GitHub热门项目 | 🚀 A real-time monitoring dashboard for Claude Code, built with SQLite3, Node.js, Express, React, Vite, TailwindCSS, and WebSockets. It tracks sessions, agent activity, tool usage, and subagent orchestration, providing live analytics, a Kanban status board, status notifications, a cute buddy, and an interactive web UI/MacOS/Windows native app. | Stars: 734 | 162 stars this week | 语言: TypeScript

Bonjour Je travaille actuellement sur un nouveau langage de programmation appelé Klyn . Alors je sais, certains vont me dire pourquoi encore un nouveau langage. Peut-être est-ce vrai, mais d'un autre point de vu, pourquoi ne pas être audacieux et proposer une autre lecture possible. A méditer. De plus, logiquement on ne fait pas de promo de projet sur r/programming , mais pour le coup le projet porte clairement sur la programmation et je me dis que ce post est quand même à sa place (j'espère qu'on m'en tiendra pas trop rigueur ; je suis nouveau sur Reddit). Quoi qu'il en soit, mon point de départ est que Python propose une syntaxe épurée et lisible, par contre les performances en termes de temps d'exécution, c'est pas ça. Du coup, pourquoi ne pas intégrer les bonnes idées de C++ pour les perfs dans un langage "Python-like" ? Et tant qu'on y est, Java et C# propose aussi des trucs sympa. Et puis j'ai aussi quelques autres idées sympa à tester (j'ai notamment tester des choses sur les syntaxe des collections). Et donc je suis partis à proposer Kl yn , un langage "Python-like" orienté performance . Du coup, j'en suis là : une syntaxe lisible et agréable, proche de Python, un typage statique pour la fiabilité des codes, une compilation native et implicite pour les performances, des propriétés inspirées de C#, pleins d'idées perso sur la syntaxe et les lib, une API déjà assez riche autour des collections, chaînes, fichiers, terminal, interface graphique, bases de données, thread, api llm... Etant actuellement seul sur le projet, j'ai grandement fait usage de l'IA (je préfère être cash ; clan Codex), mais franchement, je ne le regrette pas. En l'état le projet n'est pas prêt a passer en production. C'est pour ça que j'ai besoin de vos impressions (afin de préparer cette future étape). De plus, si vous êtes convaincu par la démarche, qu’attendriez vous d'autre d’un tel projet ? Site du projet : https://klyn.deepcodia.fr Tutoriel : https://klyn.deepcodia.fr/docs/tutorial/in

This is a write-up on our company blog that I wrote, sharing our perspective into Hamiltonian Neural Networks (Greydanus et al., 2019) from a differential-geometry angle rather than the usual "here's the loss function" treatment. I've been working on HNN and LNN adjacent topics for years now and I found this particular lens made the *why* click in a way the standard framing never did for me, and I've been meaning to put everything in writing for a while now. I just feel like the Noether's Theorem which shows conservations can be mapped to symmetries (and in ML context, generalization) is not getting the attention that it deserves around physics informed neural networks. Also, it's a really beautiful architecture and I just love talking about it at every opportunity. It's math-heavy, but I did my best to sprinkle some tension relievers and interactive visuals here and there and make is as easy as it is to follow. Hopefully, I did a good job. I'd genuinely love to see your thoughts and your feedback submitted by /u/FlameOfIgnis [link] [留言]

Everyone keeps saying AI will let a solo developer take down the giants. And everyone keeps saying the giants will just absorb everything. Both takes are wrong , and I spent a while reading the actual 2025 data to figure out why. I pulled from four of the biggest developer datasets of the year: DORA 2025 State of AI-Assisted Software Development (Google Cloud, ~4,867 respondents) Stack Overflow 2025 Developer Survey (49,009 respondents) GitHub Octoverse 2025 (behavioral data across 180M+ developers) JetBrains State of the Developer Ecosystem 2025 (24,534 developers) Here's the honest synthesis. It's more useful than either hype narrative. The one-sentence thesis AI collapsed the cost of writing software to near zero. It did not collapse the cost of distribution, trust, support, or being liable when it breaks — and those are ~80% of what a software business actually is. So the effect isn't "solos beat giants." The effect is that the middle got hollowed out . The 10-person, VC-funded, me-too startup building a feature is the loser of this era — squeezed from below by a solo who ships the same thing for free, and from above by a giant who bundles it. Solos and giants both survive. The undifferentiated middle doesn't. "AI is an amplifier, not an equalizer" This is the single most important finding of 2025, and it comes straight from DORA: "AI's primary role in software development is that of an amplifier. It magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones." Read quickly, that kills the "AI levels the playing field" fantasy. AI rewards whoever already has good practices — not whoever is scrappiest. But read one layer deeper and it becomes the best available argument for the small team. DORA found the key enabler is independence of action — "the ability to develop, test, and deploy value independently, with little or no coordination cost." In an Adidas pilot they cite, teams in loosely-coupled architectures saw 20–30% produ

Turn to-dos into scheduled tasks Discussion | Link

A large-scale audit of AI-as-judge evaluation — covering over half a million individual judgments — finds that AI judges are consistently reliable but not valid, meaning they give the same answer repeatedly without that answer being correct. Published work and popular benchmarks like Chatbot Arena have treated consistency as proof of trustworthiness, and the audit shows that assumption is unfounded. Key facts What: Using one AI to grade another is now common — but the biggest audit yet shows these graders are consistent without being correct. A judge that always picks "answer A" scores perfectly on consistency. When: 2026-06-19 Primary source: read the source (arXiv 2606.19544) The distinction matters: a judge is reliable if it's consistent (same question, same answer), and valid if those answers are actually correct. The audit's central finding is that AI judges are reliable without being valid, and the field has been treating the first as evidence of the second. Because consistency is easy to measure and looks reassuring, it has stood in for actual trustworthiness across a lot of published work. A new audit makes the problem stark: a judge that ignores both answers and always picks the one labeled "A" would be perfectly consistent — flawless reliability, identical verdict every time — and completely worthless, because it never read anything. Consistency is trivially easy to fake and says almost nothing about whether the judging is sound. Yet "the judge agrees with itself" has done significant reassurance work in papers and benchmarks, and the always-pick-A example shows exactly how empty that reassurance is. When the researchers corrected for the agreement you'd get by chance — as any fair test should — confident-looking scores deflated noticeably. Gaps between models that seemed meaningful shrank or blurred. Accepted folk wisdom also took a hit: the long-standing worry that AI judges are suckers for longer, wordier answers turned out to be far weaker than assumed

Pressing enter to accept model suggestions now takes less effort than scrolling past it. One keystroke, and the code is yours. Reading it, understanding it, deciding if it's actually right, that part hasn't gotten any faster. That gap, between how fast we can accept code and how fast we can actually understand it, is where things start to go wrong. The new shape of technical debt We used to know where technical debt came from. Tight deadline, cut corner, # TODO: comment that nobody ever revisits. Rushing was the cause, and we could at least point to it. Now you can build up the same kind of debt on a calm Tuesday afternoon, no deadline in sight, just six suggestions in a row accepted because they looked fine and the flow felt good. Nobody rushed you, and the code still ended up just as unexamined. Same debt, just a different excuse. "It works" is not the same as "I understand why it works" Everyone knows that debugging is twice as hard as writing a program in the first place. So if you're as clever as you can be when you write it, how will you ever debug it? — Brian Kernighan, 1974 Fifty years later, the gap got wider. Kernighan was talking about code you wrote. At least you understood it once. A suggestion that compiles, passes the linter, survives code review and even comes with passing tests can still be standing on a wrong assumption that nobody caught, because nobody was reading it as code. They were reading it as output, and output that makes sense tends to get approved. Compiling is a low bar. Passing tests is a slightly higher one, depending on whether you wrote the tests, or its suggestion shaped or created those too. If it's the second, it's like grading its homework with its own answers. None of it tells you the logic is sound, that the edge cases are covered, or that it does what you actually needed, something we already learned every time we trusted code we didn't write. Somehow it's easy to forget it the moment the code appears inline, in our own edito

HTTP cookies are everywhere in authentication, sessions, and tracking — but reading Set-Cookie headers manually is tedious. I built a free, browser-only HTTP Cookie Inspector that parses cookie strings and gives you a security analysis. Live Tool 👉 https://devnestio.pages.dev/cookie-inspector/ What it does Parse Set-Cookie strings — extract all attributes at a glance Attribute cards — name, value, expires/max-age, domain, path, Secure, HttpOnly, SameSite Security score (0–100) — +25 for Secure, +25 for HttpOnly, +25 for SameSite≠None, +25 for expiry XSS/CSRF risk flags — warns when HttpOnly or SameSite is missing Syntax highlighted raw header — color-coded by attribute type Presets — session, persistent, secure+httponly, SameSite=Strict, minimal 100% client-side — no data leaves your browser Cookie security flags explained Flag Missing risk Present benefit Secure Cookie sent over HTTP Only sent over HTTPS HttpOnly JS can steal it (XSS) Inaccessible via document.cookie SameSite=Strict CSRF attacks possible Never sent on cross-site requests SameSite=Lax Partial CSRF risk Sent on top-level nav only SameSite=None Always cross-site Requires Secure flag SameSite values Set-Cookie: session=abc123; SameSite=Strict; HttpOnly; Secure # Best practice for auth cookies Set-Cookie: prefs=dark; SameSite=Lax # OK for non-sensitive preferences Set-Cookie: embed=true; SameSite=None; Secure # Cross-site embeds (e.g. payment widgets) Testing 84 tests, all passing ✅ Tests cover: Parsing all standard attributes Boolean flags (Secure, HttpOnly) detection SameSite value classification Max-Age duration calculation Security score computation XSS/CSRF warning logic All preset templates HTML escaping in output UI elements and copy functionality All tools at devnestio.pages.dev — free browser-only developer utilities.

Working With Massive JSON Responses Without Losing Performance Every developer eventually encounters it. You make an API request expecting a few hundred objects, and instead receive a response that's tens—or even hundreds—of megabytes. Suddenly your browser freezes, your editor becomes sluggish, and your application consumes gigabytes of memory. Large JSON responses aren't unusual anymore. Analytics platforms, cloud providers, search engines, AI services, ecommerce catalogs, IoT systems, and data export endpoints routinely generate enormous payloads. The good news is that handling massive JSON efficiently is mostly about choosing the right techniques. This guide covers the best practices that help you inspect, process, and optimize large JSON datasets without overwhelming your tools or your users. Understand Why Large JSON Is Expensive Before optimizing, it's helpful to know where the cost comes from. When an application receives JSON, it usually goes through several stages: Download the response. Store it as a string. Parse it into objects. Allocate memory for every property. Traverse the resulting object graph. For a 100 MB JSON file, peak memory usage can easily exceed 300 MB because both the raw string and the parsed objects coexist temporarily. This explains why applications often run out of memory long before reaching the actual file size. Don't Pretty-Print Gigantic Responses Immediately Pretty-printing is useful—but formatting a huge document all at once can consume significant CPU time and memory. Instead: inspect only the sections you need collapse large objects expand nodes on demand search before formatting If you need to examine a large payload in the browser, using a dedicated formatter designed for large documents can make navigation much easier. Tools like JSON Formatter allow you to validate, format, collapse, and inspect JSON without manually editing thousands of lines. Stream Instead of Loading Everything One of the biggest mistakes is reading an

Debugging JWT authentication usually means copying tokens between tabs and tools. I built a free, browser-only JWT Creator & Signer — create, sign, and verify JWTs entirely in your browser using the Web Crypto API. Live Tool 👉 https://devnestio.pages.dev/jwt-creator/ What it does Create JWTs — edit header (alg, typ) and payload (any JSON) Sign with HMAC — HS256, HS384, or HS512 Quick claim buttons — insert sub , name , exp (+1h), iss with one click Generate random secrets — 256-bit hex secret via crypto.getRandomValues() Verify existing JWTs — paste any token and verify signature + expiry Color-coded output — header in red, payload in green, signature in blue 100% client-side — Web Crypto API, no server, your secrets stay local How signing works (Web Crypto API) const key = await crypto . subtle . importKey ( " raw " , new TextEncoder (). encode ( secret ), { name : " HMAC " , hash : " SHA-256 " }, false , [ " sign " ] ); const sig = await crypto . subtle . sign ( " HMAC " , key , new TextEncoder (). encode ( header + " . " + payload ) ); The output is base64url-encoded (replacing + → - , / → _ , stripping = padding) to form the final JWT. Why browser-only matters for a JWT tool JWT secrets are sensitive. Any tool that sends your signing secret to a server is a liability. This tool never sends anything — the Web Crypto API runs entirely inside your browser tab. Testing 77 tests, all passing ✅ Tests cover: Base64url encoding edge cases JWT structure (3-part dot-separated) HMAC algorithm mapping (HS256 → SHA-256 etc.) Expiry check (expired vs. valid tokens) Error states: invalid JSON payload, malformed JWT UI: claim insertion, secret toggle, copy, clear Web Crypto API usage verification All tools at devnestio.pages.dev — free browser-only developer utilities. Feedback welcome!

Apple Hide My Email Vulnerability, GitHub Hardening Guide, and Advisory Database Trends Today's Highlights This week, we delve into a critical Apple 'Hide My Email' vulnerability leaking user addresses and a practical guide for GitHub maintainers to enhance project security. We also examine the record-breaking surge in vulnerability disclosures and how the GitHub Advisory Database manages this growing volume. Apple 'Hide My Email' vulnerability reveals peoples' real email addresses (Hacker News) Source: https://easyoptouts.com/guides/apple-hide-my-email-is-leaking-email-addresses This report details a critical vulnerability discovered in Apple's "Hide My Email" service, designed to protect user privacy by providing unique, randomly generated email addresses that forward to their real inbox. The flaw allows an attacker to bypass this privacy mechanism and reveal a user's actual email address. This is a significant concern for user privacy, as it undermines the core purpose of a feature intended to prevent spam and tracking. The article provides examples of how the leak can occur, often involving specific scenarios where the "Hide My Email" alias is used in conjunction with other services, allowing for correlation back to the original address. The vulnerability highlights the challenges in maintaining privacy-preserving features across a complex digital ecosystem. While Apple provides this service, its interaction with third-party applications or specific email processing methods can inadvertently expose the underlying data. Users are advised to be aware of this limitation and consider their risk tolerance when relying on such privacy features. The full technical details of the bypass and the specific conditions that trigger it are explained, offering insights into the potential attack vectors. Comment: This is a serious privacy breach for a feature designed explicitly for privacy. It reminds us that even robust privacy tools can have subtle flaws in complex usage pat

A new system called Qwen-Image-Agent gives text-to-image models the ability to plan, reason, and revise across multiple steps, closing what its authors call the "context gap." Instead of converting a prompt directly into pixels, the agent wraps a language model around an image generator and runs them in a loop—breaking complex requests into pieces, writing sharper instructions, executing them, and reflecting on what worked. The result is image generation that can handle multi-part, reasoning-heavy tasks that defeat single-shot models. Key facts What: Qwen-Image-Agent wraps planning, reasoning, and memory around a text-to-image model so it can break a hard request into steps - and the local-AI crowd immediately asked whether it runs on a gaming GPU. When: 2026-06-27 Primary source: read the source (arXiv 2606.26907) The architecture follows a four-phase loop. Faced with a complicated request, the agent first plans , breaking the big ask into smaller, manageable pieces. Then it reasons about each piece, pulling in information from its own memory or outside tools and writing tighter instructions. Then it executes , calling the image-generation or image-editing tools to make or modify the picture. Finally it reflects , storing what worked in an episodic memory so the next job goes better. The contrast is direct: a single-shot image model answers in one pass; the agent sketches, steps back, reconsiders, and revises. The paper frames the advantage over ordinary text-to-image the same way a vending machine differs from commissioning a designer—one takes a request and dispenses a result with no conversation, the other asks clarifying questions, works in drafts, keeps notes on your preferences, and iterates toward what you actually meant. The vending machine is faster for a simple request; the designer is who you want for anything with moving parts. This is the same AI agents pattern—plan, act, observe, repeat—that has been reshaping text tasks, now pointed at images. To mea

Opening hook It happened during a quiet afternoon at the mosque. The imam was mid-sentence when a rhythmic, high-pitched ringtone cut through the silence like a knife. Every head turned. It was my phone. My heart sank as I scrambled to silence it, only to realize I had forgotten to flip the physical toggle before walking in. That moment of collective, disappointed glares burned. It wasn't just an annoyance; it was a total breakdown of my focus and a social failure I had accidentally caused because my phone couldn't manage itself. The problem We live in an era where our devices are supposedly 'smart,' yet they are remarkably bad at knowing when to keep quiet. We carry computers in our pockets that can calculate the exact position of the moon or stream 4K video, but they cannot inherently tell that we are in a meeting, a lecture, or a place of worship. You could argue that setting a manual schedule works, but life isn't static. Meetings run over, prayer times shift by a minute each day based on astronomical calculations, and spontaneous plans happen. I found myself constantly juggling the physical volume buttons. If I remembered to mute it, I inevitably forgot to unmute it afterward, missing urgent calls from family. If I didn't mute it, I was the person disrupting the room. I wanted a solution that respected the context of my location and the specific time of day without requiring me to touch my screen. The core friction is that Android is designed to restrict background processes to save battery, which is exactly what a silent-automation app needs to thrive. Getting the app to reliably trigger a volume change while the phone is sitting in a pocket, deep in Doze mode, became my primary development hurdle. The technical decision / implementation When I started building Muffle, I initially tried a standard Service with a Handler loop to check conditions. It worked fine while the screen was on, but as soon as the phone entered Doze mode, the OS aggressively throttled my

A full form backend you can test before paying Discussion | Link

Fans’ euphoric reactions to the Mexican national team’s recent victory in the 2026 World Cup caused a series of unusual vibrations that were detected by seismic warning systems.

1. The Problem It Solves Logistic Regression is used when the outcome is a category rather than a number . Most commonly, it's used for binary classification , where the answer is either Yes or No , True or False , or 1 or 0 . Typical business problems include: Will a customer churn? Is this transaction fraudulent? Will a customer click an ad? Will a loan default? Is an email spam? Will a machine fail in the next 24 hours? Unlike Linear Regression, we're not trying to predict a continuous value. Instead, we're predicting the probability that an event belongs to a particular class. For example: A customer may have an 82% probability of churning . The business can then decide whether that probability is high enough to trigger an intervention. 2. Core Intuition Imagine you're trying to predict whether a customer will cancel their subscription. Suppose the only feature you have is how many times they opened your app this month. If you use a straight line like Linear Regression, the predictions quickly become unrealistic. A very active customer might end up with a -20% chance of churn . A completely inactive customer could end up with 140% . Probabilities obviously can't work like that. To fix this, Logistic Regression takes the linear equation and passes it through a mathematical function called the Sigmoid Function . Instead of producing a straight line, it creates an S-shaped curve . No matter how large or small the input becomes, the output always stays between 0 and 1 . That makes it perfect for probability estimation. 3. The Mathematical Model The model first calculates a linear score. Instead of using that score directly, it passes it through the Sigmoid function. Where: z = linear score p̂ = predicted probability The final output is always between 0 and 1 . For example: 0.08 → Very unlikely 0.32 → Low risk 0.65 → Moderate risk 0.94 → Very high probability Businesses can then choose a decision threshold. For example: Probability ≥ 0.50 → Predict Churn Probability