标签：#t

Building a Deterministic Security Scanner for AI-Generated Code TL;DR: I built TruffleKit , a CLI security scanner that catches 22 vulnerability classes in under 2 seconds with zero false positives. Here's how the scanning engine works under the hood. AI code generation is producing more production code than ever. But AI models are trained on public code — which means they reproduce the same security mistakes the open-source ecosystem has been making for decades. In my tests, 73% of AI-generated code snippets contain at least one security vulnerability that a standard linter would completely miss. I couldn't find a tool that was fast, deterministic, and had zero false positives. So I built one. The Architecture The scanner is a rule-based deterministic engine written in Python. Each rule is a self-contained module that pattern-matches against a file's AST or raw content. scanner/ ├── __init__.py ├── engine.py # Orchestrator ├── reporter.py # Output formatting ├── rules/ │ ├── __init__.py │ ├── secret_detection.py │ ├── sql_injection.py │ ├── path_traversal.py │ ├── weak_encryption.py │ ├── cors_misconfig.py │ └── ... (22 rules total) └── models.py Key Design Decisions 1. AST-Based Pattern Matching For languages like Python and JavaScript, we parse the file into an AST and match against structural patterns — not regex. This eliminates false positives from strings that happen to look like code. import ast class SQLInjectionRule ( BaseRule ): def check ( self , tree : ast . AST , filename : str ) -> list [ Finding ]: findings = [] for node in ast . walk ( tree ): # Match: cursor.execute(f"...{variable}...") if isinstance ( node , ast . Call ): func_name = self . _get_call_name ( node ) if func_name in ( ' cursor.execute ' , ' db.execute ' , ' connection.execute ' ): for arg in node . args : if self . _is_f_string_or_concat ( arg ): findings . append ( self . _make_finding ( severity = ' high ' , message = ' SQL injection: parameterized query required ' , line = node .

With the release of version 1.7.9, ZenQL’s Collection API, Thor, received substantial performance improvements, largely driven by a series of memory optimization enhancements. These changes reduced unnecessary allocations, improved data handling efficiency, and significantly accelerated query execution, particularly when working with large in-memory datasets. From the early stages of development, we established a baseline benchmark to measure both correctness and performance consistently: filtering a slice of 50 million items and validating the result. The original Collection API completed this benchmark in approximately 9 seconds. Later, we introduced Thor as a replacement for the default Collection API, reducing the benchmark time to around 4 seconds. With the latest round of memory optimizations and internal improvements, Thor now completes the same benchmark in less than one second. benchmark: goos: linux goarch: amd64 pkg: github.com/malikhan-dev/zenql/collections/Thor cpu: 12th Gen Intel(R) Core(TM) i7-12700H BenchmarkQueryEngine BenchmarkQueryEngine-20 88 13636313 ns/op 22727310 B/op 0 allocs/op at Thor_Engine__test . go func BenchmarkQueryEngine ( b * testing . B ) { result := From ( & items ) . Where ( func ( search ComplexObjectToSearch ) bool { return search . Name == "Jane" && search . Flag == false }) . Collect () result2 := From ( & result ) . Any ( func ( search ComplexObjectToSearch ) bool { return ( search . Name != "Jane" ) || ( search . Flag != false ) }) . Assert () if result2 { b . Error ( "result should be false" ) } } Join the Journey We are committed to making ZenQL the fastest and most developer-friendly query engine for Go. As we continue to grow and push the boundaries of performance, we need your support! If you find ZenQL useful, please star our repository on GitHub. Your support helps us reach more developers and keep the project moving forward. Thank you!

How to Auto-Sync Your Hashnode Blog to Dev.to Using GitHub Actions (2026 Guide) FOLASAYO SAMUEL OLAYEMI FOLASAYO SAMUEL OLAYEMI FOLASAYO SAMUEL OLAYEMI Follow Jun 7 How to Auto-Sync Your Hashnode Blog to Dev.to Using GitHub Actions (2026 Guide) # discuss # automation # tutorial # devops 5 reactions Comments Add Comment 5 min read

There's a pattern I've noticed with every new AI coding tool that comes out: they all want you to switch editors. Or open a new terminal. Or context-switch into some standalone app. I DON'T WANT TO DO THAT My entire dev workflow lives in VS Code. My keybindings, my split panes, my snippets, my extensions — all of it. When Google released the Antigravity CLI ( agy ), an agentic coding assistant, I genuinely liked what it could do. But to use it properly, I had to live in a terminal window, manually managing sessions, typing slash commands from memory, and losing my editor context entirely. So I built a VS Code extension for it instead. What is Antigravity? Google Antigravity is Google's agentic coding CLI — think of it as a Gemini-powered dev assistant that can read your project, run tools, execute terminal commands, and help you build. It's the kind of tool that can handle complex multi-step tasks, not just autocomplete. The CLI is called agy , and it's genuinely capable. The problem was the workflow: terminal-first, session management by hand, and no visual layer over the context you're already in. The Extension: Antigravity for VS Code Install it on the VS Code Marketplace Source on GitHub The core idea is simple: the extension is a UI layer. It never bundles or replaces the agy binary — it shells out to whichever version you have installed locally. Same philosophy as the Claude Code VS Code extension: the editor provides the surface, the CLI does the work. Here's what it actually does: Sessions List The sidebar panel opens to all your saved sessions. You can open an existing one, delete it, or start fresh. New sessions can be launched in sandboxed mode or with permissions bypassed — accessible right from the "New Session" overflow menu, without memorizing CLI flags. Any session with an active turn shows a loading indicator in its row, so you always know what's in flight. Chat Panel (Material 3 Expressive) This is the main surface. Each session runs its own live,

Before this week, I thought Excel was just a fancy calculator with boxes. But after three days of my Data Science & Analytics course, I realise I was wrong. Really wrong. Excel is a spreadsheet tool used by millions of people from small business owners to data analysts at giant companies. And the best part? You don’t need to be a programmer to use it. You just need to know a few tricks. Here’s how Excel helps solve real-world problems using exactly what I learned in Week 1. 3 Real-World Ways Excel Is Used Business decisions with logic Managers use IF() statements to answer yes/no questions. Example: =IF(Sales>1000, "Bonus", "Needs Improvement"). One cell can decide who gets paid more. Cleaning messy data Real data is never clean. Marketing teams use Remove Duplicates, Find & Replace, and Text to Columns to fix hundreds of messy rows in seconds. No manual typing. Tracking deadlines and ages HR teams use DATEDIF() to calculate employee ages or years of service. TODAY() and NOW() keep reports automatically updated. No more “oh, I forgot to update the date.” 3 Excel Features I Learned This Week Remove Duplicates – One click, and Excel deletes repeated rows. Saved me from sending the same customer email twice. IFERROR() – Hides ugly errors like #DIV/0! and shows something friendly instead (e.g., “Check data”). Your boss will thank you. Sort & Filter – With AutoFilter, I can find all sales above $500 in one second. Then Custom Sort lets me sort by date and region together. My personal reflection Honestly? Learning Excel has changed how I see data. I used to look at a messy spreadsheet and feel lost. Now I see Remove Duplicates, Text to Columns, and TRIM() as tiny tools that bring order to chaos. Data isn’t scary anymore. It’s just a puzzle and Excel gives me the pieces. I’m only one week in. But I already feel like a junior data analyst in training.

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on AI confusion, follow Robert Hart. The Stepback arrives in our subscribers' inboxes at 8AM ET. Opt in for The Stepback here. How it started At first, AI influencers were relatively easy to identify - and to […]

🚀 SpaceX signed a massive $920 million monthly deal with Google for 110,000 Nvidia chips — this is a huge infrastructure play ahead of their monster $1.7 trillion IPO. 🏛️ The Trump administration is discussing taking equity stakes in top AI firms — this would make the public official partners in the upside of AI-driven economic growth. 🔓 Meta's automated AI support was hacked to take over high-profile accounts — it proves that offloading critical security tasks to AI can create dangerous, easily exploited vulnerabilities. 🧠 Tech workers are trading hours of manual labor for high-level strategy thanks to AI — while tasks now take minutes, humans are still needed for crucial, complex decision-making. submitted by /u/Ok_Muffin_7347 [link] [留言]

Sigma’s new entry is both a bold design experiment and a pretty decent camera.

These 5- to 6-inch blades are the secret workhorses of the kitchen, whether you’re a smaller person, have smaller hands, or just desire a smaller but still high-functioning knife.

Just shipped this project and wanted to share the full technical breakdown because hotel/hospitality AI doesn't get much attention compared to the usual chatbot and SaaS use cases. The client manages 500 hotel properties. Their support team was manually handling around 15,000 guest emails per day. Same questions over and over across hundreds of hotels but each one still needed a human to read it, understand it, find the answer, and reply. Here's how the system works end to end: Layer 1: Email ingestion and question extraction This was the hardest part. Guest emails are messy. A typical one looks like: "Hi there, we're coming for our anniversary on the 20th and I was wondering if you have any room upgrades available. Also is the spa open to guests or do we need to book separately? We're driving so need to know about parking too. Last time we stayed the wifi was a bit slow in our room, has that been fixed? Thanks!" That's four separate questions plus a complaint wrapped in one email. If you just embed the whole thing and search the FAQ database you get a blended result that partially answers one or two questions and misses the rest. So I built an extraction layer that reads the full email and breaks it into individual questions. It handles directly stated questions ("is the spa open?"), implied questions ("we're driving" implies they need parking info), complaints that need acknowledgment but aren't FAQ-searchable ("wifi was slow"), and informational context that shouldn't be treated as a question at all ("coming on the 20th"). Getting this extraction reliable was probably 40% of the total development time. Layer 2: FAQ knowledge base with vector search All hotel FAQs get embedded and stored in a vector database. Different properties have different amenities, policies, and details so the search is scoped per hotel. When a guest emails the Berlin property asking about breakfast, it searches the Berlin FAQ, not the Munich one. Each extracted question from Layer 1 gets s

Lauf’s sleek new entry feels closer to a traditional mountain bike than anything I’ve ridden before.

After 16 weeks of daily use, our WIRED testers saw visible hair regrowth with these red-light therapy devices.

This post is a continuation of part 1 During my childhood, I was obsessed with mazes. I would spend hours drawing mazes with increasingly complex rules and I would force my parents and friends to solve them. I wanted to translate this to the computer. Every so often, I would return to the challenge. Most of my mazes were built in Minecraft. Soon though, my mind started to connect the dots. Minecraft had convinced me that computers could be bent to my will. If I could understand how the game worked, maybe I could make my own world. I was convinced understanding the .bat script was the key. Initially, I experimented. I vividly remember trying to rename the script, after which windows would yell out a scary warning about how changing an extension might make the file unusable. I quickly pressed cancel, hoping I did not break my game. The first time I tried opening the minecraft.bat file in notepad, I was overwhelmed. A bunch of nonsensical garbage filled my screen. I did not know it at the time, but the people who shipped the cracked version obfuscated the script. It was not meant to be understood. I borrowed more and more books on programming and computers from the library, slowly building an understanding of how mysterious lines of text made the computer do stuff. I attempted many times to apply my knowledge. Most of my "programming" was copying code from books in notepad, trying to run it but not having the compilers or knowledge to execute my code. My computer was littered with hundreds of little files. maze.py , maze.php , maze.java . Each an attempt to achieve my dream of creating a maze. Each time, I faced disappointment when I double-clicked, and the computer told me that the file I just worked on was unrecognised. However, there was one piece of code I wrote that actually worked. A small little batch script - welcoming me to a new world. echo "Hello World" A short while later the computer I was working on died. Being locked out of a world I had only just starte

Data analysis is at the heart of how we spot patterns and improve systems today. Tools like Python, SQL, Power BI, and Tableau are everywhere in the data world, but Excel has held its ground as the starting point for anyone getting into data work, and there is a reason for that. What is Excel? Excel is a spreadsheet built on a grid of rows and columns. You use it to organize, format, and calculate data. For analysts it is where messy raw data gets sorted out, numbers get worked through, and everything gets turned into something that actually makes sense to look at. Ways Excel is Used in Real-World Data Analysis 1. Data Cleaning Raw data is almost never clean. Names are misspelled, IDs get duplicated, spacing is off, values go missing. None of that is unusual, it is just the reality of working with real data. Before any analysis happens the data has to be honest, because if the data is wrong the results will be too. Functions like PROPER() and TRIM() are some of the basic tools that help get data into a state where you can actually work with it. 2. Financial Reporting Every business, big or small, needs to know where the money is going. Excel makes that straightforward. SUM() adds up a range of numbers, AVERAGE() finds the mean, and once the calculations are done the data can be turned into charts and dashboards that tell the story of the business clearly. Not everyone in the room is an analyst, but everyone can read a chart. 3. Business Decision Making Clean data presented well becomes a decision making tool. What do customers want? What is working? What needs to change? Sorting figures from highest to lowest or filtering by region can take thousands of rows and turn them into something focused and answerable. That is really what data is for, helping people make better calls. Excel Features I Have Learned and How They Apply Three features that have stood out to me are conditional formatting, data validation, and cell referencing. Conditional formatting highlights ce

Most online file converters require uploading your documents, images, or videos to an unknown server. This is slow, inconvenient, and raises serious privacy concerns. I decided to build something different: a converter that works entirely inside your browser. Processing large files without a backend presents two main engineering challenges: How do you avoid consuming all available RAM? How do you prevent the user interface from freezing? This article explains how I solved these problems using OPFS, Web Workers, and a Backpressure mechanism. The result is a working tool you can try right now: PixelForge Free . The Architecture at a Glance Here is the simplified data flow of the entire pipeline: Drag & Drop → OPFS (Virtual Disk) → Worker Pool (Backpressure) → ZIP Stream → Download Problem 1: Out-of-Memory (OOM) Crashes The Challenge: Loading many files directly into the browser's memory is impossible. A user dropping a folder with 100+ high-resolution images would instantly crash the tab. The Solution: Origin Private File System (OPFS) OPFS provides a fast, isolated virtual disk inside the browser. Instead of loading files into RAM, my pipeline intercepts the drop event and streams the raw binary data directly to this virtual disk. Here is a simplified version of how it works: // Get a reference to the virtual disk const root = await navigator . storage . getDirectory (); const fileHandle = await root . getFileHandle ( `input_ ${ id } .raw` , { create : true }); // Create a writable stream to the disk const writable = await fileHandle . createWritable (); // Stream the file directly from the user's computer to the virtual disk await file . stream (). pipeTo ( writable ); This allows the application to accept a folder with 500+ items without consuming more than a few megabytes of actual RAM. The data stays on the user's SSD, not in memory. Problem 2: UI Freezing The Challenge: Image compression, PDF parsing, and video encoding are CPU-intensive operations. Running them

The annual developer event is where Apple announces operating system updates—like iOS 27—and maybe even teases future hardware. Here’s how to see it all.

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built CampusBeat 2.0 — a React Native campus super-app for students across 17 colleges in Odisha, India. It started in 2023 as a simple notice board aggregator: scrape college websites so students didn't have to visit them. It worked. Students used it. Then life happened, and it sat untouched on GitHub for three years. This challenge gave me the push to finally open that repo again. What I found was equal parts embarrassing and educational. What it is now: 📰 Real-time notices for 17 colleges — ITER, KIIT, NIT Rourkela, IIT, and more 🎨 Complete UI overhaul — warm cream × charcoal × coral editorial design 🃏 3D tiltable campus identity card you can share with friends 🔖 Bookmarks — save any notice, grouped by college 💬 Real-time campus chat rooms powered by Socket.io 🛒 Campus marketplace — buy/sell within your college 🔔 Push notifications via Firebase Demo The original app from July 2023: LinkedIn post CampusBeat 2.0 — running on device: Onboarding screen - with beautiful animation Onboarding.mp4 - Google Drive drive.google.com Login screen — editorial serif heading, Lottie animation, warm ink hero Register screen — custom college picker bottom sheet with live search Home screen — quote card, college notice feed, floating tab bar Profile screen — 3D tiltable campus card with holographic shimmer Share modal — drag to rotate the card, share natively News Explorer — college chips, notice type tabs, live banner Marketplace — buy and sell within your college Bookmark - your persistent news bookmark.mp4 - Google Drive drive.google.com Chat screen - live interaction within colleges chat.mp4 - Google Drive drive.google.com The Comeback Story What I found after 3 years Opening an old repo is humbling. Here is what I walked into. The dead API. The home screen showed a daily quote — except quotable.io had shut down. Every user was silently seeing the hardcoded fallback for three years: "Villains are not bad, the

Why RAG needs context judgment, not just better retrieval Most RAG systems optimize for retrieval. That makes sense. Search better. Embed better. Chunk better. Rank better. Fetch more sources. All of that matters. But retrieval alone does not answer a different question: Should this context actually influence the model? That is the problem FreshContext is built around. FreshContext is context judgment infrastructure for AI agents, RAG systems, and retrieval workflows. The simple version: candidate context in decision-ready context out Retrieval is not judgment A retriever usually answers: What might be relevant? A context judgment layer asks: What should happen to this context before it reaches the model? Those are different problems. A source can be relevant but stale. A source can be recent but low-confidence. A source can be useful as background but not strong enough to cite. A source can have no reliable date. A source can be a duplicate. A source can need verification before it should influence an answer. A normal RAG pipeline can retrieve all of that and still pass it straight into the prompt. That is where things get messy. The model may reason fluently from weak context, and the final answer can look confident even when the input material was stale, uncertain, or not citation-grade. The missing layer between retrieval and reasoning FreshContext sits after retrieval and before reasoning. It does not try to replace search, vector databases, RAG frameworks, or agent frameworks. It focuses on the boundary between them and the model. The product spine looks like this: candidate context -> FreshContext Core -> freshness / provenance / confidence / utility / source profile -> decision helper -> decision-ready output -> model / agent / app The goal is not just to produce another score. The goal is to turn candidate context into a decision. Example decisions include: cite_as_primary cite_as_supporting use_as_background needs_refresh needs_verification watch_only excl

For two years, our Sponsored Placements service booked limited ad inventory through Redis: a counter in Redis, a Redlock around the decrement, and a TTL key per hold. It oversold. Not catastrophically — consistently. 40–60 double-booked placements a month , each one a manual refund and an apology email to an advertiser. The root cause was never one bug. It was the architecture: two sources of truth that could not be made atomic with each other. The count lived in Redis; the ownership lived in SQL. No transaction spans both. The Redlock only ever protected the Redis half. The one mental shift SKIP LOCKED turns a contended table into a concurrent work queue. Instead of every request fighting over one counter, each request grabs different rows and ignores the ones someone else is holding. FOR UPDATE alone serializes — that's the experience that scares people off SQL locking. FOR UPDATE SKIP LOCKED is the opposite: a transaction that would have blocked instead skips the locked row and takes the next free one. One row per reservable unit, then: START TRANSACTION ; SELECT id FROM inventory_unit WHERE placement_id = 42 AND ( status = 'available' OR ( status = 'held' AND hold_expires_at < NOW ( 3 ))) -- self-healing expiry ORDER BY id LIMIT 2 FOR UPDATE SKIP LOCKED ; -- the whole trick UPDATE inventory_unit SET status = 'held' , reservation_id = 'uuid' , hold_expires_at = NOW ( 3 ) + INTERVAL 10 MINUTE WHERE id IN ( 1107 , 1108 ); INSERT INTO reservation (...) VALUES (...); COMMIT ; Two concurrent requests for the same pool lock different rows. Neither waits. The claim, the hold, and the reservation are one transaction — there is nothing to reconcile because there is nothing else. The numbers (8 weeks before vs 8 weeks after) Metric Redis + Redlock MySQL SKIP LOCKED Oversells / month 40–60 0 Reservation p95 210 ms 34 ms Reservation p99 540 ms 61 ms Throughput / instance ~600 RPS 1,400 RPS Lock-wait timeouts / day ~900 <5 Nightly reconciliation 9–14 min deleted Redis cluster

Query optimization has never been a solved problem. The moment you think your database is running efficiently, data volumes triple, access patterns shift, and suddenly your carefully tuned indexes are doing more harm than good. For decades, database engineers have relied on rule-based query planners — systems that follow deterministic logic to pick execution plans. That model is cracking under the weight of modern big data workloads. AI-driven query optimization is emerging as the answer, and it's already changing how high-scale systems handle billions of records in real time. This isn't about replacing the database administrator. It's about giving them — and the database itself — a fundamentally smarter toolset. Why Traditional Query Planners Hit a Wall Every relational database ships with a query planner: a component that reads your SQL, examines table statistics, and decides how to execute the query. PostgreSQL's planner, for instance, uses cost-based estimation to choose between sequential scans, index scans, hash joins, and nested loops. The system is elegant, and it works — until it doesn't. The problem is that cost-based planners operate on inherently stale statistics. They estimate cardinality (the number of rows a filter will return) based on histograms and samples collected at the last ANALYZE run. When data distributions drift — as they constantly do in real-world systems — those estimates go wrong, sometimes catastrophically. A planner that believes a filter will return 100 rows but actually gets 10 million will choose a completely wrong join strategy, turning a 200ms query into a 45-second disaster. Scale compounds this fragility. In big data environments running on distributed systems like Apache Spark, Trino, or BigQuery, a bad plan doesn't just waste one machine's resources — it cascades across hundreds of nodes, blowing through memory budgets and creating shuffle bottlenecks that ripple across the cluster. How AI Changes the Optimization Equation AI