标签：#r

Welcome to the “Temu experience of telehealth,” where everyone from Grindr to MAGA influencers can open a virtual clinic selling weight loss drugs and more.

https://www.404media.co/apple-hide-my-email-vulnerability-re... , https://archive.vn/mCbBw

submitted by /u/TheSwedeheart [link] [留言]

BMW's X5 lineup finally has an electric option with impressive range.

Fujifilm is expanding its QuickSnap lineup with a new disposable camera focused on taking monochrome photos and another built to survive harsh outdoor environments. The $22.90 QuickSnap Black and White and the $24.75 QuickSnap Active are expected to launch sometime later this fall, to the delight of Gen Z snappers driving the current resurgence in […]

A researcher found that using Anthropic’s Claude Opus 4.7, he could break into the website of Front Gate—used by every festival from Lollapalooza to Bonnaroo—and freely issue any ticket he chose.

Seriously, LeetCode in 2026? Everyone is saying HackerRank just killed LeetCode, and yet here I am,...

If you've submitted a BOM for quoting recently and gotten a lead time that made you do a double take, you're not imagining things. Passive component sourcing in 2026 is tighter than it's been in a few years — and MLCCs are the epicenter. I want to break down why this is happening, which component categories are actually at risk, and — more importantly — what you can do at the design stage to make your board less vulnerable to it. This isn't a "just wait it out" post; there are concrete layout and BOM decisions that meaningfully change your exposure. Why now? Three demand sources are converging on the same MLCC/inductor capacity that used to be dominated by consumer electronics: AI server infrastructure — GPU power delivery networks alone can chew through hundreds of decoupling capacitors per board, and hyperscaler order volumes dwarf typical consumer runs. EVs — automotive-grade passives (AEC-Q200, X8R/X7R) come from a narrower qualified supplier base, so even modest EV growth disproportionately tightens that segment. Renewables/grid infrastructure — pulling on high-voltage inductors and power resistors. On the supply side, new MLCC/ferrite production lines take 12–24 months to come online from the capital decision. Semiconductor fabs can reallocate capacity relatively fast; passive component fabs can't. That structural lag is the real reason lead times stretch out faster than they recover. Which parts are actually at risk Not everything is equally exposed: Category Normal LT 2026 Tight-Market LT Exposure Commercial MLCC (X7R, 0402/0603) 4–8 wks 8–16 wks Moderate–High High-density MLCC (0201, high µF) 6–10 wks 16–26 wks High Automotive MLCC (AEC-Q200, X8R) 10–14 wks 20–30+ wks Very High C0G/NP0 (precision/timing) 4–8 wks 6–12 wks Low–Moderate Power inductors (shielded, low DCR) 6–10 wks 12–20 wks Moderate–High Chip resistors 2–6 wks 4–8 wks Low Chip resistors are the least affected — manufacturing capacity is less concentrated and swapping vendors doesn't trigger a

I'm curious... What's the one feature that instantly makes you stop using a resume builder? For me, it was simple: You spend time creating your resume, everything looks great, and then the site asks you to pay just to download it. That experience inspired me to build Resumship, a resume builder where downloading your resume is completely free. Now I'm thinking about the next features to add, and I'd love to hear from the community. If you were building the ideal resume builder, what features would you include? AI-powered resume suggestions? Better ATS optimization? More templates? Portfolio integration? Cover letter generation? Something completely different? If you have a minute, I'd also love for you to try Resumship and share your honest feedback. 🌐 https://resumship.com Your feedback will directly influence what gets built next. Every suggestion, bug report, or feature request helps make the platform better for everyone. Looking forward to hearing your ideas! 🚀

The Problem When you put RabbitMQ's Management UI behind an nginx reverse proxy under a sub-path like /rabbitmq/ , queue detail pages and many API calls break silently. The root cause: nginx normalizes the request URI before proxying. It decodes %2F (the URL-encoded forward slash) into a literal / . RabbitMQ's Management API uses %2F to represent the default virtual host ( / ) in API paths: GET /api/queues/%2F/my-queue When nginx decodes it: GET /api/queues///my-queue ← broken What Doesn't Work The common advice of using merge_slashes off or a rewrite directive doesn't fully solve this because nginx still normalizes $uri before forwarding. The Fix Use $request_uri inside an if block. Unlike $uri , $request_uri holds the raw, undecoded URI exactly as the client sent it — nginx never touches it. nginx # RabbitMQ: API paths — use $request_uri to preserve %2F (never decoded by nginx) location ~* ^/rabbitmq/api/ { if ($request_uri ~* "^/rabbitmq/(.*)") { proxy_pass http://rabbitmq:15672/$1; } proxy_buffering off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; } # RabbitMQ: general UI (JS, CSS, static assets, non-API pages) location ~* ^/rabbitmq/ { rewrite ^/rabbitmq/(.*)$ /$1 break; proxy_pass http://rabbitmq:15672; proxy_buffering off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; }

Sign-in worked flawlessly in dev. Then a real user pasted a real code and got "invalid format" — before the code ever reached Supabase. The credential was fine. My regex was wrong. Here's the one-line assumption that broke auth for every human who wasn't me. I run a Discord-native Company Brain. Teams /save docs and /ask grounded answers; access is gated by a magic-link claim that emails a one-time code. Standard GoTrue OTP flow. The client shows a box, you paste the code, the server verifies it. Boring — which is exactly what auth should be. The bug: a six-digit assumption in a validation guard The claim handler did a cheap client-side sanity check before calling verifyOtp : // The bug. Looks reasonable. Rejects every real code. const OTP = /^ \d{6} $/ ; function normalize ( input : string ): string { const code = input . trim (); if ( ! OTP . test ( code )) throw new Error ( " Enter the 6-digit code from your email. " ); return code ; } Every OTP tutorial uses \d{6} . Every code demo shows six digits. So I typed six digits into the test and it passed. In dev I was generating my own codes and never actually reading the email. Supabase's GoTrue emits an eight-digit code on this project. ^\d{6}$ rejects eight digits outright. The user's perfectly valid credential got thrown out by my own front door with a lie for an error message — "enter the 6-digit code" when the email plainly showed eight. Why it happens: OTP length is a setting, not a constant The length of a GoTrue email OTP is configurable — GOTRUE_MAILER_OTP_LENGTH (Dashboard → Authentication → Email). It defaults to six in many setups and to eight in others depending on when and how the project was provisioned. The number in the tutorial is that author's project setting , not a property of OTPs. Hardcoding 6 couples your client to a server config you don't control and might change. Bump the length for security later and every client silently starts rejecting valid codes. No error in your logs — the rejection

Trump has remade the nation’s capitol in his own image. Ahead of the Fourth of July, WIRED guides you through the dizzying effects of DC’s makeover.

Give Your AI Superpowers on macOS Discussion | Link

Here's a scenario that plays out in engineering teams every day: you spin up a conversation with an AI tool to analyze some code, get a useful response, copy-paste the output, and close the tab. An hour later, you need a follow-up analysis — and you're starting from scratch. No context, no history, no continuity. Now multiply that by five tools running in parallel. ChatGPT for drafting, Claude for analysis, Copilot for code, a local model for sensitive data, maybe a custom agent for domain-specific tasks. The outputs are scattered across browser tabs, Slack threads, and clipboard history. Nothing connects. The AI tools themselves are capable enough. What's missing is the infrastructure to treat them as actual team members — with identities, workspaces, and accountability. The Identity Problem Every AI interaction today is anonymous. You talk to "the model," it responds, the session ends. There's no persistent identity, no accumulated context, no track record. This works fine for one-off questions. It breaks down the moment AI needs to participate in a sustained workflow — the kind where you need to know who did what, when, and how well. We've been building an open-source project called Octo (Apache 2.0, GitHub ) that approaches this problem by giving AI agents a proper identity system. In Octo, each AI agent is a Bot — a first-class entity with a name, a creator, a capability card, and a work history. A Bot isn't a chatbot wrapper. It's a structured identity: Creator binding : Every Bot is created by a human user and inherits a scoped subset of that user's permissions. The Bot acts on behalf of its creator, not autonomously. AgentCard : A structured capability declaration — what the Bot can do (coding, analysis, translation, design), at what level, in what domains, and with what constraints. Think of it as a resume that other team members can inspect before assigning work. Work history : Every task a Bot participates in gets recorded — completion status, quality sco