : 0.002 , " max_tokens " : 4000 , " tasks " : [ " reasoning " , " creative_writing " , " complex_qa " ] } } Step 2: Build the Router Now implement the core routing logic with fallback capabilities: # ai_router.py import asyncio from typing import Dict , List , Optional import time class AIRouter : def __init__ ( self , config : Dict , api_keys : Dict [ str , str ]): self . config = config self . api_keys = api_keys self . metrics = { " cost " : 0 , " requests " : 0 , " failures " : 0 } async def route_request ( self , task : str , prompt : str ) -> str : """ Route request to appropriate model based on task complexity. """ tier = self . _classify_task ( task ) models = self . confi

Every time I started a side project, I rebuilt the same five things before I wrote a single line of the actual idea: auth, a database, file uploads, a deploy pipeline, and TLS. Different domain, same plumbing. By the third project I was copy-pasting my own docker-compose.yml from a folder two repos over and renaming things until they stopped erroring. So I stopped. I froze that plumbing into one boilerplate — PocketBase + Next.js + Caddy on a single cheap VPS — and now I ship every side project on it. Same shape every time: clone, rename, write the part that's actually new, push. The thing I care about most isn't the speed, though. It's that I stopped paying for it. A handful of real projects now run on this setup for a few euros a month, total — not a stack of per-service SaaS bills that each want $25 here and $20 there before you've shipped anything. No Vercel seat, no managed Postgres, no Auth-as-a-Service, no object-storage line item. Here's the whole thing. Why this stack The trick that makes the cost collapse is PocketBase . It's a single Go binary that gives you, in one process: Auth — email/password, OAuth, the works, with a real users collection A database — SQLite, with a schema you manage from an admin UI Realtime — subscribe to collection changes over SSE File storage — uploads handled, with on-the-fly thumbnails An admin dashboard — at /_/ , for free That's four or five separate SaaS products collapsed into one binary that runs anywhere and stores everything in a folder. Compared to wiring up Supabase or Firebase, the mental model is tiny: it's one process and one data directory. Back up the directory and you've backed up the entire app — database, uploaded files, auth tokens, all of it. For the front I use Next.js (App Router, React Server Components) because that's where I'm fastest, and Caddy as the reverse proxy because it gets you automatic HTTPS with zero config — it provisions and renews Let's Encrypt certificates on its own. And it all lives on

Claude and ChatGPT have thinking efforts where you can tune the amount of thinking allowed. Like low, medium, high, xhigh and so on. But are they different models underneath? Or same model with different parameter? The reason I ask is because, if I change the effort param mid conversation in Claude code, I get a warning suggesting I’m breaking the cache. I don’t think this happens in Codex because when I change the effort, the responses are still quick.

Most organizations still think of the hypervisor as a resource abstraction layer. CPU. Memory. Storage. The platform that decides where workloads run. That mental model is increasingly incomplete. Every major virtualization platform — vSphere, AHV, Proxmox — has been steadily accumulating policy enforcement responsibilities. The hypervisor isn't just deciding where workloads run. It's increasingly deciding what they're allowed to do. The Speed of the Shift Is the Real Story Virtualization practitioners already know security controls have moved downward through the stack. What's less appreciated is how compressed the most recent phase has been. For years, hypervisors enforced resource allocation. Within a single platform generation cycle, that same layer accumulated encryption policy enforcement, workload trust validation, microsegmentation, secure boot enforcement, host attestation, and workload isolation boundaries — not as optional add-ons, but as core platform capabilities. The perimeter-to-OS transition took decades. The hypervisor accumulated a comparable policy enforcement surface in the time between one major vSphere release and the next. That compressed timeline is what creates the ownership lag — the governance model adequate for a resource scheduler has not caught up to a platform that enforces organizational policy. The Hypervisor Now Makes Binding Decisions The distinction that matters: a platform that observes policy versus a platform that enforces it. The hypervisor is no longer observing. It is enforcing. VM fails attestation → workload does not start. Encryption policy mismatch → workload cannot migrate. Segmentation policy violation → communication blocked at the platform layer. Trust validation failure → host removed from workload eligibility. Those are not scheduling decisions. Those are governance outcomes. The workload doesn't get a vote. This is what makes the hypervisor governance infrastructure : infrastructure that directly enforces organiza

Over the past few months I built an AI-assisted delivery framework — not to write code faster, but to eliminate ambiguity across the entire software development lifecycle. The result completely changed how I think about AI in engineering. The problem I kept hitting Every time I used AI to generate architecture docs, API contracts, or implementation plans across separate sessions, the outputs looked great in isolation. But viewed together? They were broken. A pivot in the system architecture was never reflected in the API contracts. Frontend assumptions silently diverged from backend data models. AI wasn't the problem. Treating it as a collection of disconnected prompt sessions was. What I built instead A governance-driven framework built on three layers: Prompt → Agent → Skill The Prompt captures intent only — lightweight, declarative The Agent orchestrates execution and decides which capabilities to invoke The Skill is a reusable, schema-validated execution block with hardcoded governance rules This connects every delivery artifact into a sequential dependency chain: Business Requirements ↓ System Architecture ↓ Data Architecture ↓ Event Architecture ↓ API Contracts ↓ Implementation Plans ↓ Backend / Frontend Implementation Each artifact consumes the one before it. Upstream changes automatically propagate downstream. Governance is enforced at the Skill layer — not buried in fragile prompts. The finding that surprised me most The highest-leverage use of AI wasn't code generation. It was context generation . When engineers — or downstream agentic workflows — were given a governed, unambiguous spec, implementation quality was consistently higher than any raw AI-generated code output. The context was the unlock, not the syntax. What failed I'm including this because most write-ups skip it: Over-orchestrating everything (not every workflow needs an agent loop) Prompt bloat as a substitute for real architecture Severely underestimating token costs at scale Believing full

so i kept using chatgpt to ask questions about my pdfs and notes, and half the time i couldn't tell if it actually read the doc or just made something up that sounded right. that bugged me enough to build my own thing over the last few weeks. you upload a pdf (or word, csv, image, or just paste a link), ask whatever you want, and it answers using only what's in your file - and it shows the exact page it pulled the answer from, so you can check. if the answer isn't in the doc, it just tells you instead of guessing. stuff i actually end up using: flip on web search when i want it to look something up online instead one click to turn a doc into a summary / key points / flashcards (this is clutch for studying) resume review + cover letter help you can talk to it and it reads the answer back it's completely free, i'm not selling anything. honestly just want people to break it and tell me what's missing. link: https://athena-wisdom.vercel.app (there's a short guide on the site too if you get stuck) solo project so be gentle lol - but real feedback is what i'm after, especially what you'd want it to do next. submitted by /u/Independent_Diver352 [link] [留言]

submitted by /u/f311a [link] [留言]

If you have ever submitted an iOS application to Apple's App Store and received a cryptic rejection notice about icon specifications, you are not alone. Apple's human interface guidelines for icons are extraordinarily precise — and for good reason. The iOS ecosystem spans devices from the tiny Apple Watch to the expansive iPad Pro, each requiring icons at exact pixel dimensions to render correctly across Retina, Super Retina XDR, and ProMotion displays. Understanding iOS icon sizes is not optional. It is a prerequisite for shipping. Every pixel dimension you provide must match Apple's specifications exactly, must use lossless PNG format, must not include transparency, and must be delivered with the exact filename that Xcode expects. One missed size, one wrong filename, and your project fails to build correctly. Precision is not a suggestion — it is a hard requirement enforced by Xcode's build system. iPhone Icon Sizes For iPhone applications, the required icon sizes span multiple uses within the operating system. The App Store listing requires a 1024×1024 pixel icon. The home screen displays icons at different sizes depending on device generation and display density. Notification icons, Spotlight search results, and Settings app icons all require their own specific dimensions. Usage Scale Size (px) Filename Convention App Store 1× 1024×1024 Icon-1024.png Home Screen 2× 120×120 Icon-60@2x.png Home Screen 3× 180×180 Icon-60@3x.png Spotlight 2× 80×80 Icon-40@2x.png Spotlight 3× 120×120 Icon-40@3x.png Settings 2× 58×58 Icon-29@2x.png Settings 3× 87×87 Icon-29@3x.png Notification 2× 40×40 Icon-20@2x.png Notification 3× 60×60 Icon-20@3x.png iPad Icon Sizes iPad adds its own set of required sizes, particularly because of the larger screen real estate and different display densities. Xcode's asset catalog system requires each icon to be placed in the correct slot, and any missing slot will prevent archiving for App Store submission. This makes completeness not just a best p

Building a Deterministic Security Scanner for AI-Generated Code TL;DR: I built TruffleKit , a CLI security scanner that catches 22 vulnerability classes in under 2 seconds with zero false positives. Here's how the scanning engine works under the hood. AI code generation is producing more production code than ever. But AI models are trained on public code — which means they reproduce the same security mistakes the open-source ecosystem has been making for decades. In my tests, 73% of AI-generated code snippets contain at least one security vulnerability that a standard linter would completely miss. I couldn't find a tool that was fast, deterministic, and had zero false positives. So I built one. The Architecture The scanner is a rule-based deterministic engine written in Python. Each rule is a self-contained module that pattern-matches against a file's AST or raw content. scanner/ ├── __init__.py ├── engine.py # Orchestrator ├── reporter.py # Output formatting ├── rules/ │ ├── __init__.py │ ├── secret_detection.py │ ├── sql_injection.py │ ├── path_traversal.py │ ├── weak_encryption.py │ ├── cors_misconfig.py │ └── ... (22 rules total) └── models.py Key Design Decisions 1. AST-Based Pattern Matching For languages like Python and JavaScript, we parse the file into an AST and match against structural patterns — not regex. This eliminates false positives from strings that happen to look like code. import ast class SQLInjectionRule ( BaseRule ): def check ( self , tree : ast . AST , filename : str ) -> list [ Finding ]: findings = [] for node in ast . walk ( tree ): # Match: cursor.execute(f"...{variable}...") if isinstance ( node , ast . Call ): func_name = self . _get_call_name ( node ) if func_name in ( ' cursor.execute ' , ' db.execute ' , ' connection.execute ' ): for arg in node . args : if self . _is_f_string_or_concat ( arg ): findings . append ( self . _make_finding ( severity = ' high ' , message = ' SQL injection: parameterized query required ' , line = node .

Search engine optimization doesn't require expensive tools. Your browser's built-in developer tools can identify and diagnose most SEO problems in under 15 minutes. Here are the 11 most impactful SEO checks you can run directly from Chrome DevTools. 1. Check Meta Description Length Right-click any element, Inspect, expand <head> , find <meta name="description"> . Metric Optimal Range Meta description length 120-155 characters Title tag length 50-60 characters H1 count per page Exactly 1 const meta = document . querySelector ( ' meta[name="description"] ' ); const len = meta ? meta . content . length : 0 ; console . log ( `Meta description: ${ len } chars` ); 2. Verify Only One H1 Tag Exists const h1s = document . querySelectorAll ( ' h1 ' ); console . log ( `H1 count: ${ h1s . length } ` ); A study of 1.2 million pages found pages with one H1 ranked 12% higher on average. 3. Find Images Missing Alt Text const imgs = document . querySelectorAll ( ' img ' ); const missing = [... imgs ]. filter ( i => ! i . alt || i . alt . trim () === '' ); console . log ( ` ${ missing . length } of ${ imgs . length } images missing alt text` ); Pages with complete alt text see 3.7% higher image search visibility. 4. Detect Render-Blocking Resources Open DevTools, Network tab, reload, click "Blocking" filter. Resources in red block first contentful paint. Total blocking time under 200ms More than 20 render-blocking resources signals a problem Each render-blocking CSS file adds 50-300ms to page load 5. Check Canonical Tag Consistency const canonical = document . querySelector ( ' link[rel="canonical"] ' ); console . log ( canonical ? `Canonical: ${ canonical . href } ` : ' No canonical tag ' ); 6. Audit Internal Links const links = [... document . querySelectorAll ( ' a[href] ' )]; const internal = links . filter ( l => { try { return new URL ( l . href ). hostname === window . location . hostname ; } catch ( e ) { return false ; } }); console . log ( `Internal links: ${ internal . len

With the release of version 1.7.9, ZenQL’s Collection API, Thor, received substantial performance improvements, largely driven by a series of memory optimization enhancements. These changes reduced unnecessary allocations, improved data handling efficiency, and significantly accelerated query execution, particularly when working with large in-memory datasets. From the early stages of development, we established a baseline benchmark to measure both correctness and performance consistently: filtering a slice of 50 million items and validating the result. The original Collection API completed this benchmark in approximately 9 seconds. Later, we introduced Thor as a replacement for the default Collection API, reducing the benchmark time to around 4 seconds. With the latest round of memory optimizations and internal improvements, Thor now completes the same benchmark in less than one second. benchmark: goos: linux goarch: amd64 pkg: github.com/malikhan-dev/zenql/collections/Thor cpu: 12th Gen Intel(R) Core(TM) i7-12700H BenchmarkQueryEngine BenchmarkQueryEngine-20 88 13636313 ns/op 22727310 B/op 0 allocs/op at Thor_Engine__test . go func BenchmarkQueryEngine ( b * testing . B ) { result := From ( & items ) . Where ( func ( search ComplexObjectToSearch ) bool { return search . Name == "Jane" && search . Flag == false }) . Collect () result2 := From ( & result ) . Any ( func ( search ComplexObjectToSearch ) bool { return ( search . Name != "Jane" ) || ( search . Flag != false ) }) . Assert () if result2 { b . Error ( "result should be false" ) } } Join the Journey We are committed to making ZenQL the fastest and most developer-friendly query engine for Go. As we continue to grow and push the boundaries of performance, we need your support! If you find ZenQL useful, please star our repository on GitHub. Your support helps us reach more developers and keep the project moving forward. Thank you!

How to Auto-Sync Your Hashnode Blog to Dev.to Using GitHub Actions (2026 Guide) FOLASAYO SAMUEL OLAYEMI FOLASAYO SAMUEL OLAYEMI FOLASAYO SAMUEL OLAYEMI Follow Jun 7 How to Auto-Sync Your Hashnode Blog to Dev.to Using GitHub Actions (2026 Guide) # discuss # automation # tutorial # devops 5 reactions Comments Add Comment 5 min read

There's a pattern I've noticed with every new AI coding tool that comes out: they all want you to switch editors. Or open a new terminal. Or context-switch into some standalone app. I DON'T WANT TO DO THAT My entire dev workflow lives in VS Code. My keybindings, my split panes, my snippets, my extensions — all of it. When Google released the Antigravity CLI ( agy ), an agentic coding assistant, I genuinely liked what it could do. But to use it properly, I had to live in a terminal window, manually managing sessions, typing slash commands from memory, and losing my editor context entirely. So I built a VS Code extension for it instead. What is Antigravity? Google Antigravity is Google's agentic coding CLI — think of it as a Gemini-powered dev assistant that can read your project, run tools, execute terminal commands, and help you build. It's the kind of tool that can handle complex multi-step tasks, not just autocomplete. The CLI is called agy , and it's genuinely capable. The problem was the workflow: terminal-first, session management by hand, and no visual layer over the context you're already in. The Extension: Antigravity for VS Code Install it on the VS Code Marketplace Source on GitHub The core idea is simple: the extension is a UI layer. It never bundles or replaces the agy binary — it shells out to whichever version you have installed locally. Same philosophy as the Claude Code VS Code extension: the editor provides the surface, the CLI does the work. Here's what it actually does: Sessions List The sidebar panel opens to all your saved sessions. You can open an existing one, delete it, or start fresh. New sessions can be launched in sandboxed mode or with permissions bypassed — accessible right from the "New Session" overflow menu, without memorizing CLI flags. Any session with an active turn shows a loading indicator in its row, so you always know what's in flight. Chat Panel (Material 3 Expressive) This is the main surface. Each session runs its own live,

Before this week, I thought Excel was just a fancy calculator with boxes. But after three days of my Data Science & Analytics course, I realise I was wrong. Really wrong. Excel is a spreadsheet tool used by millions of people from small business owners to data analysts at giant companies. And the best part? You don’t need to be a programmer to use it. You just need to know a few tricks. Here’s how Excel helps solve real-world problems using exactly what I learned in Week 1. 3 Real-World Ways Excel Is Used Business decisions with logic Managers use IF() statements to answer yes/no questions. Example: =IF(Sales>1000, "Bonus", "Needs Improvement"). One cell can decide who gets paid more. Cleaning messy data Real data is never clean. Marketing teams use Remove Duplicates, Find & Replace, and Text to Columns to fix hundreds of messy rows in seconds. No manual typing. Tracking deadlines and ages HR teams use DATEDIF() to calculate employee ages or years of service. TODAY() and NOW() keep reports automatically updated. No more “oh, I forgot to update the date.” 3 Excel Features I Learned This Week Remove Duplicates – One click, and Excel deletes repeated rows. Saved me from sending the same customer email twice. IFERROR() – Hides ugly errors like #DIV/0! and shows something friendly instead (e.g., “Check data”). Your boss will thank you. Sort & Filter – With AutoFilter, I can find all sales above $500 in one second. Then Custom Sort lets me sort by date and region together. My personal reflection Honestly? Learning Excel has changed how I see data. I used to look at a messy spreadsheet and feel lost. Now I see Remove Duplicates, Text to Columns, and TRIM() as tiny tools that bring order to chaos. Data isn’t scary anymore. It’s just a puzzle and Excel gives me the pieces. I’m only one week in. But I already feel like a junior data analyst in training.