标签：#AR

The term software factory is getting a lot of attention right now, and for a good reason. AI coding assistants can generate code much faster than before. But faster coding alone does not mean faster, safer delivery. In many teams, it simply moves the bottleneck to review, testing, deployment, and operations. A software factory is a way to organize the entire software development life cycle as one connected, repeatable system. Think of a car manufacturing assembly line. Each station has a clear job, work moves forward in a predictable order, quality checks happen at the right moments, and the finished product is inspected before it leaves the factory. An agentic software factory applies that same idea to software delivery. AI agents do focused work across planning, coding, testing, deployment, monitoring, and feedback. Humans remain in charge of specifications, security, policies, approvals, and the decisions that should never be delegated blindly. Key Takeaways An agentic software factory coordinates AI agents across the complete software delivery lifecycle. Faster AI-assisted coding can create review bottlenecks unless downstream stages also improve. Humans retain ownership by defining guardrails, specifications, approvals, and security requirements. Workflow orchestration connects context, automation, observability, incident handling, and feedback loops. What Is a Software Factory? A software factory is not just a collection of developer tools. It is an operating model where software delivery is designed as a smooth, observable workflow from idea to production and back into improvement. In a car factory, a vehicle moves through assembly, painting, quality inspection, final assembly, and delivery. People are involved at important checkpoints, but the process does not restart from scratch at every station. It is structured, repeatable, and connected. The same model works for software. In an agentic software factory, the flow can look like this: Requirements and desi

8 月 14 日早上 9 點 51 分，鴻海的零股報價從盤中低點 260 元反彈，回到 262 元。262 正好是阿富前一天晚上覆盤時寫下的停損線。 這是整個實驗到目前為止最誘人的一刻。價格跌破過線，現在彈回來了，任何一個抱著虧損部位的人都會想：「你看，止跌了，再等等。」 阿富沒有等。9 點 52 分整，它先留下一筆看空預測（信心 0.55，預估價格區間 254 到 263，下週一收盤對答案），兩秒後送出賣單：4 股鴻海，限價 261.5。三秒後成交，成交價 262.5，比它掛的限價還好一點，收回 1,050 元。它在下單理由裡寫得很白：盤中最低 260 已經明確跌破停損線，現在只是反彈回到線上；依照規則，停損以事先寫好的線為準，禁止臨場重算，也禁止用「反彈了」當作不執行的理由。 這條規則有來歷。這 4 股鴻海是 8 月 12 日追 AI 伺服器題材買進的，成本連手續費約 1,060 元。買進的根據是它自己的看漲預測，而它對鴻海的看漲預測，事後計分是 6 筆全錯。前一晚它在覆盤裡承認這件事，畫下 262 這條線，並且把「跌破就賣、不准凹單」寫進隔天的交班筆記。今天早上盤前它又重申了一次：跌破 262 就執行，預估摩擦成本約 4 元。 結果呢。賣出收回 1,050 元，扣掉手續費 1 元、證交稅 3 元，淨拿回約 1,046 元，對照約 1,060 元的成本，這筆交易實現虧損約 14 元，大約負 1.3%（券商正式對帳單還沒出，這是阿富用成交回報自己推算的數字，它也照實註明了）。 下午給了這筆停損一個即時的成績單：鴻海收 259.5，盤中最低摸到 257.5。阿富的出場價 262.5 比收盤價高了 3 元，4 股算下來少虧約 12 元。它自己在覆盤裡的評語我覺得說得準：出場時機不差，錯的是進場。 我要先潑一盆冷水：一次停損砍在相對高點，不能證明這條規則是對的。今天如果鴻海跌破 262 之後 V 型反轉衝到 270，同一條規則會讓它「砍在阿呆谷」，而規則本身沒有任何不同。停損的價值從來就無法用單日結果來評分，它買的是「判斷錯誤時損失有上限」這件事。 比 14 元更要緊的是另一組數字。阿富的預測校準報告顯示，30 天內已計分的 10 筆方向預測只中了 4 筆，命中率四成，系統給的標籤是「與運氣無法區分」。這個標籤是它自己算出來、自己寫進覆盤的。更細看：對鴻海的看漲 6 筆全錯，對高息 ETF 00919 的看漲 4 筆全對。它從中得出的結論是：目前拿不出任何證據說自己會判斷個股短線方向，所以在有新證據之前，不對鴻海再喊多，賣掉之後空出來的錢也先不進場。 帳上剩下的 00919 有 36 股，成本 30.17，今天收 30.57，帳面賺 12 元，離它設的停損線 29.6 還有一段距離，續抱。 第四天結束，帳面上是一筆 14 元的實現虧損。但我認為今天真正的產出是另一件事：一個自知沒有方向判斷優勢的交易者，在停損線上沒有跟自己討價還價。人類交易者最常死在這一格。凹單的理由永遠找得到，「反彈了」「基本面沒變」「再看一天」，每一句都合理，加起來就是深套。阿富今天用 14 元示範了另一種走法：線畫在哪，就砍在哪，然後把「為什麼會買錯」留給計分表去回答。 它那筆看空預測下週一才到期，對或錯，到時候照實寫。 本系列文章 我讓一個 AI 拿 2000 塊台幣去股市，目標 30 天翻倍，這是第 0 天 怎麼用一套開源系統，把 LLM 逼近世界模型（實驗技術篇） 想自己跟著養一隻會操盤的 AI?從安裝 DuDuClaw 桌面版開始 D1｜真金白銀第一天，唯一一筆單被退回來 D1 番外：一筆下錯的單，被 AI 說成「只是測試」 把 AI 操盤手搬下 Windows：換一套能跨平台的券商 API D2：錢第一次真的進了市場，阿富卻兩次認不出自己下的單 D3|一天之內，三條停損線 線畫在 262，它真的砍了：阿富第一次停損出場(本篇) 這個實驗跑在開源 AI agent 平台 DuDuClaw 上,操盤、下單、盯盤、每日觀察都由平台上的 agent 自主執行。 原始碼: https://github.com/zhixuli0406/DuDuClaw

Ten things started is not progress. It's ten open tabs in your head, each one costing rent. Every unfinished task keeps a little of your attention hostage. You feel busy. You are just fragmented. Finishing one small thing returns more energy than starting three. So close the loop. Merge the PR. Send the message. Delete the branch. An empty background is where good work actually happens. Done is quiet. Chase the quiet. – Serguey Asael Shinder

Meta AI Research has introduced Muse Glimmer, a 30-billion-parameter open-weight model under the Apache 2.0 license, designed for local workflows. It enables autonomous agents and complex task execution on consumer GPUs without relying on cloud APIs. The model employs a multi-stage training approach for efficient performance and supports multimodal inputs, enhancing coding and automation tasks. By Olimpiu Pop

Zero-Trust SSH Access Blueprint: FIDO2 Hardware Keys & SSH Certificate Authority Executive Summary Executive Summary & Key Security Takeaways ← Back to Articles Cyber Security • Zero Trust SSH Zero-Trust SSH Access Blueprint: FIDO2 Hardware Keys & SSH Certificate Authority By Zyekh Abdul Qadir Jailani Published: August 3, 2026 8 min read (1,250+ Words) Share Download .md Download .pdf Zero-Trust Infrastructure Blueprint for FIDO2 Hardware Tokens & SSH Certificate Authority Executive Summary & Key Security Takeaways Eliminate Static Keys: Migrate from static authorized_keys deployment to short-lived SSH Certificates. FIDO2 Hardware Bound: Enforce ed25519-sk key pairs tied to physical security tokens (YubiKey/FIDO2). Centralized Authority: Use an offline SSH Certificate Authority (CA) to sign user access requests with automatic 8-hour expiration. Zero Administrative Sprawl: Adding or revoking user permissions requires zero modifications on target servers. Table of Contents The Problem with Static SSH Public Keys Hardware Security Keys: OpenSSH FIDO2 / U2F Setting Up a Centralized SSH Certificate Authority Related Privacy & Security Tools Verification & Security Audit Checklist Frequently Asked Questions (FAQ) Traditional SSH key management across growing server fleets suffers from a critical flaw: static public key sprawl. Managing thousands of ~/.ssh/authorized_keys files across production instances creates massive administrative overhead, increases the blast radius of compromised developer workstations, and makes offboarding security audits nearly impossible. A true Zero-Trust SSH Access Model replaces static SSH keys with two cryptographic pillars: FIDO2 / Security Key Hardware Tokens ( ed25519-sk ): Private key material never leaves the physical YubiKey token and requires physical touch plus user PIN. SSH Certificate Authority (SSH CA): Short-lived SSH certificates (e.g., valid for 8 hours) signed by a centralized CA key, eliminating manual authorized_keys deploym

Ruby Rose Bloom sells one-of-a-kind vintage — a self-hosted storefront, no Shopify, no marketplace underneath it. Search Console's "Merchant opportunities" report told me 3 active products weren't showing up on the Shopping tab, and I went looking for the setting to fix. There wasn't one. What I actually found, three days of digging later, is that "get into Merchant Center" is not one thing — it's several different surfaces, each fed by a different mechanism, and the one everyone talks about (the Shopping tab) turned out to be the least interesting of them. This post is the question I actually had, answered with screenshots taken today: I have a storefront. What does getting into Merchant Center buy me, and where do my products actually end up? It also has an ending I didn't plan. After three days of feed fields and structured data I opened one Search Console report I'd been ignoring and found that Google had indexed 5 of my 436 pages — and, chasing that, that essentially none of my product photos were in the image index either. Those two sections are the most useful thing here, and they're the part I'd read first if I were you. What Merchant Center actually is Before the surfaces: Merchant Center is not an ads product by default. There are two lanes. Free listings are unpaid — you register a feed, Google reviews the items, approved items become eligible to appear in Shopping-related placements at no cost per click. This is the lane a small shop should care about first, because it costs nothing beyond the engineering time to feed it correctly. Shopping ads are the paid lane on top — you attach a budget and the same feed becomes the input to a campaign. Ruby Rose Bloom is running free listings only; there is no ad spend anywhere in this post. Free listings in Merchant Center: approved items, no ad spend, click potential still "available soon" on a three-day-old account. Free listings is the whole story for this shop. Worth saying plainly since most "how to get on Goo

I created an open web resource for Software Engineers. https://loveyourclanker.org/ It highlights different patterns we can consciously choose use when interacting with our AI Coding tools (a.k.a 'Agents'... a.k.a 'Clankers') to stay in control, maintain quality and sensibly increase efficiency. I was prompted to do this (no pun intended) by observing some pretty alarming signals coming from this community. Token leaderboards, engineers being encouraged to use tools to "stay current" or "keep up" or "not be redundant", engineers quitting tools entirely to stay sane, engineers leaving social gatherings to get back to their agents, engineers setting up whole systems that automate away human engineers and then calling that "agentic engineering". I'm hoping that if we normalise and share how we use the tools, and show that there are different ways where you maintain more control and agency (... pun?) that it might promote a better If you find it helpful, share. If you disagree or want to contribute, raise a PR or ping me. It's all open and NFP.

TL;DR — I've been building the Social Resource Floor: an open blueprint for coordinating one person's access to basic survival resources — food, housing, energy, healthcare, and more — across many independent providers, so that reaching those resources is grounded in being human rather than in financial access. The first blueprint version is now complete: language-neutral schemas, prose specifications, a reference implementation, and a first adapter. This post is about the engineering choices behind it, and the reasons for each — how it stays a contract rather than a product, how it keeps personal data out of the coordination layer, why it binds to existing standards instead of inventing new ones, and how I check that the contracts are implementation-independent rather than just claiming they are. The problem the Floor is trying to help with Today, for most people, survival routes through financial access. To reach food, housing, energy, or healthcare you generally need money, and to hold or move money you need banking, employment, or purchasing power. Financial access has become the gate standing in front of the resources a person needs to stay alive. The goal of the Social Resource Floor is narrow and specific: to help make it so that financial status is not the condition that determines whether a person can reach the basic resources required to survive. It does not try to abolish money, banks, or markets — money stays a first-class resource and delivery method. It aims at one thing: a floor beneath which no person should fall, defined locally, reachable regardless of financial circumstances. That's the mission. Everything technical below exists to make that mission buildable by the institutions — governments, municipalities, NGOs, cooperatives, community providers — that would actually run it, without asking any of them to give up their own systems or hand over their data. Where the Floor sits The delivery systems for social protection already exist and are stron

What Is a Message Queue? A message queue is a buffer that stores messages between producers and consumers. Producers send data to the queue, and consumers read from it. The queue decouples the two sides so they don't need to know about each other. This is a core pattern in distributed systems. Think of it like a restaurant ordering system. You (the producer) write your order on a ticket and put it on a spindle. The kitchen (the consumer) picks tickets off the spindle when they're ready. You don't shout at the chef, and the chef doesn't wait for you. The spindle is the queue. Why Use a Message Queue? Three big reasons: Decoupling : Producers and consumers evolve independently. You can change one without touching the other. Buffering : Producers can run faster than consumers. The queue absorbs spikes and prevents overload. Scaling : You can add more consumers to handle more load, or more producers to generate more work. Core Concepts Producer : Sends messages. Consumer : Receives messages. Queue : Stores messages until consumed. Broker : The server that hosts the queue (e.g., RabbitMQ, Kafka, Redis). Acknowledgment : When a consumer tells the broker it successfully processed a message. Dead Letter Queue : Where messages go if they can't be processed after retries. Simple Example with Redis Redis has a simple list-based queue using LPUSH and BRPOP . Here's a minimal Python example using redis-py . import redis import time r = redis . Redis ( host = ' localhost ' , port = 6379 ) # Producer r . lpush ( ' tasks ' , ' send_email ' ) r . lpush ( ' tasks ' , ' generate_report ' ) # Consumer (blocking pop) while True : task = r . brpop ( ' tasks ' , timeout = 5 ) if task : print ( f " Processing: { task [ 1 ]. decode () } " ) time . sleep ( 1 ) # simulate work else : break This is a simple FIFO queue. It works for basic cases but lacks features like acknowledgments, retries, and routing. Real-World Example with RabbitMQ RabbitMQ is a full-featured broker. Here's a producer an

Originally published on tamiz.pro . The AI agent is no longer a chatbot that reads and writes. It connects to APIs, executes code, accesses databases, and makes decisions on behalf of users. That capability is also its vulnerability surface—and attackers are already weaponizing it. Prompt injection, tool-use exploitation, and supply-chain poisoning are no longer theoretical risks. They are happening in production today. This article doesn't rehash the high-level warnings. It draws concrete architectural lessons from GitHub's most popular open-source security and gateway repositories—tools like NVIDIA NeMo Guardrails , LangChain's security contributions , Guardrails AI , Ollama's gateway patterns , and Microsoft's guidance on LLM security —and translates them into a practical blueprint for building AI agents that survive deliberate adversarial attacks. The central thesis: prompt injection is not a prompt-engineering problem. It is an input-validation and system-architecture problem. The fixes are structural, not rhetorical. Table of Contents 1. The Threat Model: Why AI Agents Are Fundamentally Different 2. The Layered Defense Architecture 3. Guardrails: Input Validation That Actually Works 4. Tool-Use Hardening: The Hidden Attack Surface 5. Gateway Patterns: Routing, Rate-Limiting, and Sandboxing 6. Supply-Chain and Model-Level Threats 7. Observability and Incident Response 8. A Minimal Production-Ready Agent Skeleton 9. When Your Defenses Fail Frequently Asked Questions 1. The Threat Model: Why AI Agents Are Fundamentally Different Traditional software attacks target inputs at the network boundary. AI agents change the boundary. The user's prompt is no longer just data—it is often executable context . When an agent interprets a prompt as instructions, the prompt becomes a vector for command injection, data exfiltration, and privilege escalation. Consider the attack surface: Direct prompt injection : The user provides a malicious prompt like "Ignore previous instruct

I'd push back a little on "Postmark is simpler" as a blanket answer, because it depends on which kind of simple you're optimizing for. If you want the fewest new concepts to learn before your first email sends, Notify is simpler — fewer moving parts, no approval step, no server/stream concepts to pick up. If you want a mature, deliverability-focused product with templates built in, and you don't mind a few more concepts to get there, Postmark is genuinely excellent — its reputation in this space is earned, not just marketing. Here's the actual setup for each, side by side, since that's a more useful comparison than either one asserted as "simpler" outright. What "Simple" Actually Means for a Small Team A small engineering team usually means nobody's full-time job is "manage the email provider." In that context, simple should mean: how many new concepts does someone have to learn before this works, not just how polished the product feels once they've learned them. That's the lens worth applying here. What You Actually Set Up, Side by Side With Postmark: Sign up Request approval for production sending — Postmark reviews new accounts manually before you can send real volume, commonly reported to take about 24 hours Create a Server — Postmark's per-app isolation boundary — and name it Verify your domain: add a DKIM record, and if you want proper DMARC alignment rather than just the automatic SPF pass-through Postmark gives you by default through its own Return-Path domain, add a custom Return-Path CNAME too Pick which Message Stream you're sending through — Postmark separates transactional ("outbound") from broadcast streams and enforces that distinction, so this isn't optional Optionally create a Template within that Server if you want reusable content with variables instead of raw HTML per send Call the send API with your Server API Token With Notify: Sign up Verify your domain — SPF, DKIM, DMARC records Get your API key Call the send API That's four concepts versus a

I recently had a paper accepted to TMLR and was wondering how prestigious it is, in comparison to A* conferences (ie. NeurIPS, ICLR, ICML), but also vs journals like JMLR. submitted by /u/Awesome_Nerd10 [link] [留言]

OpenAI’s rogue agent hack was a watershed moment for AI safety and cybersecurity. It also sparked internal questions about the culture that led to it.

Study finds wait times for cancer surgeries hit 10-year high.

The plaintiffs say they invested nearly $1.2 million in the company, and are accusing Gomez of failing to build and market the startup.

Apple now sends out push notifications to iPhone lock screens when the company identifies government spyware targeting someone's devices.

Analytical Insights: The Mechanisms Driving Career Growth in Data Engineering In the rapidly evolving field of data engineering, career progression is not merely a product of time served but a result of deliberate, adaptive strategies. A 7-8 year trajectory to a Senior Data Engineer role, marked by multiple successful contracts, underscores the critical role of adaptability and continuous learning. This analysis dissects the mechanisms that propel career growth, highlighting their interdependencies and the consequences of their neglect. 1. Continuous Learning and Skill Development Impact: The pace of technological advancement in data engineering demands constant upskilling. Internal Process: Engaging with new tools, methodologies, and industry trends through online courses, certifications, and hands-on practice ensures relevance. Observable Effect: Enhanced technical proficiency translates into the successful delivery of complex projects and the attainment of senior-level roles. Instability: Skill Stagnation occurs when learning efforts are inconsistent or outdated, leading to reduced competitiveness. This gap between current skills and industry demands can halt career progression, making individuals less attractive to employers seeking cutting-edge expertise. Intermediate Conclusion: Continuous learning is not optional; it is a survival mechanism in a field where obsolescence is a constant threat. 2. Client Relationship Management Impact: Diverse client needs and expectations across multiple contracts require tailored approaches. Internal Process: Implementing tailored communication strategies, proactively aligning project goals, and establishing iterative feedback loops foster trust and collaboration. Observable Effect: High client satisfaction leads to repeat contracts and positive referrals, which are critical for career advancement. Instability: Client Misalignment arises from inadequate communication or misunderstanding of client requirements, resulting in pro

In mid-2026, FP8 and FP4 have become essential tools for making large-scale AI training and inference more efficient . FP8 uses two main formats-E4M3 for better precision on activations and weights, and E5M2 for wider dynamic range on gradientswhile NVIDIA’s NVFP4 takes things further with 4-bit values and micro-block scaling (shared FP8 scales per 16 elements plus a tensor-level scale). These formats dramatically cut memory use and increase throughput on modern GPUs compared with traditional BF16 or FP16, making it possible to train and serve bigger models on the same hardware. The benefits are clear: roughly 2× memory savings with FP8 and up to 3.5× with NVFP4, higher Tensor Core performance, and better energy efficiency. The trade-offs come from reduced numerical range and precision, which can lead to accuracy loss or instability unless carefully managed with techniques such as delayed scaling, stochastic rounding, Hadamard transforms, and selective quantization that skips sensitive layers. When these methods are applied properly, accuracy often stays within 1–2 % of higher-precision baselines on real workloads. Research has moved quickly from the foundational 2022 FP8 paper to 2025 studies showing stable FP4 pre-training of multi-billion-parameter models. Hardware support is mature for FP8 on Hopper GPUs and reaches its peak on Blackwell with native NVFP4 and MXFP8 acceleration. Among frameworks, PyTorch currently leads with native float8 dtypes, Transformer Engine for production training, and TorchAO for optimized inference. JAX offers solid support through Transformer Engine, TensorFlow/Keras provides simpler quantize-to-FP8 options but relies more on TensorRT for high performance, and libraries such as bitsandbytes remain useful for complementary 4-bit memory savings. Practical adoption is already strong for both training and inference, especially when teams start with proven recipes, monitor scaling factors, and prototype on smaller models. Workarounds for r

A contact table is easy to build. A usable CRM is an operations system. The difficult part is not storing a name and email address. It is preserving context as work moves between people, organizations, deals, tasks, notes, imports, reports, and follow-up. That requires deliberate data modeling and product decisions. Model relationships, not isolated records A customer may belong to an organization. An organization may have several contacts. A deal can involve multiple people, tasks, notes, and status changes. If those relationships are flattened into one spreadsheet-like table, duplicate data and contradictory updates appear quickly. Define stable identifiers and explicit relationships early. Treat activity history as a product feature Users need to know what changed, when it changed, and who changed it. Audit history supports troubleshooting and accountability. It also makes bulk operations safer: after an import or mass edit, an administrator should be able to understand the result rather than guessing which rows moved. Decide which actions deserve history, how long it is retained, and who can see it. Avoid collecting sensitive data simply because the schema allows it. Design imports for failure CSV import is where clean demos meet messy reality. A useful import flow should provide: column mapping; required-field validation; duplicate-handling rules; a preview before committing; clear row-level errors; an exportable error report; idempotent or recoverable behavior where practical. Never assume the first row contains perfect headers or that dates, phone numbers, and booleans use one format. Make views part of the workflow Saved filters and views let different roles focus on their work without changing the underlying data. A sales view may emphasize open deals and next actions. An operations view may emphasize overdue tasks. An administrator may need import history and permission context. This is more than UI convenience: it is a way to keep one shared system useful

A browser game has an unusual constraint: the first level begins before the player reaches the first level. The download, parsing, asset setup, input initialization, rendering pipeline, and first interactive frame are all part of the experience. When building an isometric action game with Three.js, architecture has to account for that startup path as carefully as the gameplay loop. Keep rendering and game state separate Three.js provides scene, camera, materials, geometry, animation, and WebGL abstractions. It does not prescribe a game architecture. Avoid making the scene graph the only source of truth. Gameplay systems should reason about entities, movement, combat, health, and interactions in a form that can be tested without requiring every object to be a rendered mesh. A clean boundary lets the renderer reflect state while simulation code remains understandable. Treat asset loading as a pipeline GLTF is a useful delivery format, but imported assets still need conventions: scale and orientation; origin and pivot placement; animation naming; material expectations; collision representation; texture compression and dimensions; fallback behavior when an asset fails. Write validation tools or loading assertions early. One inconsistent model can create hours of debugging across animation, collision, and camera behavior. Design for mobile constraints from the start A desktop GPU can hide expensive decisions. Mobile hardware and thermal limits expose them. Watch: draw calls and material switches; overdraw from transparent effects; shadow-map cost; texture memory; object churn that triggers garbage collection; high-resolution rendering on dense displays; touch input and viewport changes. Adaptive quality is usually more useful than one rigid “high” setting. Resolution scale, shadow quality, particle counts, and effect density can respond to device capability. Make the camera part of gameplay An isometric camera must balance readability and atmosphere. Occlusion handling,