标签：#AR

Remote File Inclusion (RFI) is a web vulnerability where an application accepts a URL from user input, fetches the file at that URL, and executes it. When there is no validation on what URLs are allowed, an attacker can point the application to a malicious script on their own server and get it executed remotely. This pattern shows up in automation tools, plugin systems, and CI/CD pipelines. The idea of loading scripts from a URL seems useful, but without strict controls, it becomes a direct path to remote code execution. Here is a simplified example of vulnerable server-side code: // Vulnerable automation runner - DO NOT USE IN PRODUCTION const express = require ( ' express ' ); const http = require ( ' http ' ); const https = require ( ' https ' ); const app = express (); app . get ( ' /api/automation/run ' , ( req , res ) => { const scriptUrl = req . query . scriptUrl ; const startTime = Date . now (); const parsedUrl = new URL ( scriptUrl ); const client = parsedUrl . protocol === ' https: ' ? https : http ; client . get ( scriptUrl , ( response ) => { let data = '' ; response . on ( ' data ' , ( chunk ) => { data += chunk ; }); response . on ( ' end ' , () => { // VULNERABLE: executes fetched script without sandboxing or validation const output = eval ( data ); const executionTime = Date . now () - startTime ; res . json ({ status : ' success ' , output : output , executionTimeMs : executionTime }); }); }); }); app . listen ( 8080 , () => { console . log ( ' Server running on port 8080 ' ); }); The core problem with the code above: It accepts any URL from user input without validation It fetches and runs that URL's content using eval() There is no sandboxing or restriction on what the script can do The code runs with the same privileges as the application itself Ethical Considerations This is for educational purposes only. You should only test for RFI on systems you own or have explicit permission to test. Unauthorized testing is illegal and can lead to serious

I used to think tests were a waste of time. "Ship fast, fix later" was my motto. Until I spent three painful weeks debugging a production issue that a simple test would have caught in 30 seconds. That was the day I became a believer. The Harsh Reality Most Solo Developers Ignore If you're a freelancer or indie hacker building real products for clients, here’s what happens without good tests: You make a "small change" and something unrelated breaks Clients find bugs you should have caught Refactoring becomes terrifying You lose sleep before every deployment Your reputation slowly takes hits A solid test suite changes all of that. What a Test Suite Actually Gives You Confidence to Move Fast You can refactor, add features, or upgrade dependencies without fear. Living Documentation Your tests explain how the system should behave — better than comments ever could. Early Bug Detection Catch issues before they reach the client or production. Better Architecture Writing testable code forces you to write cleaner, more modular code. Professional Credibility When clients or senior devs review your code, a good test suite immediately signals seriousness. The Test Suite Pyramid I Actually Use Unit Tests (70%) → Test individual functions and components Integration Tests (20%) → Test how different parts work together (API + DB) End-to-End Tests (10%) → Critical user flows (login → checkout → etc.) I don't aim for 100% coverage. I aim for high-value coverage — especially around business logic and critical paths. Final Thought Writing tests feels slow at first. But it compounds. Every month you have tests, you move faster and sleep better. The developers who ship reliable software consistently aren't necessarily the smartest — they're usually the ones who learned to respect testing. Have you built a strong test suite habit yet? Or are you still in the "I'll test it manually" phase? Drop your experience below. Let's talk.

Everyone optimizes the buying experience. Almost nobody builds for what happens after checkout. Every appliance, device, and tool you buy comes with records that matter later: the receipt, purchase date, model number, serial number, the manual, and the warranty terms. Most people have no system for keeping those together — they're scattered across email, a kitchen drawer, screenshots, and random cloud folders. So when something breaks, the warranty claim dies on a single question: "Can you send proof of purchase and the serial number?" That's the gap we're building SnapRegisters for. The simple version of the fix (works with any notes app) The day anything substantial arrives, capture four things: The product The receipt The model / serial label (it fades — grab it early) The warranty card or manual Organize them by product, not by document . Instead of "where's that receipt," it becomes "open the dishwasher record." When support asks for details, it's a 10-second lookup instead of a 20-minute hunt. Where AI actually helps after the purchase The interesting part for builders: the post-purchase layer is a great fit for AI. Point a camera at a receipt and you can extract the model, serial number, and purchase date, then track the warranty automatically — turning a tedious filing chore into a 5-second snap. It's not flashy AI, but it's the kind that quietly saves people money (most warranty coverage goes unused simply because the paperwork is gone). If you've ever eaten a repair bill for something that was technically still covered, you've felt this problem. Curious how other builders think about the "boring but valuable" software gaps like this one. 📲 SnapRegisters is free on iOS: https://apps.apple.com/app/id6757603213

Introduction Large Language Models (LLMs) like ChatGPT have transformed how we interact with AI. They can write code, answer questions, summarize documents, and generate creative content. However, they have one major limitation - they only know what they were trained on and can sometimes generate incorrect or outdated information. So, how do modern AI applications answer questions about your company's private documents, recent news, or knowledge that wasn't part of the model's training? The answer is Retrieval-Augmented Generation (RAG). In this blog, we'll explore what RAG is, how it works, its architecture, benefits, challenges, and real-world applications. What is RAG? Retrieval-Augmented Generation (RAG) is an AI architecture that combines a retrieval system with a Large Language Model (LLM). Instead of relying only on the model's internal knowledge, RAG first retrieves relevant information from an external knowledge source and then uses that information to generate a more accurate response. Think of it like an open-book exam. Instead of answering from memory, the AI first searches for the most relevant pages and then writes the answer based on those pages. Why Do We Need RAG? Traditional LLMs have several limitations: Knowledge becomes outdated. They cannot access private company data. They may hallucinate (generate incorrect facts). Retraining models is expensive and time-consuming. RAG solves these problems by allowing the model to retrieve fresh and domain-specific information before generating an answer. RAG Architecture A typical RAG pipeline consists of the following components: User Query Embedding Model Vector Database Retriever Prompt Builder Large Language Model Final Response Step-by-Step Workflow * Step 1: * User asks a question Example: "What is our company's leave policy?" Step 2: Convert the question into embeddings The query is transformed into a vector representation using an embedding model. Example: "What is leave policy?" ↓ [0.12, -0.45, 0.7

CMF by Nothing won't be able to release a follow-up to the Phone Pro 2 this year.

After adding one to my home, here's why you might want a home battery, how they work, and what to look for, plus some installation tips.

At WWDC 26, Apple announced the Core AI framework, the official successor to Core ML. It is designed to allow developers to run large language models and generative AI entirely on-device, supporting both custom-converted PyTorch models and pre-optimized open-source models. By Sergio De Simone

We’ve trawled the depths of Amazon to find the best deals on gear we’ve tested.

I did the research and taste-testing to find the best greens powders worth your money. Bloom Nutrition’s Superfood Greens Powder is my tried-and-true pick.

The new Siri AI is conversational, omnipresent, and actually helpful.

Working with AI Means Thinking More, Not Less Yes, this text is long. Yes, it repeats itself in places. I did not clean that up. A text that sounded too smooth while arguing that AI forces you to think more, not less, would be at least slightly dishonest. This is not fast food for quick consumption. And yes, don’t worry: you won’t hear anything especially new here. That is part of the problem too. There is a popular and very seductive story about AI in software development. Now that the machine can write code, the human gets to think less. You just point it in the right direction, and the model will quickly and cheaply do a significant part of the work on its own. In that picture, AI is primarily an accelerator for code production, and human thinking gradually shifts from necessity to optional extra. I keep feeling more and more strongly that this description is dangerously wrong. A more accurate formula for my own experience right now is this: I’m the tech lead, the AI is the entire team in one body . And if you take that metaphor seriously, the conclusion is the exact opposite of the mainstream narrative. Working with AI is not a way to think less. It is a mode in which you need to think more, not less . Not because the AI is bad. But because it is too good at one very treacherous thing: it confidently and smoothly fills in what was left unsaid. I’m the tech lead, the AI is the team At first this metaphor felt like a neat formulation. Now it feels like a literal description of what is going on. If you treat AI as a very fast and very capable executor, a lot of things become clearer immediately. It really can wipe out months of routine work. It can spin up prototypes quickly, take over test scaffolding, try out alternatives, make local edits, help break a task into parts, and sometimes even suggest a decent direction. On the surface, this really does look like a silver bullet. Especially if the human knows the stack and can read code. The pace becomes so extreme th

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Architecture that lives only in people's heads doesn't survive agents. For most of my career, the real rules of a codebase weren't written down. People knew them. Senior engineers knew which layers could talk to which. They knew which dependencies were forbidden, which schemas were effectively frozen, and which shortcuts would create problems six months later. New engineers learned those rules the traditional way: break one, get caught in review, get the explanation, and eventually remember not to do it again. It wasn't perfect, but it mostly worked. What I didn't fully appreciate until I started working heavily with coding agents is how dependent that model is on tribal knowledge. Humans accumulate context over time. Agents don't. They don't remember the migration that went sideways three years ago. They weren't around when the team spent weeks untangling a dependency cycle. They don't know why a particular boundary exists. They only know what they can see. Which means if a rule isn't written down, from the agent's perspective, the rule doesn't exist. I've seen agents wire inner layers directly to outer layers. I've seen them introduce dependencies we intentionally avoided and extend contracts everyone on the team considered settled. The code often worked, which was the dangerous part. The problem wasn't correctness. The problem was architectural drift. That's when something clicked for me. Architecture can't remain folklore once agents start writing code. It has to become law. Not a convention. Not a suggestion. Not something a reviewer remembers at 6 PM on a Friday. A law. Written down, explicit, and enforceable. That's what I mean by a constitution. A Constitution Is Not Documentation The first mistake I made was treating the constitution like another documentation file. It isn't. Documentation explains how the system works today. A constitution defines what the system is allowed to become. Those sound similar, but they serve very different purposes. Package nam

Using Claude Fable 5 or Mythos 5 on Amazon Bedrock requires opting into provider_data_share, sending prompts and outputs to Anthropic for 30-day retention with human review. Previous Bedrock models kept inference data inside the AWS boundary. Three days after launch, Anthropic asked AWS to revoke access to both models citing US export control compliance. By Steef-Jan Wiggers

Researchers have demonstrated they can make coffee comparable to conventional espresso using ultrasonic waves. Because the process doesn’t need hot water, it consumes 75 percent less energy.

I can't remember the last time I got excited about a fan. Normally, I just buy whatever Vornado or Dreo model fits my budget, but that was before I started testing the battery-powered Standing Circulator Fan from SwitchBot. As the name indicates, the SwitchBot fan is a 3D circulator - a fancy way of saying […]

Why I built GigVorx, a SaaS tool to help freelancers and agencies manage client briefs and invoices more professionally. Freelancers and small agencies often have one messy problem: Client details are everywhere. Some requirements come through WhatsApp. Some come through calls. Some are sent as voice notes. Some are inside Google Docs. Some are buried in old messages. At the start, this feels normal. But later, it creates problems. You forget important requirements. You ask the client the same question again. Invoices are created manually. Project details are not organised. The whole process looks less professional. That is the problem I wanted to solve with GigVorx . What is GigVorx? GigVorx is a client intake and invoicing tool for freelancers and small agencies. It helps users: Collect client requirements professionally use ready-made brief templates organise client details create professional invoices avoid scattered WhatsApp chats, calls, and docs The goal is simple: Help freelancers and agencies manage client intake and invoicing from one dashboard. Who is it for? GigVorx is mainly for: web designers developers graphic designers video editors SEO freelancers social media agencies digital marketing agencies small service businesses These people usually talk to many clients and need a better way to collect requirements before starting work. Why I built it I noticed that many freelancers lose time before the project even starts. They ask questions manually. They collect details in random chats. They create invoices separately. They do not have one organised place for client information. This makes the work slower and sometimes confusing. So I wanted to create a simple tool that gives freelancers a more professional workflow. Current status GigVorx is already live in early access. Right now, I am not focusing on making it perfect. I am focusing on getting real users' feedback and improving the product based on what freelancers actually need. What I am learning Bui

The cycle number on a lithium battery's spec sheet is true and almost useless, because it describes a life the battery will live only in a temperature-controlled lab being cycled gently by a machine that never has a bad day. A cycle, in that test, means a full charge and a full discharge under mild, steady conditions, repeated until the pack fades to some fraction of its original capacity, often eighty percent. Your warehouse does none of that. It charges in bursts, discharges to whatever the shift demanded, bakes the pack in summer and chills it in winter, and counts a cycle as whatever happened between two plug-ins. Depth is the lever nobody quotes The single biggest mover of cycle count is how deep you run the pack on each outing, and that figure almost never shares the page with the headline number that sells the battery. The relationship is steeply nonlinear, which is the part that surprises people. Drain a lithium pack to nearly empty every time and you spend cycles fast. Use the top half and tuck it back on charge, and the same cell can deliver many times the number of shallow cycles before reaching the same faded state. The chemistry is mechanical about it: every deep swing stretches and contracts the electrode structures further, and the wider the swing the more wear each one inflicts. Two fleets on identical batteries can see lifespans years apart purely from how hard they drain them. This is why opportunity charging does double duty. It keeps the truck running, and it keeps each cycle shallow, which stretches the pack's life as a side effect. It also means a published cycle figure measured at full depth understates what a top-up fleet will see, while a figure measured shallow oversells what a run-it-flat operation will get. The same battery, the same number, two outcomes the sheet never warned you about. You have to know the test depth to know what the promise means. Heat is the other clock Cycles are only one of two clocks ticking on a battery, and the s

Enterprise Design Patterns in Python: Repository & Unit of Work 🐍🏗️ Series: Enterprise Application Architecture | Source: Fowler's EAA Catalog | Code: GitHub Repository 🧠 What Are Enterprise Design Patterns? Martin Fowler's Patterns of Enterprise Application Architecture (2002) is one of the most influential books in software engineering. It documents recurring architectural solutions — patterns — that solve common problems in enterprise systems: how to organize domain logic, how to talk to databases, how to handle transactions, and more. In this article, we'll explore two of the most powerful and widely-used patterns from that catalog: Pattern Category Core Purpose Repository Data Source Abstracts data access behind a collection-like interface Unit of Work Data Source Tracks object changes and commits them as a single transaction These two patterns work beautifully together — and you'll see exactly why with a real-world example. 🛒 The Problem: An E-Commerce Order System Imagine you're building a backend for an online store. When a customer places an order: A new Order is created Each Product 's stock is decremented A Payment record is registered If any of these steps fail midway, the entire operation should roll back — no partial state. This is exactly the problem the Unit of Work pattern solves, and the Repository pattern makes it all cleanly testable. 📁 Repository Pattern Definition "A Repository mediates between the domain and data mapping layers using a collection-like interface for accessing domain objects." — Martin Fowler, PoEAA The Repository acts as an in-memory collection of domain objects. Your business logic never knows if it's talking to PostgreSQL, SQLite, or even a mock list — it just calls .add() , .get() , .list() . Domain Model # models.py from dataclasses import dataclass , field from typing import List from uuid import uuid4 @dataclass class Product : id : str name : str price : float stock : int @dataclass class OrderItem : product_id : str qua

A working prompt library is the main event, not an appendix. The industry still treats prompts as some half-baked spitball left in a README, or, worse, a plaintext blob stapled to package.json and forgotten. That's a waste of compute and credibility. What powers reliable AI-assisted refactoring, onboarding, or even next-gen code IDEs is not the size of the model but the clarity and context supplied by the actual, shipped prompt set. OTF kits turn this lesson into a repeatable deliverable: every paid template includes 20+ production-tested prompts tied to the real file structure, component API, and product-specific conventions. This is not a suggestion; it's structural. The takeaway: a real prompt library is as important as your component library. Treat it like one. Start with the pain: why blank chat boxes don't scale The web is full of “integrations” that paste a blank chat input over your codebase and call it an “AI coding assistant.” The result: hallucinated function names, invented conventions, broken import paths. Here’s what happens in real life: Dev: "Add a social login button." AI (blank prompt): "Sure! Insert <SocialLoginButton> in your LoginScreen.js." Dev: (There’s no such component. There's not even a LoginScreen.js.) Short: A generic prompt with zero context simply can't know your conventions, files, or patterns. The agent will either fail, hallucinate, or pepper you with clarifying questions you have already answered in your product architecture. Takeaway: Prompting without context is coding without types — fragile guesses instead of structured outcomes. What a first-class prompt library enables When the prompt library ships with the codebase, it looks like this: Every prompt knows the folder structure (e.g., features/auth , screens/Settings/index.tsx ). Conventions are hard-coded: naming, import styles, design token usage. Endpoints and integration points (e.g., “update the Stripe webhook handler in api/webhooks/stripe.ts ”) are spelled out. The promp