标签：#war

The old app "still needs to be retired," AcuRite tells us.

One of the reasons I often find myself disagreeing with modern software trends is that many conversations revolve around features. How many features does it have? How quickly can we add more? What can we put on the marketing page? What can we announce next? Features matter. But I care far more about systems. Because at the end of the day, people don't buy features. They buy outcomes. And outcomes come from systems. The Car Analogy One of the easiest ways to explain my thinking is with cars. A car is made up of thousands of individual components. An engine. A transmission. Suspension. Brakes. Fuel systems. Electrical systems. Cooling systems. Sensors. Wiring. Each component is important. But nobody walks into a dealership and says: "I'd like to purchase six pistons, a transmission housing, and a fuel injector." They buy a car. They buy transportation. They buy a complete system. The individual parts only matter because they contribute to the overall experience. The customer doesn't want to think about every moving piece. They want to get in, turn the key, and drive. Drivers and Mechanics This is where I think technology often loses its way. Users are drivers. Engineers are mechanics. A driver should be able to: Start the vehicle Fill it with fuel Check the oil Wash it Perform light maintenance That's about it. They shouldn't need to understand combustion timing, transmission gearing, or electrical diagnostics to get to work. The mechanic, however, lives in the details. They tune the system. They replace parts. They troubleshoot failures. They recommend upgrades. They understand how the pieces fit together. Technology is exactly the same in my mind. Users should be able to focus on their goals. Engineers should focus on the machinery. Features Are Parts This is where I think software conversations sometimes become backwards. A feature is a component. A login screen is a component. A dashboard is a component. A database is a component. An API is a component. AI integra

Set Up Your Own ChatGPT: Ollama + Open WebUI for Data That Never Leaves Home As artificial intelligence models rapidly integrate into our lives, privacy concerns are growing in parallel. Especially for companies or individuals working with sensitive data, sending information to cloud-based services can pose a serious risk. At this point, setting up your own local Large Language Model (LLM) infrastructure offers a great solution. In this guide, I will explain step-by-step how to set up your own chat interface using tools like Ollama and Open WebUI, ensuring your data never leaves your system. This approach allows you to both reduce costs and maximize your data security. This setup is particularly important for those like me, with a background in enterprise software development, who believe that data flows should always follow the most secure path. In the past, working on a production ERP, transferring supply chain data to external systems without anonymization could lead to serious security vulnerabilities. This is where local LLM solutions come into play. Why You Should Set Up Your Own Local LLM While cloud-based LLM services are incredibly convenient, they come with some fundamental drawbacks. Most importantly, every piece of data you input is potentially sent to the service provider's servers. This can be unacceptable, especially when dealing with financial data, patient information, trade secrets, or sensitive code in your personal projects. By setting up your own local LLM, you eliminate these risks. In recent months, while working on my side project, a financial calculator, I felt the need to use an LLM for complex financial analyses. However, the details of these analyses could not be leaked externally. This situation led me to search for a solution where I could keep my data under my own control. Ollama and Open WebUI emerged as the most practical and powerful duo in my search. ℹ️ Data Privacy and Control A local LLM solution gives you full control over where

Introduction and Background The Rust ecosystem, celebrated for its memory safety and performance, relies heavily on crates —its package management system. These crates, hosted on the crates.io registry, are the building blocks of Rust projects, enabling developers to share and reuse code efficiently. However, this convenience comes with a hidden cost: a single compromised crate can cascade into a full-blown supply chain attack, as recently demonstrated by the 'onering' crate compromise . The Role of Crates in the Rust Ecosystem Crates serve as the backbone of Rust's dependency system. When a developer adds a crate to their project, Cargo , Rust's package manager, automatically resolves and includes all transitive dependencies. This mechanism, while streamlining development, amplifies the attack surface . A malicious crate, like 'onering', can propagate through multiple projects, executing harmful code during build or runtime. The attack on 'onering' exploited this very mechanism, leveraging the trust inherent in the Rust ecosystem to exfiltrate sensitive code from unsuspecting systems. The 'onering' Compromise: A Case Study in Supply Chain Vulnerability The 'onering' crate was compromised through a malicious code injection during an upload or update. This injection bypassed the insufficient security measures of the crates.io registry, which lacks robust checks for uploaded crates. Once deployed, the malicious code executed during the build process, exfiltrating sensitive data from systems that depended on it. The attack's success underscores the lack of developer vigilance regarding supply chain security and the overreliance on registry integrity . Systemic Failures and Their Mechanisms Insufficient Security Scanning: The crates.io registry failed to detect the malicious code during upload due to limited automated scanning capabilities . This allowed the compromised crate to enter the ecosystem undetected. Overreliance on Registry Security: Developers often trust cr

CUDA for AMD Lemonade, Intel Arc Pro Linux Gains, XPU Manager 2.0 Today's Highlights Today's top GPU news highlights include AMD's Lemonade SDK gaining NVIDIA CUDA support, significant performance improvements for Intel Arc Pro GPUs on Linux 7.1, and the major 2.0 overhaul of Intel's XPU Manager for better GPU management on both Windows and Linux. AMD's Lemonade SDK For Local AI Adds NVIDIA CUDA Support (Phoronix) Source: https://www.phoronix.com/news/AMD-Lemonade-10.7-Released AMD has released a new version of its Lemonade SDK, a powerful local AI server solution designed to leverage AMD's diverse hardware ecosystem, including their CPUs, GPUs, and NPUs. The most significant update in this release is the addition of NVIDIA CUDA support. This integration allows developers to utilize NVIDIA GPUs within their Lemonade-powered local AI deployments, bridging a critical gap in cross-platform AI development. The inclusion of CUDA support is a strategic move, enabling Lemonade to tap into NVIDIA's extensive CUDA ecosystem and a vast array of pre-optimized models and libraries. This means that applications built with Lemonade can now seamlessly target a wider range of hardware, offering unprecedented flexibility for developers working with local AI. For users, it provides the choice to deploy their AI models on either AMD or NVIDIA hardware using a single, unified SDK, expanding the potential reach and efficiency of their AI workloads. Comment: This is a massive step for cross-vendor AI development. Being able to use AMD's Lemonade SDK to deploy local AI models and then seamlessly target NVIDIA GPUs via CUDA truly unifies the AI backend landscape for diverse hardware setups, making it incredibly practical for hybrid environments. Intel Arc Pro B70 Showing Off Some Performance Wins With Linux 7.1 (Phoronix) Source: https://www.phoronix.com/review/linux-71-arc-pro-b70 Recent testing by Phoronix indicates that Intel's Arc Pro B70 discrete GPUs are demonstrating notable perform

The hard parts of robotics are supposed to be perception, planning, and control. So why does so much of the day go to everything that comes before them? The hidden setup tax in every robotics simulation project Ask anyone what's hard about robotics and you'll get the same list: perception, planning, control, navigation. The genuinely interesting problems. If you track where your hours actually go, though, a strange thing shows up. A big chunk of the day disappears before you reach any of that. You're not solving hard problems yet. You're just getting to the starting line: wiring up a workspace, writing description files, stitching together launch files, and coaxing a simulator into opening without errors. It's the unglamorous tax on every project, and most of us have quietly accepted it as the cost of doing business. Building a differential drive robot simulation in ROS 2 and Gazebo from scratch A diff drive base, a LiDAR, and Gazebo, set up from one prompt instead of an afternoon of boilerplate. A few days ago I wanted a simple mobile robot simulation. Nothing exotic: a differential drive base (two driven wheels, the classic mobile-robot setup), a LiDAR for sensing, running in Gazebo . This is the kind of thing that should be straightforward. In practice it's an afternoon of boilerplate before the robot so much as twitches. So instead of wiring it up by hand, I wanted to see how far Drift could get from a single prompt. To make it a fair test, I stripped the workspace down to nothing. No packages, no URDF, no launch files. A blank slate. Then I typed one line: "Create a mobile simulation from scratch." From XACRO to URDF: how the robot description gets generated in ROS 2 What the tool wrote first, and what XACRO and URDF actually do for your robot. It checked the workspace first: The opening move was sensible: it looked at the current directory to understand what it was working with. It generated a XACRO file for the robot's dimensions: XACRO is the macro-based for

The US military struck Iran again after an Iranian drone’s lucky midair strike.

Through the acquisition, WMG aims to better track when its artists' work is used in AI-generated content or for training AI models.

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims. This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group.

WhatsApp has caught the NSO Group phishing its users, in violation of a court order.

The real question isn't which framework is better. It's which one you can stop thinking about six months into the project. Key Takeaways Project Suitability — Django is built for weight. Flask is built for speed. Know which one your project actually needs before you commit. Development Flexibility — Django makes decisions so your team doesn't have to. Flask hands those decisions back. Both are features, depending on who's writing the code. Scalability & Performance — Scaling is an architecture problem first, a framework problem second. Pick the one that matches the system you're building — not the one you hope to build. Security Features — Django's protections are on by default. Flask's require you to turn them on. In a fast-moving team, that difference is more significant than it sounds. Ecosystem & Community — Both communities are active and well-documented. You won't be stuck either way. The Decision Nobody Takes Seriously Enough I've watched this play out more times than I'd like to count. A team kicks off a Python project, someone picks a framework — usually the one the most senior person knows best — and everyone moves on. Fast forward six months and the codebase is exhausting to work in. Either they're dragging a full framework through a service that should've been twenty lines of Flask, or they're rebuilding authentication from scratch on something that outgrew its lightweight origins two sprints in. The framework choice isn't irreversible. But undoing it mid-project is expensive in a way that doesn't show up in any estimate. Django and Flask are both genuinely good. What they're good for is different. That's the part worth slowing down on. What You're Actually Getting With Each One Django arrives with almost everything a web application needs already assembled — an ORM, an admin panel, authentication, form handling, CSRF protection, and more. The design assumption is that most web applications need most of these things, so it makes more sense to ship them i

Every low-code vendor says "we support customization." But supports is a weasel word — recoloring a button is customization, and rewriting a scheduling engine is also customization. What actually decides whether a platform locks you in is how far up its extensibility goes. Here's a ruler. The three levels of customization Level What you can do Most no-code A real dev framework L1 — Config Fields, forms, workflows, permissions, themes ✅ ✅ L2 — Extension Custom components, custom actions, external API calls, business rules ⚠️ limited ✅ L3 — Framework Modify/extend the core, custom engines, deep rewrites, source under control ❌ wall ✅ (when open/controllable) Where it stops is where your ceiling is. Plenty of no-code platforms are delightful at L1, then hit "can't do that" at L2/L3 — and you retreat to writing your own thing next to it. Now low-code is the burden. Why you get locked in Black-box SaaS — no source, so any extension point the vendor didn't expose is simply out of reach. Two sources of truth — your extension code and the platform's config live in different systems, so a platform upgrade breaks/voids your work. Crippled self-hosting — the on-prem edition quietly drops extension capabilities. Closed ecosystem — only their component marketplace; your stack can't get in. How model-driven + open source raises the ceiling One unified extension system — your extensions (custom fields/components/actions) and the platform itself are built on the same metadata. Extension isn't a bolt-on, it's a first-class citizen — upgrades don't wipe your customizations. Source under your control — open + self-hostable is what makes L3 framework-level extension actually possible: an extension point you can't reach, you can add. AI at the metadata layer — AI-generated extensions land in the same model, so they stay maintainable and evolvable. That's the road Oinone takes: 100% metadata-driven, front + back end open source, self-hostable — customization reaches L3. How to stress-tes

Microsoft today released software updates to plug nearly 200 security holes across its Windows operating systems and supported software, a record number of fixes for the company's monthly Patch Tuesday cycle. Nearly three dozen of those bugs earned Microsoft's most dire "critical" rating, and exploit code for at least three of the weaknesses is now publicly available.

Vortex 3.0 RISC-V GPGPU, Pragtical SDL GPU Backend, NVIDIA RTX Spark Launch Today's Highlights Today's top stories highlight significant advancements in open-source GPU hardware with Vortex 3.0 adding a 3D pipeline and a lightweight code editor, Pragtical, leveraging an SDL GPU backend for UI rendering. NVIDIA also unveiled RTX Spark, a new 'superchip' aimed at bringing personal AI agents to Windows PCs with accelerated on-device processing. Vortex 3.0 Released As Full-Stack, Open-Source RISC-V GPU Now With 3D Pipeline (Phoronix) Source: https://www.phoronix.com/news/Vortex-3.0-RISC-V-GPGPU Vortex, an open-source, OpenCL-compatible RISC-V GPGPU implementation developed by Georgia Tech, has released its next major version, 3.0. This significant update introduces a full 3D rendering pipeline, marking a crucial evolution from its previous focus solely on general-purpose GPU (GPGPU) compute. The expansion into 3D graphics capabilities makes Vortex a more comprehensive open-source GPU solution, enabling it to handle a wider range of visual and computational tasks. As an open-source hardware design, Vortex 3.0 provides developers, researchers, and hardware enthusiasts with unparalleled access to study, modify, and implement its architecture. Its OpenCL compatibility ensures that it can leverage existing GPGPU codebases, fostering experimentation with RISC-V-based GPU development, custom hardware accelerators, and exploring alternative GPU instruction sets and architectures. This release allows for deeper exploration into the integration of compute and graphics within an open framework. This development is pivotal for the open-source hardware and RISC-V ecosystems. It underscores the growing maturity of RISC-V for demanding compute and graphics workloads, offering a royalty-free alternative to proprietary GPU designs. The inclusion of a 3D pipeline extends its utility beyond just general-purpose compute to full graphics rendering, potentially impacting future embedded syst

Το πρόβλημα της ώρας Η ώρα είναι από τα πιο ύπουλα προβλήματα στην ανάπτυξη λογισμικού. Αν ένας χρήστης στην Αθήνα δημιουργήσει μια παραγγελία στις 20:00 και ένας άλλος στη Νέα Υόρκη τη δει στις 13:00, ποια είναι η "σωστή" ώρα; Αν μια εφαρμογή αποθηκεύσει μόνο το 20:00, χωρίς να γνωρίζει τη ζώνη ώρας, τότε η πληροφορία είναι πρακτικά άχρηστη. Αυτός είναι ο λόγος που υπάρχουν έννοιες όπως: Local Time UTC UTC Offset Epoch / Unix Timestamp Δεν δημιουργήθηκαν για να μας μπερδεύουν. Δημιουργήθηκαν για να λύνουν το πρόβλημα της παγκόσμιας διαχείρισης χρόνου. Local Time Το Local Time είναι η ώρα που βλέπει ο χρήστης στη χώρα του. Παραδείγματα: Αθήνα: 2026-06-09 20:00 Λονδίνο: 2026-06-09 18:00 Νέα Υόρκη:2026-06-09 13:00 Όλες οι παραπάνω ώρες μπορεί να αντιστοιχούν στην ίδια ακριβώς χρονική στιγμή. Συνέβει ένα γεγονός μία ενέργεια στον πλανίτη γη ακριβώς αυτή την στιγμή που όμως για διαφορετικές γεωγραφικές περιοχές αντιστοιχεί σε διαφορετικές ώρες. Πότε χρησιμοποιούμε Local Time; Μόνο για εμφάνιση στον χρήστη. Παραδείγματα: Ημερομηνία παραγγελίας Ώρα δημιουργίας post Ημερολόγιο συναντήσεων Reports προς τον χρήστη Πότε ΔΕΝ το αποθηκεύουμε; Σχεδόν ποτέ ως μοναδική πηγή αλήθειας. Αν αποθηκεύσεις: 2026-06-09 20:00 δεν γνωρίζεις: Σε ποια χώρα δημιουργήθηκε Σε ποια ζώνη ώρας ανήκει Αν ίσχυε θερινή ώρα (DST) UTC (Coordinated Universal Time) Το UTC είναι η παγκόσμια αναφορά χρόνου. Όλες οι ζώνες ώρας υπολογίζονται σε σχέση με αυτό. Παράδειγμα: UTC: 2026-06-09 17:00 Την ίδια στιγμή με βάση την UTC ώρα μπορούμε να έχουμε: στην Αθήνα UTC+3 -> 20:00 στο Λονδίνο UTC+1 -> 18:00 στη Νέα Υόρκη UTC-4 -> 13:00 Πότε χρησιμοποιούμε UTC; Σχεδόν πάντα στο backend. Αποθηκεύουμε: 2026-06-09 T 17 : 00 : 00 Z Το Z σημαίνει UTC. Γιατί; Επειδή: Δεν αλλάζει με DST Δεν εξαρτάται από χώρα Είναι παγκόσμιο σημείο αναφοράς Ένας κανόνας που ακολουθούν σχεδόν όλες οι μεγάλες εταιρείες: Store in UTC, display in Local Time. UTC Offset Παραδείγματα: UTC+3 UTC+2 UTC-5 UTC+9 Για την Αθήνα: Χειμώνας -> UTC+2 Καλοκα

Shareable blog post edition: https://andymaleh.blogspot.com/2026/06/andys-laws-of-ai-in-software-engineering.html Law #1: "The more Software Developers use AI, the more valuable Software Engineers who do not use AI become." Software Engineers who are masters at delivering Software without using AI will actually have increased job security the more Software Developers in the worldwide Software Development community rely on AI to deliver Software without having true mastery over Software Engineering. As more Software Developers become fully dependent on AI to build Software without truly understanding how AI gets work done, Software Engineers who do understand what is going on under the hood will dwindle and become more valuable than ever. In other words, they will have a competitive advantage over Software Developers who can only deliver Software features with AI as well as Software Developers who have not mastered Software Engineering. Also, there will always be a need for Software Engineers who can maintain the Software of AI itself. Law #2: "Software Developers benefit from AI in direct proportion to how weak they are in Software Engineering" The weaker Software Developers are at Software Engineering the more they benefit from AI. After all, AI learns from Master Software Engineers and then applies its learnings in code generation done for lower-level Software Developers who lack mastery in Software Engineering. So, users of AI simply place themselves lower in the expertise hierarchy to be on the receiving end of what Master Software Engineers feed AI with their code. This explains why many experts like Linus Torvalds do not find AI very useful while devs who have zero degrees and qualifications feel like they get a lot from AI. A beneficial thing to learn from this law is that it is more valuable for a Software Developer to hone in their Software Engineering skills (including the completion of university degrees) than to hone in their AI usage skills because if t

The iOS 27 developer beta includes code that references the fold state and screen angle of a device.

(The following example is fictionalized.) A notification template feature shipped six months ago. It let each tenant customize the messages sent to their own customers without requiring a back-end change every time the wording changed. The code reviewer could tell the design was hard to follow, especially the path from template to rendered value. But "this is hard to follow" is difficult to turn into a concrete objection when the feature works, the tests pass, and nothing is obviously unsafe or wrong. The design risk was real, but there wasn't an obvious bug to point to. QA signed off, and the feature went into production. Then a bug report came in: one customer had received a notification containing another customer's information. Somewhere in the notification pipeline, the system was leaking PII. At first, the fix sounded small: make sure notifications only render data belonging to the intended recipient. Then the assigned developer, who wasn't the original author, started looking for the place to make the fix. The templates were stored in the database. There were six template types, and each one populated its real values in a different part of the codebase. Some values came from customer-facing records, some came from internal workflow state, and some came from template-specific logic. The placeholder-to-value mapping lived somewhere else. Email and SMS channels shared part of the rendering path, but not all of it. Before the developer could decide where to fix the leak, they had to answer a more specific set of questions: Which placeholder rendered the wrong value? Where did that value come from? Which template types could use that placeholder? Did email and SMS resolve it the same way? What evidence would show that the leak was fully contained? The system was hard to change because it made the behavior hard to understand. What the developer needed was not just "clean code." They needed trustworthy signals they could use as evidence to answer harder questions: w

Navigating the tech space today often feels like walking a tightrope between two extremes: massive corporate monopolies holding all the keys, and idealistic local projects trying to build everything from scratch. But this doesn't have to be an "Us vs. Corporations" battle. We don’t need to completely eliminate corporate tools; we need to leverage them. The real pragmatic goal is to use localized, decentralized data-driven systems to solve real-world physical problems on the ground, in real time. When people hear the word "decentralized," they often assume it means chaotic fragmentation, isolation, or losing control of data. It doesn't. Decentralization does not mean losing data; it means movement. In fact, the paradox of modern tech is that More Decentralized Data = Centralized Utility. 1. Moving Beyond "App Consumption" to Localized Edge Data For too long, the cultural conversation around tech has been stuck in the clouds. We talk about "the cloud" abstractly, and the average consumer's tech vocabulary is limited to a handful of corporate app names. True tech pragmatism brings data collection back down to earth, turning communities from passive consumers into active, node-operating contributors. Here is what that looks like in practice: Hyper-Local Climate Grids: Instead of teaching students about weather patterns using generic data from an airport weather station 50 miles away, a school can deploy its own low-cost local weather station. Students learn from their immediate microclimate, and that real-time local data is fed back into a wider community grid. Optimized Infrastructure: Instead of spending millions on speculative traffic studies, we can use existing, low-cost edge cameras to count traffic patterns locally. This decentralized edge data tells planners exactly what kind of infrastructure—like traffic lights (or "robots" as we call them here) or bypass lanes—a specific zone actually needs. It is planning based on true utility, not guesswork. The Energy Grid

Linux 7.1 Boosts Intel Arc, Flatpak Integrates ROCm, Vintage AMD Driver Refined Today's Highlights Recent developments enhance GPU performance and accessibility, with the Linux 7.1 kernel providing significant gains for Intel Arc Battlemage graphics. AMD's ROCm compute platform gains broader deployment potential through Flatpak 1.18 integration, while an older AMD GPU driver sees notable code cleanups. Linux 7.1 Helping Intel Arc Battlemage Graphics Achieve Better Performance (Phoronix) Source: https://www.phoronix.com/review/intel-b580-linux-71 Phoronix reports that the upcoming Linux 7.1 kernel release is delivering superior graphics performance for Intel's Arc B580 Battlemage desktop graphics card compared to the current stable Linux 7.0. This indicates ongoing, critical optimization work within the open-source Linux graphics stack, directly impacting the gaming and compute capabilities of Intel's latest GPU architecture. Such kernel-level improvements are vital for unlocking the full potential of new hardware on Linux platforms, ensuring users receive the best possible experience from their Intel Arc GPUs. The performance uplift suggests that deeper integration and fine-tuning of the kernel's display and compute drivers are progressing, addressing potential bottlenecks and enhancing throughput. For users and developers leveraging Intel Arc GPUs on Linux, this kernel update is a significant milestone, promising more stable and efficient operation for various workloads, from gaming to professional applications. It highlights the dynamic nature of Linux driver development, where continuous collaboration leads to tangible performance benefits even before major hardware refreshes. Comment: This shows how crucial kernel updates are for modern GPUs on Linux. Early adopters of Arc Battlemage should definitely keep an eye on Linux 7.1 for a noticeable performance bump. Flatpak 1.18 Released With Integration For AMD ROCm (Phoronix) Source: https://www.phoronix.com/news/Fl