Table of contents What is OAUTH A trip to OAUTH1.0Ville What is OAUTH2.0 Examples of OAUTH Technology OIDC Hands-on Implementation with Microsoft Entra ID What is OAUTH OAUTH is a technological standard that allows you to authorize one app or service to sign in to another without divulging private information, such as passwords. OAUTH stands for Open-Authorization , not Authentication . Authentication is a process that verifies your identity, although OAUTH involves identity verification, its main purpose is to grant access to connect you with different apps and services without requiring you to create a new account. How Does OAUTH Work OAUTH uses access tokens, and this is what makes OAUTH secure to use. An access token is a piece of data that contains information about the user and the resource the token is intended for. A token will also include specific rules for data sharing . For example, you want to share your photos from Instagram with Kyrier — An intelligent email platform built for professionals who refuse to let their inbox run their day , but you only want Kyrier to access your profile image. Kyrier does not also need to access your direct messages or friends list. Instagram issues an access token to Kyrier to access the data you approve (your profile image in this case) on your behalf. So an access token will only allow Kyrier to access your profile image, not even other photos on your page. There may be rules governing when Kyrier can use the access token, it might be for a single use or for recurring uses, and it always has an expiration date. A trip to OAUTH1.0Ville Welcome to OAuth1.0Ville. Please keep your hands inside the vehicle. This is where OAuth started. It was built only for websites , back when "an app" meant a web page and nothing else. Although it worked, it had a lot of problems: Only three authorization flows (2.0 has six) No real plan for mobile or modern apps A scaling problem it never solved It also makes you cryptographically sign e

Welcome to My Generative AI Learning Journey Artificial Intelligence is changing the way we work, learn, build software, and solve problems. Every day, new AI tools, models, and technologies are being released, making it difficult to know where to begin. Instead of randomly watching videos or reading articles, I've decided to follow a structured learning path—and I'm inviting you to join me. This blog marks the beginning of a long-term Generative AI learning series. Whether you're a student, software developer, freelancer, entrepreneur, or simply curious about AI, this roadmap will help you understand what we'll learn together over the coming weeks and months. The goal isn't just to understand AI theory. It's to build practical skills that can be used in real-world projects and professional development. Why Learn Generative AI in 2026? Generative AI is no longer a futuristic concept. It is already transforming industries such as: Software Development Healthcare Education Finance Marketing Customer Support E-commerce Human Resources Design and Creativity Companies are actively seeking professionals who can build AI-powered applications, automate workflows, and integrate AI into existing systems. Learning Generative AI today means preparing for the next generation of technology. What You Can Expect from This Series This series is designed for beginners but will gradually move toward advanced concepts. Each article will build upon the previous one, making the learning process simple and structured. We'll focus on: Understanding AI concepts Learning industry terminology Exploring popular AI models Writing effective prompts Building AI applications Working with APIs Using open-source models Creating AI-powered software Deploying AI projects By the end of this journey, you'll have both theoretical knowledge and practical development experience. Complete Learning Roadmap Phase 1: AI Fundamentals We'll begin by building a strong foundation. Topics include: What is Generativ

Prompt analytics and citation mapping for AI search Discussion | Link

企业尽调智能体实战：60+真实企业的AI尽调报告 从5天到10分钟：AI如何重构企业尽调 企业贷前尽调，银行和金融机构最头疼的环节。一位信贷经理曾这样描述他的工作：打开天眼查查工商信息，切到Wind拉行情，再打开百度搜新闻，最后把散落在七八个系统里的数据拼进Word模板。一家企业，至少5天。如果碰上集团客户、关联方众多的，两周起步。 一家支行行长曾无奈地说："25个客户经理，每个人做的尽调报告格式都不一样。同样的企业，A经理评'低风险'，B经理评'中等风险'，谁对谁错无从判断。"问题的根源不是人的能力差异，而是工具链的碎片化——数据散落在不同系统里，没有统一入口，也没有标准化的采集流程。 我们调研了12家金融机构的尽调流程，发现三个共性痛点： 信息散落 （数据分布在6-10个系统中）、 耗时漫长 （单家企业5-10个工作日）、 质量参差 （依赖个人经验，无标准化流程）。 本文记录的，是一个用AI Agent解决这个问题的实战项目——企业尽调引擎v5.0。它不是概念验证，不是Demo，而是在60+家真实企业上跑通的生产级系统。 技术架构：多源数据整合的数据流 尽调的核心难题不是"分析"，而是"采集"。一家上市公司的完整画像，需要从至少6个异构数据源拉取信息。传统方式是人肉Copy-Paste，我们的方案是用Agent自动编排数据流： 用户输入 "美的集团" │ ▼ ┌─────────────────────────────────┐ │ Step 1: 股票代码查询 │ │ 联网搜索 → 000333.SZ │ └──────────────┬──────────────────┘ │ ┌──────────┴──────────┐ ▼ ▼ ┌─────────┐ ┌──────────┐ │ Step 2a │ │ Step 2b │ │ 实时行情 │ │ 新闻舆情 │ │ ifind │ │ 联网搜索 │ └────┬────┘ └─────┬────┘ │ │ └─────────┬──────────┘ │ ┌──────────┼──────────┐ ▼ ▼ ▼ ┌────────┐ ┌────────┐ ┌────────┐ │Step 3a │ │Step 3b │ │Step 3c │ │工商信息 │ │风险扫描 │ │估值指标 │ │ MCP │ │ MCP │ │ MCP │ └───┬────┘ └───┬────┘ └───┬────┘ │ │ │ └──────────┼──────────┘ │ ▼ ┌─────────────────────────────────┐ │ Step 4: 舆情分析 + 综合评分 │ │ 多源交叉验证 → 生成尽调报告 │ │ 输出: JSON(5KB) + Markdown(4KB) │ └─────────────────────────────────┘ 这个数据流的核心设计原则是 并行采集、串行推理 。Step 2的行情和舆情可以并行获取，Step 3的三个MCP调用也可以并行，但Step 4的综合评分必须等所有数据到齐后才能做交叉验证。这种设计把端到端耗时压到了10分钟以内。 另一个关键设计是 渐进式降级 ：如果MCP工具不可用（比如企业是非上市公司），引擎会跳过行情和估值模块，仅返回工商+风险+新闻的"基础版"报告，而不是直接报错退出。这一设计在实际使用中至关重要——我们的60+企业样本中，有11家是非上市企业，如果要求所有数据源齐备才能出报告，这11家就会被拒之门外。 五大能力详解 1. 股票代码查询 输入企业名称，自动搜索匹配股票代码。比如输入"美的集团"，引擎通过联网搜索拿到 000333.SZ 。这个步骤看似简单，却是后续所有数据获取的前提——行情、估值、历史走势全部依赖股票代码。对于非上市企业，引擎会标记 stock_code: null 并跳过相关模块。在实际测试中，股票代码查询的成功率超过98%，少数失败案例主要是名称变更（如"格力地产"更名为"珠免集团"）尚未被搜索引擎索引。 2. 实时行情数据 通过ifind接口获取实时股价、涨跌幅、成交量、换手率等指标。这些数据直接写入报告的"行情数据"章节，避免分析师手动从交易软件抄录。更重要的是，行情数据与后续的估值指标做交叉验证——如果PE_TTM显示14倍但股价异常波动，报告会标注"数据一致性待确认"。 3. 企业新闻舆情 联网搜索获取企业最新新闻，引擎对新闻做情感分析后输出舆情等级（正面/中性/负面）和舆情得分（0-100）。这不是简单的关键词匹配，而是基于上下文的语义判断。当正面信号和风险信号同时出现时，报告会分别列出，而非简单抵消。一条"美的集团海外营收创新高"和一条"美的集团遭反倾销

4A企业架构+TOGAF如何指导Agent Skill设计 引言：AI Skill设计的"巴别塔"困局 当下的AI Agent生态，正陷入一种似曾相识的混乱。 去年帮一家保险公司梳理Agent技能库，发现100多个Skill横七竖八地堆在一起——有的直接调API，有的内嵌业务逻辑，有的把数据获取和分析揉成一团。问架构师这些Skill怎么分类，回答是"按安装顺序排的"。再问两个Skill之间数据怎么流转，回答是"各写各的"。一个股票监控Skill自己爬数据、自己做分析、自己发消息，三件事耦合在同一个脚本里。换一个场景想复用其中的分析逻辑？做不到，只能重写。 这不是个例。几乎所有率先部署AI Agent的企业都面临同样的困境：Skill越堆越多，越堆越乱。缺乏统一的能力域划分，缺乏标准化的数据接口，缺乏清晰的组合规则，缺乏可复用的构建块沉淀。 听起来很熟悉？没错——这正是企业架构在20年前要解决的问题。当年企业信息化的混乱，和今天AI Skill的混乱，本质上是一回事：没有架构约束的开发，必然走向无序。 4A企业架构（业务架构BA、数据架构DA、应用架构AA、技术架构TA）加上TOGAF的构建块思想，为Agent Skill设计提供了一套经过验证的方法论。本文试图建立这二者之间的映射框架，并用实际案例说明其可行性。 4A映射框架：四个问题驱动Skill设计 企业架构的核心是四个问题：做什么（BA）、数据怎么流（DA）、用什么组合（AA）、底层怎么支撑（TA）。这四个问题同样适用于Skill设计。 ┌───────────────────────────────────────────────────────────────┐ │ 4A → Skill 映射框架 │ ├───────────────────────────────────────────────────────────────┤ │ │ │ BA 业务架构 │ │ ┌─────────────────────────────────────────────────────────┐ │ │ │ Skill的业务能力域划分、价值链映射 │ │ │ │ → 回答"这套Skill体系解决什么业务问题" │ │ │ └────────────────────────────┬────────────────────────────┘ │ │ │ │ │ DA 数据架构 │ │ │ ┌────────────────────────────▼────────────────────────────┐ │ │ │ Skill的数据流、信息交换标准 │ │ │ │ → 回答"Skill之间数据怎么流转、用什么格式" │ │ │ └────────────────────────────┬────────────────────────────┘ │ │ │ │ │ AA 应用架构 │ │ │ ┌────────────────────────────▼────────────────────────────┐ │ │ │ Skill的组合关系、依赖图谱 │ │ │ │ → 回答"哪些Skill可以组装、依赖关系是什么" │ │ │ └────────────────────────────┬────────────────────────────┘ │ │ │ │ │ TA 技术架构 │ │ │ ┌────────────────────────────▼────────────────────────────┐ │ │ │ Skill的运行时、工具链、基础设施 │ │ │ │ → 回答"Skill跑在什么环境上、需要哪些依赖" │ │ │ └─────────────────────────────────────────────────────────┘ │ │ │ └───────────────────────────────────────────────────────────────┘ 用表格更清晰地展示每一层的核心映射关系： 架构层 核心问题 Skill映射 示例 BA 业务架构 Skill解决什么业务问题？ 按能力域分组：协同办公、内容生产、数据智能、系统运维等 "数据智能"域包含客户画像、股票监控、财务智能等Skill DA 数据架构 Skill间数据如何流转？ 统一数据格式(Markdown/JSON)，标准化数据源→转换→消费管道 搜索Skill输出Markdown，报告Skill消费Markdown生成PDF AA 应用架构 Skill如何组合复用？ 构建依赖图谱，上层组合下层，同类可替换 日报Skill = 搜索 + 摘要 + PDF转换 + 消息推送

Every week, over 1,300 US companies file a funding round with the SEC — and most of them never appear in the tech press. If your job involves selling to funded startups, tracking competitors' war chests, or spotting investment trends, you're probably relying on funding newsletters and databases that are days late and hundreds of dollars per seat. There's a better way: go to the primary source. In this tutorial you'll build a real-time startup funding feed from SEC Form D filings — the regulatory document every US company must file when it raises private capital. You'll get exact amounts, industries, locations and investor counts, as clean JSON, for a fraction of a cent per round. Why Form D beats funding news When a startup raises money under Regulation D (the exemption used by virtually all US venture rounds), it must file Form D with the SEC within 15 days of the first sale. That filing includes: The exact amount sold so far — not a journalist's "sources say" estimate The total offering size (or whether it's open-ended) Industry group, city and state Number of investors who participated Date of first sale and year of incorporation Compare that to funding news: TechCrunch covers a tiny, PR-driven slice. Databases like Crunchbase aggregate press and manual research — comprehensive over time, but late and expensive. Form D is the ground truth both of them chase. The catch? EDGAR (the SEC's database) is built for lawyers, not for automation. The filings are XML documents scattered across an archive, discoverable only through a quirky full-text search API with hidden rate limits. That's the part we'll automate. The 5-minute setup We'll use the Startup Funding Feed Actor — it handles EDGAR's discovery API, XML parsing, rate limits and pagination, and returns one JSON record per filing. It's pay-per-event: $0.002 per filing returned (a full weekly sweep of all US rounds costs ~$2.60; a filtered slice costs cents). Failed fetches are never charged. Create a free Apify acc

Bootstrap 5 and Tailwind CSS are the two most popular CSS frameworks in 2026. If you're starting a new project and trying to decide between them, this guide gives you an honest comparison based on real-world usage — not just feature lists. The Core Difference Bootstrap 5 gives you pre-built components. Tailwind CSS gives you utility classes to build your own. That's the fundamental difference and it drives every other comparison. With Bootstrap you get a navbar, modal, card, and dropdown out of the box. With Tailwind you build those yourself using utility classes like flex , px-4 , bg-blue . Neither is wrong. They solve different problems for different teams. When Bootstrap 5 Makes More Sense You Need to Ship Fast Bootstrap's pre-built components mean you spend less time on UI and more time on business logic. For admin dashboards, CRM panels, and internal tools — where UI consistency matters more than pixel-perfect custom design — Bootstrap is the faster choice. Your Team Knows HTML and CSS Bootstrap has a shallow learning curve. Any developer who knows basic HTML and CSS can pick up Bootstrap in a day. Tailwind requires understanding its utility-first philosophy and memorizing class names. You're Building an Admin Dashboard Admin dashboards need data tables, modals, dropdowns, sidebars, and form components — all of which Bootstrap provides out of the box. Building these from scratch with Tailwind takes significantly more time. You Want Predictable Output Bootstrap's components look consistent across browsers and screen sizes without extra configuration. Tailwind output depends heavily on how well your team implements it. When Tailwind CSS Makes More Sense You're Building a Custom Marketing Site If your design is highly custom — unique layouts, non-standard components, pixel-perfect design system — Tailwind gives you more flexibility without fighting Bootstrap's default styles. You Have a Design System Already If your team has a defined design system with specific t

There is a fascinating, quiet tension happening in the software engineering community right now. If you listen closely to late-night developer chats, team syncs, or tech forums, you will notice that our industry has rapidly split into two distinct schools of thought regarding the rise of AI coding tools like Cursor, Claude Code, and Copilot. On one side, you have the Traditional Developers. They argue that software engineering is a disciplined art form that cannot be replaced by text prompts. To them, unchecked AI coding is a recipe for buggy, unreadable spaghetti code, creating a technical debt nightmare for the future. On the other side, you have the Vibe Coders. This is a fast-moving generation of builders, both technical and non-technical, who believe in shipping fast, prompting quickly, and adjusting on the fly. They do not see a need to obsess over syntax when the AI can translate their intent into a working application in minutes. The reality is that both sides are entirely right. If we stop arguing over who is ruling the current meta and actually look at the core truths each camp holds, we can see exactly where the future of software development is heading. 1. The Traditional Developer is Right: Guardrails Matter The traditional development camp is fundamentally right about structure. Building a beautifully designed UI that works on a surface level is vastly different from building an enterprise-ready, scalable architecture. When you prompt an AI to build a feature, its primary objective is to satisfy the literal words in your core prompt. This is the "as long as it works" mentality. Unless you are practicing strict, spec-driven development and explicitly dictating your architectural doctrines, security protocols, and API patterns, the AI will make assumptions for you. Historically, those assumptions are optimized for speed and not long-term stability. Without deep technical oversight to catch anti-patterns, edge cases, and hidden security flaws, fast-shippe

Killing game discs is an anti-consumer move that only benefits Sony.

Hardwood, the project Gunnar Morling kick-started handling of Parquet files in Java, reached version 1. Its multi-threaded approach and zero mandatory external dependencies promise a simpler, more efficient alternative to the Apache Parquet Java implementation. For now, the library supports just reading; writing support is expected in the upcoming versions. By Olimpiu Pop

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. The UK’s generational tobacco ban might not work. I’m supporting it anyway. —Jessica Hamzelou As the parent of two little girls, I often think about how their childhood is different from…

New York City’s Summer of Ludd festival is teaching people how to live offline.

Since its inception, Apple TV, née Apple TV Plus, has built a reputation on quality over quantity. It has far fewer shows and movies than the likes of Netflix or Disney Plus, but generally speaking, the projects it does put out are quite good. It's a strategy that has brought comparisons to the HBO of […]

The Cloud Native Computing Foundation (CNCF) has announced the graduation of OpenTelemetry, elevating the project to the foundation's highest level of maturity and formally recognizing it as production-ready for enterprise use. By Craig Risi

Midjourney has shown more of its futuristic medical scanner. It still hasn't shown much proof it works. The AI startup, best known for generating images, released a behind-the-scenes video of its dunk-tank ultrasound scanner, which it plans to deploy in spas and hopes will transform medicine with cheap, detailed, radiation-free imaging. The nearly 20-minute tour […]

submitted by /u/noteflakes [link] [留言]

AI and Robotics in the New Age of Industrialization Since 2025, a new era of...

It's difficult to pinpoint the moment in my life where America started to lose the plot.

Everyone needs a safe way to listen to music on outdoor runs. We’ve found the bone conduction headphones to grab on your way out the door.