标签：#an

Plus: AI bug hunting fuels Microsoft’s biggest-ever Patch Tuesday, ShinyHunters ransomware gang exploits an Oracle zero-day, and more.

RJ Scaringe, the CEO of Rivian Automotive, joined us for a wide-ranging interview about how his company’s new electric SUV fits into the current EV industry, and what comes next.

CORE had telemetry. That was the comforting part. Every LLM exchange was being logged. Prompt tokens. Completion tokens. Duration. Cognitive role. Model snapshot. Timestamp. Privacy level. Enough information to reconstruct what the system had asked, which model had answered, and how the autonomous loop had used the result. Then I asked the obvious question: What did the last month of LLM work cost? The database had no answer. Not a bad answer. Not an approximate answer. No answer. The cost_estimate column existed. It was even part of the log model. But across 35,669 recorded LLM calls, it was populated exactly zero times. Every row was NULL. That is the kind of bug that looks small until you understand what kind of system CORE is trying to become. CORE is not just a wrapper around LLM calls. It is a governance runtime for AI-assisted software development. The point is not that an AI writes code. The point is that every AI-produced change must be traceable, authorized, constrained, audited, and defensible. So when cost attribution was missing, this was not just a FinOps bug. It was a governance blind spot. The System Could Explain the Work, But Not the Bill The strange thing was that most of the telemetry was already there. CORE knew which cognitive role made the call. It knew whether the call came from an architect, coder, reviewer, coherence analyst, or some other internal role. It knew which model handled the request. It knew the token counts. It knew when the call happened. That meant I could ask questions like: Which cognitive roles are consuming the most tokens? Which models are being used by which part of the system? Which workflows are driving LLM activity? How much autonomous reasoning happened during a given period? But I could not ask: Which cognitive role costs the most? Did routing this role to a stronger model actually change the cost profile? Did a model swap increase operational cost? Is local inference replacing paid inference in the places where it

After a year of nights and weekends, I shipped Lucidcast — an Android podcast player I built because every mainstream app I tried was missing the same three things. The app went live on Google Play this week. This post is for indie devs thinking about shipping their own Android project — six lessons I learned the expensive way. What Lucidcast does (90-second context) A podcast player with on-device AI: Whisper transcribes downloaded episodes locally (audio never leaves the phone) AI episode summaries via Gemini, with a live progress ring "Podcast" wake-word voice commands that work on the lock screen and in Android Auto Smart Pause auto-pauses on loud noises or when someone talks to you Plus the usual: chapters, transcripts, value tags (Podcasting 2.0), 22 languages, Android Auto, live radio, no accounts, no ads. Free includes the full podcast player. Pro one-time unlocks the audio intelligence engine. AI Pack subscription enables Whisper + summaries. Made in EU by a one-person Czech indie team (Prismatic s.r.o.). Play Store | Landing OK, lessons. 1. On-device Whisper is harder than it looks (NDK 29 patch needed) I wanted local transcription so audio doesn't leave the device. whisper_ggml is the only Flutter binding I found that works end-to-end. Catch: it needs Android NDK 29.0.13113456 while most other plugins are still on 27. Setting ndkVersion = "29..." in android/app/build.gradle.kts works for new builds, but the plugin's auto-detected version was sometimes off — needed a small patch script ( flutter/tool/patch_whisper_ggml.sh ) to enforce it during CI. Battery cost is real: I gate transcription to charging-only mode by default with a configurable battery threshold (10-80 %, default 50 %). When the user toggles "transcribe downloaded episodes," I queue the work but only execute when the phone is plugged in. Users on r/podcasts would otherwise notice a 5-10 % overnight battery drain. 2. Sharing the microphone is a contract nobody documents Smart Pause uses noise

An AI agent system proposed by researchers in Spain promises to prevent energy theft and damage to EV chargers, as well as the critical energy infrastructure that powers them.

Andrew Yang made a list of everything Americans overpay for — housing, food, wireless — and thinks the next startup gold rush is giving that money back.

A receiver pulling a UDP feed was missing roughly 30% of its messages. No errors, no exceptions, no stack traces — just gaps in the sequence numbers. The first suspect is always the network: a flaky switch, a saturated link, a tired NIC. The network was innocent. The packets were being dropped on the receiving host , after they'd already arrived. Here's how to tell the difference, and why it matters. Why UDP makes this sneaky UDP has no retransmission and no backpressure. When a datagram is lost, nobody is notified — not the sender, not the receiver. The packet simply isn't there. That means two completely different failures look identical from the application's point of view: The network dropped the packet before it reached your machine. Your own host accepted the packet and then threw it away after it arrived. The application sees the same thing in both cases: a missing sequence number. But the fix is in a different building depending on which one it is. Where the packets actually go The receive path is: NIC → kernel socket receive buffer → your recv() call. The kernel parks incoming datagrams in a per-socket buffer until your code reads them. If your code doesn't drain that buffer fast enough, it fills, and the kernel drops the overflow. Crucially, the kernel counts those drops. On Linux: # Per-protocol summary — look for "receive buffer errors" netstat -su # Or straight from the kernel counters cat /proc/net/snmp | grep -A1 Udp # InDatagrams ... InErrors RcvbufErrors ... If RcvbufErrors is climbing, the network did its job and your host discarded the datagrams. That single counter collapses a week of "is it the switch?" into about ten seconds of certainty. The actual cause In this case the socket receive buffer was sitting at the default (~208 KB). The sender burst faster than a single receive thread could call recv() . Average throughput looked fine on every dashboard — but the bursts filled the buffer in milliseconds, and everything past the brim was dropped.

有時候我剛跑完一個指令，馬上發現其實只需要改其中一小部分。 例如我剛用 ffmpeg 轉了一個影片： ffmpeg -i calligraphy01.mp4 -c :v libx264 -c :a aac calligraphy_good_01.mp4 然後我想用同樣的指令處理下一個檔案： ffmpeg -i calligraphy02.mp4 -c :v libx264 -c :a aac calligraphy_good_02.mp4 如果用傳統方法，我可能會按上箭頭，然後手動把兩個地方的 01 改成 02 。 但在 zsh 裡，可以直接輸入： !! :gs/01/02/ 意思是： 拿上一個指令，把所有的 01 都換成 02 ，然後執行。 所以這個： !! :gs/01/02/ 會展開成： ffmpeg -i calligraphy02.mp4 -c :v libx264 -c :a aac calligraphy_good_02.mp4 語法是什麼意思？ !! 代表「上一個指令」。 :gs/01/02/ 代表「把所有 01 全部替換成 02 」。 所以完整的： !! :gs/01/02/ 意思就是： 使用上一個指令，把所有 01 改成 02 ，然後執行。 先預覽，不要馬上執行 有時候我不想讓它立刻執行，尤其是指令比較長、比較重要，或者執行成本比較高的時候。 這時可以加上 :p ： !! :gs/01/02/:p 它會只印出修改後的指令，不會執行： ffmpeg -i calligraphy02.mp4 -c :v libx264 -c :a aac calligraphy_good_02.mp4 如果看起來沒問題，就按一下 上箭頭 ，把剛剛印出的指令帶回命令列，再檢查一次，然後按 Enter 執行。 比較安全的流程就是： !! :gs/01/02/:p 確認輸出結果後： 上箭頭 → 再看一次 → Enter 這對比較長、比較容易打錯、或不想立刻執行的指令很有用。 只替換第一個地方 如果你只想替換第一個出現的地方，也可以用： ^01^02 不過像上面的 ffmpeg 例子，輸入檔名和輸出檔名裡都有 01 ，所以通常會比較適合用： !! :gs/01/02/ 這種小技巧每次可能只省幾秒鐘，但如果你常常在 command line 裡重複處理檔案、日期、編號、影片、圖片或 migration，累積起來真的會讓工作順很多。

Magento's default Luma checkout loads a heavy Knockout.js stack, dozens of RequireJS modules, and payment iframes that fight for the main thread. For merchants where checkout is the conversion bottleneck, shaving seconds off load and interaction time pays back faster than another homepage hero image. We rebuilt checkout in React— React Checkout Pro —for Magento 2 and Hyvä stores that needed Shopify-like speed without leaving Adobe Commerce. Here is what we measured, what surprised us, and what we would do differently. The problem: checkout is where Core Web Vitals go to die Homepage optimizations are table stakes. Checkout is different: More JavaScript. Payment methods, validators, shipping step observers, and third-party scripts stack on one route. More layout shift. Address suggestions, shipping method lists, and tax updates re-render large DOM regions. More input delay. Autocomplete plugins, reCAPTCHA, and BNPL widgets compete on keydown handlers. On a representative Luma checkout (mid-size US retailer, ~80 SKUs in catalog, 4 payment methods), lab tests before migration showed: Metric Luma checkout (before) React checkout (after) LCP (lab, 4G) 4.8s 2.1s INP (field interaction) 320ms 95ms CLS (full flow) 0.18 0.04 JS transferred (checkout route) ~1.9 MB ~420 KB Time to interactive (est.) 6.2s 2.8s Field data from CrUX lagged lab wins by 4–6 weeks but trended the same direction once cache and CDN rules settled. Your numbers will differ. The pattern we see repeatedly: the biggest win is shipping less JavaScript to checkout , not micro-optimizing the JavaScript you keep. Architecture: React island, Magento brain We did not headless the entire storefront. Magento still owns: Quote totals and tax calculation Shipping rate requests Payment tokenization and order placement APIs Customer session and cart persistence React owns the UI layer: step navigation, form state, validation UX, and optimistic updates while Magento APIs catch up. High-level flow: Browser → React Chec

Coding agents are no longer just autocomplete with a longer prompt. GitHub describes Copilot cloud agent as software that can research a repository, create an implementation plan, make code changes on a branch, run in an ephemeral GitHub Actions-powered environment, and let a developer review or create a pull request afterward. OpenAI's Codex GitHub integration similarly positions code review as a repository-aware review pass that follows AGENTS.md guidance and focuses comments on serious issues. That shift changes the buyer question. The useful question is not "does the agent usually write code?" It is "can the team detect when the agent drifts away from the developer's intent before the change reaches production?" A May 2026 arXiv paper, "How Coding Agents Fail Their Users" , gives teams a better vocabulary for that review. The authors studied 20,574 real IDE and CLI coding-agent sessions across 1,639 repositories and define misalignment as a breakdown that becomes visible through developer correction or pushback. The paper reports seven recurring symptom categories: wrong project diagnosis, misread developer intent, developer constraint violation, self-initiated overreach, faulty implementation, operational execution error, and inaccurate self-reporting. Effloow Lab also ran a bounded OpenAI API check using three synthetic, non-confidential coding-agent transcript snippets. The run did not measure real-world incidence, compare vendors, or reproduce the paper. It produced a small rubric that maps visible symptoms to review gates such as diff-scope checks, evidence-before-edit checks, acceptance-criteria coverage, and verification-output requirements. The public lab note is available at /lab-runs/coding-agent-misalignment-failure-taxonomy-poc-2026 . This guide turns that research and lab output into a practical QA checklist for teams buying, piloting, or packaging coding-agent workflows. Why This Matters for Agent Buyers Coding-agent procurement often starts with p

Hey tech family! 👋 If you’ve noticed your favorite Chrome extensions acting a bit differently lately or if you're a developer currently sweating over a massive codebase rewrite you are experiencing the era of Manifest V3 (MV3) . 🤖 Google has officially pushed the web ecosystem forward by deprecating Manifest V2, making MV3 the absolute standard for how browser extensions behave. But why is this happening, what actually changed, and why is the internet so divided over it? Let’s break it all down in plain English! 👇 🧐 What Exactly is Manifest V3? Think of a "Manifest" as the blueprint file ( manifest.json ) that tells the browser exactly what an extension is, what files it uses, and what permissions it needs to run. Manifest V3 is Google's major architectural overhaul of this system. Its core mission sounds great on paper: improve user privacy, beef up security, and boost browser performance . However, achieving those goals meant rewriting the core rules of how extensions interact with your browser. 🛠️ The Biggest Changes & New Features MV3 isn't just a small patch; it fundamentally alters the underlying extension engine. Here are the headline shifts: Goodbye Background Pages, Hello Service Workers! 💤 In MV2, extensions used hidden, persistent background pages that ran 24/7, hogging your computer's RAM even when you weren't using them. MV3 replaces these with Service Workers. They are event-driven meaning they wake up, execute a task (like clicking an extension icon), and go right back to sleep. Hello, free RAM! 🐏 The Ad-Blocker Shakeup: webRequest vs. declarativeNetRequest 🛑 This is the most controversial change. In MV2, powerful extensions like uBlock Origin used the webRequest API to intercept, read, and block network requests in real-time using complex code. MV3 replaces the blocking version of this with declarativeNetRequest . Instead of letting the extension intercept the data, the extension must now hand Chrome a pre-defined list of rules, and Chrome does the b

The tech giant said a group called "Outsider Enterprise" used AI to scam hundreds of thousands of victims, sending 2.5 million text messages over a span of two weeks.

The company made its heavily anticipated debut on Friday, trading higher than its initial $135 IPO price.

A SpaceX-Tesla merger seems inevitable.

Section 702 of FISA to expire tonight, but certification lasts until March 2027.

TL;DR: HTML-first means shipping real, server-rendered content before any JavaScript runs, then adding scripts only where they earn their place. In 2026 this approach is winning again, not out of nostalgia, but because the median mobile page now ships around 646 KB of JavaScript, fewer than half of mobile sites pass Core Web Vitals, and the browser already does natively what many sites still pull in libraries for. For most business websites, progressive enhancement is faster to ship, cheaper to run, and easier to keep alive. Sometime in 2026, "just use HTML" stopped being a contrarian take. I noticed it first in my own client work, not in a conference talk. The sites that start close to the platform, plain HTML, forms, links, server rendering, and add JavaScript only where it genuinely helps, are the ones that launch faster, load cleaner, and generate fewer confused support messages two months later. This is not anti-JavaScript. It is a reaction to a decade of reaching for a framework before asking whether the project needed one. The pendulum is swinging back toward the browser, and the numbers explain why. What HTML-first actually means (and why it is not 2009 web design) The fastest way to misunderstand this is to picture table layouts and inline styles. That is not it. HTML-first is an order of operations. You build a page that is complete and usable as server-rendered HTML, then you enhance it. The content is readable before a single script loads. The form submits even if JavaScript never arrives. This is the old idea of progressive enhancement , applied deliberately with modern tools instead of by accident. There is a small but real movement around this now. The HTML First community manifesto argues, fairly, that the platform has far more capability than most teams use. You do not have to agree with every line of it to notice the shift. The point is not to ban JavaScript. The point is to stop treating it as the default starting material for every page. The 2026

Há alguns meses, pagando $7/mês por um servidor de 512MB no Render pra hospedar uma API de um projeto da escola, decidi entender como esse tipo de infraestrutura funciona por baixo — e construir a minha própria versão. O resultado é o Arctis Deploy : uma plataforma de deploy contínuo via Git, com Docker isolado por projeto. Esse post é sobre como ela funciona por dentro. Arquitetura geral Frontend (Next.js) │ ▼ Backend (Go + Fiber) — Clean Architecture │ ├──► Deploy-Agent (roda em cada servidor) → Docker └──► Database-Agent (provisiona MySQL/Postgres) em desenvolvimento, ainda não disponível para usuários Cada servidor de produção roda um deploy-agent próprio. O backend central envia comandos via HTTPs autenticado e o agent executa o que for necessário — clone, build, container, métricas. O pipeline de deploy Todo deploy passa por 5 etapas sequenciais: clone — git clone --depth 1 , otimizado pra trazer só o necessário analyze — detecta o framework automaticamente lendo package.json , requirements.txt , go.mod , etc. build — gera um Dockerfile multi-stage específico pro framework detectado (timeout: 15min) deploy — sobe o container na porta alocada, com limites de CPU/RAM aplicados health check — faz requisições até o container responder, com rollback automático em caso de falha Cada etapa emite logs estruturados ( info / warn / error ), transmitidos via WebSocket em tempo real pro frontend. Detecção automática de framework Next.js, React, Vue, Node.js, e sites estáticos. A detecção é baseada nos arquivos do repositório — o usuário só conecta o Git e dá push. Outros detalhes Pool de recursos : cada plano define um total de Projetos/CPU/RAM/disco que o usuário distribui livremente entre seus projetos Auto-sleep : no free, containers sem tráfego são pausados ( docker pause ) — não destruídos — e despertam automaticamente na próxima requisição Domínios : subdomínio automático ou domínio próprio, com SSL via Cloudflare Pagamentos : MercadoPago integrado, planos em real V

TechCrunch has followed SpaceX's start, struggles, and successes from the early days. And we're here for what happens next too. This package of SpaceX IPO coverage includes who stands to win (and maybe some who won't), pre-IPO deals, and what's tucked inside its S-1 registration document.

A pending report on climate attribution may be setting the stage for conflict.

The company made its heavily anticipated debut on Friday, trading higher than its initial $135 IPO price.