标签：#ev

Claude Fable 5 me permitiu criar um "GTA" em apenas um prompt. Prompt: "Crie um jogo, Tiny GTA 3D." A própria Anthropic afirma que o Fable 5 é seu modelo mais poderoso já lançado ao público, com avanços significativos em engenharia de software, pesquisa científica, visão computacional e execução autônoma de tarefas complexas. Em testes iniciais, empresas relataram que o modelo foi capaz de comprimir meses de trabalho de engenharia em poucos dias. Cidade 3D aberta com 64 quarteirões, prédios, parques e oceano Dirija, roube carros e fuja da polícia Sistema de procurado com 5 estrelas, viaturas e helicóptero te perseguem 42 pedestres vivos que fogem, voam e morrem 16 missões de entrega com histórias de corrupção brasileira Áudio sintetizado: motor, sirene, buzina e cantada de pneu Recorde salvo no navegador Jogue aqui: https://andredarcie.github.io/tiny-gta/

Most developers know Haskell as a language for functional programming, type safety, compilers, parsers, and beautiful mathematical abstractions. But can Haskell also be used to build an interactive engineering simulator? That was the motivation behind my project: Four-Bar Mechanism Haskell Simulator Repository: https://github.com/mohammadijoo/Four-Bar-Mechanism-Haskell This project is a browser-backed desktop-style GUI application written in Haskell. It visualizes, classifies, and animates a planar four-bar linkage mechanism, which is one of the most classical mechanisms in mechanical engineering, kinematics, and machine design. The GUI is built with Threepenny-GUI , so the interface runs in a local browser window, while the mathematical model and mechanism logic remain written in Haskell. For me, the interesting part was not only drawing a moving linkage. It was about connecting mechanism design theory , computational geometry , and functional programming in one small educational simulator. What is a four-bar linkage? A four-bar linkage is a closed-loop mechanical system made from four rigid links connected by four revolute joints. In this project, the four links are: Symbol Name Description g Ground link Fixed distance between pivots A and B a Input link Rotating link from A to moving pivot C b Output link Link from fixed pivot B to moving pivot D f Floating link / coupler Link connecting moving pivots C and D The fixed pivots are placed at: A = ( 0 , 0 ) , B = ( g , 0 ) The input link rotates by angle α . Therefore, point C can be computed directly as: C = ( a cos α ,; a sin α ) Point D is more interesting. It must satisfy two geometric distance constraints: ∣ D − C ∣ = f ∣ D − B ∣ = b So the simulator solves the position of point D using a circle-intersection method. One circle is centered at C with radius f . The other circle is centered at B with radius b . Where those two circles intersect, the mechanism can close. That is the basic geometric heart of the sim

Building a URL shortener with Cursor, ChatGPT, AWS Lambda, API Gateway, and Cloudflare taught me more about shipping software than writing code. Since last year, Cursor has been my go-to development assistant for daily tasks. But at the beginning of this year, just using it to generate snippets didn't feel like enough anymore. Having studied programming since 2011, I knew what modern AI tools could do, but I wanted to test their limits. I decided to build a full project—a URL shortener—without writing a single line of frontend or backend code myself. For the stack, I chose Node.js with TypeScript, React with Vite, and AWS Lambda to handle redirects. While I used ChatGPT to debate architectural trade-offs, Cursor generated the entire codebase. Watching a functional application take shape so quickly was the exact moment a line was crossed for me. It made me realize how fundamentally software development is shifting: our role is evolving from code writers to architectural decision-makers and problem-solvers. But truth be told, this project and this post represent a massive personal milestone. Like many developers, I have a graveyard of half-finished projects on my machine. This is one of the first times I've pushed a personal project all the way to production. Writing this and exposing my work to the community is a huge first step for me. This isn't just a story about code or AI—it's about the challenge of finally shipping something. The Stack Before asking Cursor to write a single line of code, I wanted to map out the architecture. I didn't need a massive enterprise system for a URL shortener, but I did want something flexible enough to support future features and experiments. To validate my ideas, I used ChatGPT to debate the pros and cons of different architectural approaches. We eventually settled on this stack: Backend: Node.js + TypeScript Frontend: React + Vite Database: MongoDB Atlas Redirects: AWS Lambda Entry Point: AWS API Gateway DNS / CDN: Cloudflare Secur

The automaker today is turning on vehicle-to-grid charging for its GM Energy customers. Will people actually use it?

EVs from GM will soon be able to top up at more kinds of public chargers.

Grab a refreshing slice of cold watermelon (because it’s summer in Tokyo and I love it!), and let me...

I’m building a website that will eventually become a collection of useful browser-based tools, similar to iLovePDF but covering many different categories. The goal is simple: No downloads No accounts Fast and mobile-friendly Free to use I’m researching what people actually need before building more tools. What’s a small utility, calculator, converter, formatter, generator, or productivity tool you use regularly but wish had a better version? Examples: Land measurement calculators PDF tools Text formatting tools Developer utilities SEO tools Study tools I’d love to hear your ideas and pain points. submitted by /u/Nikpa_2163 [link] [留言]

SQL is arguably the most widely used language in software engineering, yet it is often the least carefully written. Most teams enforce strict linting on their application code but leave SQL queries as a free-for-all. This guide covers the formatting rules that separate maintainable, team-friendly SQL from query spaghetti that haunts on-call rotations. Why Poorly Written SQL Is a Real Engineering Problem Unformatted SQL is not just an aesthetic issue - it is a correctness risk. Dense, run-on queries make it nearly impossible to spot accidental Cartesian products, missing GROUP BY clauses, or WHERE conditions that silently bypass indexes. By the time a performance problem surfaces in production, tracing it back to the root cause becomes a painful exercise in reading someone else's stream of consciousness. Rule 1: Keyword Capitalization SQL engines treat select and SELECT identically, but human readers do not. Always uppercase reserved keywords such as SELECT, FROM, WHERE, JOIN, GROUP BY, and ORDER BY. Keep table names, column names, and aliases lowercase. This single habit immediately creates a visual boundary between the logic structure of the query and the underlying data it operates on. Rule 2: Indentation and Clause Alignment Think of SQL clauses as layers in a data pipeline. Each major clause - SELECT, FROM, WHERE, GROUP BY, ORDER BY - should start at the left margin. Columns and filter conditions beneath them should be indented by 4 spaces (or 1 tab, as long as your team is consistent). This structure lets any reviewer skim the query top-to-bottom and understand the data flow at a glance. Rule 3: Trailing vs. Leading Commas This is a genuinely debated topic on data teams. Leading commas (placing the comma at the start of each new line) make version control diffs significantly cleaner when columns are added or removed. Trailing commas look more natural for developers coming from JavaScript or Python. Neither approach is wrong - what is wrong is mixing both styles

When you expose inventory or checkout endpoints to public-facing front-ends or third-party webhooks, safeguarding those APIs from brute-force scripts, scraping bots, and inventory hoarding algorithms becomes a critical requirement. Without defensive rate limiting, a single coordinated script can easily overwhelm your database connections. The Problem with Simple Counter Resets A common mistake when setting up basic API protection is using a rigid "Fixed Window" counter (e.g., allowing 100 requests per minute, resetting exactly at the turn of the clock). This creates a massive flaw where a developer can flood your server with 100 requests at 11:59:59 and another 100 requests at 12:00:01, effectively doubling your acceptable burst traffic and causing severe performance dips. To handle uneven burst traffic safely without crashing your database, the standard approach is implementing a token bucket algorithm. The Token Bucket Pattern The token bucket algorithm maintains a centralized bucket that holds a maximum capacity of tokens. Tokens are added back to the bucket at a constant, predictable rate over time. Each incoming API request consumes exactly one token. If the bucket is completely empty, the request is instantly rejected with a 429 Too Many Requests status code, protecting your core server threads. javascript // Quick Redis-based token bucket rate limiter concept async function isRateLimited(userId) { const key = `rate:${userId}`; const now = Date.now(); // Use a Redis multi-exec transaction to atomically check and update tokens const [tokens, lastRefill] = await redis.hmget(key, 'tokens', 'lastRefill'); // Calculate token replenishment based on time elapsed... // Return true if tokens <= 0, otherwise decrement tokens and update timestamp }

Exactly one year ago, my terminal was a blank slate. I started where almost everyone does , wrestling with HTML, CSS, and JavaScript, trying to understand the web pixel by pixel. What began as curiosity quickly turned into a full obsession. I went from building simple static pages to diving deep into full-stack development. Here’s what that intense first year of constant building, breaking things, and shipping real projects has looked like. The Leap into Modern Frameworks Once vanilla JavaScript started feeling limiting, I jumped into React . Component-based thinking completely changed how I approached interfaces. Then came Next.js — it bridged client-side beauty with server-side power and pushed me into a true full-stack mindset. The Ultimate Test: Lynvista Safaris The biggest challenge was building lynvistasafaris.com , a live travel booking platform for a real client. This project forced me far beyond tutorials and into real engineering problems. I had to implement: Payment infrastructure from scratch with Daraja API (M-Pesa STK pushes) and Paystack for international transactions. A robust database layer using Drizzle ORM + MySQL. Custom business logic , including a multi-currency pricing system with special validation rules for currencies like GBP. It was messy , many late nights debugging webhooks, schema mismatches, and edge cases , but shipping it taught me more than any course ever could. What One Year Taught Me Syntax is just a tool. The real skill is learning how to break down complex problems, debug effectively, and keep iterating even when things break in production. I’m incredibly proud of the progress I’ve made in 365 days (402 contributions later), but I know I’m still at the very beginning. For the next phase, I’m focused on shipping more projects, writing about the crazy bugs I encounter, and deepening my architectural and full-stack skills. If you want to see what I’m building right now, check out my GitHub .

In Q1 2026, OpenAI and Anthropic moved enterprise customers from flat-rate plans to token-based billing. The change looks administrative, but it had a direct consequence for engineering teams: the real cost of AI became visible for the first time. The market's reaction over the following two months was enough to reopen a question many considered settled: does AI actually deliver measurable ROI? What happened when the bill arrived The most documented case is Uber. The company had encouraged all employees to use agentic tools as much as possible and even ranked AI usage internally on leaderboards. The result: the entire annual budget was consumed in four months. The response was a $1,500/month cap per employee per agentic coding tool (Claude Code, Cursor, and similar). At Brex, engineers were limited to $500/week in tokens; employees outside engineering received a $5/week cap. T-Mobile temporarily capped usage at $2,000/month per user with plans to migrate to a tiered system. One unnamed company, according to Ed Zitron in "AI Is Slowing Down" (June 2026), spent $500 million on Anthropic models in a single month due to absent spend controls. These are not isolated cases. A KPMG survey reported by the Wall Street Journal in June 2026 found that only 26% of companies have a comprehensive view of their AI costs; 50% have partial visibility; and 22% only find out what they owe after the bill arrives. Steve Chase, KPMG's global head of AI, told the Journal: "It's a new resource that needs to be managed that didn't exist quite that way, and we're seeing exponential growth." The structural problem behind the spending caps The spending caps are a symptom. The root cause, as Zitron details in the same article, is that the economics of generative AI require numbers that currently seem out of reach. Anthropics has made over $330 billion in compute commitments with Google, Amazon, and Microsoft, plus another $45 billion with CoreWeave and SpaceX. To cover those commitments, it nee

73 cryptographically signed npm packages from Microsoft were compromised last week with advanced credential-stealing malware that fires the moment a developer opens one in an AI coding agent. Claude Code, Gemini CLI, Cursor, VS Code — all trigger it. It's the second supply-chain attack in two months against the same Microsoft account. "The genius of this Miasma worm lies in how it adhered to legitimate workflows. It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem." — Cloudsmith What actually changed 73 official Microsoft npm packages were poisoned with the Miasma worm — a clone of TeamPCP's open-sourced Mini Shai-Hulud toolkit Malware executes automatically when any of the 73 packages are opened inside an AI coding agent The payload (28 KB) harvests credentials from AWS, Azure, GCP, Kubernetes, 90+ dev tool configs, and password managers , then spreads laterally through cloud infrastructure Attack vector: stolen Microsoft publisher credentials → bypasses the build pipeline entirely → malicious build published with valid SLSA provenance attestation Each infection gets a uniquely encrypted payload — meaning hash-based IOCs are useless for detection GitHub initially flagged packages as "terms of service violations" rather than malware; Microsoft only acknowledged possible malicious content 48 hours later The same Microsoft account was compromised in May 2026 (durabletask Python SDK on PyPI, 400k downloads/month) — and apparently wasn't fully remediated Why this one stings The supply-chain attack playbook has levelled up. SLSA provenance — the framework designed to give you cryptographic confidence that a package came from a legitimate build — was used against you here. Attackers stole a legitimate Microsoft OIDC token, published a malicious build with real provenance, and conventional scanners waved it through as a routine trusted update. The AI agent angle makes it worse.

I’ve been working on a unit conversion website and would appreciate feedback from fellow developers. Goals: Fast loading Mobile friendly SEO focused Clean UX Site: https://myunitconverter.app I’d especially love feedback on: Navigation Search experience Performance Features worth adding Happy to return feedback on your projects too. submitted by /u/Nikpa_2163 [link] [留言]

Apple has announced the latest version of macOS. It’s all about the reintroduction of Siri, which is now accessible from anywhere on the Mac desktop.

Apple took the wraps off iOS 27 at its WWDC event, and the iPhone update is chock-full of smart upgrades, with a big focus on improvements to Siri.

submitted by /u/feross [link] [留言]

Founder and CEO RJ Scaringe has called it "maybe the most important thing we've launched to date."

Apple used to question whether generative AI-powered editing features were worth the risk of distorting our perceptions of the world. Now it seems Apple no longer believes that photos should accurately capture reality. At WWDC 2026, the company announced a host of new AI-powered photo editing tools. They give users effortless powers of manipulating images […]

"How do I hide wp-admin" is one of the most-searched WordPress security questions, and most answers give the same advice: install a plugin that renames your login URL. That advice isn't wrong. It's just answering a smaller question than the one being asked. Renaming /wp-login.php to /my-login moves the login form. It does not change what answers at the old path, what your plugin folders advertise, or what your home page tells a scanner about the stack underneath. If your only problem is the password-guessing bot hammering the default form, a renamer solves it. If your problem is "stop my site from being identified and targeted as WordPress," you've solved maybe a third of it. Here are the three leaks a login rename leaves open. Leak 1: the old path still costs a full WordPress boot When a login-URL renamer "blocks" the default path, the request to /wp-login.php still loads WordPress. PHP starts, the plugin stack initializes, and only then does the plugin decide to return a 404 to the logged-out visitor. The visitor sees a 404. Your server still did the work of booting WordPress to produce it. On a quiet site, nobody notices. On a site taking tens of thousands of probes a day, that's tens of thousands of full WordPress boots spent generating 404s. Your security dashboard's "attempts blocked" counter looks great. Your CPU graph disagrees. The architectural alternative is to reject the request at the rewrite layer, before PHP runs: # Apache .htaccess — reject the default login path at the server level < IfModule mod_rewrite.c > RewriteEngine On RewriteCond %{REQUEST_URI} ^/(wp-login\.php|wp-admin) [NC] RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC] RewriteRule .* - [R=404,L] </ IfModule > # nginx — same idea, requires a config reload after change location ~ * ^/(wp-login \ .php|wp-admin) { if ( $http_cookie !~* "wordpress_logged_in") { return 404 ; } } The probe to the old path returns 404 from the server, WordPress never loads, and the request costs almost nothi

Visibility Comes Before Optimization in IT Operations is a practical operating principle, not a slogan. The useful version of analytics, automation, and software operations is usually quieter than the marketing version. It is less about collecting everything or automating everything, and more about making the work easier to understand, review, and improve. The practical problem Teams often try to optimize before they can see the system clearly. That creates confident changes based on partial evidence, especially in infrastructure and telecom-adjacent workflows where signals are distributed. This is where many teams lose clarity. They have tools, charts, workflows, and activity, but the connection between evidence and decision is weak. When that connection is weak, software work becomes harder to evaluate. Teams still make decisions, but they rely more on memory, opinion, or urgency than on a reviewable operating picture. A smaller operating model Start with visibility: what is running, which state changed, where the weak signal appeared, and which workflow was affected. Then connect that signal to a decision or operational review. The important detail is restraint. A useful system does not need to track every possible action or automate every possible step. It needs to preserve the signals that help operators understand the situation and act with more confidence. That usually means naming the workflow, keeping the outcome visible, preserving enough context to explain the signal, and making uncertainty explicit instead of hiding it behind a polished interface. What to review Useful analytics separates normal activity from operational risk. It should make the next investigation smaller, not create another dashboard that requires interpretation from scratch. A reviewable system is easier to trust because it can explain its own state. It shows what happened, what changed, what remains uncertain, and which decision should move next. For WebmasterID, this is the practical