标签：#RAM

submitted by /u/OSBY_Glabay [link] [留言]

A few weeks ago I wrote about building a reproducible test harness for comparing free AI coding models before you commit . That harness answers one question: which model should I use? It does not answer the harder follow-up: once a model generates a patch for my real codebase, when is it safe to merge? This week there was a great discussion on DEV about "understanding over origin" — the idea that it doesn't matter whether code came from a human or a model, only whether someone actually understands it. I agree with the principle, but principles don't survive contact with a busy afternoon. What survives is a checklist with teeth. So here is the pipeline I bolted onto my model harness: every AI-generated patch has to pass through a scripted review gate before I even read it, and the script produces a scorecard that tells me how carefully I need to read it. The problem with eyeballing diffs When a model produces a 40-line diff that looks idiomatic, my brain does a dangerous thing: it pattern-matches on style and skips semantics. The code reads like something I'd write, so I approve it like something I'd write. The failures I've actually shipped from AI-generated code were never syntax errors — the tests even passed. They were things like: A retry loop that retried on the wrong exception type, so real errors got swallowed. A query filter that was subtly wider than the one it replaced (tests passed because fixtures were too small to notice). A dependency added for a one-liner the standard library already covers. All three would have been caught by asking four boring questions before reading the code. So I scripted the questions. The review gate: a reproducible artifact The gate is a small shell script. It takes a patch file, applies it to a throwaway worktree, and runs four checks. It never touches my working branch, and it prints a one-line verdict at the end. #!/usr/bin/env bash # review-gate.sh <patch-file> <base-branch> set -euo pipefail PATCH = " $1 " BASE = " ${ 2 :

I remember the exact moment the excitement turned to dread. I had just integrated GPT-4 into a side project—a small document summarization tool. The pricing page said $0.03 per 1K input tokens and $0.06 per 1K output tokens. Clean, simple, two numbers. I calculated roughly $0.01 per summary and smiled. Two weeks later the bill arrived: $87.43 for what I thought would be maybe $15. I wasn't being careless. I had read the docs. I knew about tokens. But the silent costs—the ones nobody puts in a neat table—had quietly multiplied my burn rate by six. That experience taught me that AI API pricing is a lot like buying a printer. The upfront cost is seductive; the real expense hides in the ink cartridges, the proprietary drivers, and the forced upgrades you never planned for. Let's talk about those hidden costs, because I'll bet you've either already hit them or you're about to. The Token Trap That Isn't What You Think Everyone knows tokens are the unit of billing, but the gap between "understanding tokens" and "feeling tokens" is enormous. First, there's the input/output asymmetry . GPT-4 charges double for output tokens. That's fine for short answers, but what about chain-of-thought? If you ask the model to reason step-by-step, those intermediate steps count as output tokens—and they add up fast. I had a single query balloon from 500 output tokens to 2,400 because the model decided to work through a logic puzzle aloud. My cost quadrupled without me changing a thing in my prompt. Then there's the system prompt tax . Many developers stuff context into system messages: instructions, examples, formatting rules. Those are input tokens paid every single time, even when the user's query is tiny. If your system prompt is 1,500 tokens and you handle 10,000 requests, that's 15 million input tokens you're paying for—whether the model uses them or not. And don't get me started on retry costs . You hit a rate limit or your request times out? The token count for that failed request? S

2.6.1. Object Safety When defining a trait, whether it is object-safe is also part of the unstated contract. Object safety is a concept in Rust related to trait objects . It determines whether a trait can be dynamically dispatched, that is, whether it can be used in the form of dyn Trait . Traits That Are Object-Safe Must Satisfy the Following Conditions (Based on RFC 255) All supertraits must also be object-safe If a trait inherits from other traits, then those supertraits must also be object-safe. It must not require Sized A trait cannot use Sized as a supertrait, meaning it cannot contain a Self: Sized bound, because the size of a trait object is unknown at compile time. It cannot have associated constants . It cannot have associated types with type parameters . All associated functions (methods) must satisfy one of the following rules : Dispatchable functions : They cannot have any type parameters, though lifetime parameters are allowed. They must be methods, and Self may only appear in receiver positions such as: &self &mut self Box<Self> Rc<Self> Arc<Self> Pin<P> (where P is one of the types above) They cannot require Self: Sized , otherwise the trait would only be usable for types with known size and object safety would be broken. Explicitly non-dispatchable functions : They may return Self , but such functions must require Self: Sized , so they cannot be called on trait objects and can only be used with concrete types. If you cannot remember all of the above, just remember object safety describes whether a trait can be safely turned into a trait object . What Object Safety Does If a trait is object-safe, meaning it satisfies all of the conditions above, then we can use dyn Trait to treat different types that implement the trait as a single generic type. If it is not object-safe, the compiler will prevent you from using dyn Trait . Object Safety and API Design When designing APIs, it is recommended to make traits object-safe, even if that slightly reduces con

When I first started testing APIs, my workflow looked a lot like everyone else's. I'd open a GUI...

Coming from school math, it feels pretty strange that: 3 / 2 * 10 != 10 * 3 / 2 This expression can evaluate to true or false depending on the programming language you use. Languages where the two sides are NOT equal Languages where the two sides ARE equal C, C++, C#, Java, Kotlin, Scala, Ruby, Go, D, Rust, Swift, Zig, Odin, V, Fortran, Python 2 Python 3, JavaScript, TypeScript, Dart, R, Lua 5.3+, Perl, MATLAB, Pascal, Mojo, Nim, Crystal, Julia, Haskell Why are the two sides not equal in the languages on the left? On the left side of the expression above, the operation 3 / 2 is evaluated first using integer arithmetic—truncating the fractional part—which results in 1 . This is then multiplied by 10 , giving a result of 10 for the left side. On the right side, 10 * 3 = 30 is the first step. Dividing this by 2 gives 15 . Thus: 10 != 15 These languages prioritize the efficient (fast) execution of expressions over mathematical correctness, as integer arithmetic is significantly faster than floating-point arithmetic. Unfortunately, these languages use the same / operator for both integer and floating-point division, selecting the operation based on the types of the operands. Regrettably, the expression 3 / 2 * 10.0 still yields 10 in most of these languages (and results in a compilation error in Rust). Even though we indicated our intent to use floating-point numbers by writing 10.0 , it is already too late: compilers evaluate 3 / 2 as integer arithmetic in the first step. Expressions like 3.0 / 2 * 10 or 3 / 2.0 * 10 , on the other hand, produce 15 . Thus, depending on the operand types, you end up with either 10 or 15 . This situation becomes even more dangerous when variables are involved in the expression: num / denum * scale != scale * num / denum This can evaluate to true or false depending on the types of the num and denum variables ( float vs. int ). To avoid these pitfalls, developers use type casting: (float)num / denum * scale != scale * (float)num / denum Thi

The first time I ran my vulnerability scanner against the industry-standard benchmark, the bottom line of the scorer's report was this: $ python scripts/score_benchmark.py --findings out/java.findings.json \ --truth benchmark-java/expectedresults-1.2.csv OVERALL precision 0.60 recall 0.07 F1 0.13 # abridged Three numbers, and here is what each one means. Precision 0.60 — of all the alarms the scanner raised, 60% pointed at real bugs: when it spoke, it was right more often than not. Recall 0.07 — of all the real bugs in the benchmark, it found 7%. In the four vulnerability classes my scanner covers, the benchmark contains 777 real, labeled vulnerabilities; it missed 93% of the bugs it exists to find. F1 0.13 — precision and recall combined into one score (their harmonic mean), dragged down to almost nothing by that recall. My first instinct was to fix it before anyone saw it. Instead I saved the output, wrote the number into my benchmark log, and kept it — because that number was always going to be published, and this is the article that publishes it. The Context For the past months I've been deep in AI — reading, building, measuring. One of the projects that came out of it is an AI vulnerability scanner. The design in one sentence: deterministic static-analysis rules do all the searching, and an LLM judges each finding — is this a real bug or a false alarm? The full architecture gets its own article. This one is about the first measured number. The test set is the OWASP Benchmark — 2,740 labeled Java test cases, the standard exam for Java security scanners. In my scanner's four vulnerability classes (SQL injection, command injection, path traversal, XSS) there are 1,478 cases: 777 real vulnerabilities and 701 cases deliberately designed to bait scanners into raising false alarms. Every tool I compare against — Semgrep, CodeQL — takes the same exam, scored by the same scoring code. Same rules for everyone. New to this? Three words carry this article. A source is wher

I had a podcast pipeline I was proud of. It took a transcript, turned it into a two-person conversation with text-to-speech, laid in the music, and produced an MP3 I could publish. I'd built it in one app, and it worked. I loved the output. So when I started a second app that needed the same flow, I didn't want to rebuild the pipeline. I already had one. I just wanted it over there. So I asked the AI to copy it. And it did. Here's the part that matters: I didn't just copy it and hope. I checked. I opened a fresh session (a clean one, no memory of the first) and told it to look at the new pipeline and make sure everything was right. It went and looked. It came back and told me everything was good. Everything looked good. Or so I was told. Then I loaded the first real transcript and ran it. It was wrong. Not a little wrong. The voices were wrong. The music didn't come in when it was supposed to. It didn't cut off when it was supposed to. It didn't fade. It just stopped. The words were all there, every one of them, in the right order. But everything that made the first pipeline good (the timing, the production, the feel) was gone. I walked away from my desk for a bit. It pissed me off, because I'd done what I was supposed to do. I'd asked. It had answered. The check was green. And the check was a lie. Here's what I think I actually got wrong, and it's not "I trusted the AI." It's subtler than that. When I asked a fresh session to "make sure everything's good," I got back a confident yes. But the session had no way of knowing what good sounded like. It never heard the first pipeline. It had no stake in whether the podcast was any good. It reported what it could see (the code looked reasonable) and what it could see was almost never the thing I actually cared about. That's the trap, and it isn't a beginner's trap. I have a whole process built to avoid exactly this: spec, adversarial review, a plan, a build, a code review. And I skipped it, on a task I decided was too sma

Okay, story time. If you've worked on a full stack app where the backend is Java/Spring Boot and the frontend is React, you know the drill. Someone changes something on one side of a contract and nobody tells the other side. Weeks later you're playing detective across five files trying to figure out who calls what. And it's not just REST endpoints. It's the scheduled job that quietly writes to the same table your API touches. It's the service that calls another service, which calls another service. It's the Kafka event your controller publishes that some completely unrelated listener is consuming three modules away. All of that is "the contract" too, it's just invisible unless you go looking for it. Now add AI coding agents into that picture. They're great at writing code in the file they're looking at. They're not great at knowing that the component they're editing calls an endpoint, which hits a controller, which calls a service, which calls a repository, which is also written to by a scheduled job at 2am, which also fires an event three other services are listening for. Agents see one file at a time. So they'll happily rename a field or change a return shape on one side and leave everything downstream of it completely unaware anything changed. I got burned by this enough times that I decided to build the map myself. That's how Contour happened, and then, once I realized AI agents needed to query that map directly instead of just reading it off my screen, Contour MCP happened right after. Let's get into it. The actual problem Working across a UI, a REST API, a service layer, a repository layer, a database, plus schedulers and events sitting on top of all of it, two things go wrong constantly. Agents (and honestly, humans too) edit one side of a flow without knowing the other side exists. People burn real time reconstructing a call chain by hand, jumping through five or six files just to make a change that should be simple. Both come from the same root cause. Nobod

submitted by /u/asamarts [link] [留言]

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is free and source-available on Github. Star git-lrc to help devs discover the project. Do give it a try and share your feedback. A few years ago the AI conversation looked like this. "Should I pay $20?" "No, $200." "Actually this new tool is $39/month." My wallet started looking like it had gone through a startup funding winter. Then Google quietly walked into the room and started dropping free AI tools like Oprah handing out cars. "You get an AI IDE!" "You get a workflow builder!" "You get a GitHub coding agent!" ...except nobody really noticed because Google announced them across five different events, Labs pages, GitHub repos, and random blog posts. So I spent some time collecting the ones developers will actually find useful. No "AI that writes your wedding speech." No "AI that guesses your spirit animal." Just tools that can actually help you ship software. Bookmark this one. 1. Pomelli https://labs.google/pomelli If you've ever launched a side project, you already know the painful truth. Building the product is fun. Writing 37 LinkedIn posts explaining the product... not so much. Pomelli takes your website, understands what your product does, builds a brand profile, then generates social posts around it. Think of it as hiring an intern that actually reads your landing page before tweeting. Would I let it post automatically? No. Would I happily let it generate the first draft so I don't stare at a blinking cursor? Absolutely. Perfect for: Indie hackers SaaS founders Open-source maintainers pretending they enjoy marketing 2. Stitch https://stitch.withgoogle.com Remember when designing an app meant opening Figma... ...moving a button 3 pixels... ...asking for feedback... ...moving it back 3 pixels? Stitch skips a surprising amount of that. You describe the interface. Or upload a sketch. Or even paste a wireframe. It generates modern UI designs and can even produce

submitted by /u/CackleRooster [link] [留言]

Context My multiplayer game Lights Out is based on a 2D grid. Entities can only ever be in exactly one grid tile. This makes the rule evaluation really simple and understandable. However, it doesn't really feel nice to play (which you know if you've ever played any of the PuzzleScript games). At the same time, the more content is in the game, the more complex and arbitrary the game rules become. I therefore introduced the Movement Transaction System into the code base to deal with this. This includes two sides: - The gameplay code on server side deals with transactions. This bundles all movement code (including rule evaluation) into a single system. - The visualization & prediction code on client side deals with visual interpolation for moves (introducing some juice into the gameplay feel), based on the transactions managed by the server. The Transaction A single transaction includes the movement delta, a list of entities that it has affected and some flags. A transaction then undergoes several stages: - Queued : Gameplay code has requested an entity to move - Issued : The visual interpolation for the transaction has started in the client, but the entities have not been moved from a gameplay perspective - Committed : The entities have now been moved onto their new tiles, the visual interpolation is finishing - Aborted : The transaction couldn't be committed as it would've violated gameplay rules. Visual interpolation is reversed. The Visual Interpolation Whenever a transaction is issued on server-side, the server tells the clients to start a visual interpolation based on the transaction. This information includes the desired duration of the interpolation, as well as some flags (like whether to use acceleration or do a linear interpolation). The client then updates the visual interpolation every frame, until the transaction is either aborted or the target position has been reached. Simplifying Gameplay Code This new system has made the gameplay code much simpler. I c

submitted by /u/igaztanaga [link] [留言]

Online speculation over the weight loss of celebrities like Ariana Grande—even out of genuine concern—can make things worse for people struggling with eating disorders.

submitted by /u/Happycodeine [link] [留言]

submitted by /u/swdevtest [link] [留言]

If you've ever tried coding on an iPad, Galaxy Tab, or Chromebook, you know the frustration: Standard desktop tutorials assume a Mac or high-spec Linux laptop. Neovim configuration takes 4 hours of plugin debugging. Touch input on mobile terminals sucks without a dedicated extra-keys bar. I built DevDock (dock) to solve this permanently. What is DevDock? DevDock is a turnkey developer environment manager built specifically for mobile devices, Termux, Chromebooks, and low-spec hardware. Instead of fighting configuration files, one command installs a complete, high-performance terminal stack: bash curl -fsSL https://get.devdock.io | bash -s -- --profile=fullstack ⚡ Key Features Sub-5ms Terminal Rendering: Uses Starship prompt + Zsh lazy-loading tuned for ARM chips. Termux Touch Optimization: Automatically injects an ESC/TAB/CTRL touch bar and enables mouse scrolling in Tmux. Low-Memory Neovim: Starts in <50ms and uses under 50MB RAM while providing full Language Server Protocol (LSP) support for TS, Go, Python, and Rust. Curated Profiles: fullstack: Web + API tools frontend: React, TS, Vite & Tailwind preset backend: Go, Rust, Python, Postgres & Redis CLI tools devops: Kubectl, Helm, Terraform, and Cloud CLIs 🛠 Trying It Out bash Check your mobile terminal health: dock doctor View available developer stacks: dock profiles Initialize a frontend stack: dock init frontend 🔗 Open Source & Community DevDock is 100% open source under the MIT License! GitHub Repo: github.com/devdock/devdock Web Showcase: devdock.io Give it a spin on your Android phone, tablet, or cloud shell and let me know what you think in the comments below!

Being a Java Developer, I always thought about the programming language i'm working in, if it's the right one for all along the career ahead. I went through some web-based studies and, completely satisfied with the information I got to know. So, the short answer to the prime question is: Yes, Java is absolutely relevant and, here's why:- Still a Top Language Java has been in the top 3 programming languages worldwide for 2+ decades. Historical Dominance: The Backbone of Enterprise Systems: Since its inception, Java’s mantra of "Write Once, Run Anywhere" (WORA) revolutionized software development. It quickly became the foundation for global financial systems, insurance platforms, healthcare infrastructure, and e-commerce giants. Unrivaled Stability: Indexes like TIOBE and GitHub Octoverse have consistently ranked Java among the top most used languages for over 20 years. Companies do not shift their backend infrastructure on a whim; billions of dollars of existing, mission-critical infrastructure rely on the Java Virtual Machine (JVM). Enterprise Backbone Banks, insurance, e-commerce, and global-scale companies still rely heavily on Java. 95% of enterprise systems use it in some form. Banking and Financial Services (FinTech): Transactional Integrity: Mega-banks require high concurrency and absolute compliance with ACID (Atomicity, Consistency, Isolation, Durability) properties. Java's robust memory management and strict type safety prevent multi-threading errors that could result in catastrophic financial discrepancies. Legacy Settlement Layers: Systems managing global wire transfers, electronic clearing houses (ACH), and high-frequency trading platforms were built on the Java Virtual Machine (JVM) over the last 30 years. Rewriting these multibillion-dollar codebases carries massive operational risk with zero business incentive. Insurance Platforms: Complex Risk Modeling: Insurance giants process enormous volumes of historical actuarial tables and continuous risk data.

We had a checkout test at my last job that everyone called "the coin flip." Green for a week, red twice on a Tuesday, green again. Someone eventually wrapped it in a retry and it sat like that for eight months before anyone looked at it again. Turned out the real bug was a webhook that occasionally fired before the order record finished writing to the DB - a two-hundred-millisecond gap that only showed up under load. The test wasn't broken. It was the only thing in the entire pipeline that noticed. That's usually the story. Someone blames the test - bad selector, missing wait, a sleep(2) some intern left in there three years ago, and half the time they're right. But when a test flakes repeatedly and nobody can explain why, the test is rarely the actual problem. It's just the part of the system rude enough to say something. A few places I keep finding the real cause hiding. Tests that quietly depend on each other Test A writes a row, Test B reads it and never knew it needed to. Run B by itself, it passes. Run the suite in a different order, or in parallel, and B fails for no reason anyone can point to. I've lost a full afternoon to this exact thing more than once - a cache value from Test 12 leaking into Test 47. The actual fix is annoying and unglamorous: every test gets its own fixtures, its own scoped data, no assumptions about what ran before it. If your suite only goes green in one specific order, you don't have a flaky test. You have an undocumented dependency graph, and it's going to bite someone eventually. The app is racing, not the test Click a button, immediately assert on the result - that's a bet that the UI update lands the instant the click handler returns. It usually does, on your machine, on a good day. Add a debounce, a background job, or just enough network latency and that bet stops paying off. This one's frustrating because the test isn't being paranoid. The app genuinely has a race condition. The test just runs the interaction often enough, acro