标签：#t

Following the success of its $99 Kodak-branded Snapic A1, Reto Project is releasing the Kodak EC35, an even more affordable 35mm film camera for just $34.99. The EC35 certainly isn't fancy. Its 25mm acrylic lens with a fixed f/10 aperture and 1/100 shutter speed basically put it on par with a drugstore disposable. The fact […]

On the latest episode of Equity, we debate whether Apple's lawsuit will cast over OpenAi's much-discussed plans to get into hardware and go public.

When a new video shows up in one of our regional crawlers, three things need to happen almost immediately: the SQLite FTS5 search index for that region needs a new row, the discovery ranking cache needs to be invalidated, and the sitemap generator needs to know a URL was born. For a long time we did all of this inline, inside the same cron process that fetched the video. It worked until it didn't. A slow FTS5 rebuild would stall the fetch loop, a sitemap write would fail silently, and a crash halfway through meant one region had the video indexed and another didn't. The fetch and the fan-out were fused together, and every failure was a partial failure. The fix was to stop treating "a video was discovered" as a function call and start treating it as an event. At TrendVidStream we run discovery across 8 regions, and the moment we introduced NATS JetStream as the spine between the crawler and the downstream consumers, the whole system got calmer. This post is the concrete version of how we did it: the stream config, the publishers, the consumers, and the mistakes we made that you can skip. Why Not Just Use a Queue Table in SQLite We already had SQLite everywhere, so the obvious move was a jobs table. We tried it. The problems showed up fast: Polling latency vs. load tradeoff. Poll every second and you hammer the DB with mostly-empty SELECT queries across 8 regions. Poll every 30 seconds and your search index lags noticeably behind your crawler. No fan-out. One row, one worker. If the sitemap generator and the FTS5 indexer both need the same event, you either duplicate rows or invent a consumed_by bitmask. Both are ugly. Locking. SQLite's writer lock means the queue table and the actual data table start contending under the multi-region cron bursts we run. Cross-region delivery. Our regions aren't all on the same box. A queue table doesn't cross machines without you building a replication story on top. JetStream solves all four: push-based delivery (no polling), multipl

The security officer said no. Not "maybe with some modifications." Not "let us review the data handling policy." No. Cloud-hosted AI code review was not going to happen in their environment. The codebase contained classified material. The network was air-gapped. No data leaves the building. End of conversation. This was a defence contractor. Their development team was writing code that couldn't touch any external API, any cloud service, any SaaS platform. But they were also writing 200,000+ lines of code per year with a team that was struggling to maintain review quality across twelve engineers, the exact problem that AI code review solves. The challenge: deploy AI code review capability that runs entirely on-premise, in an air-gapped network, with no external connectivity, while meeting the security and compliance requirements of a classified computing environment. This is the guide we wish existed when we started that project. It covers hardware requirements, model selection, inference server setup, CI/CD integration and the security architecture that made it pass the compliance review. Why air-gapped AI code review is different from everything else Most AI code review guides assume cloud connectivity. The model runs on the provider's infrastructure. The code is sent via API. The review comes back. The security question is about data handling policies, encryption in transit and vendor trust. In an air-gapped environment, none of that applies. The model runs on hardware you control. The code never leaves your network. There is no vendor to trust because there is no vendor in the loop. This sounds simpler from a security perspective. In some ways it is. In other ways it's significantly more complex because you're now responsible for the entire stack, model selection, quantisation, inference hardware, deployment, monitoring, updating and maintaining the system that in a cloud deployment is someone else's problem. Hardware requirements The hardware question is the fir

What Is a Pointer in C? A Beginner's Guide If you're learning C and pointers are the moment things suddenly feel harder, you're not alone. Pointers trip up more beginners than almost any other concept in the language. But the core idea is simpler than it looks once you strip away the confusing syntax: a pointer is just a variable that stores an address instead of a value. A Variable Normally Stores a Value When you write int age = 25; , C sets aside a small chunk of memory, gives it a label called age , and stores the number 25 inside it. Every variable in your program lives somewhere in memory, and every location in memory has an address, similar to a house having a street address. Most of the time you don't think about that address at all. You just use the variable name and C handles the memory bookkeeping behind the scenes. What a Pointer Actually Stores A pointer is a variable, but instead of holding a regular value like a number or character, it holds the memory address of another variable. Here's what that looks like: int age = 25 ; int * agePointer = & age ; The & symbol means "give me the address of," and * when declaring a variable means "this variable is a pointer." So agePointer doesn't contain 25. It contains the address where 25 is stored. If you want to see the value at that address, you dereference the pointer using * again: printf("%d", *agePointer); would print 25, not the address. Why Not Just Use the Variable Directly? This is the question that trips up most beginners, and it's a fair one. If you already have age , why bother with a pointer to it? The real value of pointers shows up in a few common situations: Passing large data to functions. When you pass a variable to a function in C, it normally gets copied. For a single integer that's cheap, but for a large array or struct, copying is wasteful. Passing a pointer instead means the function works with the original data directly, without duplicating it. Modifying a variable inside a function. Nor

Turn drum audio into a score you can actually edit Discussion | Link

This post is my submission for DEV Education Track: Build Multi-Agent Systems with ADK . What I Built Preparing for technical interviews can be overwhelming. I wanted to build a tool that doesn't just give generic questions, but actually analyzes my specific resume to challenge my unique skill set. This led me to build a multi-agent system using the ADK. This multi-agent system, will take user resume and extracts their profile for generating Interview Questions specialized to the candidate profile. The agents communicate in a sequential loop: The Profiler extracts data -> The Interviewer generates questions -> The Judge validates them. If the Judge rejects a question, the Interviewer re-drafts it, ensuring only high-quality, resume-relevant questions make it to the user. Cloud Run Embed Your Agents Profiler Receives a resume PDF GCS path, downloads it in-memory, parses the text content, and builds a summary of skills. Interviewer Reads the candidate summary and drafts 3 technical interview questions designed to test the boundaries of their experience. Analyzes the drafted questions. Passes the iteration if they are resume-specific; rejects/fails them if they are too generic. Key Learnings This project was a fantastic weekend challenge. Working through the Google Codelab gave me a solid grasp of agent-based architectures, specifically implementing Agent, LoopAgent, and SequentialAgent to create a robust workflow. A few key technical takeaways included: Managing Statelessness : Learning to handle agent sessions in a Cloud Run environment was a great lesson in explicit session lifecycle management. Cloud Integration : Integrating Google Cloud Storage for file handling taught me how to bridge in-memory document processing with persistent cloud storage efficiently. Deployment Architecture : Mastering the transition from local development to a containerized, production-ready Cloud Run deployment provided deep insights into modern backend orchestration. Check the Code from

Prisma and Drizzle connect as the postgres role and bypass Supabase RLS entirely, so your policies never protect ORM queries. Here's the fix. TL;DR: No. Prisma and Drizzle open their own direct Postgres connection and log in as the postgres role, which owns your tables and carries BYPASSRLS — so Row Level Security is skipped on every ORM query. Point your app's connection at a dedicated, non-owner NOBYPASSRLS role (and keep the auth check in your code), not at postgres . If you built your Supabase project assuming RLS is a safety net on the data itself, adding an ORM quietly punches a hole straight through it. Your policies are still there. They just never run for the ORM's connection. Here's the mechanism, the myth to unlearn, and three fixes in order of how much you should reach for them. Does Prisma respect Supabase RLS? No. RLS is not a global property of the database — Postgres enforces it per role, per statement . A policy only bites for a role that is (a) not the table's owner, (b) has no BYPASSRLS attribute, and (c) is not a superuser. The Supabase JS client satisfies all three because it reaches Postgres through PostgREST, which runs your query as the unprivileged anon or authenticated role. Prisma and Drizzle satisfy none of them: they read DATABASE_URL and open a raw SQL connection as postgres , which owns virtually every table you migrated and holds BYPASSRLS . Either fact alone is enough for Postgres to skip your policies. So the same query that returns one tenant's rows through supabase-js returns every tenant's rows through Prisma. That is not a bug in your policy — it's the connection role. Two doors into the same database There are two completely different paths to your data, and they authenticate as different roles. The supabase-js path (RLS enforced). supabase-js talks HTTP to PostgREST, not to Postgres directly. PostgREST connects as authenticator , validates the request JWT, and does a SET ROLE into anon or authenticated for the statement. Those

Learning software engineering in the past was a straight forward process, you learn the programming language, you build projects in your portfolio, apply to companies, get a job and life goes on. Doing that in the current times might be a little bit different, as when applying for jobs, you can see some new requirements other than your programming skills and portfolio project such as Prompt Engineering, Work with Agents, Claude Code, and others. You may ask yourself, what are those? And if I am new to Software Engineering, will that change my learning path? Lets discuss all this below. Software Engineering in the Past For a long time, the path into software engineering was clear. You picked a language, maybe Java, Python, or JavaScript. You spent a few months learning the syntax, then the fundamentals: data structures, algorithms, how a database works, how the web sends and receives data. After that, you built things such as A todo app, weather app, clone of a website you liked. These projects went into a portfolio, usually a GitHub profile and a simple personal site. Then you applied to companies, passed a technical interview, and started your first job, so the skills you needed were stable, if you learned React in 2018, React was still useful in 2021. Tools changed, frameworks came and went, but the core idea stayed the same: you write the code, you understand what you wrote, and you fix it when it breaks. When Did AI Start Becoming Something Required The shift did not happen in one day. It came in steps. The first step was autocomplete , around 2021, tools like GitHub Copilot started suggesting the next line of code while you typed. Most developers saw it as a nice helper, nothing more. It saved you from writing boilerplate, but you were still the one thinking. The second step was chat , when ChatGPT and Claude became popular, developers started using them to explain errors, review code, and write small functions. Still a helper, but a much stronger one. At this

I regularly lose time to terminal muscle memory. I work across Windows and Unix-like shells, so I will remember the right command in the wrong environment, transpose a Git subcommand, or use a valid binary with an invalid subcommand. The fix is usually easy to find. The interruption is the costly part: stop, search, translate the answer back into the current shell, and try again. The idea is not new. There are projects that help with failed commands, as well as terminal-integrated LLMs such as aichat. However, I wanted something that does one thing well: fix commands in a seamless workflow powered by an LLM. I wanted a deliberately narrow tool: when a command fails, suggest the command I probably meant, let me inspect it, and run it only after confirmation. During a Fable promotion period, I used an LLM coding agent to see how far a well-scoped prompt could get me. With very little steering, it produced a usable Go prototype in roughly an hour. The project is now open source: nudge . The workflow I wanted The core interaction is intentionally small: Run a command as usual. If it fails, type fix (or bare nudge ) to get a suggested correction. Review it, then press Enter to run, e to edit it first, or n to cancel. The cheapest case is a plain typo, which never reaches a model at all: PS> git pshu git: 'pshu' is not a git command. See 'git --help'. PS> fix `git pshu` isn't a valid command. Did you mean: → git push (typo fix for `git pshu`) Run it? [Enter = yes / n = no / e = edit] The (typo fix for ...) label is the tool telling me it answered locally, in under 10 ms, without a network call. The cross-shell version of the same mistake is reaching for a binary that does not exist here. Because the binary is missing, the shell's command-not-found hook fires and I do not have to type anything at all: PS> printenv `printenv` isn't a valid command. Did you mean: → Get-ChildItem env: (list all environment variables) Run it? [Enter = yes / n = no / e = edit] The case that act

You've got a Next.js app on one domain and your API on another. The login works, the dashboard fills up, everything looks fine. Then one day you open the Network tab and there it is: your access token, in plain text, in a request header the browser sent all by itself. At that point every line of JavaScript on the page can read it. Not just your code. The analytics snippet you added last week, the twelve transitive dependencies you've never opened, whatever an XSS bug manages to slip in. And you never really decided this. It just happened, because calling the API straight from the component was the path of least resistance, and nothing complained. The browser is not a trusted client The version that gets you here looks completely reasonable: // ❌ a Client Component talking to your API ' use client ' ; export function Profile () { useEffect (() => { fetch ( ' https://api.example.com/me ' , { headers : { authorization : `Bearer ${ token } ` }, }) . then (( r ) => r . json ()) . then ( setProfile ); }, []); } Look at what that actually signed you up for. The token is in JavaScript, so the protection an HttpOnly cookie would have given you is simply gone. The call is cross-origin, so you're now on the hook for CORS: preflight requests, an allowed-origins list to maintain, Access-Control-Allow-Credentials , and the quiet worry that you've opened it wider than you should. And because the request leaves from the browser, anyone with devtools can read your API's base URL, its routes, and how it expects to be authenticated. That's a decent map of your backend, handed out to every visitor. What makes this hard to catch is that none of it breaks. It works in the demo, it works in production, it reviews clean. It just sits there as a liability until the day it stops being quiet. The browser talks to your server. Your server talks to your API. The Backend-for-Frontend pattern draws one line: the browser only ever talks to your Next.js server. The Next.js server talks to your API.

This report analyzes pricing shifts across 35 developer tools tracked over a seven-week period from 2026-W19 to 2026-W29. We have identified 37 total pricing changes during this window, providing a clear snapshot of how platform tiers are evolving for engineering teams. GitHub Copilot’s Tier Expansion GitHub Copilot has seen significant activity in its subscription structure over the last two months. On May 25, the platform solidified its existing pricing, maintaining the Free tier at $0, Pro at $10/mo, and Pro+ at $39/mo. By June 15, the service introduced a "Max" tier priced at $100/mo. This was followed on July 12 by the addition of two enterprise-focused options: Business at $19/mo and Enterprise at $39/mo. Cursor’s Rapid Plan Iterations Cursor has undergone a series of rapid adjustments to its tiering model since late May. On May 25, the platform introduced a Free Hobby plan and a $20/mo Pro plan while removing the Individual tier. This structure was short-lived; on June 15, the platform removed both the Hobby and Pro tiers, replacing them with a single $20/mo Individual plan. As of the latest tracking, the current price for the Cursor Pro plan is listed at $20/mo. Netlify and Windsurf Pricing Shifts Infrastructure and IDE-integrated tools are also shifting their cost models. On July 12, Netlify moved its Enterprise tier from a "contact sales" model to a defined starting price of $500/month. Windsurf also saw a notable change on June 15 regarding its Teams offering. The price shifted from a flat $40/user/month to a base of $80/mo plus an additional $40/mo per seat. This follows Windsurf's earlier introduction of a Free ($0/month) tier on May 25. Vercel and Firebase Updates Platform-as-a-Service providers have focused on refining their entry-level and usage-based offerings. On May 25, Vercel added a Free Hobby plan and updated its Pro tier to $20/mo (plus additional usage). During that same week, Firebase added a Spark plan ($0) and a usage-based Blaze plan, whi

I would never go so far as to say there's no place for AI in music (I'm a fan of Holly Herndon, after all). But I generally find music made with generative AI to be offensively boring, especially the outputs of Suno. So I'm having a bit of a tough time processing the fact that […]

Clone any website into clean code. Free & open source Discussion | Link

Your personal context file for every agent. Discussion | Link

According to the New York Times, federal agents have been told that the FBI will no longer be investigating confrontations involving ICE agents. The DHS and DOJ denied the change in policy to The Times. The reported change in guidance follows renewed scrutiny of violence by ICE agents who have killed two people in the […]

Manage your team of AI agents by voice, from anywhere Discussion | Link

Free browser tools for everyday tasks, no login Discussion | Link

Welcome back to TechCrunch Mobility, your hub for the future of transportation and now, more than ever, how AI is playing a part.

I’ve been out of context with my computer science degree for years, and honestly, it feels overwhelming. I want to change that, so I'm starting this log to document my comeback story, my failures, and my progress. What I did today: Acknowledged the starting line. Took 10 minutes to think about where I left off and what I need to tackle first. Decided to write daily logs. This is not my first attempt to finish the degree, but hopefully with some public eyes on it, it will be the last. 10 subject left. Starting with Mathematical analysis. The biggest challenge right now: Feeling completely out of context and fighting the urge to get distracted by everything else. Many things have changed since i was actively going to classes. My generation graduated many years ago and i feel like getting all the information I need will be extremely difficult since i don't know anyone. Getting information from the university websites and emailing professors will be slow. Next steps: Tomorrow, I'm going to try to overcome my overdramatic anxiety and post in the student groups I was in, in hope that somebody might have new information about the subjects. I will go start lesson #1. Goal is to ease into the material and start a habit, rather than pressuring myself to do everything at once. Come back tomorrow.