标签：#r

I've been tuning Codenames AI , a small web game where an LLM plays Codenames with you. Clue generation is tightly constrained: one word, a count, optional intended targets, JSON on the wire, then deterministic validation before anything reaches the board. As the project started attracting regular players, I wanted to improve the gameplay experience without blowing out costs. Moving one model generation from gpt-4o-mini to gpt-5-mini was my first instinct. The default reasoning setting made responses an order of magnitude slower for this workload. Minimal reasoning looked like the obvious compromise: newer model, responsive gameplay. I expected to compare clue quality, latency, and cost while the surrounding prompt, validator, and consumer contracts stayed put. That last part was wrong. The experiment stopped behaving like an A/B test What showed up was structural, and it showed up in places that had been stable for months. Validation failures started rising. Retries started rising. Entire candidate batches started failing before the game ever saw a clue. The sharpest signal came from a clue-selection path that had run untouched for months, and it hard-failed for the first time. They weren't latency regressions so much as architectural ones. It is easy to read that as "minimal reasoning made the model worse." More often, the failures were exposing gaps in contracts that had looked fine under the previous model. What each failure actually invalidated Eventually every failure traced back to one of three layers: Prompt contracts ask for exactly count targets and, in batch mode, several distinct candidates. Deterministic validators reject target/count mismatches and filter invalid candidates before anything downstream runs. Downstream consumers only see survivors. Empty batches retry with rejection feedback, then fall back if needed. Those layers share one job: enforce the same invariants. The failures below cut across all three rather than mapping one to one. Side comm

I created the official PasteDB VS Code extension that lets you upload your current file or selected code directly from Visual Studio Code. It includes secure API key storage, customizable upload settings, recent paste history, automatic language detection, and instant shareable links. In this post, I'll explain how it works, how to install it, and the challenges I faced while building it. More Info View on Marketplace

Federal authorities have arrested a Florida man suspected of stealing at least $220,000 in crypto through malware-infected Steam games, as reported earlier by local news outlet Local10. In the complaint, officials accuse 21-year-old Zyaire Wilkins and co-conspirators of launching eight malware-embedded games from around May 2024 to February 2026, allowing them to infect about 8,000 […]

How Bifrost Enterprise combines Data Access Control (DAC), Role Based Access Control (RBAC), Access Profiles, and Bifrost Edge to secure AI applications at scale. Artificial intelligence is quickly becoming part of every employee's workflow. Developers rely on coding assistants, customer support teams use AI powered chat applications, analysts generate reports with large language models, and organisations increasingly deploy AI agents connected to internal tools through the Model Context Protocol (MCP). While this rapid adoption improves productivity, it also introduces a significant governance challenge. It's no longer enough to decide who can log into an AI platform; you must also determine who can access specific AI resources, which models they can use, what they can spend, and which data they should even be able to see. This is where Bifrost Enterprise provides a comprehensive governance layer. By combining Role Based Access Control (RBAC), Data Access Control (DAC) , Access Profiles , and Bifrost Edge , organisations can secure AI workloads without slowing down innovation. Together, these capabilities create a governance framework that scales from small engineering teams to global enterprises and you can learn more about this in the documentation on GitHub . Why Enterprise AI Needs More Than Authentication Traditional enterprise applications typically answer two questions: Who is the user? What can that user do? Modern AI platforms introduce a third and equally important question: What information should this user actually be able to see? Imagine an organisation with several engineering teams working on independent AI products. Each team has its own prompts, routing rules, API budgets, virtual keys, observability data, and model configurations. If every developer can view every configuration simply because they have developer permissions, sensitive information can easily become exposed. This challenge becomes even more complicated when organisations begin deplo

Some Amazon customers logged on Friday to a surprise bill estimate claiming that they owed the tech and cloud giant billions in fees.

Just getting this concept is like money in the bank! I'm too excited for words! At age 67, I have never coded a thing in my life. All of the sudden in 2026, I find that I've become a "vibe" coder with the help of Grok and Gemini. Both in segregated project silos are acting as my PMs and doing a damn fine job of it. As CEO of a brand new company, I'm taking on the entire scope of development for The Avinoam Group, LLC. My business partner Eyal and I have a very cool vision for what we intend to accomplish. And while it is beyond the scope of this post, only 2 crazy non-dev guys would be this bold, with all due respect to the young guns here on DEV. Our core principles incorporate transparency and authenticity. I can think of no better business idea as 4 separate cornerstones (we have 4 separate projects) than the brilliant concept-commitment to #build in public. So, I'm looking forward to telling everyone what we're doing and how we're doing it. We have nothing to hide except a little "secret sauce" that we can't really talk about without shooting ourselves in the foot. Other than that, I want to "show & tell" just like when I was in kindergarten in 1964 and brought "Meet The Beatles" in to Miss Shreiner's class and all the little kids danced! Right now, I'm reading how to get the most out of DEV and being here. At my age, I like to give back. What can an old geezer whose never coded before offer? My life experience and business knowledge. For example, we are developing freepaycalc (Google it if you want) to help devs, makers and freelancers plug the leaks in their "money buckets." and how to kill off that dreaded "scope creep" that so many independent consultants and contractors get trapped in. I don't want this post to be too long. I just wanted to reinforce the value of building in public. If you want to punch through each and every challenge of a complex project, then why not tell brilliant dev colleagues what you're up to? Whatever problem you're facing has a so

Why giant AGENTS.md files may be wasting context, hurting maintainability, and making AI-assisted development harder to scale. A few years ago, for many developers, using AI for software development meant copying a small piece of code into a chat window. We would ask for a refactoring, copy the response back into the editor, run the tests ourselves, and return to the chat when something failed. Coding agents changed that workflow. Tools such as Codex, Claude Code, and others can now explore an entire repository, modify multiple files, execute commands, run tests, and iterate on failures. Coding agents turned code assistants into tools capable of executing multi-step software development tasks. But most repositories were not designed for this new kind of contributor. The repository became part of the agent's working context A coding agent needs much more than source code. It may need to understand: the project architecture; dependency boundaries; coding conventions; test strategy; build commands; local environment requirements; validation steps; security restrictions; the definition of done. A common solution is to place these instructions inside files such as AGENTS.md , CLAUDE.md , or other agent-specific configuration files. This works. I have been doing something similar in my own projects for a while. But as the repository grows, the instruction file grows with it. Eventually, a single file may contain thousands of lines covering unrelated concerns: Architecture Testing Environment setup Coding standards Infrastructure UI conventions Validation Release workflows Definition of done At that point, the file is no longer just a set of agent instructions. It has become an informal repository operating manual. The monolithic context problem A large AGENTS.md has an obvious advantage: the agent knows where to find it. But it also creates several problems. It is difficult for humans to navigate These files are not only for agents. Developers also need to read, review, m

TL;DR I checked 50 AI-generated login endpoints. Zero had rate limiting. Attackers can brute-force credentials at full speed against these routes. Adding a rate limiter takes four lines and one npm install. I asked Cursor to build a login route for a side project last month. Email, password, JWT back on success. It worked first try, passed my manual tests, and I moved on to the next feature. Three weeks later I ran a load test against it out of curiosity and hit the endpoint two thousand times in under a minute. Not one request got throttled. That's when I started pulling apart every AI-generated auth route I could find, mine and other people's open source side projects, and the pattern held everywhere I looked. The models write correct authentication logic and completely skip rate limiting, because rate limiting isn't part of "does this login work," it's part of "does this login survive contact with an attacker." The vulnerable code (CWE-307) Here's roughly what Cursor and Claude Code hand you when you ask for a login route: // ❌ No rate limiting - CWE-307: Improper Restriction of Excessive Authentication Attempts app . post ( ' /api/login ' , async ( req , res ) => { const { email , password } = req . body ; const user = await User . findOne ({ email }); if ( ! user || ! ( await bcrypt . compare ( password , user . passwordHash ))) { return res . status ( 401 ). json ({ error : ' Invalid credentials ' }); } const token = jwt . sign ({ id : user . id }, process . env . JWT_SECRET , { expiresIn : ' 1h ' }); res . json ({ token }); }); Password hashing is fine. JWT signing is fine. But nothing stops a script from hitting this route as fast as the network allows. No lockout, no delay, no cap on attempts per IP or per account. A credential-stuffing list with ten thousand leaked passwords runs against this endpoint in seconds. Why this keeps happening Rate limiting lives outside the function the model was asked to write. The prompt is "build a login endpoint," and it re

Heads-up: this post references a tool I built. It's a genuinely useful walkthrough either way — the technique applies to any Airbnb scraping project. If you've ever tried to scrape Airbnb, you already know the two walls you hit: the pages are rendered by JavaScript, and Airbnb aggressively blocks datacenter IPs. Below is the reliable way to get clean Airbnb data in 2026 — listing prices, ratings, coordinates, and discounts — without running a headless browser or babysitting proxies. The key insight: Airbnb ships its data in the HTML You don't need to render the page. Every Airbnb search response embeds the full result set as JSON inside a <script id="data-deferred-state-0"> tag. Parse that and you get structured data straight away — no DOM scraping, no selectors that break on the next redesign. The path to the results is: niobeClientData[*][1].data.presentation.staysSearch.results ├── searchResults[] // ~18 listings per page └── paginationInfo.pageCursors[] // all page cursors, upfront Each listing carries a base64-encoded ID in demandStayListing.id (decode it, take the segment after the last colon, and you have the numeric listing ID for airbnb.com/rooms/<id> ), a price line with discounts, avgRatingLocalized ("4.95 (123)"), and GPS coordinates. The two gotchas Datacenter IPs get blocked. You need residential proxies. If a response comes back without the data-deferred-state marker, you've been served a bot check — rotate to a fresh IP and retry. ~270 result cap per search. Airbnb won't paginate past ~15 pages. To cover a whole market, split into narrower searches (by price band or neighborhood) and dedupe by listing ID. The no-code way If you'd rather not maintain proxy pools and parsers, I published an Airbnb Scraper on Apify that does exactly the above. Paste a location or a full Airbnb search URL (every filter is honored), and get flat JSON/CSV back. curl -X POST "https://api.apify.com/v2/acts/ethanteague~airbnb-scraper/run-sync-get-dataset-items?token=YOUR_TOKE

Patreon is strengthening its defenses against AI scraping by working with Cloudflare to block bots that train AI models on creators’ content without permission. The move marks a shift away from relying on websites using robots.txt alone to actively block unauthorized AI training.

Ken Thompson — คนที่เขียนระบบปฏิบัติการใน 3 สัปดาห์ ปี 1969 เคน ทอมป์สัน อายุ 26 เป็นวิศวกรที่ Bell Labs เขากับทีมเพิ่งเสียโปรเจกต์ Multics ซึ่งเป็นระบบปฏิบัติการที่ซับซ้อนเกินไปจนถูกยกเลิก Bell Labs ถอนตัว ทีมแตก โปรเจกต์ตาย เคนมีเวลาเหลือเฟือ และมี PDP-7 ซึ่งเป็นคอมพิวเตอร์เก่าที่แทบไม่มีใครใช้ ใน 3 สัปดาห์ เขาเขียน Unix kernel, shell, editor, และ assembler ขึ้นมาบน PDP-7 — ทั้งหมดเป็น assembly — ภาษา B ยังไม่เกิดตอนนั้น B ถูกสร้างขึ้นหลังจากนั้น — เพื่อใช้เขียน utility ต่าง ๆ แทน assembly — และนี่คือจุดเริ่มต้นของสายภาษา B → C → Go ภาษา B — เกิดหลัง Unix เวอร์ชันแรก Unix เวอร์ชันแรกสุด — สิงหาคม 1969 — เป็น assembly ล้วน หลังจากนั้นไม่นาน Ken ก็เริ่มสร้าง B — โดยตัดทอนมาจาก BCPL — เพื่อให้มีภาษาระดับสูงไว้เขียน tools โดยไม่ต้องใช้ assembly ทั้งหมด B มาจาก BCPL (Basic Combined Programming Language) ซึ่งพัฒนาโดย Martin Richards ที่ Cambridge ในปี 1966 BCPL เป็นภาษาที่ไม่มี type — ทุกอย่างคือ word — และออกแบบมาให้ compiler พกพาง่าย Ken เอา BCPL มาตัดทุกอย่างที่ไม่จำเป็นออก — จนเหลือภาษาเล็กมากที่ทำงานได้บน PDP-7 ซึ่งมี RAM แค่ 4K words PDP-7 Assembly → Unix v1 (1969, 3 สัปดาห์) ↓ BCPL (Richards, 1966) ↓ ตัด feature, ลดขนาด B (Thompson, 1969-1970) ↓ ใช้ rewrite Unix utilities (ไม่ใช่ kernel) ↓ ↓ เพิ่ม type system, struct, portability C (Ritchie, 1972) ↓ Unix v4 rewrite ด้วย C (1973) B ไม่มี type system ไม่มีโครงสร้างข้อมูล มีแค่ word — เหมือนกับว่าเป็น BCPL เวอร์ชัน minimal B ถูกใช้เขียน shell, utilities, และ tools ต่าง ๆ ของ Unix — แต่ kernel ยังเป็น assembly อยู่ จนกระทั่ง Dennis Ritchie สร้าง C ขึ้นมาในปี 1972 ทำไมต้อง B PDP-7 มี assembly แต่นั่นไม่ใช่เหตุผลที่ดีพอที่จะใช้มัน Ken ไม่เชื่อในการเขียน OS ด้วย assembly ทั้งระบบ — assembly เร็วแต่เขียนช้า แก้ยาก พกพาไม่ได้ การใช้ภาษาระดับสูง (แม้จะสูงนิดเดียวแบบ B) ทำให้: เขียน shell, utilities เร็วขึ้นมาก แก้ไขง่าย — ไม่ต้องเขียนใหม่เวลาย้ายเครื่อง ใช้คนน้อยลง — Unix version แรกเขียนโดย 2 คน จาก B → C → Unix → ทุกอย่าง เมื่อทีมได้ PDP-11 ซึ่งเป็นเครื่องที่ใหญ่กว่า — B เริ่มมีปัญหา PDP-11 มี byte-addressing แต่ B ออกแบ

a local, Claude-powered brain-assistant for solopreneurs I kept losing good ideas — not because I forgot to write them down, but because nothing ever went back and connected them. A task on Monday, an idea on Wednesday that was secretly the same problem, a question on Friday that contradicted something I'd decided two weeks earlier. All of it just... sat there. So I built Dot Connector : a small local app where every capture is a "dot," and every few captures, Claude reviews the stream against a standing memory and surfaces three things — non-obvious connections between notes, contradictions with what you said before, and open loops you haven't closed yet. The architecture is deliberately simple. It's Express + vanilla JS, no build step, no account system. Every capture gets a cheap, fast Claude call for auto-tagging. Every 3rd capture triggers a deeper "sweep" — a second Claude call that looks at recent captures alongside standing memory and open loops, and returns structured updates: new memory facts, dot-connects, contradictions, and open-loop resolutions. Why local-first. no server of my own, notes never leave your machine except the direct calls to Anthropic's API, bring-your-own API key so there's no subscription — you pay Anthropic directly, typically well under $1/month for personal use.] Its just a steal one-time $29 download All info and download get it here: https://dot-connector.eu

I have released version 2026-07-11 of Seed7 . Seed7 is about portability , maintainability , performance and memory safety . There is an automatic memory management without a garbage collection process (which might stop the world). The templates / generics don't need syntax with angle brackets. Seed7 is an extensible programming language. The syntax and semantics of the language is not hard-coded in the compiler but defined in libraries. Seed7 checks for integer overflow . You either get the correct result or an OVERFLOW_ERROR is raised. Unlike Java Seed7 compiles to machine code ahead of time (GRAAL works ahead of time but it struggles with reflection). Unlike Java Seed7 operators can be overloaded . Unlike C, C++, Go, Zig, Odin, Nim and C3 Seed7 is a memory safe language. The standard libraries cover many application areas. Example programs are: make7 , bas7 , pv7 , tar7 , ftp7 , comanche and many more. This release consists of 1029 commits from several contributors (thanks to them). Notable changes in this release are: Many improvements have been triggered by the Seed7 community. Support for the PCX image file format has been added and the support for BMP , TGA , JPEG and TIFF has been improved. Protections against stack overflow and shell injection have been added. Checks for the result and the parameters of primitive actions have been added. Several database drivers have been improved. A detailed change log can be found at r/seed7 or GitHub . This release is available at GitHub and SF . There is also a Seed7 installer for windows , which downloads the newest version from GitHub and SF. The Seed7 Homepage is now at https://seed7.net . There is a demo page with Seed7 programs compiled to JavaScript/WebAssemly. Please let me know what you think, and consider starring the project on GitHub, thanks! submitted by /u/ThomasMertes [link] [留言]

David Risher insists that Lyft has lowered its prices and that customers who only check his competitor’s app are “leaving money on the table.”

I tested REI’s best new and revamped outdoor gear of 2026. Here’s what’s worth buying, from tents and sleeping bags to coolers and bikes.

Remarkable's Paper Pure replaces Remarkable 2, and it is quite good.