标签：#us

GitHub热门项目 | The customization marketplace for Windows programs: https://windhawk.net/ | Stars: 8,822 | 7 stars today | 语言: Rust

GitHub热门项目 | ANOLISA (Agentic Nexus Operating Layer & Interface System Architecture) | Agentic OS with runtime, security, observability, and Tokenless response compression for lower token usage and cost. | Stars: 610 | 2 stars today | 语言: Rust

It's the week before vizcrush goes public, and I have two files open side by side. On the left, the launch copy: the JS core beats the most popular npm downsampling package by 32×, "and WASM adds another 5-10x on top." On the right, the repo's own benchmark control run: wasm/js ≈ 1.00× . One million points, same algorithm, same machine. Parity. I go looking for the measurements behind the claim. Half of it holds up: the 32× JS comparison has a result file (1.72ms against 55.52ms, real). The claimed additional 5-10× from WASM has nothing behind it, and the repo's own control run contradicts it. That afternoon set the shape of the whole launch: before anything shipped, every performance claim would either get a measurement behind it or get deleted. Three beliefs didn't survive. Each one got a public retraction, written up as an ADR in the repo. vizcrush is a set of data primitives for browser visualization (downsampling, binning, spatial indexing, streaming sketches), written in Rust, compiled to WebAssembly, with a pure-JS core behind the same API as a fallback and explicitly selectable backend. It went open source this week: the repo and the book are public, and all 11 packages are live on npm. npm install @vizcrush/core @vizcrush/downsample This is a launch story about turning benchmark results into product policy: claims, documentation, and WebGPU policy follow the measurements, while WASM dispatch stays availability-based pending further investigation. One scope note before the data. Every result here is workload-specific: LTTB (Largest-Triangle-Three-Buckets, the downsampling algorithm that picks, per bucket, the point that best preserves the visual shape of the line) is downsampling, the stats kernel is a reduction, and bin2d is histogramming. Which backend wins is algorithm- and engine-dependent, so none of what follows is a library-wide WASM-versus-JS verdict. It is three specific workloads measured on specific engines, with the claims and documentation follo

Protecting data that must stay secret ten years from now is a problem for today : an adversary can capture your encrypted traffic now and decrypt it once quantum capability exists ( harvest now, decrypt later ). Quipu is a free hybrid post-quantum encryption library for data at rest: it combines proven classical cryptography with the new kind, so that it only breaks if both fall at once. Pure Rust, and why Quipu started out aiming at several languages: a Rust core with a C ABI on top and bindings for Python, Node and Go. It worked, but the lesson was clear: maintaining a stable C interface plus four bindings, each with its own packaging and interoperability tests, was complexity that did not pay for itself against the real goal — protecting data at rest — and it widened the attack surface with unsafe we did not want. Today Quipu is pure Rust : memory safe, no garbage collector, no first-party unsafe . And for people who do not write Rust, it ships as a native Python wheel via PyO3 — the surface that non-Rust users actually need. One codebase, one thing to audit. It is the same philosophy that guides the rest: where good cryptography exists, reuse it; simplicity is a security decision, not a convenience. Installation cargo add quipu # Rust pip install quipu-crypto # Python (native wheel, PyO3) Encrypt and decrypt in Python import quipu # Symmetric, with a passphrase blob = quipu . encrypt_stream ( b " sensitive data " , " my-passphrase " ) assert quipu . decrypt_stream ( blob , " my-passphrase " ) == b " sensitive data " # Post-quantum, for a recipient pub , sec = quipu . generate_keypair () # X25519 + ML-KEM-1024 c = quipu . encode_to_recipient ( b " secret " , pub ) assert quipu . decode_as_recipient ( c , sec ) == b " secret " What is underneath Encryption: XChaCha20-Poly1305 (authenticated AEAD). Key derivation: Argon2id (brute-force resistant) + HKDF. Post-quantum: X25519 + ML-KEM-1024 for keys; Ed25519 + ML-DSA-87 for signatures. Security level: NIST category 5

As audio-focused generative tools and platforms have gotten more sophisticated, the internet has become increasingly filled with AI-generated music whose melodies and vocals are algorithmically derived from the work of human artists. While some of the people pumping out this kind of content immediately own up to using AI, others have denied using the technology […]

I’ve been building Unmuse because I kept noticing a simple problem: Having an idea is easy. Turning that idea into something actually worth posting is the hard part. You can have a thought like: “People keep waiting for the perfect time to start.” But turning that rough thought into a strong hook, script, or caption can take way more effort than it should. So I built Unmuse. You give it the rough thought in your head, choose what you want to create, and Unmuse turns it into a usable piece of content. Right now, it’s an early MVP. I’m building it mostly by myself and plan to add a lot more features as I get feedback and traction. If you create content, I'd genuinely love to hear: What’s the most annoying part of turning an idea into a post? Try it here: https://unmuse.online/

Most of what you read about autonomous agents is about giving one a goal and hoping it doesn't go sideways on the way there — the unwatched agent that loops, or drifts, or quietly runs up a bill. I wanted the cleaner version of that question, with the goal taken out entirely: what does an agent do when there's no goal at all? I've spent about four months building a harness around a coding agent — gates, persistent memory, verification hooks. Last night I ran it with the one variable that matters here set to zero: no task. Method Three sequential runs: Each run was a fresh agent process — no conversation history carried over from the run before, only the harness it loads at startup. The prompt was a single "." — the minimal input the CLI accepts (an empty string exits with an error). As close to "no instruction" as the interface allows. The agent's scratch working directory was empty and swept between runs — but the harness, the git repo, and a shared run-record all persist and load at startup. So no run was handed a task, yet a later run could read what earlier ones had recorded. That's deliberate, and it's the point: it's how Run 2 knew it was the second run and Run 3 could check Run 2's fix. What I'm measuring isn't behavior from a blank slate — it's what the agent does with a maintenance-shaped harness and a shared record when nobody gives it a job. No task was assigned. Logging was external and invisible to the agent, so it had no "produce a report" objective to satisfy. Same model each run. Cost was billed per run; I recorded turns, cost, and the resulting git state for each. Then I read the transcripts and checked every action against the actual commit and log. Numbers below are measured, not estimated. Results Run 1 — 17 turns, $1.65. The agent inspected system state unprompted. It found a stale security alert, cross-checked it against the record, and classified it as an already-resolved false positive. It then attempted a file operation that a safety gate bl

Bulk messaging sounds like a straightforward productivity feature: write once, send to many people, and save a large amount of repetitive work. That was how I saw it when I first built the workflow for MSG.AI. Once I had a working queue, configurable delays, progress tracking, and pause-and-resume controls, however, my view changed. The technical problem was manageable. The harder problem was deciding when the feature should be used at all. The more reliable the tool became, the more important it felt to talk about restraint. There are legitimate reasons to message a group of customers Bulk messaging is often discussed as if it were synonymous with cold outreach. In real customer operations, that is not always true. A business may need to tell existing customers about a delivery delay. A salesperson may need to share updated documents with people who requested them at a trade show. A support team may need to notify affected customers about a service interruption. A supplier may need to communicate a holiday schedule to active buyers. These messages can be useful, timely, and expected. The repetitive part is operational. Opening dozens of chats, pasting the same update, checking names, attaching the right file, and remembering who has already received it creates room for mistakes. A task queue can reduce that mechanical work. But solving the mechanical problem does not answer the more important question: should this person receive the message? Consent cannot be implemented as a sending interval Developers like problems that can be represented as settings. If sending too quickly creates risk, add a delay. If identical timing looks unnatural, randomize the interval. If a task is too large, split it into batches. If the user makes a mistake, add a preview screen. Those controls are useful, but they do not create consent. A five-minute delay between unwanted messages still produces unwanted messages. Random timing does not turn an unknown phone number into an existing cu

Winning is the part everyone posts about. The two months after — the part where a cash prize actually...

The unexpected interruption came hours before the president wrote a congratulatory post on Truth Social about the company’s most recent earnings report.

Most developers treat SEO as "someone else's job" — a marketing concern that happens after the site ships. But a huge chunk of SEO is actually decided at the code level, long before a marketer ever touches the content. If you're building sites — for clients, for yourself, or as side projects — a few technical fundamentals can make or break how discoverable that work ever becomes. Here's the technical SEO checklist I use when reviewing or building sites, from a digital marketing + web perspective. Core Web Vitals Aren't Optional Anymore Google uses three core metrics as direct ranking signals: LCP (Largest Contentful Paint) — how fast the main content loads INP (Interaction to Next Paint) — how responsive the page feels to input CLS (Cumulative Layout Shift) — how visually stable the page is while loading A site can have perfect content and still underperform in search if these numbers are bad. Common culprits: unoptimized images, render-blocking JS, and layout shifts from late-loading ads or fonts. Quick wins: Lazy-load offscreen images Serve modern image formats (WebP/AVIF) Reserve space for dynamic content (ads, embeds) to avoid layout shift Defer non-critical JavaScript Structured Data Is a Developer Task, Not a Marketing One Schema.org markup (JSON-LD is the recommended format) helps search engines — and increasingly AI-driven search summaries — understand what's actually on the page: is this a product, an article, a recipe, an FAQ? Sites with well-implemented structured data are more likely to get rich results (star ratings, FAQ dropdowns, breadcrumbs) in search — which directly impacts click-through rate even without a ranking change. If you're building a site and skip this step, you're leaving visibility on the table for something that's usually a few hours of implementation work. Rendering Strategy Affects Crawlability Client-side rendered (CSR) React/Vue apps can still get indexed, but it's inconsistent and slower than server-rendered or statically generate

Fraudsters are exploiting enterprise chat apps like Teams and Webex to trick Chinese victims into transferring large sums of money, fueling a wave of complaints.

The fastest way to lose trust in an AI support assistant is to watch it confidently invent an answer. That is the problem retrieval-augmented generation (RAG) is built to solve. Instead of relying on whatever a language model memorized during training, a RAG system first retrieves the relevant passages from your own knowledge base, your help docs, policies, and product specs, then generates a reply grounded in that verified content. The result is an assistant that answers from your truth, cites its sources, and reflects updates the moment you publish them, with no expensive retraining. The business case is hard to ignore. Teams deploying RAG report sharply lower issue resolution times, deflected tier-one tickets, and agents who get accurate suggested answers in seconds. But RAG is not a switch you flip. Answer quality lives or dies on how well you chunk, embed, and retrieve your content, and on the guardrails you put around what the model is allowed to say. This guide walks through how RAG actually works and what it takes to ship it responsibly. Why plain LLMs fall short for support A bare language model is a confident generalist with three liabilities that are fatal in a support context. Its knowledge is frozen at training time, so it has never seen your latest pricing, your current return policy, or the feature you shipped last week. It has no access to your specifics, so it does not know this customer's plan or your internal escalation rules. And when it does not know, it tends to guess fluently. In casual use a wrong answer is an annoyance. In customer support it is a refund processed against the wrong policy, a security claim that isn't true, or a promise your team now has to honour. RAG addresses all three problems by grounding every answer in your verified, current content, so the model stops improvising and starts citing. In plain terms A plain chatbot answers from memory and sometimes guesses. A RAG assistant looks up the answer in your documentation first,

Cloud spending is on track to pass a trillion dollars a year, and most of it is wasted. Industry data puts idle resources, over-provisioned instances, and missed commitment discounts at 25 to 35% of the average cloud bill. For an early-stage company where hosting can eat 6 to 12% of revenue, that waste is not a rounding error. It is runway. The good news is that cloud cost optimization rarely requires a painful re-architecture. The biggest wins come from a few low-risk moves: switching off what nobody is using, rightsizing what is over-provisioned, and buying commitments for the baseline you will run anyway. The discipline that ties these together is called FinOps, and you do not need a dedicated team to practise it. You need visibility into where the money goes, a short list of high-leverage actions, and the habit of reviewing the bill before it reviews you. This playbook walks through exactly that, in the order we apply it for the startups we work with. Find the waste before you cut it You cannot optimize what you cannot see. Before touching a single instance, make your spend legible. That starts with cost allocation tags, a small enforced set like env , team , service , and customer , applied to every resource. Untagged spend is where waste hides, so treat an untagged resource as a bug to be fixed, not a footnote. With tags in place, the native tools do most of the heavy lifting. AWS Cost Explorer (and its equivalents on GCP and Azure) will show you the trend line, the biggest line items, and the resources sitting idle. Set budget alerts at the account and per-environment level so a runaway job pings you on day two, not on the invoice. The most important shift is what you measure. Don't stop at "we spent $14k on EC2." Tie cost to a unit of business value: cost per customer, per active user, or per thousand requests. That single number turns an abstract bill into a metric you can defend in a board meeting and optimize against deliberately. The number that matters

Web accessibility stopped being optional. The European Accessibility Act has been enforced since June 28, 2025, and it reaches any business that sells products or services to EU customers, regardless of where that business is based. In the United States, the Department of Justice's ADA Title II rule requires public bodies to meet WCAG 2.1 Level AA by April 2026, and private-sector lawsuits keep climbing every year. For a company shipping a website or app, that means a real deadline and real financial exposure. EAA penalties can reach 5% of annual turnover for large companies, and a single ADA complaint can cost tens of thousands to settle before you have fixed anything. The good news: the standard everyone points to, WCAG 2.1 AA, is well-defined and achievable. The bad news is that the most heavily marketed shortcut, the accessibility overlay widget, does not get you there and can make your legal position worse. This guide covers what the law actually requires, why the quick fix backfires, and how we build accessibility into a site from the start instead of bolting it on at the end. What the law actually requires Three names come up constantly, and they fit together cleanly. WCAG 2.1 Level AA is the technical standard. The EAA and the ADA are the laws that, in practice, point back to it. In Europe, meeting WCAG 2.1 AA satisfies the digital requirements of the harmonized EN 301 549 standard, which is how you demonstrate EAA conformance. WCAG is organized around four principles, known as POUR: content must be Perceivable, Operable, Understandable, and Robust. In concrete terms that means text alternatives for images, sufficient color contrast, full keyboard operability, visible focus states, labeled form fields, and markup that screen readers can parse. Level AA, not AAA, is the bar nearly every regulation references. Note the EAA exempts the smallest businesses, those under 10 employees and under two million euros in turnover, but that carve-out is narrower than most

If your website has a support chatbot, an AI assistant, or any feature that writes text or generates images for visitors, a hard deadline is now on your calendar. From 2 August 2026, Article 50 of the EU AI Act requires you to tell people when they are talking to a machine or looking at AI-generated content. It is the first part of the Act that touches ordinary businesses rather than just labs building frontier models, and it applies the way GDPR does: not by where your company is based, but by whether people in the EU use your product. The good news is that Article 50 is mostly about transparency, not heavy engineering. You are not being asked to prove your model is safe or file a conformity assessment. You are being asked to be honest about what is human and what is not. The catch is that "be honest" has specific rules, the fines are large enough to matter (up to 35 million euros or 7% of global turnover for the worst breaches), and a surprising number of teams discover they are a "provider" of an AI system when they assumed they were just a user of one. Here is what Article 50 actually requires, how to tell which obligations land on you, and the short list of changes most businesses need to ship before August. What Article 50 actually requires Article 50 covers four situations, and each one has its own disclosure rule. Chatbots and conversational AI must tell users they are interacting with an AI system, unless that is already obvious to a reasonable person. AI-generated or manipulated media (synthetic images, audio, and video, including deepfakes) must be labelled as artificially generated. AI-generated text published to inform the public on matters of public interest must be disclosed as such. Emotion recognition and biometric categorization systems must inform the people exposed to them. Most businesses are touched by the first two. If you run a chatbot, the disclosure has to be clear and come at the right moment, which in practice means before or at the start

Every team has a list of small jobs nobody wants to do: copy a new lead from the website into the CRM, chase an unpaid invoice, summarise a support email, post the same update to three places. None of them is hard. Together they eat hours every week and quietly burn out the people stuck doing them. Automation platforms exist to take that list off your hands, and in 2026 the three names you will keep running into are Zapier, Make and n8n. What changed recently is that all three stopped being simple "when this, then that" tools and grew real AI agents. Zapier shipped Agents that act across its 8,000-plus app catalogue. Make added Maia, an assistant that builds whole workflows from a sentence. n8n 2.0 went deepest, with native LangChain support, 70-plus AI nodes, persistent memory and human approval steps. So the question is no longer whether to automate, it is which platform fits how you work, what you can afford to run at scale, and how much control you need over your own data. Here is how the three actually differ, and how to pick without locking yourself into the wrong one. The honest three-way comparison The marketing pages all promise the same outcome. The real differences show up in pricing models and ceilings. Zapier is the easiest to start with and the most expensive to scale. It bills per task , and every single action counts. A ten-step workflow that runs 1,000 times a month burns 10,000 tasks. Great for non-technical teams wiring up a handful of common apps; painful once volume grows. Make sits in the middle. Its visual canvas is genuinely pleasant for branching, multi-step logic, and it bills per operation at a lower unit cost, staying under roughly 100 euros a month even at high volume. The sweet spot for teams that want real logic without code. n8n is the power tool. Free if you self-host, 20 to 50 euros a month on its cloud, plus the AI token costs you would pay anyway. It is the most AI-native of the three and the only one you can run entirely on your

For a decade the advice was simple: put everything in the cloud and never look back. In 2026 that consensus is cracking. A Barclays survey found 83% of enterprises plan to repatriate at least some workloads from public cloud to private infrastructure, and IDC puts the share expecting to move compute or storage within the year near 80%. The most-cited example is still 37signals, the team behind Basecamp, who left the public cloud and reported saving roughly $7 million over five years. It is tempting to read those numbers as "cloud was a mistake." It was not. The cloud is still the right home for spiky, unpredictable, early-stage workloads where you are buying speed and optionality. What changed is that a lot of companies have now run the same steady, predictable workload on rented hardware for years, paying a premium for flexibility they stopped using. Repatriation is not a reversal of cloud strategy. It is the correction that comes after the bill gets big enough to read carefully. The question worth answering is not "should we leave the cloud" but "which specific workloads no longer earn their cloud premium," and that is a question you can answer with numbers. What is actually driving the move Cost is the headline, and it is real. Organizations that repatriate the right workloads commonly report 30 to 60% lower infrastructure spend for those workloads, because on-demand cloud pricing carries a large convenience margin that only makes sense when your usage is genuinely variable. Run a database at a steady 60% utilization every day for three years and you are paying a premium for elasticity you never touch. But cost is not the only force. Just over half of organizations name data security and privacy as a top driver, and in Europe the regulatory pressure is sharper than the cost case. Frameworks like DORA are already enforceable, and regulators increasingly want evidence of control over where data physically lives, not just a contractual promise from a hyperscaler. Fo

A recent paper argues that AI is often better at doctoring than doctors. Guess who isn't thrilled.

Uber’s GitFarm provides Git operations as a centralized service, eliminating local repository clones across large scale monorepo workloads. The platform uses prewarmed checkouts, ephemeral sandboxes, repository synchronization, and gRPC streaming to reduce resource consumption and startup latency for automation services operating across thousands of repositories. By Leela Kumili