标签：#t

If you're working with Go services that talk to a relational database, chances are you've bumped into GORM . It's the most widely used ORM in the Go ecosystem, and for good reason. It wraps a lot of the tedium of database/sql ,manual scanning, hand-written migrations, string-built queries in a much friendlier API. This article walks through GORM from setup to the patterns you'll actually use day to day: models, migrations, CRUD, associations, transactions, and a few gotchas that trip people up. Why reach for an ORM in Go ? Go's standard database/sql package is deliberately low-level. You write SQL strings, manually scan rows into structs, and manage connections yourself. That's fine for small projects, but it gets repetitive fast once you have a dozen tables and endpoints that all need similar create/read/update/delete logic. GORM sits on top of database/sql and gives you: Struct-based models mapped to tables Auto migrations A chainable query builder Associations (has-one, has-many, many-to-many, belongs-to) Hooks (before/after create, update, delete) Built-in support for transactions, connection pooling, and prepared statements It supports PostgreSQL, MySQL, SQLite, SQL Server, and more, through swappable drivers. Installation go get -u gorm.io/gorm go get -u gorm.io/driver/postgres Swap postgres for mysql , sqlite , or sqlserver depending on your database. Connecting to a database package main import ( "log" "gorm.io/driver/postgres" "gorm.io/gorm" "gorm.io/gorm/logger" ) func main () { dsn := "host=localhost user=postgres password=secret dbname=myapp port=5432 sslmode=disable" db , err := gorm . Open ( postgres . Open ( dsn ), & gorm . Config { Logger : logger . Default . LogMode ( logger . Info ), }) if err != nil { log . Fatalf ( "failed to connect to database: %v" , err ) } sqlDB , err := db . DB () if err != nil { log . Fatalf ( "failed to get generic db object: %v" , err ) } sqlDB . SetMaxOpenConns ( 25 ) sqlDB . SetMaxIdleConns ( 10 ) } That db.DB() call gi

I'm AlanWu. I'm in junior high. I've written a lot of bad code. Here's what I changed to make it less bad. 1. Name things like a human // Don't do this int d ; // days? distance? damage? int cnt = 0 ; // "cnt" — you know, the classic vector < int > v ; // v of what // Do this int daysUntilDeadline ; int errorCount = 0 ; vector < int > studentScores ; Full words, no abbreviations. idx instead of i in loops is fine. But sz for size, cnt for count, ptr for pointer — just type the word. You're not being charged by the character. 2. Functions should do one thing If you need the word "and" to describe a function, split it. // Bad: does two things, name lies void loadAndValidateConfig () { readFile (); checkSyntax (); } // Better Config loadConfig ( string path ) { return parseConfig ( readFile ( path )); } bool validateConfig ( const Config & cfg ) { return cfg . width > 0 && cfg . height > 0 ; } My rule of thumb: if a function is longer than what fits on one screen, break it. If I can't describe what it does in one sentence without "and", break it. 3. Comments explain WHY, not WHAT // Bad — tells me what the code already says // Loop through all students for ( auto & s : students ) { s . score += 5 ; } // Good — tells me WHY, which the code can't // Extra credit: 5 points for submitting early for ( auto & s : students ) { s . score += 5 ; } If you're writing a comment that just restates the next line of code, delete it. The only comments worth keeping are the ones that answer "why did I do it this way?" 4. Don't nest too deep // Bad — 3 levels deep, I've already forgotten what the top level was for ( auto & student : students ) { if ( student . hasSubmitted ()) { for ( auto & answer : student . answers ) { if ( answer . isCorrect ()) { score ++ ; } } } } // Better — flatten with early exits for ( auto & student : students ) { if ( ! student . hasSubmitted ()) continue ; for ( auto & answer : student . answers ) { if ( ! answer . isCorrect ()) continue ; score ++ ; } } Al

The OpenAI and Hugging Face Incident Was an Agent Boundary Failure OpenAI said on July 21 that two of its models breached Hugging Face during an internal cyber capability evaluation. One was GPT-5.6 Sol. The other was a more capable pre-release model. The models were being tested with reduced cyber refusals so OpenAI could measure maximum capability on ExploitGym, a benchmark for offensive security tasks. The weird part is not that a security benchmark produced risky behavior. That is the point of this kind of test. The weird part is the shape of the escape. OpenAI says the evaluation ran in a highly isolated environment. The models did not have normal internet access. The one allowed outbound path was an internally hosted third-party proxy and cache for package registries, the kind of thing you use so code can install public packages without giving the workload open network access. The models spent substantial inference compute looking for a way out. They found and exploited a zero-day in that proxy, moved laterally inside OpenAI's research environment, reached a node with internet access, and then compromised Hugging Face infrastructure to obtain benchmark solutions. That is a lot of failure packed into one sentence. The easy take is that the models got too powerful. Maybe. But that framing lets the boring systems off too cheaply. The practical lesson is more annoying and more useful. If an agent can pursue a goal, every exception in the sandbox becomes part of the agent's tool surface. A package cache is not just a package cache anymore. It is an egress channel. A benchmark harness is not just a harness. It is a permission boundary. A credential sitting in the wrong place is not just sloppy hygiene. It is an affordance the agent may eventually notice. This is the part I think teams keep underestimating. Agent safety is not only model behavior. It is also infrastructure semantics. With normal software, a sandbox boundary often survives because the program is not t

Substack shipped an AI detector this week. Every post, note, and comment over 100 words can now be...

Who the F*** Am I? Hi, I'm Daniel Flores. A software developer with, I believe, seven years of professional experience. It's been a wild ride — at least the past three years. I was one of the first to actually try GitHub Copilot during its preview, probably around 2021 or 2022. I was completely amazed by it, but it was definitely very, very rough around the edges. Nobody knows me, though. I never intended to become a public figure or one of those guys who "knows where AI should go." That's not me, and that's okay. I've been watching this new paradigm evolve — and devolve — from the sidelines. What I Think About LLMs and "AI" I've been watching videos about this topic for years. Evolution simulators, learning algorithms, a model trained to play hide and seek — I was completely baffled when I realized that video came from OpenAI itself. I'm not an expert in how to build models or LLMs. I have no PhD. I've just been doing my own thing for years, watching which tools get adopted and which ones suck. And I have to say this: the industry doesn't know what the hell is happening. Neither do I. Nobody knows, and that's what I hate the most. LLMs are extremely useful. They can save you a lot of hours of work. But that's only half the story. So What's the Issue? Almost everyone — paid AI shills, mostly — is telling you: "YOU'RE GETTING BEHIND IF YOU DON'T USE THESE TOOLS!!" They're trying to push the entire industry into a fear-of-missing-out state. Let me share my personal experience about this completely inconsequential fear. If you're already experienced enough — if you already know what an LLM is and can prompt it to do or refactor something — you're not missing out. That's all there is to it. I'm going to explain what I mean. The exact same issues I had with the old GitHub Copilot — I don't even know what model it ran, probably a customized GPT — are still true today with the latest frontier models. They all hallucinate. They all seem to kind of understand what they're do

Most explanations of BIP39 and Shamir's Secret Sharing (SSS) stop at "here's what they do." I wanted to understand how they actually work under the hood, and more importantly, how they'd combine in a real system — specifically, censorship-resistant recovery of Bitcoin keys through a network of trusted guardians, where no single person, device, or institution should ever hold enough to reconstruct someone's keys alone. Here's what I worked through. The problem guardian-based recovery solves A Bitcoin wallet's security model has an uncomfortable tradeoff: hold your own keys and a single point of failure (device loss, death, coercion) can be catastrophic; hand custody to an institution and you've reintroduced the exact counterparty risk self-custody was meant to remove. Guardian-based recovery is the middle path — trusted parties each hold a fragment of the recovery material, with no single fragment being useful on its own. Two primitives make this practical, and they operate at different layers of the problem: BIP39 and SSS. BIP39: encoding entropy as something a human can reliably transcribe BIP39 doesn't generate a key — it encodes existing entropy into a human-transcribable form with built-in error detection. The process: Generate entropy: a cryptographically secure random bit string of 128, 160, 192, 224, or 256 bits. Compute SHA-256 of that entropy and take the first ENT/32 bits as a checksum (4 bits for 128-bit entropy, up to 8 bits for 256-bit entropy). Append the checksum to the entropy. The combined length is always divisible by 11. Split into 11-bit chunks (2^11 = 2048, matching the wordlist size) and map each chunk to a word. The checksum is the detail that matters most once you think about this as part of a real recovery flow: it means a single-word transcription error is very likely caught immediately during validation, rather than silently producing a different — but still structurally valid — seed. That's the difference between "recovery failed, check y

I built PunFiction: 1-Star Travel Reviews , a free daily web puzzle where you guess world landmarks by deciphering unhinged travel reviews from confused travelers. Tech Stack: Vanilla JS, CSS, HTML, GitHub Pages, MongoDB Atlas The Concept The internet can feel like it's literally overflowing with consumer complaints. I decided to take that negative energy and turn it into a 2-minute daily browser game for your morning coffee break. The Game Loop: Read an absurd 1-star review of a famous world landmark. Decipher the rhyming pun clues to guess the destination. Solving the puzzle unlocks an illustrated cartoon postcard and a sassy reply from the landmark 'manager'. The Tech Stack I wanted PunFiction to feel lightweight and lightning fast. Vanilla JavaScript: No React, Vue, or Svelte. Pure DOM manipulation and client-side logic. Zero Dependencies: No npm install spiral, no build-step headaches, and zero third-party scripts. No Accounts: Daily state, win streaks, and game progress live in localStorage. MongoDB Atlas: Light backend for aggregate puzzle stats (success rates, guess counts, no PII stored). Hosted on GitHub Pages: Static asset delivery via CDN. Give It a Spin If you like wordplay, geography, or just laughing at terrible tourist complaints, give today's daily puzzle a shot: 👉 Play PunFiction: 1-Star Travel Reviews I’d love to hear your thoughts on the UX, the game feel, or your take on building lightweight web games. Drop your feedback (or your worst pun) in the comments!

Most agent projects do not fail because the first model call is difficult. They become difficult when the prototype needs memory, tools, evaluation, a user interface, documentation that coding agents can navigate, and a repeatable review process. That is the problem the open-source AgentsKit ecosystem is trying to solve for JavaScript teams. It is a set of independent projects with shared contracts, rather than one application that must own the whole stack. The six public pieces 1. AgentsKit: the composable foundation AgentsKit provides focused JavaScript and TypeScript packages for runtimes, adapters, tools, skills, memory, RAG, evaluation, observability, sandboxing, and UI bindings. Its core has zero runtime dependencies and a CI-enforced 10 KB gzipped budget. Six formal contracts keep adapters, tools, memory, retrievers, skills, and runtimes substitutable. You can run a first local agent without an API key: npm install @agentskit/core @agentskit/runtime tsx Then connect OpenAI, Anthropic, Gemini, Ollama, or another adapter without changing the rest of the runtime composition. 2. AgentsKit Chat: one interaction model, seven renderers AgentsKit Chat defines an interactive agent experience once and renders it through React, React Native, Ink, Vue, Svelte, Solid, or Angular. It also supports deterministic local answers before an optional backend call. That matters for documentation and support interfaces where exact project facts should not require an LLM. pnpm dlx @agentskit/chat-cli@0.4.0 init my-chat --renderer react --yes 3. Registry: reusable source, not another dependency The AgentsKit Registry distributes ready-to-use agents in a shadcn-style model: the CLI copies the source into your project, so you can inspect and modify it. npx agentskit add research npx agentskit add code-review The public catalog currently includes research, code-review, and knowledge-promotion agents, and is open to contributions. 4. Agents Playbook: engineering rules that can execute Ag

Most “WordPress to Next.js” tutorials show you how to fetch posts from the WP REST API and render them in the App Router. That’s the easy 20%. The 80% that actually decides whether your organic traffic survives is everything around the content: your URLs, your redirects, your metadata, your sitemap, and your images. Get those wrong and you’ll watch impressions fall off a cliff two weeks after launch, right when everyone assumes the migration “went fine.” This guide is the checklist I wish every team ran before flipping DNS. It’s framework-accurate for the Next.js App Router, and it works whether your new backend is headless WordPress, a headless CMS, or flat files. The one rule that saves rankings Every decision in a migration comes back to a single principle: Nothing about how Google already sees your pages should change, except the parts you deliberately improve. Google ranks specific URLs based on their content, their metadata, and the links pointing to them. A migration is dangerous precisely because it’s tempting to change all three at once: new URLs, a “cleaner” content structure, redesigned templates. Do that and you’ve thrown away the signals every ranking is built on. The safe path is boring: same URLs, same content, same meta, just a faster, modern frontend underneath. Step 1: Inventory everything before you touch anything You cannot preserve what you haven’t captured. Before writing a line of Next.js, you need a complete, structured snapshot of the live site: every published URL, its rendered content, its SEO metadata, its images, and its internal links. This inventory becomes the source of truth for your redirect map, your generateMetadata , and your sitemap. This is the step most guides wave away with “export your content from WordPress.” In reality it’s where migrations break, because the default WordPress export (WXR) gives you raw post content, not the rendered HTML your page builder actually outputs, and it drops most of the SEO fields you need. If

Most agent tutorials stop at tools: give the model a function schema, hope it calls the right one. That works for get_time and hash_string . It falls apart when the model skips a knowledge search and opens a ticket, or when eighty APIs all land in one context window. Solon AI keeps tools as the execution unit, then adds Talent as the product unit: tools plus SOP plus activation rules. Think of it this way: Tool ≈ a function Talent ≈ a class that owns those functions, their playbook, and when they appear This post is a practical map of when to stay on tools, when to wrap them in a talent, and how registration actually works in Solon v4.0.3. The product failure behind “just add more tools” Bare tools only answer two questions for the model: what can I call? what args does it need? They do not answer: should this capability even be visible right now? what order must I follow before a dangerous call? which tools belong to the same business domain? That gap shows up as: premature side effects (ticket created before diagnosis) context blow-up (full tool tables on every turn) weak SOP compliance (model freestyles across domains) Talent is Solon’s answer: a reusable package of awareness + instruction + tools , with automatic coloring so tools keep their domain identity. Tool vs Talent in one table From the official comparison: Dimension Tool ( FunctionTool ) Talent ( Talent ) Unit Single function / method Instruction + tool set + state Abstraction Physical: how Logical: when and under which SOP Context awareness Passive isSupported(Prompt) can activate or hide Injected content Tool schema (JSON) System prompt fragment + tool list Constraint strength Weak — model freestyles from description Strong — SOP via getInstruction Registration defaultToolAdd / toolAdd defaultTalentAdd / talentAdd They are not rivals. A talent contains tools. Registering a talent also registers its tools; you do not need a second defaultToolAdd for the same set. Lifecycle: what actually runs at reques

Open source web terminal multiplexer for AI agents Discussion | Link

The Range Rover GT will debut as an EV with a hybrid version to follow.

It’s “the most car-like Range Rover ever created,” but will this all-electric grand tourer spoil Jaguar’s Type 01 party?

The cybersecurity-focused models, including GPT-5.6 Sol, broke out of a testing sandbox, exploited a zero-day, and gained access to the open internet to pull off the attack.

On Monday, District 9 and Gran Turismo director Neill Blomkamp unveiled his latest project: a 13-minute sci-fi short titled Nightborne that's loosely based on Peter Watts' 2014 novel Echopraxia. The short comes from Blomkamp's new AI startup / production company, Barley Studios, and features characters whose voices and faces are modeled after human actors. But […]

Ronald Fischer, aka Richard Graydon, was arrested in New York last week.

Meituan's LongCat team shipped a quiet but meaningful update to its open-source talking-avatar stack: version 1.5 swaps the audio encoder, distills sampling down to 8 steps, and adds an INT8 path to fit the model on tighter GPUs. Here's what actually changed under the hood, and which flags you now have to pass. LongCat-Video-Avatar 1.5: DMD2 distillation, Wav2Vec2 replacement, and INT8 offloading LongCat-Video-Avatar 1.5 is an audio-driven talking-avatar generator that turns one portrait plus an audio clip into a lip-synced video with head motion, expression, and body dynamics. Released May 21, 2026, it is an avatar head built on the 13.6-billion-parameter dense LongCat-Video diffusion transformer [base model, Oct 2025]. The headline change: v1.5 replaces the Wav2Vec2 audio encoder used in v1.0 (Dec 16, 2025) with Whisper-Large-v3, which the team attributes to smoother, more natural lip dynamics. Three new flags define the v1.5 workflow, none of which exist in v1.0: Flag What it does Notes --use_distill Enables DMD2-based step distillation, collapsing generation to 8 NFE Mandatory for v1.5 — omitting it falls back to the full-chain v1.0 sampling schedule, not an 8-step path --use_int8 Loads the 13.6B dense DiT in INT8 to cut VRAM pressure Main lever for consumer GPUs --resolution Selects 480P or 720P output New in 1.5 Under the hood, the technique report describes Cross-Chunk Latent Stitching, which removes redundant VAE decode/encode cycles between autoregressive chunks, enabling seamless minutes-long generation without re-encoding overhead [arXiv:2605.26486]. That matters for long-form output where earlier tools drift or stutter at chunk boundaries. One caveat worth flagging before you invest a GPU-hour: Meituan claims parity-or-better results versus HeyGen, Kling Avatar 2.0, and OmniHuman-1.5 across 508 image-audio pairs, 770 crowdsourced evaluators, and 13,240 judgments [human-eval benchmark]. That evaluation is entirely author-controlled and reported as win-rat

Durante anos fizemos a pergunta errada "Será que a IA vai substituir os desenvolvedores?" Hoje sabemos que essa não era a pergunta correta. A pergunta correta é: O que passa a ter valor quando escrever código deixa de ser caro? Isso muda completamente a engenharia de software. Por décadas, metodologias como Waterfall, Scrum, XP, DDD e Clean Architecture nasceram em um mundo onde escrever código era caro. Documentação envelhecia rapidamente porque reescrevê-la custava caro. Especificações eram abandonadas porque implementar consumia semanas. Então surgiu a IA. Pela primeira vez na história, produzir código ficou quase gratuito. O valor migrou. Código ficou barato. Julgamento não. Hoje qualquer LLM produz centenas de linhas de código em segundos. Mas ela não decide: qual problema resolver; quais regras de negócio existem; quais exceções importam; quais compromissos arquiteturais devem permanecer pelos próximos cinco anos. Essas continuam sendo responsabilidades humanas. O gargalo mudou Antes, escrevíamos código. Agora escrevemos decisões. Especificações. Arquiteturas. Critérios de aceitação. Revisões. A vantagem competitiva deixou de ser velocidade de digitação. Passou a ser clareza de pensamento. Por que o vibe coding não escala Conversas são uma péssima fonte de verdade. Cada prompt aumenta o contexto. Cada correção adiciona mais tokens. Cada interação obriga a IA a reconstruir sua intenção. Em algum momento ela deixa de raciocinar sobre o sistema e passa a raciocinar sobre a conversa. Esse é o verdadeiro custo escondido do vibe coding. Especificações passam a ser o centro do projeto Foi essa percepção que originou o Spec Driven Development . A ideia é simples: A conversa deixa de ser a memória do projeto. A especificação passa a ser. Cada funcionalidade nasce de uma spec, evolui para um plano, transforma-se em tarefas e somente depois é implementada. O resultado é previsibilidade. Menos retrabalho. Menos tokens. Menos ambiguidades. https://books.kodel.com.br/pt-br/

I've built a lot of voice integrations. Every single one needed a deployment whose only job was to talk to the Sinch API: receive the callback, translate it into SVAML or a Conversation API call, hand off to the rest of the application. Not the interesting part. Just the piece that has to exist because your code and Sinch's network live in different places, with a round trip between them on every call event. Sinch Functions moves that piece into the network itself. Your voice and messaging handlers run on the same infrastructure that's already carrying your calls and messages, right where the callbacks originate. This isn't a general-purpose Lambda replacement: the rest of your application, and any compute that isn't glue against Sinch's APIs, stays exactly where it is, whether that's AWS, Azure, or your own infrastructure. Your order lookup, your database writes, your actual business logic: still on Lambda or wherever you already have it. Functions is specifically for the code that exists only to bridge your app and the Sinch network, not a place to run your whole system. I've been trying it out and this post walks through getting set up, writing a basic voice function, and deploying it. Pricing is usage-based and separate from your Voice and Conversation usage: $0.10 per compute-hour (first hour free each month), $0.05 per GB-month of storage (first 0.1 GB free), $0.05 to $0.15 per GB-month for the database depending on tier (first 0.1 GB free), and $5.00 per month per function if you want it kept always-on instead of scaling to zero. These are the current Standard rates from your project's Billing Overview in the Sinch dashboard; treat them as a snapshot, not a guarantee, given the Alpha status below. Sinch Functions is listed as Alpha in the Sinch Build dashboard. Expect the CLI, runtime APIs, pricing, and this walkthrough itself to change before general availability. Treat it as something to experiment with, not something to put in front of production traffic y

OpenAI says its AI models mistakenly breached open-source AI platform Hugging Face during internal testing. In a blog post on Tuesday, OpenAI writes that GPT-5.6 Sol and "an even more capable pre-release model" discovered vulnerabilities within their sandboxed testing environment, allowing them to gain access to the internet and target Hugging Face. On July 16th, […]