标签：#t

Using AI to find authorization bugs — and to prove the ones that aren't real Draft flagship post. Safe to publish now (no undisclosed vulnerabilities). The production case study referenced at the end is withheld pending coordinated disclosure. In 2026, bug bounty programs started closing their doors. Nextcloud suspended paid rewards, citing a flood of AI-generated, low-quality reports. Mattermost ended its program. The Internet Bug Bounty cut payouts by roughly 80%. The common thread isn't that AI can't find bugs — it's that most AI-assisted "findings" are plausible but wrong , and triage teams are drowning in them. That reframes the problem. The scarce skill in 2026 isn't generating candidate vulnerabilities — a language model will hand you fifty before lunch. It's refuting the forty-nine that don't hold . The differentiator is a method whose primary output is correct negatives . Here's the method I use for source-available targets, and a worked example where the honest result was "there's no bug here." The method: fan out to find, converge to refute Two stages, two different cost tiers: Fan-out (cheap models). Split the target's authorization surface into subsystems and read each in parallel. Each reader's only job is to surface candidate broken invariants — places where an object is loaded by ID without an owner check, where a protected action might skip a re-auth gate, where two code paths authorize the same thing differently. Optimize for recall. Expect mostly false positives. Adversarial verification (an expensive, high-reasoning model). Take each candidate and try to kill it. Default to REFUTED. A candidate survives only if you can cite the specific source lines proving the guard is absent and the dangerous path is reachable and nothing upstream already blocks it. Frame every survivor as a broken invariant — a one-sentence statement of the rule the system must never violate — and classify it as core versus config-dependent. The output that matters most is the

Shared, searchable memory for every AI coding agent Discussion | Link

Introduction to Hydration and Rendering Strategies In the relentless pursuit of faster, more responsive web applications, developers have engineered a spectrum of hydration and rendering strategies . Each approach emerges as a response to specific performance bottlenecks, yet none is universally optimal. This section dissects the core mechanics of these strategies, their historical evolution, and the critical problem they aim to solve—balancing speed with practicality. The Problem: A Trade-Off Landscape At its core, the challenge is mechanical : how to deliver content to the user’s browser with minimal latency while maintaining interactivity. Traditional rendering methods (e.g., server-side rendering) prioritize initial load speed but often defer interactivity until JavaScript execution. Client-side rendering, conversely, delays the first paint but ensures seamless interactions post-hydration. The tension between these extremes has birthed hybrid strategies like incremental hydration and islands architecture , each addressing specific failure points in the rendering pipeline. Key Mechanisms Driving Strategy Evolution Advancements in Web Technologies : New APIs (e.g., Web Components, Streaming SSR) enable finer-grained control over rendering. For instance, streaming SSR reduces Time-to-First-Byte (TTFB) by sending HTML in chunks, but risks breaking the causal chain of DOM hydration if not synchronized with client-side scripts. User Expectations : Sub-second load times are no longer aspirational but expected. This pressure deforms traditional workflows, pushing developers toward pre-rendering or static site generation (SSG), which trade dynamic flexibility for speed by offloading rendering to build time. Competitive Pressure : Performance is a zero-sum game. Companies adopt strategies like partial hydration (hydrating only interactive components) to minimize JavaScript payload, but this risks breaking interactivity if the hydration boundary is misaligned with user int

We’ve all been there. You get a notification from your smartwatch saying your heart rate has been a bit funky, or your blood oxygen is dipping. Usually, we ignore it until it becomes a problem. But what if your personal AI was looking out for you? 🤖 In this tutorial, we are building an Autonomous Health Agent . This isn't just a notification bot; it's a proactive system that uses Playwright browser automation , OpenAI Function Calling , and Python to monitor your health trends and—if things look suspicious for three days straight—literally opens a browser and books a doctor's appointment for you. By leveraging Autonomous AI Agents and Playwright automation , we are moving from "Passive Monitoring" to "Active Intervention." This is the future of Health Tech Automation . 🏗 The Architecture Before we dive into the code, let's look at how the data flows from a "scary heart rate" to a "confirmed appointment." graph TD A[Wearable Data/Health Logs] --> B{3-Day Anomaly Check} B -- Normal --> C[Stay Healthy! 🟢] B -- Abnormal --> D[Trigger AI Agent 🤖] D --> E[OpenAI Function Calling] E --> F[Playwright Browser Automation] F --> G[Hospital Booking Platform] G --> H[Appointment Confirmation 🏥] H --> I[Notify User via SMS/Email] 🛠 Prerequisites To follow along, you’ll need: Python 3.10+ Playwright : The king of modern browser automation. OpenAI API Key : For the "brain" of our agent. A healthy dose of curiosity! 🥑 pip install playwright openai pydantic playwright install chromium 👨‍💻 Step 1: Defining the "Brain" (OpenAI Function Calling) We don't want the LLM to just "talk" about booking an appointment; we want it to actually execute the action. We'll use OpenAI's Function Calling to bridge the gap between text and code. import json from openai import OpenAI client = OpenAI () # Define the tool our agent can use tools = [ { " type " : " function " , " function " : { " name " : " book_doctor_appointment " , " description " : " Books a medical appointment based on department and s

Video AI systems consistently fail to track what happens when the camera looks away: when a scene pans away from an object in motion and returns, current models re-render the object in its original position rather than showing the logical result of off-screen change. Scaling to more parameters makes this failure worse, not better, according to WRBench , a new benchmark that tests what researchers call "world model reliability." The benchmark presents AI video systems with scenes where something happens off-screen — the camera pans away while an object is in motion, or while a light changes, or while an open door should stay open — then pans back to see what the system believes should have happened. A system that genuinely models the world would track what occurred during the off-screen interval. Current systems mostly don't. Key facts What: A new benchmark tests whether video AI systems can track what happens to parts of a scene the camera isn't currently showing. Across 23 models, the answer is mostly no — and making the models larger made the problem worse, not better. When: 2026-06-19 Primary source: read the source (arXiv 2606.20545) The benchmark covers twenty-three different video generation models and nearly ten thousand video clips across six categories of off-screen change, each designed to test a different aspect of world continuity: objects in motion, light sources changing, object states such as open or closed doors, and several others. This gives a comprehensive picture rather than a single narrow test. The most striking finding is the scaling result. The researchers tested one of the more capable video generation systems at two different sizes: a smaller version and one with more than ten times as many parameters. More parameters didn't help. Scaling made the off-screen tracking problem measurably worse. The larger model produced more realistic-looking frames, but it was less accurate about what should have happened to the parts of the scene it wasn't

Loop Engineering — เมื่อการ Prompt Agent ด้วยมือไม่พออีกต่อไป แล้ว Programmer ต้องออกแบบ Loop แทน โดย Nokka (นก-กา) | 1 กรกฎาคม 2026 TL;DR — สำหรับคนที่รีบ กลางเดือนมิถุนายน 2026 ที่ผ่านมา วงการ AI developer สั่นสะเทือนด้วยประโยค 6 คำจาก Peter Steinberger ผู้สร้าง OpenClaw: "You shouldn't be prompting coding agents anymore. You should be designing loops that prompt your agents." ประโยคนี้มียอดวิว 8 ล้านครั้งในวันเดียว และจุดกระแส "Loop Engineering" ที่กลายเป็น buzzword ร้อนที่สุดของเดือน Loop Engineering คือการเปลี่ยนจากการนั่ง Prompt Agent ทีละคำสั่ง มาเป็นการเขียน Loop (โปรแกรม) ที่ทำหน้าที่ Prompt Agent แทนคุณ โดย Loop จะเป็นคนเลือกงานต่อไป, ส่งให้ Agent, ตรวจสอบผล, ตัดสินใจว่าจะทำต่อหรือหยุด คุณไม่ได้เป็นคนขับ Agent อีกต่อไป — คุณเป็นคนออกแบบระบบที่ขับ Agent 1. Loop Engineering คืออะไร? เกิดมาจากไหน? เรื่องนี้เริ่มต้นจาก Boris Cherny ผู้สร้าง Claude Code พูดบนเวที Acquired Unplugged ต้นเดือนมิถุนายน 2026 ว่า: "I don't prompt Claude anymore. I have loops that are running. They're the ones that are prompting Claude and figuring out what to do. My job is to write loops." สองวันต่อมา Peter Steinberger โพสต์บน X ว่า "You shouldn't be prompting coding agents anymore. You should be designing loops that prompt your agents." โพสต์นี้มียอดวิว 8 ล้านครั้ง [1] หลังจากนั้น Addy Osmani (Google Engineer, O'Reilly author) เขียนบทความ "Loop Engineering" บน O'Reilly Radar ให้คำจำกัดความว่า: "Loop engineering is replacing yourself as the person who prompts the agent." [2] และ @0xCodez ก็รวบรวมเป็น 14-step roadmap จาก "prompter" สู่ "loop designer" [3] ในมุมมองของผม Loop Engineering ไม่ใช่ buzzword ธรรมดา แต่มันคือการเปลี่ยน abstraction layer ของการทำงานกับ AI เหมือนกับที่เราเปลี่ยนจาก Assembly → High-level language หรือจาก Bare metal → Cloud แต่ก็ต้องยอมรับว่า Loop Engineering ยังเป็นแนวคิดใหม่ และยังไม่มี standard practice ที่ชัดเจน สิ่งที่ใช้ได้วันนี้อาจเปลี่ยนไปใน 3 เดือน 2. ทำไมต้อง Loop Engineering? ลองนึกภาพการทำงานกับ AI coding agent แบบเดิม: คุณพิมพ์ prompt → รอ → อ่าน dif

Apple is readying several new iPad Pro tablets, and a budget-friendly MacBook Pro, reports suggest.

Quick, creative video subtitling with direct canvas control Discussion | Link

Fourth of July weekend is the last great grill and griddle sale of the summer, including $250 off my favorite pellet smoker.

Next spring could be a fiesta of new iPads, MacBooks and iPhones.

The company has grown rapidly by acquiring and revamping last-generation tech brands like AOL, Eventbrite, Evernote, Meetup, and Vimeo.

Apple is working on a "revamped" version of its entry-level MacBook Pro that it could launch as soon as the first half of 2027, Bloomberg reports. The company is also testing four new iPad Pros that are set to launch in the spring with a focus on "internal improvements." The updated MacBook Pro, which will […]

The co-founders of Bending Spoons, the Italian company quietly buying beloved, ailing Internet brands, learned big lessons from their own startup's failure.

Cody Spencer, the co-owner of the small games retail chain Pink Gorilla Games, put it well when I asked about the impact of Sony's recent announcement that it will stop making discs for new games starting January 2028. "It's sad to see. This decision is only a negative for gamers. We're losing the ability to […]

Meta says usernames improve privacy, but critics question whether its safeguards can prevent impersonation.

GitHub热门项目 | 🚀 A real-time monitoring dashboard for Claude Code, built with SQLite3, Node.js, Express, React, Vite, TailwindCSS, and WebSockets. It tracks sessions, agent activity, tool usage, and subagent orchestration, providing live analytics, a Kanban status board, status notifications, a cute buddy, and an interactive web UI/MacOS/Windows native app. | Stars: 734 | 162 stars this week | 语言: TypeScript

Everyone keeps saying AI will let a solo developer take down the giants. And everyone keeps saying the giants will just absorb everything. Both takes are wrong , and I spent a while reading the actual 2025 data to figure out why. I pulled from four of the biggest developer datasets of the year: DORA 2025 State of AI-Assisted Software Development (Google Cloud, ~4,867 respondents) Stack Overflow 2025 Developer Survey (49,009 respondents) GitHub Octoverse 2025 (behavioral data across 180M+ developers) JetBrains State of the Developer Ecosystem 2025 (24,534 developers) Here's the honest synthesis. It's more useful than either hype narrative. The one-sentence thesis AI collapsed the cost of writing software to near zero. It did not collapse the cost of distribution, trust, support, or being liable when it breaks — and those are ~80% of what a software business actually is. So the effect isn't "solos beat giants." The effect is that the middle got hollowed out . The 10-person, VC-funded, me-too startup building a feature is the loser of this era — squeezed from below by a solo who ships the same thing for free, and from above by a giant who bundles it. Solos and giants both survive. The undifferentiated middle doesn't. "AI is an amplifier, not an equalizer" This is the single most important finding of 2025, and it comes straight from DORA: "AI's primary role in software development is that of an amplifier. It magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones." Read quickly, that kills the "AI levels the playing field" fantasy. AI rewards whoever already has good practices — not whoever is scrappiest. But read one layer deeper and it becomes the best available argument for the small team. DORA found the key enabler is independence of action — "the ability to develop, test, and deploy value independently, with little or no coordination cost." In an Adidas pilot they cite, teams in loosely-coupled architectures saw 20–30% produ

Turn to-dos into scheduled tasks Discussion | Link

A large-scale audit of AI-as-judge evaluation — covering over half a million individual judgments — finds that AI judges are consistently reliable but not valid, meaning they give the same answer repeatedly without that answer being correct. Published work and popular benchmarks like Chatbot Arena have treated consistency as proof of trustworthiness, and the audit shows that assumption is unfounded. Key facts What: Using one AI to grade another is now common — but the biggest audit yet shows these graders are consistent without being correct. A judge that always picks "answer A" scores perfectly on consistency. When: 2026-06-19 Primary source: read the source (arXiv 2606.19544) The distinction matters: a judge is reliable if it's consistent (same question, same answer), and valid if those answers are actually correct. The audit's central finding is that AI judges are reliable without being valid, and the field has been treating the first as evidence of the second. Because consistency is easy to measure and looks reassuring, it has stood in for actual trustworthiness across a lot of published work. A new audit makes the problem stark: a judge that ignores both answers and always picks the one labeled "A" would be perfectly consistent — flawless reliability, identical verdict every time — and completely worthless, because it never read anything. Consistency is trivially easy to fake and says almost nothing about whether the judging is sound. Yet "the judge agrees with itself" has done significant reassurance work in papers and benchmarks, and the always-pick-A example shows exactly how empty that reassurance is. When the researchers corrected for the agreement you'd get by chance — as any fair test should — confident-looking scores deflated noticeably. Gaps between models that seemed meaningful shrank or blurred. Accepted folk wisdom also took a hit: the long-standing worry that AI judges are suckers for longer, wordier answers turned out to be far weaker than assumed

Pressing enter to accept model suggestions now takes less effort than scrolling past it. One keystroke, and the code is yours. Reading it, understanding it, deciding if it's actually right, that part hasn't gotten any faster. That gap, between how fast we can accept code and how fast we can actually understand it, is where things start to go wrong. The new shape of technical debt We used to know where technical debt came from. Tight deadline, cut corner, # TODO: comment that nobody ever revisits. Rushing was the cause, and we could at least point to it. Now you can build up the same kind of debt on a calm Tuesday afternoon, no deadline in sight, just six suggestions in a row accepted because they looked fine and the flow felt good. Nobody rushed you, and the code still ended up just as unexamined. Same debt, just a different excuse. "It works" is not the same as "I understand why it works" Everyone knows that debugging is twice as hard as writing a program in the first place. So if you're as clever as you can be when you write it, how will you ever debug it? — Brian Kernighan, 1974 Fifty years later, the gap got wider. Kernighan was talking about code you wrote. At least you understood it once. A suggestion that compiles, passes the linter, survives code review and even comes with passing tests can still be standing on a wrong assumption that nobody caught, because nobody was reading it as code. They were reading it as output, and output that makes sense tends to get approved. Compiling is a low bar. Passing tests is a slightly higher one, depending on whether you wrote the tests, or its suggestion shaped or created those too. If it's the second, it's like grading its homework with its own answers. None of it tells you the logic is sound, that the edge cases are covered, or that it does what you actually needed, something we already learned every time we trusted code we didn't write. Somehow it's easy to forget it the moment the code appears inline, in our own edito