标签：#t

GitHub shipped a small changelog entry this week that says more about the future of coding agents than most of the launch demos. Security validation for third-party coding agents is now generally available. Not just for GitHub's own Copilot cloud agent. For third-party agents too, including Claude and OpenAI Codex. The feature sounds boring in the best possible way. When an agent creates code, GitHub can run CodeQL, check new dependencies against the GitHub Advisory Database, and use secret scanning to detect tokens, API keys, and other sensitive material. If it finds a problem, the agent tries to fix it. That is not the flashy part of agentic coding. It is the important part. Because once agents are allowed to act inside repos, the question stops being "which model wrote this diff?" and becomes "can the repository apply the same policy to every automation actor?" authorship is the wrong abstraction We still talk about generated code as if authorship is the primary thing that matters. Was this written by Copilot? Claude? Codex? A human with tab completion? A human who pasted something from a chat window and cleaned it up? A junior engineer following a Stack Overflow answer from 2018? Those distinctions matter for procurement and product marketing. They matter less for the repository. The repository has a simpler problem: a change is trying to enter the system. It may introduce a vulnerability, add a risky dependency, leak a secret, violate an internal rule, or be perfectly fine. That is why the GitHub change is interesting. It moves the useful boundary from "our approved coding assistant" to "any coding agent operating in this repository." the agent is now an actor For years, repository automation was mostly boring and legible. CI ran tests. Dependabot opened dependency updates. Release bots bumped versions. Linters complained. Security scanners commented. Humans reviewed. The automation could be annoying, but its shape was predictable. Coding agents are different.

PostgreSQL Error 2201X: invalid row count in result offset clause PostgreSQL error code 2201X ( invalid_row_count_in_result_offset_clause ) is thrown when the value provided to an OFFSET clause is not a valid non-negative integer. This commonly surfaces in applications that implement pagination using dynamic queries or user-supplied parameters, where the offset value may be negative, NULL, or a non-integer type. Top 3 Causes 1. Negative OFFSET Value The most frequent cause is a miscalculated page offset. When computing (page - 1) * page_size , a bad page number can produce a negative result. -- Triggers error 2201X SELECT * FROM orders ORDER BY created_at DESC OFFSET - 5 LIMIT 20 ; -- ERROR: invalid row count in result offset clause -- Fix: Use GREATEST to clamp the value to 0 SELECT * FROM orders ORDER BY created_at DESC OFFSET GREATEST ( 0 , - 5 ) LIMIT 20 ; 2. NULL Passed as OFFSET When an application fails to initialize or bind the offset parameter, NULL gets passed to the query. This often happens with ORMs or query builders where optional parameters are not explicitly set. -- Triggers error 2201X SELECT * FROM products ORDER BY id OFFSET NULL LIMIT 10 ; -- ERROR: invalid row count in result offset clause -- Fix: Use COALESCE to provide a default value SELECT * FROM products ORDER BY id OFFSET COALESCE ( NULL , 0 ) LIMIT 10 ; -- Parameterized query with safe fallback SELECT * FROM products ORDER BY id OFFSET COALESCE ( $ 1 :: BIGINT , 0 ) LIMIT COALESCE ( $ 2 :: BIGINT , 10 ); 3. Non-Integer Type (Float or String) Passing a float or a string that cannot be cleanly cast to a whole number causes this error. This typically happens when Python float values or unvalidated user input strings are interpolated directly into a query. -- Triggers error 2201X SELECT * FROM employees ORDER BY last_name OFFSET 10 . 7 LIMIT 5 ; -- ERROR: invalid row count in result offset clause -- Fix: Use FLOOR and explicit cast to BIGINT SELECT * FROM employees ORDER BY last_name OFFSET F

I've been using pronounciation apps for a few weeks and decided to intentionally butcher some words just to see how strict the feedback was. not subtle mistakes either. I was fully committing to the wrong pronunciation. I've noticed that it still rated some of them as correct or nearly correct. now I'm wondering how much trust I should actually put into pronunciation scores in general. do these apps genuinely analyze pronunciation, or do they sometimes just check whether you're vaguely in the right area? submitted by /u/no-cherrtera [link] [留言]

Parents want one thing, and one thing only, out of AI: to add a list of soccer games or "spirit week" theme days from an email or a poorly formatted flyer onto their calendar in one shot. And I have good news for parents with iPhones - the new Siri can finally do this. After […]

Booking travel or paying for subscriptions or for running procurement through Claude or a custom GPT wrapper no confirm button is required anymore. The capability side is mostly solved. What doesn't get talked about enough is what happens when it goes sideways. A stored card sitting in the agent's context means it holds that access the whole session. One bad tool call and it's spending outside what you intended with nothing at the infrastructure level stopping it. Real time card issuance is the cleaner model. Agent requests a card for the specific transaction, purchase completes, card cancels and nothing persists. Who is running agent initiated payments in production right now and what does the architecture look like? submitted by /u/Significant-Plant-4 [link] [留言]

Instead of spending a year raising a formal venture fund, the Sabertooth VC founder used a captive network of LPs to invest in startups like Anthropic, Anduril, and SpaceX.

A few months ago I was doing a final pre-release review on a client project before handing it...

Microsoft today released software updates to plug nearly 200 security holes across its Windows operating systems and supported software, a record number of fixes for the company's monthly Patch Tuesday cycle. Nearly three dozen of those bugs earned Microsoft's most dire "critical" rating, and exploit code for at least three of the weaknesses is now publicly available.

A recent video of a great white shark in the Mediterranean Sea offers the possibility of deriving valuable information for conservation strategies.

When building an investor list, there are often hundreds of potential firms and angels. Do you start with dream investors, easier targets, sector specialists, or investors with a reputation for being founder-friendly? I'm interested in hearing how others structure their outreach strategy. submitted by /u/Pure_Wolverine2156 [link] [留言]

On June 9, 2026, Anthropic shipped the most capable model it has ever released to the public. The most interesting thing about it is the part that sometimes refuses to talk to you. Claude Fable 5 is the first model from what Anthropic calls its Mythos class, a tier that now sits above Opus. It launched as a pair. Fable 5 is the public version. Claude Mythos 5 is the same underlying model with its guardrails loosened, and it is not for sale to most of us. It goes only to vetted cyberdefenders and infrastructure providers through a program called Project Glasswing, in collaboration with the US government. Two names, one brain. The thing that separates them is a set of classifiers. That detail is the whole story, and almost every launch-day write-up buried it under the benchmark chart. So let me start there instead. One Model, Two Names, One Classifier in Between Fable 5 ships with three classifiers running alongside it. They watch for requests about offensive cybersecurity, about biology and chemistry that edge toward weapons, and about distillation, which is using the model to train a competitor. When a classifier fires, Fable 5 does not answer. The request gets handed to Claude Opus 4.8, the model that was the top of the public stack until that morning, and Opus answers in Fable's place. For anyone building on the API, this is not an abstract safety story. It is a response shape you have to handle. A refused request comes back as stop_reason: "refusal" with a normal HTTP 200, not an error, and it tells you which classifier tripped. You can have the API retry on another model with a fallbacks parameter, or do it client side with the SDK middleware. You are not billed for a request that is refused before it generates output. { "stop_reason" : "refusal" , "stop_sequence" : null , "content" : [] } Anthropic says this is rare. Its early numbers put at least 95 percent of Fable sessions running entirely on Fable's own answers. I believe that for general work. But "rare on

This is a submission for the June Solstice Game Jam When you have a hammer- everything is a nail! This installment brings a Flutter build to Midsommer Madness via Antigravity. A complete Android APK is built with Flutter and some Joystick bugs are fixed! What I Built When it comes to Summar Solstace - the place to be is Sweden. It is one of the highlights of the calendar. This project aimed to recreate some of the mystique around the event- just in time for some fresh surestromming! Now you can get it on the GO! Midsommer Madness now in as an Android APK! Code GitHub repo is here: https://github.com/xbill9/midsommer-flutter xbill9 / midsommer-flutter Midsommer Madness game in Flutter / Web view Midsommer Madness 🇸🇪 Midsommer Madness is a Swedish-themed action retro arcade game inspired by Redneck Rampage and the Swedish Midsummer holiday. Help Sven race against the solar timer to reach the Maypole ( midsommarstång ) before sundown! If you fail, the solstice is lost, you trigger a meltdown, and you are sacrificed to the Wicker Man. 📸 Screen Gallery Title Screen Game Over Screen Victory Screen 🎮 Level Sequence The game features ten distinct thematic levels: IKEA Warehouse: Battle crowded, flatpack-carrying shoppers who throw box projectiles at you. Systembolaget: The state-owned liquor shop crowded with drunk Swedes stumbling and lobbing green beer bottles. Lördagsgodis: Sugar rush Saturday! Dodge hyperactive, strung-out Swedish kids throwing sweet candy projectiles. The Swedish Pub: Sing along with Frank Zappa fans singing "Bobby Brown" (shouting and firing glowing letters B , O , B , B , Y ). Volvo Highway: A survival lane-crossing level where… View on GitHub My Lingonberries are ripening- get to work! Appreciating Procedural Creation Midsommer Madness is a Swedish-themed retro action-arcade game built as a hybrid mobile/web application. The codebase combines a Flutter wrapper (serving as the native shell) with a Vanilla Web App (implementing the core game loop, vis

Congress narrowly voted to fund President Donald Trump's mass deportation agenda, giving the Department of Homeland Security $70 billion over the next three years. The house voted 214 to 212 in favor of the reconciliation bill Tuesday, following the Senate's 52-47 vote last Friday morning. The vote fell largely along party lines. Sen. Lisa Murkowski […]

TL;DR — AI assistants are producing C# that looks correct and passes review, but reintroduces production regressions we spent years training out of teams. I'm trying to find out whether other .NET teams see the same patterns — and what's actually catching them before merge. More AI-generated C# is landing in pull requests. Most of it is fine. But a specific category keeps slipping through — and it's the dangerous one, because it compiles, tests pass, and a human skim says "looks good." The pattern The code compiles. Tests pass. Review approves. Production finds out. These aren't syntax errors. They're architectural intent violations — the kind of thing a senior dev would have caught in review before PR volume tripled. Five regressions I keep seeing 1. EF Core read paths without AsNoTracking() Fine in dev. Expensive on a hot read path in prod. // ❌ Looks reasonable. Tracks entities you never mutate. var orders = await _db . Orders . Where ( o => o . CustomerId == id ) . ToListAsync ( cancellationToken ); Fix direction: AsNoTracking() on read-only queries, or a team convention documented in CLAUDE.md / Copilot instructions. 2. Captive dependency (scoped service in a singleton) Compiles. Runs. Wrong state across requests. // ❌ Singleton lives forever; scoped dependency does not. services . AddScoped < IOrderRepository , OrderRepository >(); services . AddSingleton < ReportCache >(); // ctor takes IOrderRepository Fix direction: align lifetimes, or inject IServiceScopeFactory instead of capturing scoped services. 3. Dropped CancellationToken The method accepts cancellation. The downstream call ignores it. // ❌ Signature honours cancellation; body doesn't. public async Task RunAsync ( CancellationToken cancellationToken ) { await Task . Delay ( 500 ); // overload with token exists } Fix direction: forward cancellationToken to every downstream async call that accepts one. 4. Swallowed exception Failure disappears. Monitoring stays green. // ❌ "Handle errors gracefully" —

Later this year, you will be able to get bundled subscriptions for iPhone apps, as Apple announced it's expanding App Store bundles so they can include offers from different companies. It's similar to streaming video bundles that have combined offers for Apple TV and Peacock, but it also could put together subscriptions for completely different […]

Το πρόβλημα της ώρας Η ώρα είναι από τα πιο ύπουλα προβλήματα στην ανάπτυξη λογισμικού. Αν ένας χρήστης στην Αθήνα δημιουργήσει μια παραγγελία στις 20:00 και ένας άλλος στη Νέα Υόρκη τη δει στις 13:00, ποια είναι η "σωστή" ώρα; Αν μια εφαρμογή αποθηκεύσει μόνο το 20:00, χωρίς να γνωρίζει τη ζώνη ώρας, τότε η πληροφορία είναι πρακτικά άχρηστη. Αυτός είναι ο λόγος που υπάρχουν έννοιες όπως: Local Time UTC UTC Offset Epoch / Unix Timestamp Δεν δημιουργήθηκαν για να μας μπερδεύουν. Δημιουργήθηκαν για να λύνουν το πρόβλημα της παγκόσμιας διαχείρισης χρόνου. Local Time Το Local Time είναι η ώρα που βλέπει ο χρήστης στη χώρα του. Παραδείγματα: Αθήνα: 2026-06-09 20:00 Λονδίνο: 2026-06-09 18:00 Νέα Υόρκη:2026-06-09 13:00 Όλες οι παραπάνω ώρες μπορεί να αντιστοιχούν στην ίδια ακριβώς χρονική στιγμή. Συνέβει ένα γεγονός μία ενέργεια στον πλανίτη γη ακριβώς αυτή την στιγμή που όμως για διαφορετικές γεωγραφικές περιοχές αντιστοιχεί σε διαφορετικές ώρες. Πότε χρησιμοποιούμε Local Time; Μόνο για εμφάνιση στον χρήστη. Παραδείγματα: Ημερομηνία παραγγελίας Ώρα δημιουργίας post Ημερολόγιο συναντήσεων Reports προς τον χρήστη Πότε ΔΕΝ το αποθηκεύουμε; Σχεδόν ποτέ ως μοναδική πηγή αλήθειας. Αν αποθηκεύσεις: 2026-06-09 20:00 δεν γνωρίζεις: Σε ποια χώρα δημιουργήθηκε Σε ποια ζώνη ώρας ανήκει Αν ίσχυε θερινή ώρα (DST) UTC (Coordinated Universal Time) Το UTC είναι η παγκόσμια αναφορά χρόνου. Όλες οι ζώνες ώρας υπολογίζονται σε σχέση με αυτό. Παράδειγμα: UTC: 2026-06-09 17:00 Την ίδια στιγμή με βάση την UTC ώρα μπορούμε να έχουμε: στην Αθήνα UTC+3 -> 20:00 στο Λονδίνο UTC+1 -> 18:00 στη Νέα Υόρκη UTC-4 -> 13:00 Πότε χρησιμοποιούμε UTC; Σχεδόν πάντα στο backend. Αποθηκεύουμε: 2026-06-09 T 17 : 00 : 00 Z Το Z σημαίνει UTC. Γιατί; Επειδή: Δεν αλλάζει με DST Δεν εξαρτάται από χώρα Είναι παγκόσμιο σημείο αναφοράς Ένας κανόνας που ακολουθούν σχεδόν όλες οι μεγάλες εταιρείες: Store in UTC, display in Local Time. UTC Offset Παραδείγματα: UTC+3 UTC+2 UTC-5 UTC+9 Για την Αθήνα: Χειμώνας -> UTC+2 Καλοκα

The rules may pose a minor hurdle for people who just have to cheat.

Yann LeCun bet a billion dollars that it can. He left Meta arguing today’s chatbots are a dead end, and that real intelligence comes from “world models,” systems that learn how the physical world works rather than just predicting the next word. Two things nag at me. First, how do we even measure it? Every famous AI test is basically a language exam. But a world model doesn’t write essays, it predicts what happens next. So either these systems slip past the tests we trust, or we have no good way to score them yet. Second, LeCun says you can’t reach real intelligence through language alone. Probably right. But isn’t the reverse just as true? Could anything that masters physics but can’t grasp language really be called intelligent? So much of human thought, math, planning, culture, rides on words. My gut says neither pure chatbot nor pure world model gets us there. The winner is some marriage of the two. So maybe the question isn’t chatbots versus world models. It’s how the two work together. Is language the engine of thought, or just a handy way to talk about it? submitted by /u/oravecz [link] [留言]

The biggest mistake teams make when comparing testing tools is treating the feature list like the decision. A tool can support API tests, visual checks, CI, reporting, and integrations, and still be the wrong choice if nobody adopts it, the runs are flaky, or the billing model turns into a budget surprise. Start with the workflow, not the brochure The first question is not “What does this tool support?” It is “Where will this tool sit in our actual delivery flow?” A tool that looks great in a demo can still fail if it does not fit how your team writes tests, reviews failures, shares results, and ships code. If your team lives in GitHub PRs, Slack, and CI pipelines, then the evaluation should center on how quickly a test result shows up where developers already work. If your team has QA specialists, product owners, and client stakeholders, then reporting and handoff matter as much as assertion syntax. This is why feature checklists can mislead. Two tools may both claim browser automation, API coverage, and dashboards, but one might require a heavy framework rewrite while the other can be adopted incrementally. The latter is usually the better tool, even if it looks less impressive on paper. Checklist item one, can people actually use it next week? Adoption beats capability. If a tool needs a long onboarding program, a specialist only one person on the team understands, or a custom setup that no one wants to own, the tool becomes shelfware fast. Look at who will author tests, who will maintain them, and who will interpret failures. A tool that lets QA write quickly but gives developers a painful review experience can still become a bottleneck. A good evaluation asks for the smallest realistic test case. Take one happy-path flow, one negative case, and one flaky UI interaction, then see how far each tool gets you without custom glue. That is usually more useful than a vendor demo with polished sample scripts. Checklist item two, what happens when the tests get messy? E

If your goal is faster releases with fewer flaky failures, the tool choice matters less than the testing strategy behind it. Teams usually start by asking, “Should we use Playwright, Selenium, Cypress, or a cloud platform?” A better question is, “What do we need to prove, in which browsers, at what cost to maintainability and reliability?” That shift changes the conversation. Browser automation is not only about writing scripts that click through a happy path. It is about building a test system that survives UI changes, covers the browsers your users actually have, and fails for the right reasons. This playbook walks through a practical sequence you can use to compare tools and make those tradeoffs explicit. Start with the outcomes, not the framework Before comparing tools, define the job your browser tests need to do. Most teams have a mix of goals, even if they do not write them down: Catch broken critical flows before merge Verify rendering in real browsers, not just headless simulations Keep test code readable enough that the team can maintain it Reduce flaky failures that waste review time and erode trust Avoid spending more time on infrastructure than on product quality Once you name those goals, tool comparison becomes simpler. A fast local developer feedback loop may point you toward one choice, while broad cross-browser coverage and managed execution may point you toward another. If a tool is fast but makes maintenance painful, that is not a win. If it supports many browsers but creates unstable runs, that is also not a win. Map your browser reality first The second step is to compare your user base with your test environment. Teams often say they support “all major browsers,” but the actual risk is usually narrower. Check which browser and device combinations matter for your product, then decide what needs automated coverage versus manual spot checks. This is where real browser execution becomes important. A headless run can be useful, but it does not repl