标签：#r

Here is an uncomfortable one: you do not own your reading list. You rent it. Every "follow" button you have pressed in the last decade put your reading relationship inside a company's database, where it can be ranked, throttled, or ended the day the business model changes. You did not sign anything. You just stopped owning it. It was not always like this. Feeds were the quiet machinery that kept the web interoperable. RSS and Atom meant a site, a reader, and a robot could all agree on the same stream without asking anyone's permission. You published once, and anything could read it: whatever app, whatever order, no algorithm in the middle. Then it eroded. Plenty of sites ship no feed at all now, and "follow us" quietly became "create an account on someone else's platform." The reason is not mysterious. Platforms had every incentive to close the loop, because a feed lets you leave, and an account does not. So the industry swapped "here is my stream, read it however you like" for "log in to see updates," and a generation of sites simply stopped publishing feeds, because the platform was where the audience was. That is the trade you made without noticing. The open format that asked nothing of you got replaced by a login that asks for everything. Your reading list used to live in your reader and survive a company changing its mind, its ranking, or its whole business. Now it lives in their database and survives exactly as long as they allow. Getting it back is not nostalgia. It is infrastructure for independence: tooling that treats feeds as a first-class citizen, aggregates the sources you actually choose, and keeps that stream under your control instead of a platform's. The full case for why this is worth fixing, and what feed-first tooling looks like, is here: https://mederic.me/blog/open-web-feeds So, honestly: how many of the people and sites you follow could you still read tomorrow if the platform in the middle disappeared tonight?

Most web applications contain at least one vulnerability from the OWASP Top 10. A typical security audit takes 2-3 weeks and costs upward of $10,000. An LLM can compress the initial audit down to a few hours because it scans code for patterns rather than specific CVEs. Below are 15 vulnerabilities found while auditing production code with Claude. Each includes the vulnerable code, the fixed version, and a prompt to reproduce the finding. Classification follows OWASP Top 10 (2021). Order reflects frequency of occurrence: most common first. Methodology: how to run an AI security audit The audit consists of three passes. First, a broad scan: the LLM receives the entire project and looks for vulnerability patterns. Second, deep analysis: each identified pattern is verified in context (middleware, ORM, framework). Third, verification: manual review of every finding, because LLMs produce false positives. Prompt for the broad scan: Perform a security audit of this code. For each finding, include: 1. CWE ID and name 2. OWASP Top 10 category 3. Severity (Critical/High/Medium/Low) 4. The vulnerable code snippet 5. Attack vector -- exactly how an attacker would exploit this 6. Fixed code Ignore stylistic comments. Focus on security only. Start with injection attacks, then broken access control, then the rest. This prompt works because it defines the output structure and prioritizes categories. Without explicit instructions, the LLM mixes critical vulnerabilities with remarks about email validation. More on structured AI code review: AI Code Review Checklist . A03:2021 -- Injection 1. SQL Injection via string concatenation The most common finding. Shows up even in projects using an ORM, because developers switch to raw queries for complex filters. Vulnerable code: // API endpoint for user search app . get ( ' /api/users ' , async ( req , res ) => { const { search , sortBy } = req . query ; const query = ` SELECT id, name, email FROM users WHERE name LIKE '% ${ search } %' ORDER

I'm writing a short series of tutorials on FlashAttention, the algorithm that largely powers modern LLMs. The core idea is to spot the associative structure hiding in the loop. Once you see it, you get two things: you can fuse the passes (in the case of attention, it is huge, because it avoids ever materializing the score matrix) and split and recombine the work across GPU threads or any parallel processor. This post is about recognizing that structure. The stable softmax operation on a vector x (part of the attention kernel) is computed as follows: m = max_j x_j softmax(x)_i = exp(x_i - m) / Σ_j exp(x_j - m) Naively, you would write something like: # pass 1 — running max m = -inf for j in 0..N: m = max(m, x[j]) # pass 2 — denominator, needs the final m d = 0 for j in 0..N: d += exp(x[j] - m) # pass 3 — normalize for j in 0..N: y[j] = exp(x[j] - m) / d The trick is not to wait for the final max before accumulating the denominator. Carry both in a small state (m, d) and rescale d whenever the max moves. Here is what the online version of the algorithm above looks like: # one pass — carry (m, d) together m, d = -inf, 0 for j in 0..N: m_new = max(m, x[j]) d = d * exp(m - m_new) + exp(x[j] - m_new) # rescale, then add m = m_new # normalize (unchanged) for j in 0..N: y[j] = exp(x[j] - m) / d It turns out this is not a one-off trick. There is a whole class of "secretly associative" loops that you can parallelize by introducing the right carrier state. The tutorial goes into detail, shows a few examples of secretly associative operations, provides the algebraic formulation for those, and gives some tools to help you recognize secretly associative loops. Overview: Safe softmax, Welford's variance, and FlashAttention belong to the same class of secretly-associative operations The twisted monoid via transport of structure, why the max-rescale coupling doesn't break associativity Third Homomorphism Theorem as a test for whether any loop is secretly associative Numerical analys

We stopped measuring retrieval quality by how many tokens we could fit into the prompt. When...

Trying to diversify what I listen to and interested to hear what everyone else is enjoying this year!

The fastest, most accurate dictation model in the world Discussion | Link

Automates your existing workflows with a single prompt. Discussion | Link

I've lost count of how many AI side projects I started and abandoned. The pattern was always the same: a spark of excitement, two weeks of frantic coding, then the slow fade into yet another half-finished repo collecting dust on GitHub. But something changed in the last two months. I shipped three AI-powered MVPs to real users. Not all of them made money, but every single one taught me something about what it actually takes to go from "cool idea" to "working product." Here's what I learned. The brutal truth about AI side projects When I started my first real AI project back in February, I had grand ambitions. I was going to build a content summarizer that would pull articles from any URL, analyze sentiment, and generate Twitter threads. I spent three weeks obsessing over the perfect prompt engineering, containerizing the whole stack with Docker, and setting up a complex pipeline using LangChain and Pinecone. Then I showed it to a friend. "Can I just paste a link?" she asked. I had built an entire orchestration layer, but the input field was buried behind two authentication screens. The project died that weekend. Here's the thing I keep rediscovering: AI side projects fail not because the technology doesn't work, but because we over-engineer before we have users. The three MVPs that actually shipped After that failure, I changed my approach. I decided to ship something—anything—every two weeks. No matter how ugly. No matter how incomplete. The goal was to have a URL someone could visit and use. MVP #1: A dead-simple blog title generator I built this in a single afternoon. The entire frontend was a text box and a button. Backend? A single Node.js endpoint that called OpenAI's API with a prompt like: "Generate 5 catchy blog titles about [topic]." Here's the code that powered it (I've simplified it, but this is the gist): import express from ' express ' ; import OpenAI from ' openai ' ; const app = express (); const openai = new OpenAI ({ apiKey : process . env . OPENAI

I built a chiptune song generator and its broadcasting algorithmically generated chiptune music.

Why this series I love writing clean architecture . Not because it looks nice in a diagram, but because it survives change — new requirements, new team members, and now, AI-assisted development , where you want boundaries an AI can respect and tests that catch it when it wanders. The problem in most Flutter stacks is the seam between app and backend. You write Dart on the client, then switch to a different language, a hand-written REST layer, DTOs that drift out of sync, and serialization bugs nobody notices until production. Serverpod removes that seam. You write Dart on the server too, and the client-server communication code is generated for you — type-safe, end to end. What is Serverpod? Serverpod is an open-source backend framework that lets you build the entire stack in Dart. Instead of context-switching between languages, your models, your API, and your database logic all live in one language. What you get out of the box: Endpoints — server methods your Flutter client calls directly. The communication code is generated, so there's no hand-written REST/JSON glue. An ORM — type-safe, statically analyzed database access with migrations and relationships. No raw SQL required. Code generation — define a model once; get serialization and client bindings on both sides automatically. Real-time data — streaming over WebSockets, managed for you. Auth — integrations for Google, Apple, and Firebase. The extras enterprises actually need — file uploads, task scheduling, caching, logging, and error monitoring. And on the "is this serious enough for production?" question: Serverpod says it's battle-tested in real-world apps and secured by over 5,000 automated tests, scaling from hobby projects to millions of users without code changes. That's exactly the property you want in an enterprise foundation. The architecture at a glance Here's how the pieces fit. A Serverpod project is generated as three packages: myapp_server → your backend: endpoints, models, business logic, DB my

A client asked: " After I run a cross-site update check, can each site show — right in the site list — how many plugin updates are still pending? " Visually the answer was obvious: a small red badge on the top-right of the 🔌 plugins button, like an unread-notification count. Easy to specify. The harder question was where the data comes from . We could have added a fresh API endpoint and a new cache to hold "pending count per site." But doing that would have doubled state management , and we already had a cache that knew this. We routed through the existing one. Here's the reasoning behind that decision. Reuse the dashboard cache as the data source The cross-site updates dashboard (the one we wrote about in killing the 24.5-second silence with a cache-first design ) already kept each site's pending plugins in a localStorage-backed state called _updatesDashState . Its shape: _updatesDashState = { sites : [ { site_id : " abc... " , plugins : [ {...}, {...}, {...} ] }, { site_id : " def... " , plugins : [ ... ] }, ], total_pending_count : 12 , loadedAt : 1748600000000 , } Look up by site_id , take plugins.length , and you have the badge's number. No new API, no new cache. The data that powers the cross-site dashboard is also the data that powers the site-list badge. The win of not adding state is quiet but real: When a maintenance run invalidates _updatesDashState , the badge disappears automatically (no sync code to write) The TTL (originally 7 days; later extended to 30 days with partial invalidation ) inherits from the existing design The badge and the underlying count can't drift — there's no second copy to fall out of step There's always a temptation to spin up a new endpoint for a new UI element. The rule we settled on: if the existing state answers it, don't add more. Attaching the badge — consolidate into helpers Both the list view and grid view need the same badge on the 🔌 button, so the logic lives in helpers. function _getPendingPluginCountForSite ( siteId )