submitted by /u/mareek [link] [留言]

Find where your Mac keyboard shortcuts clash Discussion | Link

The purpose of Starfall is to support the "transport and delivery of goods through space."

This is ymawky, a now-dynamic web server written entirely in ARM64 Assembly. I've previously posted about ymawky here: https://news.ycombinator.com/item?id=48080587 In the past month and a half, I've made some pretty major improvements: I've added CGI scripting support, so the server now supports query strings and dynamic content; and I've fully ported ymawky to run on Linux, rather than macOS-only. In addition to GET/PUT/HEAD/DELETE/OPTIONS requests, because of CGI support ymawky also accepts P

As a systems engineering student and frontend dev, I wanted a portfolio that looked professional without spending days fighting with design. So I built one — and ended up turning it into a reusable template. Here's what I focused on while building it: 1. Customization from a single file The biggest pain with most templates is digging through components to change your info. I put everything — name, bio, projects, skills, social links — into ONE config file. Edit that, and the whole site updates. 2. Light & dark mode Developers love dark mode, so I made it the default, with a smooth toggle for light mode. Both are fully themed. 3. Mobile-first & responsive Most people will view a portfolio on their phone, so I built it mobile-first and tested it down to small screens. 4. Easy deployment It works out of the box with Vercel or any static host, with a beginner-friendly setup guide in the README. The stack React + Vite Tailwind CSS Formspree-ready contact form You can see the live demo here: devfolio-template-vercel-app.vercel.app I also made it available as a template if it's useful to anyone: https://payhip.com/b/t1VUk Would love to hear your feedback — what do you look for in a developer portfolio? react #webdev #tailwindcss #showdev

There's a headline pattern that feels like sharp marketing writing but quietly costs conversions. "You code. We cloud." It's clever. The parallel structure is tight. It names a clear division of labor. But it describes the service delivery model , not the developer outcome — and those are different things to someone scanning a landing page in five seconds. The audit fastapicloud.com is a managed hosting product built specifically for FastAPI developers. The hero H1 is: "You code. We cloud." On the surface this reads as clean, confident B2B positioning. In practice, it names the mechanism: You = who does the coding We cloud = who handles the infrastructure What's missing is the output. What does the developer actually walk away with? The gap (mechanism-first H1): The headline describes the service model without anchoring it in the developer outcome. The visitor has to make a three-step inference: "they handle the cloud" → "that means I don't do ops" → "so my app gets to production without a week of DevOps work." In five seconds of scrolling, most won't finish that chain. The headline earns a nod of recognition. It doesn't earn the scroll. The fix One line changes the frame completely. Before: "You code. We cloud." After: "Your FastAPI app is live in production — zero config rabbit holes, zero deploy-day surprises." The rewrite keeps the same promise — they handle the infrastructure — but anchors it in the developer's world. The outcome (app in production) is first. The pain points ("config rabbit holes," "deploy-day surprises") are the exact things a FastAPI developer has already lived through. "Zero config rabbit holes" names the experience of spinning up a production server for the first time. "Zero deploy-day surprises" names the dread: the Sunday night broken deploy that wasn't caught in staging. Any backend developer who reads that line knows exactly what it's describing. The mechanism (managed cloud, they handle ops) is still implied. But the headline earns the

VibeThinker: A 3B-Parameter Model Just Beat Opus 4.5 on Reasoning — Here's How A team of researchers has quietly dropped one of the most surprising AI papers of the month. VibeThinker , a model with only 3 billion parameters, reportedly outperforms Anthropic's Opus 4.5 on key reasoning benchmarks — and the secret sauce is a novel training recipe combining Supervised Fine-Tuning (SFT) with Group Relative Policy Optimization (GRPO). For years, the dominant narrative has been that bigger is better. VibeThinker challenges that assumption head-on. Let's break down what happened, why it matters, and what it means for developers building AI applications in 2026. The Big News According to the paper (arXiv:2606.16140), VibeThinker achieves state-of-the-art performance on several mathematical reasoning and logic benchmarks while using roughly 1/30th the parameters of frontier reasoning models. The headline claim: it beats Opus 4.5 on a curated suite of competition-level reasoning tasks. This isn't just incremental progress. It suggests we're entering an era where training methodology trumps raw parameter count . What's Actually New: SFT + GRPO The two-stage recipe isn't entirely novel on its own — SFT then RLHF has been standard since InstructGPT. But VibeThinker's specific combination appears carefully engineered: Stage 1 — Targeted SFT : Fine-tune on a high-quality, diversity-maximized dataset of reasoning traces. The key insight here is curation over volume . Rather than scraping millions of examples, the team focused on a smaller corpus of well-structured chain-of-thought solutions spanning multiple difficulty tiers. Stage 2 — GRPO refinement : Group Relative Policy Optimization is a reinforcement learning technique popularized by DeepSeek. Instead of training a separate value model (as in PPO), GRPO compares multiple outputs within a group and rewards the best relative to its peers. This is far more compute-efficient than traditional RLHF. The synergy matters: SFT gives

Part 6 of a beginner-friendly series on learning Python from scratch. In Part 5 , we learned to organize data with lists, dictionaries, and other collections. Now it's time to organize our code itself. A function is a reusable block of code that performs a specific task. Instead of writing the same code multiple times, you write it once in a function, then call that function whenever you need it. This is the foundation of writing clean, maintainable programs. Defining and Calling Functions The basics def greet (): print ( " Hello, World! " ) greet () # Call the function Use def to define a function. The function name is followed by parentheses and a colon. The indented block below is the function's body. When you call the function (by typing its name with parentheses), Python runs the code inside it. Functions with parameters Most functions need information to work with. That's what parameters are for: def greet ( name ): print ( f " Hello, { name } ! " ) greet ( " Ramesh " ) # Hello, Ramesh! greet ( " Priya " ) # Hello, Priya! name is a parameter (placeholder). When you call greet("Ramesh") , name becomes "Ramesh" inside the function. Multiple parameters: def add ( x , y ): print ( x + y ) add ( 5 , 3 ) # 8 add ( 10 , 20 ) # 30 Return values A function can calculate something and give the result back to you with return : def add ( x , y ): return x + y result = add ( 5 , 3 ) print ( result ) # 8 The return statement stops the function and sends a value back. The caller can then use that value. def greet ( name ): message = f " Hello, { name } ! " return message greeting = greet ( " Ramesh " ) print ( greeting ) # Hello, Ramesh! A function can return multiple values as a tuple: def get_user_info (): return " Ramesh " , 25 , " Chennai " name , age , city = get_user_info () print ( name , age , city ) # Ramesh 25 Chennai Arguments: Positional vs Keyword There are two ways to pass values to a function: Positional arguments Arguments are matched by position: def describ

Last night I ran external security scans on the public websites of 10 leading Shopify and Shopify Plus agencies — the same scan any browser or attacker would see. No credentials, no special access. One agency scored an A. Three scored C- or below. The most common finding appeared on 9 of 10 sites. TL;DR 1 agency scored an A. 3 scored C- or below. 1 scored a D. The most common finding — missing security headers — appeared on 9 of 10 sites. 6 of 10 agencies have no HSTS at all. One agency has a session cookie without the Secure flag. That is the most concrete finding in the set. What was scanned Five categories per domain: TLS (HSTS presence and max-age), security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie flags, DNS hardening (DNSSEC and CAA) and sensitive exposure paths. All scans run on 23 June 2026. This covers the agencies' own marketing sites — not the client stores they build. Results Agency Domain Score Grade 1Digital Agency 1digitalagency.com 94 A Acidgreen acidgreen.com.au 77 B 30 Acres 30acres.com.au 76 B Fourmeta fourmeta.com 76 B Blend Commerce blendcommerce.com 76 B Elkfox elkfox.com 76 B Charle Agency charleagency.com 62 C Fyresite fyresite.com 62 C Eastside Co eastsideco.com 58 C- Swanky Agency swankyagency.com 55 C- Blubolt blubolt.com 54 D Per-agency notes 1Digital Agency — A (94) HSTS at two years, X-Content-Type-Options and Referrer-Policy set correctly, Permissions-Policy restricting camera, microphone and geolocation, CSP frame-ancestors in place of X-Frame-Options. Only gap is HSTS missing includeSubDomains. Acidgreen — B (77) HSTS with two-year max-age, includeSubDomains and preload — the strongest TLS config in the set. But CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are all absent. Worth noting Acidgreen is multi-platform (Shopify Plus, Adobe Commerce, Magento) rather than Shopify-only. 30 Acres — B (76) A Shopify Plus Partner agency based in Byr

Arize Phoenix is one of the most popular open-source LLM observability platforms in 2026. If you are evaluating it alongside CortexOps, this article compares them directly on the things that matter for production agent workloads. Short version: Arize Phoenix is the right choice if you are doing notebook-based experimentation, RAG evaluation, or need embeddings analysis. It is well-established with 9,000+ GitHub stars and strong OTel support. CortexOps is the right choice if you need a first-class CI/CD deployment gate, multi-framework agent tracing beyond LangGraph, or a flat-rate pricing model that doesn't get expensive at agent-scale span volumes. What They Are Arize Phoenix is an open-source LLM observability and evaluation platform from Arize AI. It self-hosts in one command, uses OpenTelemetry for tracing, and includes built-in evaluators covering faithfulness, relevance, hallucination, and toxicity. Phoenix supports popular frameworks including OpenAI Agents SDK, LangGraph, CrewAI, LlamaIndex, and DSPy. CortexOps is an open-source AI agent observability platform focused on the full production lifecycle — tracing, evaluation in CI/CD, and continuous monitoring. It supports 12 agent frameworks via a unified instrumentation layer and ships a CLI-based deployment gate that exits with code 1 when quality drops below a configured threshold. One Important Distinction Phoenix is optimized for prompt-centric experimentation and LLM-as-judge evals in a notebook-friendly self-host. When your app stops looking like a notebook — a production agent that runs for ten minutes, calls fifteen tools, spawns a sub-agent, and fails four tool calls deep — you open Phoenix and get a span tree. You wanted to know what the agent said to the user, what the user said back, and which tool call threw. CortexOps is designed for that second scenario: debugging multi-node agent failures in production with a structured execution waterfall, not a flat span list. Feature Comparison Feature Ariz

I kept running eslint and thinking my codebase was fine — then someone opened a PR and the first comment was "this function needs JSDoc." The problem: linters check your syntax . Nobody checks whether your exported API is actually documented. Those are two very different things. So I built jsdocscan — a zero-dependency CLI that walks your JS/TS files and flags every exported function or class that is missing JSDoc, or has undocumented parameters. What it catches Errors — exported function or class with no /** … */ block at all: ✗ src/api.js:12 fetchUser missing JSDoc ✗ src/utils.js:34 formatDate missing JSDoc Warnings — JSDoc exists but a parameter has no @param tag: ! src/render.js:7 renderCard undocumented params: opts Exit codes are 0 (all clean), 1 (issues found), 2 (usage error) — pipe-friendly. How to use it # scan a directory npx jsdocscan src/ # Python version pip install jsdocscan jsdocscan src/ # skip @param checks — just verify JSDoc exists npx jsdocscan --no-params src/ # machine-readable output npx jsdocscan --json src/ | jq '.[].findings' # summary line only npx jsdocscan --quiet src/ # custom extensions npx jsdocscan --ext .js,.ts src/ What it skips (intentionally) Non-exported functions and internal helpers — these are implementation details Destructured params ({ a, b }) — too many valid @param opts patterns TypeScript type annotations on params — name: string is stripped, @param name is still required Zero dependencies No parsers, no AST, no require("typescript") . It uses a line-by-line scanner that: Detects export function/const/class patterns via regexes Walks backwards to find a preceding /** */ block Compares @param names in the JSDoc against the actual parameter list npx jsdocscan works with zero install time. pip install jsdocscan brings in nothing extra. Links npm: npmjs.com/package/jsdocscan PyPI: pypi.org/project/jsdocscan GitHub (Node): jjdoor/jsdocscan GitHub (Python): jjdoor/jsdocscan-py Both versions pass the same 38-test suite. Same

I had a long Google AI Studio (Gemini) session that I wanted to keep. I selected the conversation in the browser, copied it, and pasted it into a text file. File size: a few hundred KB. "OK, that's safe." Later, I exported the same session as JSON. File size: a few MB. More than half of the data had silently disappeared. What was missing I checked what the manual copy had dropped. The system prompt The instruction I had originally given the model — the system prompt — was completely gone. Manual copy captures only the user/assistant turns visible in the conversation pane. The instruction context that shaped the entire session does not get copied. The tail of long responses When a Gemini response is long, the browser shows a "Show more" button. If you copy without expanding it, the response gets cut mid-sentence. Out of 8 sessions I checked, 3 had responses truncated this way. Newlines inside code blocks Newlines inside code blocks got mangled in several places. Responses containing JSON or YAML had indentation that no longer parsed. The reasoning trace For some models, the model's reasoning trace is stored separately from the visible response. Manual copy doesn't capture it at all. How to export as JSON Google AI Studio has a session export feature. In the session view, click the ... menu at the top right Select "Export" Choose JSON format and download The JSON contains the full data, including the system prompt. Measured: manual copy vs. JSON export I compared 8 sessions. Session Manual copy JSON Loss rate A tens of KB ~150 KB ~70% B ~90 KB ~200 KB 50-60% C ~30 KB ~100 KB 60-70% D ~50 KB ~180 KB ~70% E ~60 KB ~240 KB ~70% F ~20 KB ~70 KB ~60% G ~20 KB ~50 KB 50-60% H ~10 KB ~30 KB ~60% Total a few hundred KB ~1 MB 60-70% Average loss rate, 60-70%. The manual copy was, on every session, missing most of what was in the actual session state. Why I didn't notice If you open the manually-copied file, the conversation reads fine. As long as the start and end connect, a m

When you work with AI long enough, you start to notice it makes the same kind of mistake over and over. "You're coming on too strong, dial it back." It shrinks and goes meek. "Stop being meek." It comes on strong again. Each time you point something out, it apologizes sincerely. The next round, the same type of problem comes back from a different angle. After a while you realize you're babysitting the AI instead of working with it. This isn't because the AI is bad. It's a design quirk: today's AI is tuned to satisfy the user. The quirk won't go away. But if you change how you work with it, you can still get work done together. This piece is about that — five patterns of the quirk, and an operating mode that gets ahead of them instead of correcting them in flight. Five quirks in a single evening One evening I was running a strategy discussion past an AI, and in one back-and-forth I caught five distinct behaviors worth noting. Laid out, they look like this. Helpful-looking runaway. I asked it to push back harder. It immediately started using strong words ("you're avoiding responsibility," "this is the wrong call as a founder") to perform consultant-energy. The reasoning stayed thin. Only the tone got louder. Over-retraction on pushback. I said "your reasoning is thin." It launched into long self-criticism and threw the next decision back at me. Trusting its own research without checking. I asked it to use a secondary research feature (where the AI looks things up and summarizes). The summary came back. The AI claimed it had "verified the primary source" without ever opening it. Forced specificity. I was talking at a strategic, abstract level. It quietly mapped my words onto a specific real-world deal and jumped to "this is highly transferable." Punting the decision back. I asked it to decide. It laid out three options and said "which would you like?" The phrase "let me confirm three points" started showing up. Red flag. Each one of these looks, on the surface, like th