所有数据均采集与网络或网友提供, 仅供学习参考使用
"Phoebe Sajor" / 2025-09-26 a month ago / 未收藏/ Stack Overflow Blog发送到 kindle
Ryan welcomes Pia Nilsson, GM for Backstage and head of developer experience at Spotify, to discuss the evolution and adoption of Backstage, the impact of AI on dev experience, and how Spotify approaches platform engineering and standardization to help teams solve for specific needs.
"Shilpa Kumari" / 2025-09-26 a month ago / 未收藏/ Todd Motto发送到 kindle
For this year’s Cybersecurity Awareness Month, GitHub’s Bug Bounty team is excited to offer some additional incentives to security researchers!
The post Kicking off Cybersecurity Awareness Month 2025: Researcher Spotlights and Enhanced Incentives appeared first on The GitHub Blog.
"Margaret Tucker" / 2025-09-27 a month ago / 未收藏/ Todd Motto发送到 kindle
Why the U.S. Supreme Court case Cox v. Sony matters for developers and sharing updates to our Transparency Center and Acceptable Use Policies.
The post How GitHub protects developers from copyright enforcement overreach appeared first on The GitHub Blog.
"Margaret Tucker" / 2025-09-27 a month ago / 未收藏/ The GitHub Blog发送到 kindle
Some platforms handle copyright takedowns with a “three strikes and you’re out” policy, automatically blocking user accounts after repeated notices. While that might sound fair, it can lead to unjust outcomes, especially for open source developers who routinely fork popular projects that could become subject to a copyright takedown. If your account gets suspended, that can have immediate negative consequences not just for you, but for all the open source projects you maintain. Code is collaborative, complex, and often reused, which makes enforcement challenging, and amplifies the downstream effects of takedowns. At GitHub, we take a developer-first approach, reviewing each case individually before blocking accounts, and making sure copyright enforcement doesn’t derail legitimate work.
The U.S. Supreme Court is about to decide a case that could change how platforms like GitHub handle copyright claims — and by extension, it could also impact how you build and share code. In Cox Communications v. Sony Music Entertainment, the question is: When can an internet service provider or platform be held liable for copyright infringement committed by its users? Google, Microsoft (with GitHub), Amazon, Mozilla, and Pinterest have urged the Court to adopt a clear rule: Liability should only apply when there’s “conscious, culpable conduct that substantially assists the infringement,” not merely awareness or inaction.
This matters to developers because the platforms you depend on to host, share, and deploy code rely on legal protections called safe harbors to avoid constant liability for user-generated content. One of the most important safe harbors is Section 512 of the Digital Millennium Copyright Act (DMCA), which shields services from copyright infringement liability as long as they follow a formal notice-and-takedown process. For GitHub, this protection is especially critical given the collaborative nature of open source, the functional role of code, and the ripple effects of removing code that may be widely used. 
With over 150 million developers and 518 million projects on GitHub, we process hundreds of DMCA takedowns each month, but also receive thousands of automated, incomplete, or inaccurate notices. If “awareness” alone were enough for liability, platforms could be forced to over-remove content based on flawed notices — chilling innovation and collaboration across the software ecosystem. GitHub’s DMCA Takedown Policy supports copyright protection while limiting disruption for legitimate projects, offering a clear path for appeal and reinstatement, and providing transparency by publishing valid DMCA takedown notices to a public DMCA repository
This case matters to GitHub as a platform and to all developers who use internet service providers to create and collaborate. We’re in good company: the Supreme Court docket for the case includes amicus briefs from a wide range of civil society stakeholders including Engine Advocacy, the Electronic Frontier Foundation, and Public Knowledge advocating on behalf of free expression, the open internet, and how common-sense limitations on liability make it possible for the modern internet to function. We will continue to monitor the case as it moves forward and remain committed to advocating on behalf of software developers everywhere. 

Updates to our Transparency Center

An important aspect of our commitment to developers is our approach to developer-first content moderation. We try to restrict content in the narrowest way possible to address violations, give users the chance to appeal, and provide transparency around our actions. 
We’ve updated the GitHub Transparency Center with the first half of 2025 data, which includes a repo of structured data files. In this latest update, we wanted to clarify how we report and visualize government takedowns.
Here’s what we changed: 
  • We have combined the category of government takedowns received based on local law and based on Terms of Service into one chart/reporting category of Government takedowns received. We made this change to be more accurate in our reporting; the government takedown requests we receive may cite a local law or a Terms of Service violation, but more typically, they are just official requests for the removal of content. 
  • We have retained the separate categories of “Government takedowns processed based on local law” and “Government takedowns processed based on Terms of Service.” This is an important distinction because it reflects that some content governments ask us to take down is in violation of our Terms and is processed like any other report, whereas some content is not in violation of our terms, but is in violation of local law. In the latter case, we limit the impact on developers by only restricting access to the content in the jurisdiction in which we are legally required to do so, and we publish the request in our gov-takedowns repository to ensure transparency.
  • We have also clarified the README of our gov-takedowns repository to note that the repository solely contains official government requests, which led to content removal based on local law. 
These are small clarifications, but it’s important to be clear and accurate with the data we share so that researchers studying platform moderation and government suppression of information can use our data. If that applies to you, and you have feedback on our reporting, research to share, or reporting categories you would find useful, open an issue in our transparency center repo.  

Updates to our Acceptable Use Policies

We have opened a pull request and 30-day notice-and-comment period for a proposed update to our Acceptable Use Policies (AUP), which would reorganize several existing AUP provisions into separate policies with additional guidance. The new policies include:
  • Child Sexual Abuse Material (CSAM)
  • Terrorist & Violent Extremist Content (TVEC)
  • Non-Consensual Intimate Imagery
  • Synthetic Media and AI Tools
The Synthetic Media and AI Tools policy will be extended to explicitly disallow CSAM and TVEC in accordance with international laws. Read more about our approach to deepfake tools.   
We invite all stakeholders to review and comment on the proposed Acceptable Use Policy additions for the 30-day period until October 16.
The post How GitHub protects developers from copyright enforcement overreach appeared first on The GitHub Blog.
"Margaret Tucker" / 2025-09-27 a month ago / 未收藏/ The GitHub Blog发送到 kindle
Some platforms handle copyright takedowns with a “three strikes and you’re out” policy, automatically blocking user accounts after repeated notices. While that might sound fair, it can lead to unjust outcomes, especially for open source developers who routinely fork popular projects that could become subject to a copyright takedown. If your account gets suspended, that can have immediate negative consequences not just for you, but for all the open source projects you maintain. Code is collaborative, complex, and often reused, which makes enforcement challenging, and amplifies the downstream effects of takedowns. At GitHub, we take a developer-first approach, reviewing each case individually before blocking accounts, and making sure copyright enforcement doesn’t derail legitimate work.
The U.S. Supreme Court is about to decide a case that could change how platforms like GitHub handle copyright claims — and by extension, it could also impact how you build and share code. In Cox Communications v. Sony Music Entertainment, the question is: When can an internet service provider or platform be held liable for copyright infringement committed by its users? Google, Microsoft (with GitHub), Amazon, Mozilla, and Pinterest have urged the Court to adopt a clear rule: Liability should only apply when there’s “conscious, culpable conduct that substantially assists the infringement,” not merely awareness or inaction.
This matters to developers because the platforms you depend on to host, share, and deploy code rely on legal protections called safe harbors to avoid constant liability for user-generated content. One of the most important safe harbors is Section 512 of the Digital Millennium Copyright Act (DMCA), which shields services from copyright infringement liability as long as they follow a formal notice-and-takedown process. For GitHub, this protection is especially critical given the collaborative nature of open source, the functional role of code, and the ripple effects of removing code that may be widely used. 
With over 150 million developers and 518 million projects on GitHub, we process hundreds of DMCA takedowns each month, but also receive thousands of automated, incomplete, or inaccurate notices. If “awareness” alone were enough for liability, platforms could be forced to over-remove content based on flawed notices — chilling innovation and collaboration across the software ecosystem. GitHub’s DMCA Takedown Policy supports copyright protection while limiting disruption for legitimate projects, offering a clear path for appeal and reinstatement, and providing transparency by publishing valid DMCA takedown notices to a public DMCA repository
This case matters to GitHub as a platform and to all developers who use internet service providers to create and collaborate. We’re in good company: the Supreme Court docket for the case includes amicus briefs from a wide range of civil society stakeholders including Engine Advocacy, the Electronic Frontier Foundation, and Public Knowledge advocating on behalf of free expression, the open internet, and how common-sense limitations on liability make it possible for the modern internet to function. We will continue to monitor the case as it moves forward and remain committed to advocating on behalf of software developers everywhere. 

Updates to our Transparency Center

An important aspect of our commitment to developers is our approach to developer-first content moderation. We try to restrict content in the narrowest way possible to address violations, give users the chance to appeal, and provide transparency around our actions. 
We’ve updated the GitHub Transparency Center with the first half of 2025 data, which includes a repo of structured data files. In this latest update, we wanted to clarify how we report and visualize government takedowns.
Here’s what we changed: 
  • We have combined the category of government takedowns received based on local law and based on Terms of Service into one chart/reporting category of Government takedowns received. We made this change to be more accurate in our reporting; the government takedown requests we receive may cite a local law or a Terms of Service violation, but more typically, they are just official requests for the removal of content. 
  • We have retained the separate categories of “Government takedowns processed based on local law” and “Government takedowns processed based on Terms of Service.” This is an important distinction because it reflects that some content governments ask us to take down is in violation of our Terms and is processed like any other report, whereas some content is not in violation of our terms, but is in violation of local law. In the latter case, we limit the impact on developers by only restricting access to the content in the jurisdiction in which we are legally required to do so, and we publish the request in our gov-takedowns repository to ensure transparency.
  • We have also clarified the README of our gov-takedowns repository to note that the repository solely contains official government requests, which led to content removal based on local law. 
These are small clarifications, but it’s important to be clear and accurate with the data we share so that researchers studying platform moderation and government suppression of information can use our data. If that applies to you, and you have feedback on our reporting, research to share, or reporting categories you would find useful, open an issue in our transparency center repo.  

Updates to our Acceptable Use Policies

We have opened a pull request and 30-day notice-and-comment period for a proposed update to our Acceptable Use Policies (AUP), which would reorganize several existing AUP provisions into separate policies with additional guidance. The new policies include:
  • Child Sexual Abuse Material (CSAM)
  • Terrorist & Violent Extremist Content (TVEC)
  • Non-Consensual Intimate Imagery
  • Synthetic Media and AI Tools
The Synthetic Media and AI Tools policy will be extended to explicitly disallow CSAM and TVEC in accordance with international laws. Read more about our approach to deepfake tools.   
We invite all stakeholders to review and comment on the proposed Acceptable Use Policy additions for the 30-day period until October 16.
The post How GitHub protects developers from copyright enforcement overreach appeared first on The GitHub Blog.
"techug" / 2025-09-27 a month ago / 未收藏/ 程序师发送到 kindle
PostgreSQL 18通过全新I/O子系统提升了各类规模工作负载的性能,其从存储设备读取数据时性能最高可提升3倍,同时扩大了可使用索引的查询范围。本次发布显著降低了主版本升级的干扰性,不仅加速升级过程,更缩短了升级后达到预期性能所需的时间。
"techug" / 2025-09-27 a month ago / 未收藏/ 程序师发送到 kindle
本次发布新增功能:在INSERT、UPDATE、DELETE和MERGE命令的RETURNING子句中,可同时访问旧值(OLD)和新值(NEW)。
"techug" / 2025-09-27 a month ago / 未收藏/ 程序师发送到 kindle
PostgreSQL 18新增函数uuidv7()用于生成UUIDv7值。其实现包含标准允许但非强制要求的12位亚毫秒级时间戳小数部分,确保同一Postgres会话(即相同后端进程)生成的所有UUIDv7值具有单调性。
2025-09-27 a month ago / 未收藏/ 技术小黑屋发送到 kindle

背景

排查日志时,常需要定位关键字并带上一两行上下文确认语义。grep 内建的上下文选项可以直接满足需求,不必再手动 sed -n '19,21p'

快速示例

假设想在 app.log 中找出包含 Fatal error 的行,并且同时看到上一行与下一行:
1
grep -n -C 1 "Fatal error" app.log
  • -n 会显示行号,便于定位。
  • -C 1 等价于 --context=1,表示向前向后各多带 1 行。想多看几行时调整数字即可。
输出中,命中的行以冒号分隔行号与内容,上下文行则以短横线 - 连接,快速区分重点。

控制上下文范围

grep 提供三个粒度化参数:
  • -C <N>:两侧各 N 行,是最常用的形式。
  • -B <N>:只带前 N 行(Before)。
  • -A <N>:只带后 N 行(After)。
例如只关心关键字后面的调用栈,可使用:
1
grep -n -A 4 "NullPointerException" stacktrace.txt
再配合 -m 1(匹配一次后退出)可以缩短复杂日志的搜索时间。

与常见参数组合

  • -i:忽略大小写,处理大小写不一致的告警信息很方便。
  • -E:启用扩展正则,可直接写 grep -E "(WARN|ERROR)"
  • --color=auto:高亮命中关键字,在终端阅读更直观。
将这些参数组合成 Shell 函数,后续排查直接调用。例如在 ~/.bashrc 中定义:
1
2
3
4
gctx() {
  local keyword="$1" file="$2" lines="${3:-1}"
  grep -n --color=always -C "$lines" "$keyword" "$file"
}
执行 gctx "timeout" service.log 2,即可得到行号、关键字高亮、上下文行的结果。

小结

  • -C/-A/-B 是获取上下文的核心选项,记住数字表示行数即可。
  • 搭配 -n--color-m 等参数可以提升排查效率。
  • 如果命中结果过多,将命令与 less -Rfzf 管道组合,能够在终端中进行二次筛选,让排查体验更顺滑。


如果前两周去长三角,见的更多是客户的话,那么本周在北京出差的这几天,见的更多是合作伙伴,比如千寻、智元、北京人形等等说到导航,这两天 则又看到了本文正要解读的NavFoM,个人觉得,该工作的创新不少,值得多读几遍。
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
Ieri abbiamo accolto migliaia di sviluppatori e dirigenti a MongoDB.local NYC, l'ultima tappa del nostro tour globale della serie .local . Nel corso dell'ultimo anno, ci siamo connessi con decine di migliaia di partner e clienti in 20 città in tutto il mondo. Ma è particolarmente significativo essere a New York, dove MongoDB è stata fondata e dove abbiamo ancora la sede centrale.
Durante l'evento, abbiamo introdotto nuove funzionalità che rafforzano la posizione di MongoDB come il principale database moderno a livello mondiale. Con MongoDB 8.2, la nostra versione più ricca di funzionalità e prestazioni, stiamo alzando il livello di ciò che gli sviluppatori possono ottenere. Abbiamo anche condiviso ulteriori informazioni sui nostri modelli di embedding e reranker di Voyage AI, che offrono accuratezza ed efficienza all'avanguardia per la creazione di applicazioni AI affidabili e sicure. E con Search e Vector Search ora disponibili in public preview sia per MongoDB Community Edition che per Enterprise Server, stiamo inserendo potenti funzionalità di recupero direttamente negli ambienti dei clienti, ovunque preferiscano operare.
Sono particolarmente entusiasta del lancio della MongoDB Application Modernization Platform, o AMP. Le aziende di tutto il mondo sono alle prese con gli enormi costi dei sistemi legacy che non sono in grado di supportare le esigenze dell'AI. L'AMP non è un semplice "lift-and-shift". Si tratta di una piattaforma end-to-end ripetibile che combina strumenti basati sull'AI, tecniche collaudate e talenti specializzati per reinventare i sistemi aziendali critici riducendo al minimo i costi e i rischi. I primi risultati sono impressionanti: le aziende che passano dai vecchi sistemi a MongoDB lo fanno da due a tre volte più velocemente, e attività come la riscrittura del codice stanno accelerando di un ordine di grandezza.
Figura 1. Discorso principale al MongoDB.local New York.
Photo of the stage for the .local NYC keynote
Guarda il discorso principale completo su YouTube.

Diventare il database moderno più popolare al mondo

Quando rifletto sul percorso di MongoDB, sono colpito da quanto lontano siamo arrivati. Quando sono entrato a far parte dell'azienda poco più di dieci anni fa, avevamo solo poche migliaia di clienti. Oggi, MongoDB serve quasi 60.000 organizzazioni in ogni settore e ambito industriale, inclusi oltre il 70% delle aziende Fortune 500 e startup all'avanguardia native dell'AI.
Tuttavia, il motivo alla base della nostra crescita rimane invariato. I relational database creati negli anni '70 non sono stati progettati per la scalabilità e la complessità delle applicazioni moderne. Erano rigidi, difficili da scalare e lenti ad adattarsi. I nostri fondatori, che avevano vissuto in prima persona questi limiti durante la creazione di DoubleClick, si sono messi all'opera per creare qualcosa di meglio: un modello di database progettato per le realtà del mondo moderno. Così è nato il document model.
Basato su JSON, il document model è intuitivo, flessibile e potente. Permette agli sviluppatori di rappresentare dati complessi, interdipendenti e in continua evoluzione in modo naturale. E, mentre entriamo nell'era dell'AI, quelle stesse qualità, ovvero adattabilità, scalabilità e sicurezza, sono più importanti che mai. Il database scelto da un'azienda sarà una delle decisioni più strategiche che determinerà il successo delle sue iniziative legate all'AI.
Le applicazioni di Generative AI hanno già iniziato a migliorare la produttività, a scrivere codice, a redigere documenti e a rispondere alle domande. Ma la vera trasformazione sta nell'AI agentica: applicazioni che percepiscono, decidono e agiscono. Questi agenti intelligenti non seguono solo i flussi di lavoro: perseguono i risultati, ragionando sui passi migliori per raggiungerli. E in questo ciclo, il database è indispensabile. Fornisce la memoria che consente agli agenti di percepire il contesto, i fatti che consentono loro di decidere in modo intelligente e lo stato che consentirà loro di agire in modo coerente.
Ecco perché i dati di un'azienda sono il suo bene più prezioso. I modelli linguistici di grandi dimensioni (LLM) possono generare risposte, ma è il database che fornisce continuità, collaborazione e vera intelligenza. Il futuro dell'AI non riguarda solo il ragionamento, ma anche il contesto, la memoria e la potenza dei propri dati.

Il database ideale per l'AI trasformativa

Quindi, qual è il database ideale per l'AI agentica? Deve riflettere la complessità di oggi e il cambiamento di domani. Deve parlare il linguaggio dell'AI, che è sempre più il JSON. Deve integrare il recupero avanzato dei dati grezzi, dei metadati e degli embedding, non solo la corrispondenza esatta, ma anche il significato e l'intento. Deve collegare dati privati e LLM con embedding e reranker della massima qualità. E deve fornire le prestazioni, la scalabilità e la sicurezza necessarie per alimentare le applicazioni mission-critical su scala globale.
Questo è esattamente ciò che MongoDB offre. Non ci limitiamo a spuntare le caselle di questa lista, le definiamo noi.

Abbiamo appena iniziato

Ecco perché sono così ottimista riguardo al nostro futuro. L'energia e la creatività che vediamo in ogni evento di MongoDB.local mi ricordano la passione che ha sempre alimentato questa azienda. Mentre i nostri clienti continuano a innovare, so che MongoDB è nella posizione perfetta per aiutarli ad avere successo nell'era dell'AI.
Non vediamo l'ora di scoprire cosa svilupperai in futuro.
Per visualizzare ulteriori annunci e ricevere gli ultimi aggiornamenti sui prodotti, visita la nostra pagina Novità. Vai all'hub MongoDB.local per scoprire dove saremo prossimamente.
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
Gestern haben wir Tausende von Entwicklern und Führungskräften bei MongoDB.local NYC begrüßt, der jüngsten Station unserer globalen .local -Reihe. Im vergangenen Jahr haben wir Kontakte zu Zehntausenden von Partnern und Kunden in 20 Städten weltweit geknüpft. Aber es ist besonders bedeutsam, in New York zu sein – wo MongoDB gegründet wurde und wo wir immer noch unseren Hauptsitz haben.
Während der Veranstaltung haben wir neue Funktionen vorgestellt, die die Position von MongoDB als weltweit führende moderne Datenbank weiter stärken. Mit MongoDB 8.2, unserer bisher funktionsreichsten und leistungsstärksten Version, setzen wir neue Maßstäbe für das, was Entwickler erreichen können. Wir haben auch mehr über unsere Voyage-AI-Einbettungsmodelle und Reranker erzählt, die für höchste Genauigkeit und Effizienz bei der Entwicklung vertrauenswürdiger, zuverlässiger KI-Anwendungen sorgen. Und da Search und Vector Search jetzt sowohl für die MongoDB Community Edition als auch für den Enterprise Server in der öffentlichen Vorschauversion verfügbar sind, stellen wir leistungsstarke Abruffunktionen direkt in die Kundenumgebungen zur Verfügung – wo auch immer sie bevorzugt eingesetzt werden.
Ich freue mich besonders über die Einführung der MongoDB-Plattform für die Modernisierung von Anwendungen (AMP). Unternehmen auf der ganzen Welt kämpfen mit den enormen Kosten von Legacy-Systemen, die den Anforderungen der KI nicht gerecht werden können. AMP ist kein einfaches „Lift-and-Shift“. Es handelt sich um eine wiederholbare, durchgängige Plattform, die KI-gestützte Tools, bewährte Techniken und spezialisierte Talente kombiniert, um kritische Geschäftssysteme neu zu gestalten und gleichzeitig Kosten und Risiken zu minimieren. Die ersten Ergebnisse sind beeindruckend: Unternehmen, die von alten Systemen auf MongoDB umsteigen, tun dies zwei- bis dreimal schneller, und Aufgaben wie das Umschreiben von Code beschleunigen sich um ein Vielfaches.
Abbildung 1: Keynote MongoDB.local NYC.
Photo of the stage for the .local NYC keynote
Sehen Sie sich die ganze Keynote auf YouTube an.

Entwicklung zur weltweit beliebtesten modernen Datenbank

Wenn ich über die Reise von MongoDB nachdenke, fällt mir auf, wie weit wir gekommen sind. Als ich vor etwas mehr als einem Jahrzehnt dazukam, hatten wir nur ein paar tausend Kunden. Heute betreut MongoDB fast 60.000 Organisationen aus allen Branchen und Sektoren, darunter mehr als 70 % der Fortune-500-Unternehmen und innovative KI-native Startups.
Doch der Grund für unser Wachstum bleibt derselbe. Relationale Datenbanken, die in den 1970er Jahren entwickelt wurden, waren nie für die Skalierung und Komplexität moderner Anwendungen ausgelegt. Sie waren starr, schwer zu skalieren und ließen sich nur langsam anpassen. Unsere Gründer, die diese Einschränkungen beim Aufbau von DoubleClick aus erster Hand erlebt hatten, machten sich daran, etwas Besseres zu schaffen: ein Datenbankmodell, das auf die Realitäten der modernen Welt zugeschnitten ist. Das Dokumentmodell war geboren.
Das auf JSON basierende Dokumentmodell ist intuitiv, flexibel und leistungsstark. Es ermöglicht Entwicklern, komplexe, voneinander abhängige und sich ständig ändernde Daten auf natürliche Weise abzubilden. Und mit dem Eintritt in das Zeitalter der KI sind genau diese Eigenschaften – Anpassungsfähigkeit, Skalierbarkeit und Sicherheit – wichtiger denn je. Die Wahl der Datenbank durch ein Unternehmen ist eine der strategischsten Entscheidungen, die den Erfolg seiner KI-Initiativen bestimmen.
Anwendungen der generativen KI haben bereits Produktivitätssteigerungen gebracht, indem sie Code schreiben, Dokumente entwerfen und Fragen beantworten. Doch die eigentliche Transformation steht uns mit der agentenbasierten KI bevor – Anwendungen, die wahrnehmen, entscheiden und handeln. Diese intelligenten Agenten befolgen nicht einfach nur Arbeitsabläufe, sondern streben nach Ergebnissen und überlegen, welche Schritte am besten geeignet sind, um diese zu erreichen. Und in diesem Kreislauf ist die Datenbank unverzichtbar. Sie liefert das Gedächtnis, das es den Agenten ermöglicht, Zusammenhänge wahrzunehmen, die Fakten, die es ihnen erlauben, intelligente Entscheidungen zu treffen, und den Zustand, der sie in die Lage versetzt, kohärent zu handeln.
Deshalb sind die Daten eines Unternehmens sein wertvollstes Gut. Large Language Models (LLMs) können Antworten generieren, aber es ist die Datenbank, die Kontinuität, Zusammenarbeit und wahre Intelligenz bietet. Die Zukunft der KI liegt nicht nur im logischen Denken, sondern auch im Kontext, im Gedächtnis und in der Macht Ihrer Daten.

Die ideale Datenbank für transformative KI

Wie sieht also die ideale Datenbank für agentenbasierte KI aus? Sie muss die Komplexität von heute und den Wandel von morgen widerspiegeln. Sie muss die Sprache der KI sprechen, die zunehmend JSON ist. Sie muss eine fortschrittliche Abfrage von Rohdaten, Metadaten und Einbettungen integrieren – nicht nur einen exakten Abgleich, sondern auch Bedeutung und Absicht. Sie muss private Daten und Large Language Models mit Einbettungen und Rerankern höchster Qualität verbinden. Und sie muss die Leistung, Skalierbarkeit und Sicherheit bieten, die für den Betrieb von unternehmenskritischen Anwendungen auf globaler Skala erforderlich sind.
Genau das bietet MongoDB. Wir haken nicht einfach die Punkte auf dieser Liste ab – wir definieren sie.

Wir stehen noch ganz am Anfang

Deshalb bin ich für unsere Zukunft so optimistisch. Die Energie und Kreativität, die wir bei jedem MongoDB.local-Event sehen, erinnern mich an die Leidenschaft, die dieses Unternehmen schon immer angetrieben hat. Da unsere Kunden weiterhin innovativ sind, weiß ich, dass MongoDB in der perfekten Position ist, um ihnen im Zeitalter der KI zum Erfolg zu verhelfen.
Wir können es kaum erwarten zu sehen, was Sie als Nächstes entwickeln.
Weitere Ankündigungen und die neuesten Produktaktualisierungen finden Sie auf unserer Seite „What's New“. Und besuchen Sie den Hub von MongoDB.local, um zu sehen, wo wir als nächstes Halt machen werden.
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
어제, 글로벌 .local 시리즈의 최신 목적지인 MongoDB.local NYC에서 수천 명의 개발자와 경영진을 맞이했습니다. 지난 1년 동안 저희는 전 세계 20개 도시의 수만 명의 제휴하다와 고객과 소통했습니다. 하지만 MongoDB 본사가 설립되었고 지금도 본사가 있는 뉴욕에서 개최하게 되어 더욱 뜻깊습니다.
이번 이벤트에서는 세계 최고의 최신 데이터베이스로서 MongoDB의 입지를 더욱 강화하는 새로운 역량을 소개했습니다. MongoDB 8.2는 역대 가장 기능이 풍부하고 성능이 뛰어난 릴리스로, 개발자가 달성할 수 있는 목표의 기준을 한층 더 높이고 있습니다. 또한 신뢰할 수 있고 안정적인 AI 애플리케이션 구축에 최첨단 정확성과 효율성을 제공하는 Voyage AI 임베딩 모델과 리랭커에 대한 자세한 내용도 공유했습니다. 또한 검색 및 벡터 검색이 이제 MongoDB Community Edition과 Enterprise Server에 대한 공개 프리뷰로 제공됨에 따라 고객이 원하는 운영 환경 어디에서나 강력한 검색 역량을 직접 활용할 수 있게 되었습니다.
저는 특히 MongoDB 애플리케이션 현대화 플랫폼(AMP)의 출시에 대해 매우 기대하고 있습니다. 모든 엔터프라이즈는 AI 의 요구 사항을 지원할 수 없는 레거시 시스템의 막대한 비용으로 인해 어려움을 겪고 있습니다. AMP는 단순한 "리프트 앤 시프트"가 아닙니다. AI 기반 도구, 검증된 기술, 전문 인력을 결합하여 비용과 위험을 최소화하면서 중요한 비즈니스 시스템을 재창조하는 반복 가능한 엔드투엔드 플랫폼입니다. 초기 결과는 인상적입니다. 구형 시스템에서 MongoDB로 전환하는 엔터프라이즈는 2~3배 더 빠르게 전환하고 있으며 코드 재작성 같은 작업의 속도가 엄청나게 빨라지고 있습니다.
그림 1. MongoDB.local NYC 기조연설.
Photo of the stage for the .local NYC keynote
YouTube에서 기조연설 전문을 시청하세요.

세계에서 가장 인기 있는 현대 데이터베이스가 되다

MongoDB의 여정을 되돌아보면 저희가 얼마나 멀리 왔는지 놀라움을 금할 수 없습니다. 제가 10여 년 전에 입사했을 때는 고객이 수천 명에 불과했습니다. 오늘날 MongoDB는 Fortune 500대 기업 중 70% 이상과 최첨단 AI 네이티브 스타트업을 포함해 모든 산업과 업종에 걸쳐 거의 60,000개 조직에 서비스를 제공하고 있습니다.
하지만 성장의 원동력은 여전히 변함이 없습니다. 1970년대에 구축된 관계형 데이터베이스는 현대 애플리케이션의 규모와 복잡성에 맞게 설계되지 않았습니다. 경직되어 있고 확장하기 어려우며 적응 속도가 느렸습니다. DoubleClick을 구축하면서 이러한 한계를 직접 경험한 창립자들은 현대 세계의 현실에 맞춰 설계한 더욱 개선된 데이터베이스 모델을 설정했습니다. 바로 문서 모델이 탄생한 것입니다.
JSON을 기반으로 하는 문서 모델은 직관적이고 유연하며 강력합니다. 이를 통해 개발자는 복잡하고 상호 의존적이며 끊임없이 변화하는 데이터를 자연스럽게 표현할 수 있습니다. 그리고 AI 시대에 접어들면서 이러한 적응성, 확장성, 보안과 같은 자질은 그 어느 때보다 중요해졌습니다. 기업이 선택하는 데이터베이스는 AI 이니셔티브의 성공을 결정하는 가장 전략적인 결정 중 하나가 될 것입니다.
생성형 인공지능 애플리케이션은 이미 생산성 향상, 코드 작성, 문서 초안 작성, 질문에 대한 답변 등을 제공하기 시작했습니다. 하지만 진정한 변화는 인지하고, 결정하고, 행동하는 에이전트 AI 애플리케이션에 있습니다. 이러한 지능형 에이전트는 단순히 워크플로를 따르는 것이 아니라 결과를 추구하고 이를 달성하기 위한 최선의 단계를 추론합니다. 이 과정에서 데이터베이스는 필수 불가결한 요소입니다. 에이전트가 컨텍스트를 인식할 수 있는 메모리, 지능적으로 판단할 수 있는 사실, 일관성 있게 행동할 수 있는 상태를 제공합니다.
그렇기 때문에 기업의 데이터는 가장 소중한 자산입니다. 거대 언어 모델(LLM)은 응답을 생성할 수 있지만, 연속성, 협업 및 진정한 인텔리전스를 제공하는 것은 데이터베이스입니다. AI의 미래는 단순히 추론에 관한 것이 아닙니다. 그것은 컨텍스트, 메모리, 그리고 데이터의 힘에 관한 것입니다.

혁신적인 AI를 위한 이상적인 데이터베이스

그렇다면 에이전트 AI에 이상적인 데이터베이스는 어떤 모습일까요? 오늘날의 복잡성과 미래의 변화를 반영해야 합니다. AI 언어인 JSON을 사용하는 경우가 늘어나고 있습니다. 원시 데이터, 메타데이터, 임베딩에 걸쳐 정확한 검색뿐 아니라 의미와 의도까지 통합하는 고급 검색 기능을 제공해야 합니다. 개인 데이터와 LLM을 최고 품질의 임베딩 및 리랭커와 연결해야 합니다. 또한 전 세계적으로 미션 크리티컬 애플리케이션을 지원하는 데 필요한 성능, 확장성 및 보안을 제공해야 합니다.
이것이 바로 MongoDB가 제공하는 것입니다. 저희는 이 목록의 항목을 단순히 체크하는 것이 아니라, 직접 정의합니다.

이제 시작에 불과합니다

이것이 제가 우리의 미래에 대해 매우 낙관적인 이유입니다. 모든 MongoDB.local 이벤트에서 볼 수 있는 에너지와 창의성은 항상 이 회사의 원동력이 되어 온 열정을 떠올리게 합니다. 고객이 혁신을 거듭하는 가운데, 저는 MongoDB가 AI 시대에서 고객의 성공을 도울 수 있는 완벽한 위치에 있다고 확신합니다.
여러분이 다음 어떤 제품을 빌드할지 정말 기대됩니다.
더 많은 공지 사항을 확인하고 최신 제품 업데이트를 받으려면 새로운 기능 페이지를 방문하세요. MongoDB.local 허브로 이동하여 다음 행사가 진행되는 도시를 확인해 보세요.
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
Ontem, demos as boas-vindas a milhares de desenvolvedores e executivos no MongoDB.local NYC, a mais recente parada do nosso .local séries. Ao longo do último ano, conectamos-nos com dezenas de milhares de parceiros e clientes em 20 cidades ao redor do mundo. Mas é especialmente significativo estar em Nova York, onde o MongoDB foi fundado e onde ainda temos nossa sede.
Durante o evento, apresentamos novas capacidades que reforçam a posição do MongoDB como o principal banco de dados moderno do mundo. Com o MongoDB 8.2, nossa versão mais rica em recursos e de melhor desempenho até agora, estamos elevando o padrão do que os desenvolvedores podem alcançar. Também compartilhamos mais sobre nossos modelos de incorporação e reclassificação da Voyage AI, que trazem precisão e eficiência de última geração para a criação de aplicativos de IA confiáveis e seguros. E com a pesquisa e a pesquisa vetorial agora em visualização pública para o MongoDB Community Edition e o Enterprise Server, estamos colocando poderosas funcionalidades de recuperação diretamente nos ambientes dos clientes—onde quer que eles prefiram executar.
Estou particularmente entusiasmado com o lançamento da Plataforma de Modernização de Aplicativos MongoDB, ou AMP. Empresas em todo o mundo estão lidando com os custos massivos dos sistemas legados que não conseguem dar suporte às demandas da IA. AMP não é um simples "lift-and-shift". É uma plataforma repetível e de ponta a ponta que combina ferramentas impulsionadas por IA, técnicas comprovadas e talento especializado para reinventar sistemas críticos de negócios, minimizando custos e riscos. Os primeiros resultados são impressionantes: as empresas que estão migrando de sistemas antigos para o MongoDB estão fazendo isso de duas a três vezes mais rápido, e tarefas como a reescrita de código estão acelerando em uma ordem de magnitude.
Figura 1. Palestra principal do MongoDB.local NYC.
Photo of the stage for the .local NYC keynote
Assista à palestra completa no YouTube.

Tornar-se o banco de dados moderno mais popular do mundo.

Ao refletir sobre a jornada do MongoDB, fico impressionado com o quanto avançamos. Quando entrei há pouco mais de uma década, tínhamos apenas alguns milhares de clientes. Hoje, o MongoDB serve a quase 60.000 organizações em todos os setores e verticais, incluindo mais de 70% das empresas da Fortune 500 e inicializações nativas de IA de ponta.
No entanto, a razão por trás do nosso crescimento permanece a mesma. Os relational database criados na década de 1970 nunca foram projetados para dimensionar a escala e complexidade dos aplicativo modernos. Eles eram rígidos, difíceis de dimensionar e lentos para se adaptar. Nossos fundadores, que vivenciaram essas limitações em primeira mão ao construir a DoubleClick, decidiram criar algo melhor: um modelo de banco de dados projetado para as realidades do mundo moderno. O modelo de documento foi criado.
Baseado em JSON, o modelo de documento é intuitivo, flexível e poderoso. Ele permite que os desenvolvedores representem dados complexos, interdependentes e em constante mudança de maneira natural. E, ao entrarmos na era da IA, essas mesmas qualidades — adaptabilidade, escalabilidade e segurança — são mais críticas do que nunca. O banco de dados que uma empresa escolhe será uma das decisões mais estratégicas que determinarão o sucesso de suas iniciativas de IA.
Os aplicativos de IA generativa já começaram a oferecer ganhos de produtividade, escrever código, elaborar documentos e responder a perguntas. Mas a verdadeira transformação está por vir com a IA agêntica — aplicativos que percebem, decidem e agem. Esses agentes inteligentes não apenas seguem fluxos de trabalho; eles buscam resultados, raciocinando sobre as melhores etapas para alcançá-los. E nesse loop, o banco de dados é indispensável. Ela fornece a memória que permite aos agentes perceberem o contexto, os fatos que lhes permitem decidir de forma inteligente e o estado que lhes permitirá agir de forma coerente.
É por isso que os dados de uma empresa são seu ativo mais valioso. LLM (LLMs) podem gerar respostas, mas é o banco de dados que fornece continuidade, colaboração e verdadeira inteligência. O futuro da IA não é apenas sobre raciocínio—é sobre contexto, memória e o poder dos seus dados.

O banco de dados ideal para IA transformativa

Então, como é o banco de dados ideal para IA agentic? Deve refletir a complexidade de hoje e as mudanças de amanhã. Deve falar a linguagem da IA, que é cada vez mais JSON. Ele deve integrar a recuperação avançada de dados brutos, metadados e embeddings — não apenas a correspondência exata, mas também o significado e a intenção. Ele deve conectar dados privados e LLM com incorporações e reclassificadores da mais alta qualidade. E deve fornecer o desempenho, a escalabilidade e a segurança necessários para suportar aplicativos de missão crítica em um dimensionamento global.
Isso é precisamente o que o MongoDB entrega. Nós não apenas marcamos as caixas desta lista — nós as definimos.

Estamos apenas dando os primeiros passos

É por isso que estou tão otimista quanto ao nosso futuro. A energia e a criatividade que vemos em todos os eventos do MongoDB.local me lembram da paixão que sempre impulsionou esta empresa. À medida que nossos clientes continuam a inovar, sei que o MongoDB está na posição ideal para ajudá-los a prosperar na era da IA.
Mal podemos esperar para ver suas próximas criações.
Para ver mais anúncios e as atualizações mais recentes do produto, visite nossa página Novidades. E vá para o hub MongoDB.local para ver onde estaremos em seguida.
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
Hier, nous avons accueilli des milliers de développeurs et de cadres à MongoDB.local NYC, la dernière étape de notre tournée mondiale .local. Cette année, nous avons rencontré des dizaines de milliers de partenaires et de clients dans 20 villes à travers le monde. Mais pour nous, être à New York a une saveur particulière, car c'est la ville où MongoDB a été fondée et où nous avons toujours notre siège social.
Lors de cet événement, nous avons présenté de nouvelles fonctionnalités qui renforcent la position de MongoDB en tant que principale base de données moderne au monde. Avec MongoDB 8.2, notre version la plus riche en fonctionnalités et la plus performante à ce jour, nous mettons la barre encore plus haut sur ce que les développeurs peuvent accomplir. Nous avons également partagé plus d'informations sur nos modèles d'intégration et de reclassement Voyage AI, qui apportent une précision et une efficacité de pointe à la création d'applications d'IA fiables. Et alors que Search et Vector Search sont désormais disponibles au public pour MongoDB Community Edition et Enterprise Server, nous mettons de puissantes capacités de récupération directement dans les environnements des clients, quels qu'ils soient.
Je suis particulièrement ravi du lancement de la plateforme de modernisation des applications de MongoDB, ou AMP. Partout, les entreprises sont confrontées aux coûts considérables des systèmes hérités qui ne peuvent pas supporter les exigences de l'IA. L’AMP n’est pas un simple « lift-and-shift ». Il s'agit d'une plateforme reproductible et de bout en bout qui combine des outils alimentés par l'IA, des techniques éprouvées et des talents spécialisés pour réinventer les systèmes d'entreprise critiques tout en minimisant les coûts et les risques. Les premiers résultats sont impressionnants : les entreprises qui migrent d’anciens systèmes vers MongoDB le font deux à trois fois plus vite, et des tâches comme la réécriture de code gagnent en rapidité.
Figure 1. Conférence keynote de MongoDB.local NYC.
Photo of the stage for the .local NYC keynote
Regardez l'intégralité de la keynote sur YouTube.

Devenir la base de données moderne la plus populaire au monde

Lorsque je repense au parcours de MongoDB, je suis frappé par tout le chemin parcouru. Lorsque j'ai rejoint l'entreprise il y a un peu plus de dix ans, nous n'avions que quelques milliers de clients. Aujourd'hui, MongoDB est utilisé par près de 60 000 organisations tous secteurs confondus, dont plus de 70 % des entreprises du Fortune 500 et des startups de pointe natives de l'IA.
Pourtant, la raison de notre croissance reste la même. Les relational database créées dans les années 1970 n’ont jamais été conçues pour l'envergure et la complexité des applications modernes. Elles étaient rigides, difficiles à répartir et lentes à s’adapter. Nos fondateurs, qui avaient connu ces limitations lors de la création de DoubleClick, se sont mis en tête de créer quelque chose de mieux : un modèle de base de données conçu pour les réalités du monde moderne. Le document model est né.
Basé sur JSON, le document model est intuitif, flexible et puissant. Il permet aux développeurs de représenter de manière naturelle des données complexes, interdépendantes et en constante évolution. Et, alors que nous entrons dans l'ère de l'IA, ces mêmes qualités — adaptabilité, évolutivité et sécurité — sont plus essentielles que jamais. La base de données choisie par une entreprise sera l'une des décisions les plus stratégiques pouvant déterminer la réussite de ses initiatives en matière d'IA.
Les applications d'IA générative ont déjà commencé à générer des gains de productivité, en écrivant du code, en rédigeant des documents et en répondant aux questions. Mais la véritable transformation se trouve dans l'IA agentique — des applications qui perçoivent, décident et agissent. Ces agents intelligents ne suivent pas seulement les flux de travail ; ils recherchent des résultats et réfléchissent aux meilleures étapes pour les atteindre. Et dans cette boucle, la base de données est indispensable. Elle fournit la mémoire qui permet aux agents de percevoir le contexte, les faits qui leur permettent de décider intelligemment et l'état qui leur permettra d'agir de manière cohérente.
C'est pourquoi les données d'une entreprise sont l'actif le plus précieux qu'elle ait. Les Large Language Models (grands modèles de langage) peuvent générer des réponses, mais c'est la base de données qui assure la continuité, la collaboration et la véritable intelligence. L'avenir de l'IA ne se limite pas au raisonnement, il concerne également le contexte, la mémoire et la puissance de vos données.

La base de données idéale pour une IA transformatrice

À quoi ressemble donc la base de données idéale pour l'IA agentique ? Elle doit refléter la complexité d'aujourd'hui et les changements de demain. Elle doit parler la langue de l’IA, qui est de plus en plus JSON. Elle doit intégrer une récupération avancée des données brutes, des métadonnées et des intégrations, non seulement les correspondances exactes, mais aussi la signification et l'intention. Elle doit faire le lien entre les données privées et les LLM avec des intégrations et des reclassements de la plus haute qualité. Et elle doit offrir les performances, l’évolutivité et la sécurité nécessaires pour alimenter les applications critiques à l’échelle mondiale.
C'est précisément ce que propose MongoDB. Nous ne nous contentons pas de cocher les cases de cette liste — nous les créons.

Et ce n'est que le début

C’est pourquoi l'avenir me rend très optimiste. L’énergie et la créativité que nous voyons à chaque événement MongoDB.local me rappellent la passion qui a toujours alimenté cette entreprise. Alors que nos clients continuent d’innover, je sais que MongoDB est idéalement placée pour les aider à réussir à l’ère de l’IA.
Nous avons hâte de voir vos créations !
Pour voir d’autres annonces et consulter les dernières mises à jour de produits, accédez à notre page « Nouveautés ». Et rendez-vous sur le hub MongoDB.local pour voir où nous serons prochainement.
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
昨天,我们迎来了数千名开发者和高管参加 MongoDB.local NYC,这是我们全球 .local 系列的最新一站。在过去的一年里,我们与全球 20 个城市的数万名合作伙伴和客户建立了联系。而纽约更是意义重大,因为这里是 MongoDB 的诞生地,也是我们的总部所在地。
活动期间,我们推出了新功能,进一步巩固了 MongoDB 作为全球领先现代数据库的地位。MongoDB 8.2 是我们迄今为止功能最丰富、性能最高的版本,我们提高了开发者的能力标准。我们还分享了更多关于 Voyage AI 嵌入模型和重排序器的信息,它们为构建值得信赖、可靠的 AI 应用程序带来了最先进的准确性和效率。目前,MongoDB Community Edition 和 Enterprise Server 的搜索和向量搜索功能已进入公开预览阶段,我们将强大的检索功能直接应用到客户环境中,无论他们喜欢在哪里运行。
我对 MongoDB 应用程序现代化平台 (AMP) 的推出感到特别兴奋。世界各地的企业都在努力应对旧版系统带来的巨额成本问题,因为这些系统无法支持 AI 的需求。AMP 不是简单的“搬运”,而是可重复的端到端平台,结合 AI 驱动的工具、成熟的技术和专业的人才,重塑关键业务系统,同时最大限度地降低成本和风险。早期成果令人印象深刻:企业从旧系统迁移到 MongoDB 的速度提高了两到三倍,代码重写等任务的速度也提高了一个数量级。
图 1.MongoDB.local NYC 主题演讲。
Photo of the stage for the .local NYC keynote
在 YouTube 上观看完整的主题演讲。

成为全球最受欢迎的现代数据库

当我回顾 MongoDB 的历程时,我对我们所取得的进步感到震惊。十多年前我加入公司时,我们的客户数量只有几千名。如今, MongoDB 为各行业和垂直领域的近 60,000 个组织提供服务,其中包括超过 70% 的 Fortune 500 强企业和尖端 AI 初创企业。
然而,我们成长背后的原因却始终如一。关系数据库诞生于 20 世纪 70 年代,其设计初衷早已无法匹配现代应用程序的扩展性与复杂性。它们死板,难以扩展,适应速度慢。我们的创始人在构建 DoubleClick 时曾深切体会这些局限,从而立志创造更卓越的解决方案:一种专为现代世界现实而设计的数据库模型。文档模型诞生了。
文档模型基于 JSON,直观、灵活且功能强大。它允许开发者以自然的方式表示复杂、相互依赖且不断变化的数据。而且,随着我们步入 AI 时代,这些品质——适应性、可扩展性与安全性——其重要性空前凸显。公司选择的数据库将是决定其 AI 计划成功与否的最具战略性的决策之一。
生成式人工智能应用程序已经开始提高工作效率,编写代码、草拟文档和回答问题。但真正的变革在于代理 AI——能够感知、决策和行动的应用程序。这些智能代理不仅仅遵循工作流程;它们还追求结果,推理实现结果的最佳步骤。在此过程中,数据库不可或缺。凭借其提供的记忆,代理得以感知上下文;依据提供的事实,从而做出明智决策;再根据当前状态,最终执行出连贯的行动。
这就是为什么公司的数据是其最宝贵的资产。大型语言模型 (LLM) 可能会生成响应,但提供连续性、协作和真正智能的是数据库。AI 的未来不仅与推理有关,还与上下文、记忆和数据的力量有关。

变革性 AI 的理想数据库

那么,适合代理 AI 的理想数据库是什么样的?必须反映当今的复杂性和未来变化。必须使用 AI 语言,而这种语言越来越多地使用 JSON。必须集成跨原始数据、元数据和嵌入的高级检索——不仅仅是精确匹配,还包括意义和意图。必须通过最高质量的嵌入和重排序器来桥接私人数据和大型语言模型。而且必须提供在全球范围内支持关键任务应用程序所需的性能、可扩展性和安全性。
这正是 MongoDB 所提供的。我们不仅仅是在列表上打勾,而是定义这些标准。

我们才刚刚入门。

这就是为什么我对我们的未来如此乐观。我们在每一次 MongoDB.local 活动中亲眼见证的活力与创造力,让我感受到一种与公司发展驱动力一脉相承的激情。随着客户持续推动创新,我确信 MongoDB 能为他们提供在 AI 时代取得成功所需的关键基石。
未来可期,我们携手见证。
如需查看更多公告并获取最新产品动态,请访问我们的“最新动态”页面。前往 MongoDB.local 中心,查看我们的下一个行程。
2025-09-18 a month ago / 未收藏/ MongoDB | Blog发送到 kindle
Ayer, dimos la bienvenida a miles de desarrolladores y ejecutivos a MongoDB.local NYC, la última parada en nuestro recorrido global .local series. Durante el último año, nos hemos conectado con decenas de miles de Emparejar y cliente en 20 ciudades de todo el mundo. Sin embargo, es especialmente significativo estar en Nueva York, donde se fundó MongoDB y donde todavía tenemos nuestra sede.
Durante el evento, presentamos nuevas capacidades que refuerzan la posición de MongoDB como la base de datos moderna líder a nivel mundial. Con MongoDB 8.2, nuestra versión más rica en características y de alto rendimiento hasta el momento, estamos elevando el estándar de lo que los desarrolladores pueden lograr. También compartimos más sobre nuestros modelos de incrustación y reclasificación de Voyage IA, que aportan precisión y eficiencia de vanguardia a la creación de aplicaciones de IA confiables y fiables. Y con la búsqueda y la búsqueda vectorial ahora en vista previa pública tanto para MongoDB Community Edition como para Enterprise Server, estamos incorporando potentes capacidades de recuperación directamente en los entornos de los clientes, dondequiera que prefieran ejecutar.
Estoy particularmente entusiasmado con el lanzamiento de la Plataforma de Modernización de Aplicaciones de MongoDB, o AMP. Las empresas de todo el mundo están lidiando con los costos masivos de los sistemas heredados que no pueden soportar las demandas de la IA. AMP no es un simple “traslado y cambio”. Es una plataforma repetible de extremo a extremo que combina herramientas impulsadas por IA, técnicas probadas y talento especializado para reinventar los sistemas críticos de negocio mientras se minimizan los costos y riesgos. Los primeros resultados son impresionantes: las empresas que pasan de sistemas antiguos a MongoDB lo están haciendo dos o tres veces más rápido, y tareas como la reescritura de código se están acelerando en un orden de magnitud.
Figura 1. Ponencia de MongoDB.local NYC.
Photo of the stage for the .local NYC keynote
Vea la presentación completa en YouTube.

Convertirse en la base de datos moderna más popular del mundo

Cuando reflexiono sobre el recorrido de MongoDB, me sorprende lo lejos que hemos llegado. Cuando me uní hace poco más de una década, solo teníamos unos pocos miles de clientes. Hoy en día, MongoDB sirve a casi 60,000 Organizaciones en todas las industrias y sectores, incluyendo más del 70% de las Fortune 500 y empresas emergentes nativas de IA de vanguardia.
Sin embargo, la razón detrás de nuestro crecimiento sigue siendo la misma. Las relational database creadas en la década de 1970 nunca fueron diseñadas para escalar y la complejidad de las aplicación modernas. Eran rígidos, difíciles de escalar y lentos para adaptarse. Nuestros fundadores, que experimentaron esas limitaciones de primera mano mientras construían DoubleClick, se propusieron crear algo mejor: un modelo de base de datos diseñado para las realidades del mundo moderno. Había nacido el document model.
Basado en JSON, el document model es intuitivo, flexible y potente. Permite a los desarrolladores representar datos complejos, interdependientes y en constante cambio de manera natural. Y, a medida que ingresamos en la era de la IA, esas mismas cualidades—adaptabilidad, escalabilidad y seguridad—son más críticas que nunca. La base de datos que elija una empresa será una de las decisiones más estratégicas que determinarán el éxito de sus iniciativas de IA.
Las aplicaciones de IA generativa ya han comenzado a proporcionar mejoras en la productividad, escribiendo código, redactando documentos y respondiendo preguntas. Pero la verdadera transformación está por delante con la IA agente: aplicaciones que perciben, deciden y actúan. Estos agentes inteligentes no solo siguen los flujos de trabajo; persiguen resultados, razonando sobre los mejores pasos para lograrlos. Y en ese ciclo, la base de datos es indispensable. Proporciona la memoria que permite a los agentes percibir el contexto, los hechos que les permiten decidir de manera inteligente, y el estado que les permitirá actuar de forma coherente.
Por eso, los datos de una empresa son su activo más valioso. Los grandes modelos de lenguaje (LLM) pueden generar respuestas, pero es la base de datos la que proporciona continuidad, colaboración y verdadera inteligencia. El futuro de la IA no solo se trata de razonamiento, sino de contexto, memoria y el poder de sus datos.

La base de datos ideal para la IA transformativa

Entonces, ¿cómo debería ser la base de datos ideal para la IA agencial? Debe reflejar la complejidad de hoy y el cambio del mañana. Debe hablar el lenguaje de la IA, que cada vez más es JSON. Debe integrar la recuperación avanzada a través de datos sin procesar, metadatos e incrustaciones, no solo de coincidencia exacta, sino también de significado e intención. Debe conectar los datos privados y los LLM con incrustaciones y rerankeadores de la más alta calidad. Y debe ofrecer el rendimiento, la escalabilidad y la seguridad necesarios para impulsar aplicaciones de misión crítica a escala global.
Esto es precisamente lo que ofrece MongoDB. No nos limitamos a marcar las casillas de esta lista; las definimos.

Apenas estamos comenzando

Por eso soy tan optimista sobre nuestro futuro. La energía y la creatividad que vemos en cada evento de MongoDB.local me recuerdan la pasión que siempre ha impulsado a esta empresa. A medida que nuestros clientes continúan innovando, sé que MongoDB está en la posición perfecta para ayudarles a tener éxito en la era de la IA.
¡Estamos ansiosos por ver qué desarrollas a continuación!
Para ver más anuncios y obtener las últimas actualizaciones de productos, visite nuestra página Novedades. Y diríjase al centro MongoDB.local para ver dónde estaremos siguiente.
"美团技术团队" / 2025-09-21 a month ago / 未收藏/ meituan发送到 kindle
为解决虚拟人长视频生成的质量退化问题,美团基础研发平台/视觉智能团队推出了 InfiniteTalk 技术,实现无限时长视频生成。已在 GitHub 开源并获 1.6K Stars,Hugging Face 月下载量 64.8K,受到了很多好评,能够应用到电商直播、教育、影视等领域。
"美团技术团队" / 2025-09-22 a month ago / 未收藏/ meituan发送到 kindle
美团 LongCat 团队正式发布全新高效推理模型 LongCat-Flash-Thinking。综合评估显示,LongCat-Flash-Thinking 在逻辑、数学、代码、智能体等多个领域的推理任务中,达到了全球开源模型的最先进水平(SOTA)。
2025-09-27 a month ago / 未收藏/ DreamHost Status发送到 kindle
September 26, 2025 12:37PM PDT
Investigating - We are currently investigating connectivity issues affecting the DreamHost Web Panel. We are closely monitoring the situation and will post periodic updates as further information becomes available.

September 26, 2025 12:56PM PDT
Identified - We have identified the cause of the Web Panel connectivity issues and are working on a resolution. We’ll update this post with new information as it becomes available.

September 26, 2025 1:07PM PDT
Monitoring - Our Infrastructure Team has identified and resolved the issue affecting the DreamHost Web Panel. Services are now expected to be functioning normally. We will continue to monitor everything closely to ensure the problem is fully resolved and will update this post once we’re confident all is clear.

September 26, 2025 1:32PM PDT
Resolved - This incident has been resolved and systems are now fully operational. Please contact our Technical Support team via the DreamHost Web Panel if you are still experiencing related issues.

"C. Maoxian" / 2025-09-18 a month ago / 未收藏/ maoxian发送到 kindle

(a) Transactions relating to purchase or sale of security

            It shall be unlawful for any person, directly or indirectly, by the use of the mails or any means or instrumentality of interstate commerce, or of any facility of any national securities exchange, or for any member of a national securities exchange-

                        (1) For the purpose of creating a false or misleading appearance of active trading in any security registered on a national securities exchange, or a false or misleading appearance with respect to the market for any such security, (A) to effect any transaction in such security which involves no change in the beneficial ownership thereof, or (B) to enter an order or orders for the purchase of such security with the knowledge that an order or orders of substantially the same size, at substantially the same time, and at substantially the same price, for the sale of any such security, has been or will be entered by or for the same or different parties, or (C) to enter any order or orders for the sale of any such security with the knowledge that an order or orders of substantially the same size, at substantially the same time, and at substantially the same price, for the purchase of such security, has been or will be entered by or for the same or different parties.

                        (2) To effect, alone or with one or more other persons, a series of transactions in any security registered on a national securities exchange creating actual or apparent active trading in such security or raising or depressing the price of such security, for the purpose of inducing the purchase or sale of such security by others.

                        (3) If a dealer or broker, or other person selling or offering for sale or purchasing or offering to purchase the security, to induce the purchase or sale of any security registered on a national securities exchange by the circulation or dissemination in the ordinary course of business of information to the effect that the price of any such security will or is likely to rise or fall because of market operations of any one or more persons conducted for the purpose of raising or depressing the prices of such security.

                        (4) If a dealer or broker, or other person selling or offering for sale or purchasing or offering to purchase the security, to make, regarding any security registered on a national securities exchange, for the purpose of inducing the purchase or sale of such security, any statement which was at the time and in the light of the circumstances under which it was made, false or misleading with respect to any material fact, and which he knew or had reasonable ground to believe was so false or misleading.

                        (5) For a consideration, received directly or indirectly from a dealer or broker, or other person selling or offering for sale or purchasing or offering to purchase the security, to induce the purchase or sale of any security registered on a national securities exchange by the circulation or dissemination of information to the effect that the price of any such security will or is likely to rise or fall because of the market operations of any one or more persons conducted for the purpose of raising or depressing the price of such security.

                        (6) To effect either alone or with one or more other persons any series of transactions for the purchase and/or sale of any security registered on a national securities exchange for the purpose of pegging, fixing, or stabilizing the price of such security in contravention of such rules and regulations as the Commission may prescribe as necessary or appropriate in the public interest or for the protection of investors.

(b) Transactions relating to puts, calls, straddles, or options

            It shall be unlawful for any person to effect, by use of any facility of a national securities exchange, in contravention of such rules and regulations as the Commission may prescribe as necessary or appropriate in the public interest or for the protection of investors-

                        (1) any transaction in connection with any security whereby any party to such transaction acquires any put, call, straddle, or other option or privilege of buying the security from or selling the security to another without being bound to do so; or

                        (2) any transaction in connection with any security with relation to which he has, directly or indirectly, any interest in any such put, call, straddle, option, or privilege; or

                        (3) any transaction in any security for the account of any person who he has reason to believe has, and who actually has, directly or indirectly, any interest in any such put, call, straddle, option, or privilege with relation to such security.

(c) Endorsement or guarantee of puts, calls, straddles, or options

            It shall be unlawful for any member of a national securities exchange directly or indirectly to endorse or guarantee the performance of any put, call, straddle, option, or privilege in relation to any security registered on a national securities exchange, in contravention of such rules and regulations as the Commission may prescribe as necessary or appropriate in the public interest or for the protection of investors.

(d) Registered warrant, right, or convertible security not included in "put", "call", "straddle", or "option"

            The terms "put", "call", "straddle", "option", or "privilege" as used in this section shall not include any registered warrant, right, or convertible security.

(e) Persons liable; suits at law or in equity

            Any person who willfully participates in any act or transaction in violation of subsections (a), (b), or (c) of this section, shall be liable to any person who shall purchase or sell any security at a price which was affected by such act or transaction, and the person so injured may sue in law or in equity in any court of competent jurisdiction to recover the damages sustained as a result of any such act or transaction.  In any such suit the court may, in its discretion, require an undertaking for the payment of the costs of such suit, and assess reasonable costs, including reasonable attorneys' fees, against either party litigant.  Every person who becomes liable to make any payment under this subsection may recover contribution as in cases of contract from any person who, if joined in the original suit, would have been liable to make the same payment.  No action shall be maintained to enforce any liability created under this section, unless brought within one year after the discovery of the facts constituting the violation and within three years after such violation.

(f) Subsection (a) not applicable to exempted securities

            The provisions of subsection (a) of this section shall not apply to an exempted security.

(g) Foreign currencies

            Notwithstanding any other provision of law, the Commission shall have the authority to regulate the trading of any put, call, straddle, option, or privilege on any security, certificate of deposit, or group or index of securities (including any interest therein or based on the value thereof), or any put, call, straddle, option, or privilege entered into on a national securities exchange relating to foreign currency (but not, with respect to any of the foregoing, an option on a contract for future delivery).

(h) Limitations on practices that affect market volatility

            It shall be unlawful for any person, by the use of the mails or any means or instrumentality of interstate commerce or of any facility of any national securities exchange, to use or employ any act or practice in connection with the purchase or sale of any equity security in contravention of such rules or regulations as the Commission may adopt, consistent with the public interest, the protection of investors, and the maintenance of fair and orderly markets-

                        (1) to prescribe means reasonably designed to prevent manipulation of price levels of the equity securities market or a substantial segment thereof; and

                        (2) to prohibit or constrain, during periods of extraordinary market volatility, any trading practice in connection with the purchase or sale of equity securities that the Commission determines (A) has previously contributed significantly to extraordinary levels of volatility that have threatened the maintenance of fair and orderly markets; and (B) is reasonably certain to engender such levels of volatility if not prohibited or constrained.

In adopting rules under paragraph (2), the Commission shall, consistent with the purposes of this subsection, minimize the impact on the normal operations of the market and a natural person's freedom to buy or sell any equity security.

"C. Maoxian" / 2025-09-20 a month ago / 未收藏/ maoxian发送到 kindle

Interesting look at a Supermax prison … as awful as you can imagine it. Caged animals go barking mad, and it doesn’t help that they are all psychotic to start. The noise on the cellblock is incredible, the fluorescent lights always on, 23 hours a day alone in the cell … it has to be a fate worse than death. Interviews with some very articulate prisoners whom you are relieved are locked up forever.

The prisoners opened up with Kristi Jacobs… she’s an attractive woman.

"C. Maoxian" / 2025-09-20 a month ago / 未收藏/ maoxian发送到 kindle

93 minute running time, so the perfect length … Amy Irving and her cheekbones and 80s hair, channeling Barbara Hershey from Hannah and Her Sisters (1986) … David Pierce, Fraser’s gay little brother, actually name-checks Annie Hall in one scene … New York City looks as diverse and dirty as ever in the late 1980s … there’s a great scene where an old woman breaks into song with “Some Enchanted Evening” (Hammerstein) in a deli and the customers just sort of take it in stride and enjoy it (though Amy herself is deeply affected by it: “Once you have found him, never let him go.”)

This is a very Jewish movie (directed by Joan Micklin Silver, written by Susan Sandler), though Amy Irving was raised Christian Scientist and Peter Riegert comes from a non-observant Jewish family. It’s also clear that Silver loves the city.

There are cute bits, funny bits, some good writing, but ultimately this movie reflects the confused state of feminism by the late 80s… 33-year-old Amy is single and has a job (at a bookstore, of course) and occasional casual sex with a tall, bearded, married man, but she looks longingly at a baby boy at a bris and [spoilers] ultimately accepts the matchmaking arrangement of her Bubbie with a pickle man and his pickle. What are we supposed to make of this?

It’s a deeply traditional, conventional message in the end. It wasn’t terrible, but I can’t recommend it.

Fools give you reasons, wise men never try

"Si Quan Ong" / 2025-09-19 a month ago / 未收藏/ ahrefs发送到 kindle
If your brand isn’t appearing in these AI responses, you’re becoming invisible to an increasingly important segment of your audience. LLM visibility is about making sure you’re mentioned and cited in large language models (LLMs) like ChatGPT, Claude, Perplexity, and
Read more ›
"Despina Gavoyannis" / 2025-09-22 a month ago / 未收藏/ ahrefs发送到 kindle
User interactions, also called UX signals or user signals, include things like clicks, scrolls, swipes, and mouse hovers. These now play a major role in how Google ranks content and which brands gain more visibility in search results. Here’s everything
Read more ›
"Ryan Law" / 2025-09-22 a month ago / 未收藏/ ahrefs发送到 kindle
Thanks to generative AI, every part of our discipline is in flux: the tactics and strategies that yield great results, the tools and processes we use to achieve them, even the unit economics that justify it. One suggestion put forward
Read more ›
"Mateusz Makosiewicz" / 2025-09-23 a month ago / 未收藏/ ahrefs发送到 kindle
In this guide, I’ll show you everything you need to know about using AI to create content, while still feeling confident about it. AI-generated content is any material—text, images, video, audio, code, or data visualizations—created primarily or entirely using artificial
Read more ›
"Louise Linehan" / 2025-09-25 a month ago / 未收藏/ ahrefs发送到 kindle
Pitching these outlets means your brand gets in front of readers, circulates on social media, ranks in search, and now resurfaces in AI. Below are the top 50 most-cited publisher and editorial sites in ChatGPT that accept PR pitches. If
Read more ›
2025-09-18 a month ago / 未收藏/ vsxen发送到 kindle
这周一直在调平台的网络,有些项目文档少,内部逻辑复杂,各种判断穿插在一起,报错名不对意,很没有头绪。 这里的流程真实纯人工,算了我也不想管了,想找一个简单的CD平台,这样每次发布的时候就不需要我了。

生活

"Kev Quirk" / 2025-09-18 a month ago / 未收藏/ kevq发送到 kindle
Will everyone please stop taking about #Omarchy. It's too tempting!
"Kev Quirk" / 2025-09-20 a month ago / 未收藏/ kevq发送到 kindle
The previous post was a bit of a whinge about me logging into the *amazing* Kirby panel, getting side tracked and ending up tweaking stuff instead of actually …
"Kev Quirk" / 2025-09-22 a month ago / 未收藏/ kevq发送到 kindle
Spent some time this afternoon hooking up webmentions properly between Micro.blog and `kevquirk.com` so everything from Micro.blog now (hopefully) feeds back …
"Kev Quirk" / 2025-09-22 a month ago / 未收藏/ kevq发送到 kindle
Took me a little bit to finish this one. Even though it's a short book, I've been super busy and have been too tired to read in the evenings. Anyway, it's …
"Kev Quirk" / 2025-09-22 a month ago / 未收藏/ kevq发送到 kindle
Screw it. I've ripped out all the comment and indieweb functionality. I was already starting to battle with noise and shit - it's just too complicated. I'll …
"Evan Ackerman" / 2025-09-19 a month ago / 未收藏/ spectrum发送到 kindle


Video Friday is your weekly selection of awesome robotics videos, collected by your friends at IEEE Spectrum robotics. We also post a weekly calendar of upcoming robotics events for the next few months. Please send us your events for inclusion.
ACTUATE 2025: 23–24 September 2025, SAN FRANCISCO
CoRL 2025: 27–30 September 2025, SEOUL
IEEE Humanoids: 30 September–2 October 2025, SEOUL
World Robot Summit: 10–12 October 2025, OSAKA, JAPAN
IROS 2025: 19–25 October 2025, HANGZHOU, CHINA
Enjoy today’s videos!

A billion dollars is a lot of money. And this is actual money, not just a valuation. but Figure already had a lot of money. So what are they going to be able to do now that they weren’t already doing, I wonder?


[ Figure ]

Robots often succeed in simulation but fail in reality. With PACE, we introduce a systematic approach to sim-to-real transfer.


[ Paper ]

Anthropomorphic robotic hands are essential for robots to learn from humans and operate in human environments. While most designs loosely mimic human hand kinematics and structure, achieving the dexterity and emergent behaviors present in human hands, anthropomorphic design must extend to also match passive compliant properties while simultaneously strictly having kinematic matching. We present ADAPT-Teleop, a system combining a robotic hand with human-matched kinematics, skin, and passive dynamics, along with a robotic arm for intuitive teleoperation.


[ Paper ]

This robot can walk without any electronic components in its body, because the power is transmitted through wires from motors concentrated outside of its body. Also, this robot’s front and rear legs are optimally coupled and can walk with just four wires.


[ JSK Lab ]
Thanks, Takahiro!

Five teams of Los Alamos engineers competed to build the ultimate hole-digging robot dog in a recent engineering sprint. In just days, teams programmed their robot dogs to dig, designing custom “paws” from materials like sheet metal, foam, and 3D-printed polymers. The paws mimicked animal digging behaviors—from paddles and snowshoes to dew claws—and helped the robots avoid sinking into a 30-gallon soil bucket. Teams raced to see whose dog could dig the biggest hole and dig under a fence the fastest.


[ Los Alamos ]

This work presents UniPilot, a compact hardware-software autonomy payload that can be integrated across diverse robot embodiments to enable resilient autonomous operation in GPS-denied environments. The system integrates a multimodal sensing suite including lidar, radar, vision, and inertial sensing for robust operation in conditions where unimodal approaches may fail. A large number of experiments are conducted across diverse environments and on a variety of robot platforms to validate the mapping, planning, and safe navigation capabilities enabled by the payload.


[ NTNU ]
Thanks, Kostas!

KAIST Humanoid v0.5. Developed at the DRCD Lab, KAIST, with a control policy trained via reinforcement learning.


[ KAIST ]

I just like the determined little hops.


[ AgileX ]

I’m always a little bit suspicious of robotics labs that are exceptionally clean and organized.


[ PNDbotics ]

Er, has PAL Robotics ever actually seen a kangaroo...?


[ PAL ]

See Spots push. Push, Spots, push.


[ Tufts ]

Training humanoid robots to hike could accelerate development of embodied AI for tasks like autonomous search and rescue, ecological monitoring in unexplored places, and more, say University of Michigan researchers who developed an AI model that equips humanoids to hit the trails.


[ Michigan ]

I am dangerously close to no longer being impressed by breakdancing humanoid robots.


[ Fourier ]

This, though, would impress me.


[ Inria ]

In this interview, Clone’s co-founder and CEO Dhanush Radhakrishnan discusses the company’s path to creating the synthetic humans straight out of science fiction.
(If YouTube brilliantly attempts to auto-dub this for you, switch the audio track to original [which YouTube thinks is Polish] and the video will still be in English.)


[ Clone ]

This documentary takes you behind the scenes of the HMND 01 Alpha release: the breakthroughs, the failures, and the late nights of building the U.K.’s first industrial humanoid robot.


[ Humanoid ]

What is the role of ethical considerations in the development and deployment of robotic and automation technologies, and what are the responsibilities of researchers to ensure that these technologies advance in ways that are transparent, fair, and aligned with the broader well-being of society?


[ ICRA@40 ]

This UPenn GRASP SFI lecture is from Tairan He at Nvidia on “Scalable Sim-to-Real Learning for General-Purpose Humanoid Skills.”


Humanoids represent the most versatile robotic platform, capable of walking, manipulating, and collaborating with people in human-centered environments. Yet despite recent advances, building humanoids that can operate reliably in the real world remains a fundamental challenge. Progress has been hindered by difficulties in whole-body control, robust perceptive reasoning, and bridging the sim-to-real gap. In this talk, I will discuss how scalable simulation and learning can systematically overcome these barriers.
[ UPenn ]

"Matthew Williams" / 2025-09-21 a month ago / 未收藏/ spectrum发送到 kindle


Blue Origin is committed to making a permanent human presence in space a reality. To this end, the company has developed the New Shepard and New Glenn rockets to send payloads to orbit, and it aims to create superheavy launch vehicles to reach the moon (the New Armstrong rocket) and beyond. Another focus has been on developing systems that will enable in situ resource utilization (ISRU) in extraterrestrial environments, which is essential for making space sustainable. This includes the company’s Blue Alchemist ISRU system, which recently completed its critical design review.
For missions operating beyond low Earth orbit (LEO), opportunities for resupply missions will be few and far between. This is especially true where Mars is concerned because it takes six to nine months to make a one-way transit using conventional propulsion. Ensuring sustainability requires that missions be as self-sufficient as possible, which means relying on local resources to provide basic necessities. This is the purpose of Blue Alchemist, which is designed to transform lunar and Martian regolith into solar power systems, breathable oxygen, propellant, metals, and construction materials.

How Molten Regolith Electrolysis Reactors Work

Blue Alchemist is an end-to-end scalable system that relies on a molten regolith electrolysis (MRE) reactor. This reactor uses electrical current to separate oxygen from metals (such as iron, aluminum, and silicon) without water, toxic chemicals, or carbon emissions. The silicon can then be refined to produce radiation-resistant solar cells, while the elemental oxygen can be converted into oxygen gas, fuel cells, or liquid oxygen (LOX) propellant. The metals and ceramics can also be used as building materials for habitat structures, and to create semiconductors for electric systems.
This process reduces reliance on supplies launched from Earth. It also has potential applications here on Earth, where carbon-neutral manufacturing can ensure sustainable development. In a company press release, Pat Remias, the vice president of Blue Origin’s Advanced Concepts and Enterprise Engineering said, “Blue Alchemist changes everything about how we approach space. It is the foundation for a sustainable robotic and human presence across the solar system. Each kilogram of oxygen we make on the lunar surface is one less that we have to launch from Earth, making it a giant leap toward permanent settlements as well as critical resources for transportation to the Moon, Mars, and beyond.”
The company also indicates that it’s on track to scale the system to make lunar landings up to 60 percent cheaper and reduce fuel-cell and battery masses by up to 70 percent by enabling lunar refueling services. The system is being developed at Blue Origin’s Space Resources Center of Excellence, a 1.2-hectare facility with 5,575 square meters of lab space that is staffed by a team of 65 interdisciplinary experts. The technology is being developed with support from a NASA Tipping Point award, which was granted through the agency’s Game Changing Development program.
With the critical design review completed, Blue Alchemist will move into the next phase of development, with an autonomous demonstration in a simulated lunar environment scheduled for 2026.
"Eliza Strickland" / 2025-09-22 a month ago / 未收藏/ spectrum发送到 kindle


The ARC Prize test is a deceptively simple challenge designed to measure a machine’s ability to reason, abstract, and generalize—core ingredients of artificial general intelligence (AGI). It’s the most prominent benchmark to emerge as researchers look for ways to measure progress toward AGI. For the full story, see the feature article “Will We Know Artificial General Intelligence When We See It?
This article is part of our special report The Scale Issue.
While today’s smartest AI models still struggle with many of these visual puzzles, humans often solve them easily. We’ve selected five from the ARC collection of nearly 2,000 puzzles, aiming for a range from easy to fairly hard, and adapted them into multiple-choice quizzes.
INSTRUCTIONS: For each of the five puzzles, examine the examples and try to identify the overarching pattern between inputs and outputs. Your goal is to figure out the rule that governs how the input [on the left in each box] is transformed into the output [on the right]. Then, look at the test grid: Given its input, and based on what you’ve learned from the examples, what should the output be? Click one of the four multiple-choice answers to see if you’re right. Crack all five puzzles and prove you’re not just another language model!
"Matthew Hutson" / 2025-09-22 a month ago / 未收藏/ spectrum发送到 kindle


Buzzwords in the field of artificial intelligence can be technical: perceptron, convolution, transformer. These refer to specific computing approaches. A recent term sounds more mundane but has revolutionary implications: timeline. Ask someone in AI for their timeline, and they’ll tell you when they expect the arrival of AGI—artificial general intelligence—which is sometimes defined as AI technology that can match the abilities of humans at most tasks. As AI’s sophistication has scaled—thanks to faster computers, better algorithms, and more data—timelines have compressed. The leaders of major AI labs, including OpenAI, Anthropic, and Google DeepMind, have recently said they expect AGI within a few years.
This article is part of our special report The Scale Issue.
A computer system that thinks like us would enable close collaboration. Both the immediate and long-term impacts of AGI, if achieved, are unclear, but expect to see changes in the economy, scientific discovery, and geopolitics. And if AGI leads to superintelligence, it may even affect humanity’s placement in the predatory pecking order. So it’s imperative that we track the technology’s progress in preparation for such disruption. Benchmarking AI’s capabilities allows us to shape legal regulations, engineering goals, social norms, and business models—and to understand intelligence more broadly.
While benchmarking any intellectual ability is tough, doing so for AGI presents special challenges. That’s in part because people strongly disagree on its definition: Some define AGI by its performance on benchmarks, others by its internal workings, its economic impact, or vibes. So the first step toward measuring the intelligence of AI is agreeing on the general concept.


Are You Smarter Than an AI?

Play a version of the game that researchers are using to track AI’s progress toward artificial general intelligence.


Another issue is that AI systems have different strengths and weaknesses from humans, so even if we define AGI as “AI that can match humans at most tasks,” we can debate which tasks really count, and which humans set the standard. Direct comparisons are difficult. “We’re building alien beings,” says Geoffrey Hinton, a professor emeritus at the University of Toronto who won a Nobel Prize for his work on AI.
Undaunted researchers are busy designing and proposing tests that might lend some insight into our future. But a question remains: Can these tests tell us if we’ve achieved the long-sought goal of AGI?

Why It’s So Hard to Test for Intelligence

There are infinite kinds of intelligence, even in humans. IQ tests provide a kind of summary statistic by including a range of semirelated tasks involving memory, logic, spatial processing, mathematics, and vocabulary. Sliced differently, performance on each task relies on a mixture of what’s called fluid intelligence—reasoning on the fly—and crystallized intelligence—applying learned knowledge or skills.
For humans in high-income countries, IQ tests often predict key outcomes, such as academic and career success. But we can’t make the same assumptions about AI, whose abilities aren’t bundled in the same way. An IQ test designed for humans might not say the same thing about a machine as it does about a person.


There are other kinds of intelligence that aren’t usually evaluated by IQ tests—and are even further out of reach for most AI benchmarks. These include types of social intelligence, such as the ability to make psychological inferences, and types of physical intelligence, such as an understanding of causal relations between objects and forces or the ability to coordinate a body in an environment. Both are crucial for humans navigating complex situations.

An old black-and-white photograph shows a man in a long coat standing next to a horse. Propped up against a wall are several blackboards with mathematical notations.  Clever Hans, a German horse in the early 1900s, seemed able to do math—but was really responding to his trainer’s subtle cues, a classic case of misinterpreting performance. Alamy
Intelligence testing is hard—in people, animals, or machines. You must beware of both false positives and false negatives. Maybe the test taker appears smart only by taking shortcuts, like Clever Hans, the famous horse that appeared to be capable of math but actually responded to nonverbal cues. Or maybe test takers appear stupid only because they are unfamiliar with the testing procedure or have perceptual difficulties.
It’s also hard because notions of intelligence vary across place and time. “There is an interesting shift in our society in terms of what we think intelligence is and what aspects of it are valuable,” says Anna Ivanova, an assistant professor of psychology at Georgia Tech. For example, before encyclopedias and the Internet, “having a large access to facts in your head was considered a hallmark of intelligence.” Now we increasingly prize fluid over crystallized intelligence.

The History of AI Intelligence Tests

Over the years, many people have presented machines with grand challenges that purported to require intelligence on par with our own. In 1958, a trio of prominent AI researchers wrote, “Chess is the intellectual game par excellence.… If one could devise a successful chess machine, one would seem to have penetrated to the core of human intellectual endeavor.” They did acknowledge the theoretical possibility that such a machine “might have discovered something that was as the wheel to the human leg: a device quite different from humans in its methods, but supremely effective in its way, and perhaps very simple.” But they stood their ground: “There appears to be nothing of this sort in sight.” In 1997, something of this sort was very much in sight when IBM’s Deep Blue computer beat Garry Kasparov, the reigning chess champion, while lacking the general intelligence even to play checkers.

A man leans over a chess board on a desk, studying the pieces. On the other side of the board is a man looking at a computer screen. IBM’s Deep Blue defeated world chess champion Garry Kasparov in 1997, butdidn’t have enough general intelligence to play checkers. Adam Nadel/AP
In 1950, Alan Turing proposed the imitation game, a version of which requires a machine to pass as a human in typewritten conversation. “The question and answer method seems to be suitable for introducing almost any one of the fields of human endeavour that we wish to include,” he wrote. For decades, passing what’s now called the Turing test was considered a nearly impossible challenge and a strong indicator of AGI.
But this year, researchers reported that when people conversed with both another person and OpenAI’s GPT-4.5 for 5 minutes and then had to guess which one was human, they picked the AI 73 percent of the time. Meanwhile, top language models frequently make mistakes that few people ever would, like miscounting the number of times the letter r occurs in strawberry. They appear to be more wheel than human leg. So scientists are still searching for measures of humanlike intelligence that can’t be hacked.

The ARC Test for AGI

There’s one AGI benchmark that, while not perfect, has gained a high profile as a foil for most new frontier models. In 2019, François Chollet, then a software engineer at Google and now a founder of the AI startup Ndea, released a paper titled “On the Measure of Intelligence.” Many people equate intelligence to ability, and general intelligence to a broad set of abilities. Chollet takes a narrower view of intelligence, counting only one specific ability as important—the ability to acquire new abilities easily. Large language models (LLMs) like those powering ChatGPT do well on many benchmarks only after training on trillions of written words. When LLMs encounter a situation very unlike their training data, they frequently flop, unable to adjust. In Chollet’s sense, they lack intelligence.
To go along with the paper, Chollet created a new AGI benchmark, called the Abstraction and Reasoning Corpus (ARC). It features hundreds of visual puzzles, each with several demonstrations and one test. A demonstration has an input grid and an output grid, both filled with colored squares. The test has just an input grid. The challenge is to learn a rule from the demonstrations and apply it in the test, creating a new output grid.

Two examples show small colorful shapes on black grids labeled \u201cinput\u201d and, on grids labeled \u201coutput,\u201d those same shapes at a larger scale and now interlocking. The test shows another input grid with small shapes, and a blank output grid.     The Abstraction and Reasoning Corpus challenges AI systems to infer abstract rules from just a few examples. Given examples of input-output grids, the system must apply the hidden pattern to a new test case—something humans find easy but machines still struggle with. ARC Prize
ARC focuses on fluid intelligence. “To solve any problem, you need some knowledge, and then you’re going to recombine that knowledge on the fly,” Chollet told me. To make it a test not of stored knowledge but of how one recombines it, the training puzzles are supposed to supply all the “core knowledge priors” one needs. These include concepts like object cohesion, symmetry, and counting—the kind of common sense a small child has. Given this training and just a few examples, can you figure out which knowledge to apply to a new puzzle? Humans can do most of the puzzles easily, but AI struggled, at least at first. Eventually, OpenAI created a version of its o3 reasoning model that outperformed the average human test taker, achieving a score of 88 percent—albeit at an estimated computing cost of US $20,000 per puzzle. (OpenAI never released that model, so it’s not on the leaderboard chart.)
This March, Chollet introduced a harder version, called ARC-AGI-2. It’s overseen by his new nonprofit, the ARC Prize Foundation. “Our mission is to serve as a North Star towards AGI through enduring benchmarks,” the group announced. ARC Prize is offering a million dollars in prize money, the bulk going to teams whose trained AIs can solve 85 percent of 120 new puzzles using only four graphics processors for 12 hours or less. The new puzzles are more complex than those from 2019, sometimes requiring the application of multiple rules, reasoning for multiple steps, or interpreting symbols. The average human score is 60 percent, and as of this writing the best AI score is about 16 percent.

Two charts show different AI models\u2019 performance on the ARC-AGI-1 and ARC-AGI-2 tests, with the score on the x axis and the cost per task on the y axis.\u00a0 AI models have made gradual progress on the first version of the ARC-AGI benchmark, which was introduced in 2019. This year, the ARC Prize launched a new version with harder puzzles, which AI models are struggling with. Models are labeled low, medium, high, or thinking to indicate how much computing power they expend on their answers, with “thinking” models using the most.ARC Prize
AI experts acknowledge ARC’s value, and also its flaws. Jiaxuan You, a computer scientist at the University of Illinois at Urbana-Champaign, says ARC is “a very good theoretical benchmark” that can shed light on how algorithms function, but “it’s not taking into account the real-world complexity of AI applications, such as social reasoning tasks.”
Melanie Mitchell, a computer scientist at the Santa Fe Institute, says it “captures some interesting capabilities that humans have,” such as the ability to abstract a new rule from a few examples. But given the narrow task format, she says, “I don’t think it captures what people mean when they say general intelligence.”
Despite these caveats, ARC-AGI-2 may be the AI benchmark with the biggest performance gap between advanced AI and regular people, making it a potent indicator of AGI’s headway. What’s more, ARC is a work in progress. Chollet says AI might match human performance on the current test in a year or two, and he’s already working on ARC-AGI-3. Each task will be like a miniature video game, in which the player needs to figure out the relevant concepts, the possible actions, and the goal.

What Attributes Should an AGI Benchmark Test?

Researchers keep rolling out benchmarks that probe different aspects of general intelligence. Yet each also reveals how incomplete our map of the territory remains.
One recent paper introduced General-Bench, a benchmark that uses five input modalities—text, images, video, audio, 3D—to test AI systems on hundreds of tasks that demand recognition, reasoning, creativity, ethical judgment, and other abilities to both comprehend and generate material. Ideally, an AGI would show synergy, leveraging abilities across tasks to outperform the best AI specialists. But at present, no AI can even handle all five modalities.
Other benchmarks involve virtual worlds. An April paper in Nature reports on Dreamer, a general algorithm from Google DeepMind that learned to perform over 150 tasks, including playing Atari games, controlling virtual robots, and obtaining diamonds in Minecraft. These tasks require perception, exploration, long-term planning, and interaction, but it’s unclear how well Dreamer would handle real-world messiness. Controlling a video game is easier than controlling a real robot, says Danijar Hafner, the paper’s lead author: “The character never falls on his face.” The tasks also lack rich interaction with humans and an understanding of language in the context of gestures and surroundings. “You should be able to tell your household robot, ‘Put the dishes into that cabinet and not over there,’ and you point at [the cabinet] and it understands,” he says. Hafner says his team is working to make the simulations and tasks more realistic.
Aside from these extant benchmarks, experts have long debated what an ideal demonstration would look like. Back in 1970, the AI pioneer Marvin Minsky told Life that in “three to eight years we will have a machine with the general intelligence of an average human being. I mean a machine that will be able to read Shakespeare, grease a car, play office politics, tell a joke, have a fight.” That panel of tasks seems like a decent start, if you could operationalize the game of office politics.

Virtual people would be assigned randomized tasks that test not only understanding but values. For example, AIs might unexpectedly encounter money on the floor or a crying baby.
One 2024 paper in Engineering proposed the Tong test (tong is Chinese for “general”). Virtual people would be assigned randomized tasks that test not only understanding but values. For example, AIs might unexpectedly encounter money on the floor or a crying baby, giving researchers the opportunity to observe what the AIs do. The authors argue that benchmarks should test an AI’s ability to explore and set its own goals, its alignment with human values, its causal understanding, and its ability to control a virtual or physical body. What’s more, the benchmark should be capable of generating an infinite number of tasks involving dynamic physical and social interactions.
Others, like Minsky, have suggested tests that require interacting with the real world to various degrees: making coffee in an unfamiliar kitchen, turning a hundred thousand dollars into a million, or attending college on campus and earning a degree. Unfortunately, some of these tests are impractical and risk causing real-world harm. For example, an AI might earn its million by scamming people.
I asked Hinton, the Nobel Prize winner, what skills will be the hardest for AI to acquire. “I used to think it was things like figuring out what other people are thinking,” he said, “but it’s already doing some of that. It’s already able to do deception.” (In a recent multi-university study, an LLM outperformed humans at persuading test takers to select wrong answers.) He went on: “So, right now my answer is plumbing. Plumbing in an old house requires reaching into funny crevices and screwing things the right way. And I think that’s probably safe for another 10 years.”
Researchers debate whether the ability to perform physical tasks is required to demonstrate AGI. A paper from Google DeepMind on measuring levels of AGI says no, arguing that intelligence can show itself in software alone. They frame physical ability as an add-on rather than a requirement for AGI.
Mitchell of the Santa Fe Institute says we should test capabilities involved in doing an entire job. She noted that AI can do many tasks of a human radiologist but can’t replace the human because the job entails a lot of tasks that even the radiologist doesn’t realize they’re doing, like figuring out what tasks to do and dealing with unexpected problems. “There’s such a long tail of things that can happen in the world,” she says. Some robotic vacuum cleaners weren’t trained to recognize dog poop, she notes, and so they smeared it around the carpet. “There’s all kinds of stuff like that that you don’t think of when you’re building an intelligent system.”
Some scientists say we should observe not only performance but what’s happening under the hood. A recent paper coauthored by Jeff Clune, a computer scientist at the University of British Columbia, in Canada, reports that deep learning often leads AI systems to create “fractured entangled representations”—basically a bunch of jury-rigged shortcuts wired together. Humans, though, look for broad, elegant regularities in the world. An AI system might appear intelligent based on one test, but if you don’t know the system’s innards, you could be surprised when you deploy it in a new situation and it applies the wrong rule.

AGI Is Already Here, and Never Will Be

The author Lewis Carroll once wrote of a character who used a map of the nation “on the scale of a mile to the mile!” before eventually using the country as its own map. In the case of intelligence testing, the most thorough map of how someone will perform in a situation is to test them in the situation itself. In that vein, a strong test of AGI might be to have a robot live a full human life and, say, raise a child to adulthood.
“Ultimately, the real test of the capabilities of AI is what they do in the real world,” Clune told me. “So rather than benchmarks, I prefer to look at which scientific discoveries [AIs] make, and which jobs they automate. If people are hiring them to do work instead of a human and sticking with that decision, that’s extremely telling about the capabilities of AI.” But sometimes you want to know how well something will do before asking it to replace a person.
We may never agree on what AGI or “humanlike” AI means, or what suffices to prove it. As AI advances, machines will still make mistakes, and people will point to these and say the AIs aren’t really intelligent. Ivanova, the psychologist at Georgia Tech, was on a panel recently, and the moderator asked about AGI timelines. “We had one person saying that it might never happen,” Ivanova told me, “and one person saying that it already happened.” So the term “AGI” may be convenient shorthand to express an aim—or a fear—but its practical use may be limited. In most cases, it should come with an asterisk, and a benchmark.
This article appears in the October 2025 print issue as “Can We Build a Better IQ Test for AI?”
"Samuel K. Moore" / 2025-09-23 a month ago / 未收藏/ spectrum发送到 kindle





This article is part of our special report The Scale Issue.


Global silicone chip production chain map from Spain to Taiwan, marking various manufacturing locations.

If you want to get a sense of the truly global scale of the electronics industry, look no further than your smartphone. The processor that powers it started as a humble rock, and by the time it found its way into your device, it had probably seen more of the world than you have. Along the way it was subjected to some of the most technologically sophisticated and closely guarded processes on the planet. Come along as we retrace that incredible 30,000-kilometer ride.

1. Quartz


Mountain cross-section with a quartz crystal inset.Your smartphone processor began its journey in the northwest corner of Spain, at Mina Serrabal, a quartz mine near the city of Santiago de Compostela. Quartz—or more technically, silicon dioxide or silica—is the main component of sand. But at Serrabal it can come in huge pieces twice the width of a smartphone. Mine operator Ferroglobe runs an automated system to sort the silica by size. After the pieces are washed and treated, the big ones head to the Atlantic coast for the next step in the journey.


Fact: According to consultant Thunder Said Energy, 350 million tonnes of silica was mined in 2024.

2. Silicon Metal


Silicon production: quartz, organic materials heated to liquid in arc furnace, 2000\u00b0C.After an hour by truck, the quartz mini-boulders arrive at Sabón, Ferroglobe’s 125,000-square-meter factory in the coastal province of A Coruña. Here the quartz will be mixed with dehydrated wood chips and heated to 1,500 to 2,000 °C in a trio of electric-arc furnaces that use massive electrodes invented at this plant in the 1990s. Inside the furnace, a reaction takes place that rips the oxygen from the silica and sticks it to the carbon from the wood. The result is silicon metal and carbon monoxide.


Fact: 3.8 million tonnes of silicon metal was produced in 2023, according to the U.S. Geological Survey.

3. Purified Polysilicon


Diagram of silicon deposition process at 1150\u00b0C with SiHCl3 and H2 flow.The resulting silicon metal is about 98 percent pure, and that’s not good enough. It will need to be at least 99.9999999 percent pure to become a microprocessor, which will require some pretty powerful chemistry. So it’s off to Wacker Chemie, in Burghausen, Germany. Here, the metal undergoes what’s called the Siemens process: It’s bathed in hydrochloric acid and reacts to form hydrogen gas and a liquid called trichlorosilane. Any impurities will be in the liquid, which is then run through a multistep distillation process that separates the pure trichlorosilane from anything unwanted. Once the needed purity is reached, the reaction is reversed: At 1,150 °C, the trichlorosilane is reacted with hydrogen to deposit multiple crystals of silicon, called polysilicon, and the resulting hydrochloric acid gas is sucked away. The polysilicon forms thick rods around heating elements. Once it’s cooled and removed from the reaction chamber, the polysilicon is smashed up for shipping.


Fact: According to consultant Thunder Said Energy, 1.7 million tonnes of polysilicon was produced in 2024, most of that for solar-cell production.

4. Silicon Wafers


Diagram of silicon ingot growth from molten polysilicon at 1,425\u00b0C.The ultrapure silicon is made up of many crystals at different orientations. But microprocessors must be made from a single crystal. So the material might migrate to Sherman, Texas, where GlobalWafers recently opened a US $3.5 billion silicon-wafer plant. Here the polysilicon is put through what’s called the Czochralski (Cz) method. In a high-purity quartz crucible, the polysilicon is heated to about 1,425 °C and melts. Then a seed crystal with a precise crystal orientation is dipped into the melt, slowly drawn upwards, and rotated. Do all that exactly right, and you will pull up an ingot of pure, crystalline silicon that’s 300 millimeters across and several meters tall. Specialized saws then slice this pillar of semiconducting purity into wafers less than 1 millimeter thick. The wafers are cleaned, polished, and sometimes further processed, before heading to wafer fabs.


Fact: According to industry association SEMI, manufacturers have shipped nearly 43 million square meters of silicon wafers in the last five years. That’s enough to cover two-thirds of the island of Manhattan.

5. Processed Wafers


Silicon wafer with layers stacked in detail, highlighting texture and layering process.Now it’s off to Tainan, in southern Taiwan, where TSMC’s Fab 18 will turn these wafers into the latest smartphone processors. It’s an exceedingly intricate process, involving some of the most complex and expensive equipment on the planet, including EUV lithography systems that can cost upward of $300 million each. In Fab 18, each wafer will go through months of exquisitely precise torture to produce the transistors and wiring that make up the processors. Extreme ultraviolet radiation will print patterns onto it, hot ions will ram into its surface, precision chemical reactions will build up some parts one atomic layer at a time, acids will etch away nanometer-scale structures, and metals will electrochemically plate parts and be polished away in others. The result: a wafer full of identical processors.


Fact: The maximum size of a silicon die is 858 mm2. Within a chip, there are more than 160 kilometers of wiring. Apple’s M3 Max processor contains 92 billion transistors.

6. Packaged Chips


Visual of chip wafer layers, emphasizing a single chip labeled "A11".As amazing as these processors are, you can’t use them in this form. They first need to be packaged. For our silicon, that’s going to happen at ASE’s facility in Penang, Malaysia. A package provides the chip with mechanical protection, a way for heat to be removed, and a way of connecting the chip’s micrometer-scale parts to a circuit board’s millimeter-scale ones. To do this, the wafers are first diced into chips. Then tiny balls of solder, some only tens of micrometers across, are attached to the chips. The solder bumps are aligned to corresponding parts of the package, and the two parts are melted together. It’s becoming more common for multiple pieces of silicon to be integrated within the same package, either stacked on top of each other or positioned next to each other on a separate piece of silicon called an interposer. Other steps to the process follow, and the packaged part is now ready for its next step.


Fact: Stacking multiple chips within a package could lead to GPUs with 1 trillion transistors by 2033

7. Smartphones


Diagram of smartphone components, highlighting the A11 processor.Our packaged chip arrives next in southern India, at Foxconn’s new $2.56 billion assembly plant on the outskirts of Bengaluru. The 1.2-square-kilometer site includes dormitories to house 30,000 workers, who will turn the chip, printed circuit board, touchscreen, battery, and a multitude of other components into an iPhone—one of some 25 million the company expects to produce per year at this and three other plants.


Fact: Processors and other logic chips made up 12 percent of the $463 billion cost of smartphones and other mobile devices in 2022, according to the Yole Group

Global Trade


Comparison of global electronics sales to Canada's GDP; 20 trillion USD total.

Acknowledgment: This journey was inspired by a chapter in Ed Conway’s Material World: The Six Raw Materials That Shape Modern Civilization (Alfred A. Knopf, 2023).
This article appears in the October 2025 print issue as “From Silica to Smartphone.”

"Stephen Cass" / 2025-09-24 a month ago / 未收藏/ spectrum发送到 kindle


Our Top Programming Languages interactive tries to tackle the problem of estimating a language’s popularity by looking for proxy signals. We do this by constructing measures of popularity from a variety of data sources that we believe are good proxies for active interest for each programming language. In total, we identify 64 programming languages. We then weight each data source to create an overall index of popularity, excluding some of the lowest scorers. Below, we describe the sources of data we use to get the measures, and the weighting scheme we use to produce the overall indices.
By popularity, we mean we are trying to rank languages that are in active use, including activity from maintaining legacy systems. We look at three different aspects of popularity: languages in active use among typical IEEE members and working software engineers (the “Spectrum” ranking), languages that are in demand by employers (the “Jobs” ranking), and languages that are in the zeitgeist (the “Trending” ranking).
We gauged the popularity of languages using the following sources for a total of seven metrics (see below). We gathered the information for all metrics in July—August 2025. In the past we relied heavily on APIs to gather data from sources, but now the data is gathered manually to the difficulty of keeping up with API changes and terminations, and because many of the programming language’s names (C++, Scheme) collided with common terms found in research papers and job ads or were difficult for a search engine to parse. When a large number of search results made it impractical to resolve ambiguities by examining all of the results individually, we used a sample of each data source, and determined the relevant sample size based on estimating the true mean with 95 percent confidence. Not all data sources contain information for each programming language and we interpret this information as the programming language having “no hits” (that is, not being popular).
The results from each metric are normalized to produce a relative popularity score between 0 and 1. Then the individual metrics are multiplied by a weight factor, combined, and the result renormalized to produce an aggregate popularity score.In aggregating metrics, we hope to compensate for statistical quirks that might distort a language’s popularity score in any particular source of data. Varying the weight factors allows us to create the different results for the Spectrum, Jobs, and Trending rankings. We fully acknowledge that, while these weights are subjective, they are based on our understanding of the sources and our prior coverage of software topics. Varying the weight factors allows us to emphasize different types of popularity and produce the different rankings. We then combined each weighted data source for each program and then renormalized the resulting frequency to produce an aggregate popularity score.
The Top Programming Languages was originally created by data journalist Nick Diakopoulos. Our statistical methodology advisor is Hilary Wething, although all the actual data gathering and calculation is performed by us. Rankings are computed using R.

Google

Google is the leading search engine in the world, making it an ideal fit for estimating language popularity. We measured the number of hits for each language by searching on the template, “X programming language” (with quotation marks) and manually recorded the number of results that were returned by the search. We took the measurement in July 2025. We like this measure because it indicates the volume of online information resources about each programming language.

Stack Overflow

Stack Overflow is a popular site where programmers can ask questions about coding. We recorded the number of questions tagged to each program within the last week prior to our search (August 2025). For the Mathematica/Wolfram language, we relied on the sister “Stack” for the Mathematica platform and tallied the number of programming-related questions asked in the past week. These data were gathered manually. This measure indicates what programming languages are currently trending.

IEEE Xplore Digital Library

IEEE maintains a digital library with millions of conference and journal articles covering a wide array of scientific and engineering disciplines. We searched for journal, magazine, and early access articles that mention each of the languages in the template “X programming” for the 2025 year-to-date. For search results that returned thousands of articles, we identified the correct sample size for a 95 percent confidence interval (usually a little over 300) and pulled that number of articles. For each language we sampled, we identified the share of articles that utilize the programming language and then multiplied the total number of articles by this share to tally the likely total number of articles that reference a given programming language. We conducted this search in August 2025. This metric captures the prevalence of the different programming languages as used and referenced in engineering scholarship.

IEEE Jobs Site

We measured the demand for different programming languages in job postings on the IEEE Job Site. For search results that returned thousands of listings, we identified the correct sample size for a 95 percent confidence interval (usually around 300 results) and pulled that number of job listings to manually examine. For each language we sampled, we identified the share of listings that utilize the programming language and then multiplied the total number of job listings by this share to tally the likely total number of job listings that reference a given programming language. Additionally, because some of the languages we track could be ambiguous in plain text—such as Go, J, Ada, and R—we searched for job postings with those words in the job description and then manually examined the results, again sampling entries if the number of results was large. The search was conducted in August 2025. We like the IEEE Job Site for its large number of non-U.S. listings, making it an ideal to measure global popularity.

Career Builder

We measured the demand for different programming languages on the CareerBuilder job site. We searched for “Developer” jobs offered within the United States, as this is the most popular job title for programmers. We sampled 400 job ads and manually examined them to identify which languages employers mentioned in the postings. The search was conducted in August 2024. We like the career builder site to identify the popularity of programmer jobs among U.S.-based companies

GitHub

GitHub is a public repository for many volunteer-driven open-source software projects. We used Github’s listing of it’s top 50 programming languages, filtering out entries for things like Docker configuration scripts. The data cover the first quarter of 2025. This measured provides a strong indication what languages coders choose to work in when they have a personal choice.

Trinity College Dublin Library

The library of Trinity College Dublin is one of six legal deposit libraries in Ireland and the United Kingdom. A copy must be deposited with the library of any printed material published or distributed in Ireland, and on request any U.K. publisher or distributor must also deposit a book. We searched for all books published in the year to date that matched the names of programming languages and checked the results for false positives. The search was conducted in July 2025. We like this library collection because it represents a large and categorized sample of works, primarily in the English language.

Discord

Discord is popular chat-room platform where many programmers exchange information. We counted the number of tags that correspond to each language. In the case of languages that could also be names of nonprogramming topics (many nonprogramming-related topics also have dedicated Discord servers; for example, “Julia” could refer to the programming language or the Sesame Street puppet), results were manually examined. Disboard was searched in August 2025. Disboard lists many public discord servers and many young coders use the site, contributing a different demographic of coders.
"Stephen Cass" / 2025-09-24 a month ago / 未收藏/ spectrum发送到 kindle






Since 2013, we’ve been metaphorically peering over the shoulders of programmers to create our annual interactive rankings of the most popular programming languages. But fundamental shifts in how people are coding may not just make it harder to measure popularity, but could even make the concept itself irrelevant. And then things might get really weird. To see why, let’s start with this year’s rankings and a quick refresher of how we put this thing together.
In the “Spectrum” default ranking, which is weighted with the interests of IEEE members in mind, we see that once again Python has the top spot, with the biggest change in the top five being JavaScript’s drop from third place last year to sixth place this year. As JavaScript is often used to create web pages, and vibe coding is often used to create websites, this drop in the apparent popularity may be due to the effects of AI that we’ll dig into in a moment. But first to finish up with this year’s scores, in the “Jobs” ranking, which looks exclusively at what skills employers are looking for, we see that Python has also taken 1st place, up from second place last year, though SQL expertise remains an incredibly valuable skill to have on your resume.
Because we can’t literally look over the shoulders of everyone who codes, including kids hacking on Minecraft servers or academic researchers developing new architectures, we rely on proxies to measure popularity. We detail our methodology here, but the upshot is that we merge metrics from multiple sources to create our rankings. The metrics we choose publicly signal interest across a wide range of languages—Google search traffic, questions asked on Stack Exchange, mentions in research papers, activity on the GitHub open source code repository, and so on.
But programmers are turning away from many of these public expressions of interest. Rather than page through a book or search a website like Stack Exchange for answers to their questions, they’ll chat with an LLM like Claude or ChatGPT in a private conversation. And with an AI assistant like Cursor helping to write code, the need to pose questions in the first place is significantly decreased. For example, across the total set of languages evaluated in the TPL, the number of questions we saw posted per week on Stack Exchange in 2025 was just 22 percent of what it was in 2024.
With less signal in publicly available metrics, it becomes harder to track popularity across a broad range of languages. This existential problem for our rankings can be tackled by searching for new metrics, or trying to survey programmers—in all their variety—directly. However, an even more fundamental problem is looming in the wings.
Whether it’s a seasoned coder using an AI to handle the grunt work, or a neophyte vibe coding a complete web app, AI assistance means that programmers can concern themselves less and less with the particulars of any language. First details of syntax, then flow control and functions, and so on up the levels of how a program is put together—more and more is being left to the AI.
Although code-writing LLM’s are still very much a work in progress, as they take over an increasing share of the work, programmers inevitably shift from being the kind of people willing to fight religious wars over whether source code should be indented by typing tabs or spaces to people who care less and less about what language is used.
After all, the whole reason different computer languages exist is because given a particular challenge, it’s easier to express a solution in one language versus another. You wouldn’t control a washing machine using the R programming language, or conversely do a statistical analysis on large datasets using C.
But it is technically possible to do both. A human might tear their hair out doing it, but LLMs have about as much hair as they do sentience. As long as there’s enough training data, they’ll generate code for a given prompt in any language you want. In practical terms, this means using one—any one—of today’s most popular general purpose programming languages. In the same way most developers today don’t pay much attention to the instruction sets and other hardware idiosyncrasies of the CPUs that their code runs on, which language a program is vibe coded in ultimately becomes a minor detail.
Sure, there will always be some people who care, just as today there are nerds like me willing to debate the merits of writing for the Z80 versus the 6502 8-bit CPUs. But overall, the popularity of different computer languages could become as obscure a topic as the relative popularity of railway track gauges.
One obvious long-term consequence to this is that it will become harder for new languages to emerge. Previously, new languages could emerge from individuals or small teams evangelizing their approach to potential contributors and users. Presentations, papers, demos, sample code and tutorials seeded new developer ecosystems. A single well-written book, like Leo Brodie’s Starting Forth or Brian Kernighan and Dennis Ritchies’ The C Programming Language, could make an enormous difference to a language’s popularity.
But while a few samples and a tutorial can be enough material to jump-start adoption among programmers familiar with the ins and outs of hands-on coding, it’s not enough for today’s AIs. Humans build mental models that can extrapolate from relatively small amounts of data. LLMs rely on statistical probabilities, so the more data they can crunch, they better they are. Consequently programmers have noted that AIs give noticeably poorer results when trying to code in less-used languages.
There are research efforts to make LLMs more universal coders, but that doesn’t really help new languages get off the ground. Fundamentally new languages grow because they are scratching some itch a programmer has. That itch can be as small as being annoyed at semicolons having to be placed after every statement, or as large as a philosophical argument about the purpose of computation.
But if an AI is soothing our irritations with today’s languages, will any new ones ever reach the kind of critical mass needed to make an impact? Will the popularity of today’s languages remain frozen in time?

What’s the future of programming languages?

Before speculating further about the future, let’s touch base again where we are today. Modern high-level computer languages are really designed to do two things: create an abstraction layer that makes it easier to process data in a suitable fashion, and stop programmers from shooting themselves in the foot.
The first objective has been around since the days of Fortran and Cobol, aimed at processing scientific and business data respectively. The second objective emerged later, spurred in no small part by Edgar Dijkstra’s 1968 paper “Go To Statement Considered Harmful.” In this he argued for eliminating the ability for a programmer to make jumps to arbitrary points in their code. This restriction was to prevent so-called spaghetti code that makes it hard for a programmer to understand how a computer actually executes a given program. Instead, Dijkstra demanded that programmers bend to structural rules imposed by the language. Dijkstra’s argument ultimately won the day, and most modern languages do indeed minimize or eliminate Go Tos altogether in favor of structures like functions and other programmatic blocks.
These structures don’t exist at the level of the CPU. If you look at the instruction sets for Arm, x86, or RISC-V processors, the flow of a program is controlled by just three types of machine code instructions. These are conditional jumps, unconditional jumps, and jumps with a trace stored (so you can call a subroutine and return to where you started). In other words, it’s Go Tos all the way down. Similarly, strict data types designed to label and protect data from incorrect use dissolve into anonymous bits flowing in and out of memory.
So how much abstraction and anti-foot-shooting structure will a sufficiently-advanced coding AI really need? A hint comes from recent research in AI-assisted hardware design, such as Dall-EM, a generative AI developed at Princeton University used to create RF and electromagnetic filters. Designing these filters has always been something of a black art, involving the wrangling of complex electromagnetic fields as they swirl around little strips of metal. But Dall-EM can take in the desired inputs and outputs and spit out something that looks like a QR code. The results are something no human would ever design—but it works.
Similarly, could we get our AIs to go straight from prompt to an intermediate language that could be fed into the interpreter or compiler of our choice? Do we need high-level languages at all in that future? True, this would turn programs into inscrutable black boxes, but they could still be divided into modular testable units for sanity and quality checks. And instead of trying to read or maintain source code, programmers would just tweak their prompts and generate software afresh.
What’s the role of the programmer in a future without source code? Architecture design and algorithm selection would remain vital skills—for example, should a pathfinding program use a classic approach like the A* algorithm, or instead should it try to implement a new method? How should a piece of software be interfaced with a larger system? How should new hardware be exploited? In this scenario, computer science degrees, with their emphasis on fundamentals over the details of programming languages, rise in value over coding boot camps.
Will there be a Top Programming Language in 2026? Right now, programming is going through the biggest transformation since compilers broke onto the scene in the early 1950s. Even if the predictions that much of AI is a bubble about to burst come true, the thing about tech bubbles is that there’s always some residual technology that survives. It’s likely that using LLMs to write and assist with code is something that’s going to stick. So we’re going to be spending the next 12 months figuring out what popularity means in this new age, and what metrics might be useful to measure. What do you think popularity should mean? What metrics do you think we should consider? Let us know in the comments below.
"Dina Genkina" / 2025-09-24 a month ago / 未收藏/ spectrum发送到 kindle


There’s no such thing as a complete vacuum. Even in the cosmic void between galaxies, there’s an estimated density of about one hydrogen or helium atom per cubic meter. But these estimates are largely theoretical—no one has yet launched a sensor into intergalactic space and beamed back the result. On top of that, we have no means of measuring vacuums that low.
At least, not yet.
Researchers are now developing a new vacuum-measurement tool that may be able to detect lower densities than any existing techniques can. This new quantum sensor uses individual atoms, cooled to just shy of absolute zero, to serve as targets for stray particles to hit. These atom-based vacuum measurers can detect lower atomic concentrations than ever before, and they don’t require calibration, making them a good candidate to serve as a standard.
This article is part of our special report The Scale Issue.
“The atom was already our standard for time and frequency,” says Kirk Madison, professor of physics at the University of British Columbia (UBC), in Vancouver, and one of the pioneers of cold-atom-based vacuum-measurement technology. “Wouldn’t it be cool if we could make an atom the standard for vacuum measurement as well?”
This quantum-sensor technology promises a dual achievement in scale: Not only does it extend our ability to measure incredibly rarefied conditions with unprecedented sensitivity, it also establishes the fundamental reference point that defines the scale itself. By eliminating the need for calibration and serving as a primary standard, this atom-based approach doesn’t just measure the farthest edges of the density spectrum—it could become the very ruler by which all other vacuum measurements are compared.

Vacuum measurement on Earth

While humans haven’t yet succeeded in making vacuum as pure as it is in deep space, many earthly applications still require some level of emptiness. Semiconductor manufacturing, large physics experiments in particle and wave detection, some quantum-computing platforms, and surface-analysis tools, including X-ray photoelectron spectroscopy, all require so-called ultrahigh vacuum.
At these low levels of particles per unit volume, vacuum is parameterized by pressure, measured in pascals. Regular atmospheric pressure is 105 Pa. Ultrahigh vacuum is considered to be anything less than about 10-7 Pa. Some applications require as low as 10-9 Pa. The deepest depths of space still hold the nothingness record, reaching below 10-20 Pa.
The method of choice for measuring pressure in the ultrahigh vacuum regime is the ionization gauge. “They work by a fairly straightforward mechanism that dates back to vacuum tubes,” says Stephen Eckel, a member of the cold-atom vacuum-measurement team at the National Institute of Standards and Technology (NIST).

red light shining from a circular window in a metal vacuum chamber. A portable cold-atom vacuum-measurement tool [top] detects the fluorescence of roughly 1 million lithium atoms [bottom], and infers the vacuum pressure based on how quickly the fluorescence decays. Photos: Jayme Thornton

small dot of red light in the middle of a circular window.
Indeed, an ionization gauge has the same basic components as a vacuum tube. The gauge contains a heated filament that emits electrons into the chamber. The electrons are accelerated toward a positively charged grid. En route to the grid, the electrons occasionally collide with atoms and molecules flying around in the vacuum, knocking off their electrons and creating positively charged ions. These ions are then collected by a negatively charged electrode. The current generated by these positive ions is proportional to the number of atoms floating about in the vacuum, giving a pressure reading.
Ion gauges are relatively cheap (under US $1,000) and commonplace. However, they come with a few difficulties. First, although the current in the ion gauge is proportional to the pressure in the chamber, that proportionality constant depends on a lot of fine details, such as the precise geometry of the filament and the grid. The current cannot be easily calculated from the electrical and physical characteristics of the setup—ion gauges require thorough calibrations. “A full calibration run on the ion gauges is like a full month of somebody’s time,” says Daniel Barker, a physicist at NIST who’s also working on the cold-atom vacuum-measurement project.
Second, the calibration services provided by NIST (among others) calibrate down to only 10-7 Pa. Performance below that pressure is questionable, even for a well-calibrated gauge. What’s more, at lower pressures, the heat from the ion gauge becomes a problem: Hotter surfaces emit atoms in a process called outgassing, which pollutes the vacuum. “If you’re shooting for a vacuum chamber with really low pressures,” Madison says, “these ionization gauges actually work against you, and many people turn them off.”
Third, the reading on the ion gauge depends very strongly on the types of atoms or molecules present in the vacuum. Different types of atoms could produce readings that vary by up to a factor of four. This variance is fine if you know exactly what’s inside your vacuum chamber, or if you don’t need that precise a measurement. But for certain applications, especially in research settings, these concerns are significant.

How a cold-atom vacuum standard works

The idea of a cold-atom vacuum-measurement tool developed as a surprising side effect of the study of cold atoms. Scientists first started cooling atoms down in an effort to make better atomic clocks back in the 1970s. Since then, cooling atoms and trapping them has become a cottage industry, giving rise to optical atomic clocks, atomic navigation systems, and neutral-atom quantum computers.
These experiments have to be done in a vacuum, to prevent the surrounding environment from heating the atoms. For decades, the vacuum was thought of as merely a finicky factor to be implemented as well as possible. “Vacuum limitations on atom traps have been known since the dawn of atom traps,” Eckel says. Atoms flying around the vacuum chamber would collide with the cooled atoms and knock them out of their trap, leading to loss. The better the vacuum, the slower that process would go.

A glass cylinder with a coil inside it on a gray background. The most common vacuum-measurement tool in the high-vacuum range today is the ion gauge, basically a vacuum tube in reverse: A hot filament emits electrons that fly toward a positively charged grid, ionizing background atoms and molecules along the way. Jayme Thornton
UBC’s Kirk Madison and his collaborator James Booth (then at the British Columbia Institute of Technology, in Burnaby), were among the first to turn that thinking on its head back in the 2000s. Instead of battling the vacuum to preserve the trapped atoms, they thought, why not use the trapped atoms as a sensor to measure how empty the vacuum is?To understand how they did that, consider a typical cold-atom vacuum-measurement device. Its main component is a vacuum chamber filled with a vapor of a particular atomic species. Some experiments use rubidium, while others use lithium. Let’s call it lithium between friends.
A tiny amount of lithium gas is introduced into the vacuum, and some of it is captured in a magneto-optical trap. The trap consists of a magnetic field with zero intensity at the center of the trap, increasing gradually away from the center. Six laser beams point toward the center from above, below, the left, the right, the front, and the back. The magnetic and laser forces are arranged so that any lithium atom that might otherwise fly away from the center is most likely to absorb a photon from the lasers, getting a momentum kick back into the trap.
The trap is quite shallow, meaning that hot atoms—above 1 kelvin or so—will not be captured. So the result is a small, confined cloud of really cold atoms, at the center of the trap. Because the atoms absorb laser light occasionally to keep them in the trap, they also reemit light, creating fluorescence. Measuring this fluorescence allows scientists to calculate how many atoms are in the trap.
To use this setup to measure vacuum, you load the atoms into the magneto-optical trap and measure the fluorescence. Then, you turn off the light and hold the atoms in just the magnetic field. During this time, background atoms in the vacuum will chance upon the trapped atoms, knocking them out. After a little while, you turn the light back on and check how much the fluorescence has decreased. This measures how many atoms got knocked out, and therefore how many collisions occurred.
The reason you need the trap to be so shallow and the atoms to be so cold is that these collisions are very weak. “A few collisions are quite energetic, but most of the background gas particles fly by and, like, whisper to the trapped atom, and it just gently moves away,” Madison says.
This method has several advantages over the traditional ion-gauge measurement. The atomic method does not need calibration; the rate at which fluorescence dims depending on the vacuum pressure can be calculated accurately. These calculations are involved, but in a paper published in 2023 the NIST team demonstrated that the latest method of calculation shows excellent agreement with their experiment. Because this technique does not require calibration, it can serve as a primary standard for vacuum pressure, and even potentially be used to calibrate ion gauges.
The cold-atom measurement is also much less finicky when it comes to the actual contents of the vacuum. Whether the vacuum is contaminated with helium or plutonium, the measured pressure will vary by perhaps only a few percent, while the ion gauge sensitivity and reading for these particles might differ by an order of magnitude, Eckel says.
Cold atoms could also potentially measure much lower vacuum pressures than ion gauges can. The current lowest pressure they’ve reliably measured is around 10-9 Pa, and NIST scientists are working on figuring out what the lower boundary might be. “We honestly don’t know what the lower limit is, and we’re still exploring that question,” Eckel says.


A chart of vacuum pressures in the universe

No vacuum is completely empty. The degree to which vacuum pressure approaches pure nothingness is measured in pascals, with Earth’s atmosphere clocking in at 105 Pa and intergalactic space at a measly 10-20. In between, the new cold-atom vacuum gauges can measure further along the emptiness scale than the well-established ionization gauges can.

Sources: S. Eckel (cold-atom gauge, ionization gauge); K. Zou (molecular-beam epitaxy, chemical vapor deposition); L. Monteiro, “1976 Standard Atmosphere Properties” (Earth’s atmosphere); E.J. Öpik, Planetary and Space Science (1962) (Mars, moon atmosphere); A. Chambers, ‘Modern Vacuum Physics” (2004) (interplanetary and intergalactic space)
Of course, the cold-atom approach also has drawbacks. It struggles at higher pressure, above 10-7 Pa, so its applications are confined to the ultrahigh vacuum range. And, although there are no commercial atomic vacuum sensors available yet, they are likely to be much more expensive than ion gauges, at least to start.
That said, there are many applications where these devices could unlock new possibilities. At large science experiments, including LIGO (the Laser Interferometer Gravitational-Wave Observatory) and ones at CERN (the European Organization for Nuclear Research), well-placed cold-atom vacuum sensors could measure the vacuum pressure and also help determine where a potential leak might be coming from.
In semiconductor development, a particularly promising application is molecular-beam epitaxy (MBE). MBE is used to produce the few, highly pure semiconductor layers used in laser diodes and devices for high-frequency electronics and quantum technologies. The technique functions in ultrahigh vacuum, with pure elements in separate containers heated on one end of the vacuum. The elements travel across the vacuum until they hit the target surface, where they grow one layer at a time.
Precisely controlling the proportion of the ingredient elements is essential to the success of MBE. Normally, this requires a lot of trial and error, building up thin films and checking whether the proportions are correct, then adjusting as needed. With a cold-atom vacuum sensor, the quantity of each element emitted into the vacuum can be detected on the fly, greatly speeding up the process.
“If this technique could be used in molecular-beam epitaxy or other ultrahigh vacuum environments, I think it will really benefit materials development,” says Ke Zou, an assistant professor of physics at UBC who studies molecular-beam epitaxy. In these high-tech industries, researchers may find that the ability to measure nothing is everything.
This article appears in the October 2025 print issue.

"Gwendolyn Rak" / 2025-09-24 a month ago / 未收藏/ spectrum发送到 kindle


As AI tools become more common in people’s everyday work, researchers are looking to uncover its effects on the job market—especially for early career workers.
A paper from the Stanford Digital Economy Lab, part of the Stanford Institute for Human-Centered AI, has now found early evidence that employment has taken a hit for young workers in the occupations that use generative AI the most. Since the widespread adoption of AI tools began in late 2022, a split has appeared, and early-career software engineers are among the hardest hit.
The researchers used data from the largest payroll provider in the United States, Automatic Data Processing (ADP), to gain up-to-date employment and earning data for millions of workers across industries, locations, and age groups. While other data may take months to come out, the researchers published their findings in late August with data through July.
Although there has been a rise in demand for AI skills in the job market, generative AI tools are getting much better at doing some of the same tasks typically associated with early-career workers. What AI tools don’t have is the experiential knowledge gained through years in the workforce, which makes more senior positions less vulnerable.

These charts show how employment over time compares among early career, developing, and senior workers (all occupations). Each age group is divided into five groups, based on AI exposure, and normalized to 1 in October 2022—roughly when popular generative AI tools became available to the public.
The trend may be a harbinger for more widespread changes, and the researchers plan to continue tracking the data. “It could be that there are reversals in these employment declines. It could be that other age groups become more or less exposed [to generative AI] and have differing patterns in their employment trends. So we’re going to continue to track this and see what happens,” says Bharat Chandar, one of the paper’s authors and a postdoctoral fellow at the Stanford Digital Economy Lab. In the most AI “exposed” jobs, AI tools can assist with or perform more of the work people do on a daily basis.
So, what does this mean for engineers?

Software Developers Among Most AI-Exposed

With the rise of AI coding tools, software engineers have been the subject of a lot of discussion—both in the media and research. “There have been conflicting stories about whether that job is being impacted by AI, especially for entry level workers,” says Chandar. He and his colleagues wanted to find data on what’s happening now.
Since late 2022, early-career software engineers (between 22 and 30 years old) have experienced a decline in employment. At the same time, mid-level and senior employment has remained stable or grown. This is happening across the most AI-exposed jobs, and software engineering is a prime example.

Since late 2022, employment for early-career software developers has dropped. Employment for other age groups, however, has seen modest growth.
Chandar cautions that, for specific occupations, the trend may not be driven by AI alone; other changes in the tech industry could also be causing the drop. Still, the fact that it holds across industries suggests that there’s a real effect from AI.
The Stanford team also looked at a broader category of “computer occupations” based on the U.S. Bureau of Labor classifications—which includes hardware engineers, web developers, and more—and found similar results.

Growth in employment between October 2022 and July 2025 by age and AI exposure group. Quintiles 1-3 represent the lowest AI exposure groups, which experienced 6-13 percent growth. Quintiles 4-5 are the most AI-exposed jobs; employment for the youngest workers in these jobs fell 6 percent.

Augmentation vs. Automation

Part of the analysis uses data from the Anthropic Economic Index, which provides information about how Anthropic’s AI products are being used, including estimates of whether the types of queries used for certain occupations are more likely to automate work, potentially replacing employees, or augment an existing worker’s output.
With this data, the researchers were able to estimate whether an occupation’s use of AI generally complements employees’ work or replaces it. Jobs in which AI tools augment work did not see the same declines in employment, compared to roles involving tasks that could be automated.
This part of the analysis was based on Anthropic’s index alone. “Ideally, we would love to get more data on AI usage from the other AI companies as well, especially Open AI and Google,” Chandar says. (A recent paper from researchers at Microsoft did find that Copilot usage aligned closely with the estimates of AI exposure the Stanford team used.)
Going forward, the team also hopes to expand to data on employment outside of the United States.
"Gwendolyn Rak" / 2025-09-25 a month ago / 未收藏/ spectrum发送到 kindle


In 2017, Demis John noticed a staffing problem among the semiconductor companies in Santa Barbara. The area had about 28 small semiconductor companies at the time, many launched from the nanofabrication facility housed at University of California, Santa Barbara, where John works. But as these companies expand, “they are all headhunting the same 10 people, basically,” John says.
“It really was hindering their ability to scale. When you start up a company, you might have five or six highly educated people,” he says. “As [companies] get bigger and they go beyond the research devices, they really need technicians to start making more chips.… That’s where they often had these problems.”
This article is part of our special report The Scale Issue.
Now, following the CHIPS and Science Act of 2022 and increasing investment from companies like Intel and Taiwan Semiconductor Manufacturing Co., the United States is expecting a shortage of workers who can staff new facilities. In the next few years, tens of thousands of additional skilled workers will be needed across the semiconductor industry; in 2024, McKinsey & Co. estimated a talent gap between 59,000 and 146,000 engineers and technicians before the end of the decade. As the United States invests in reshoring chip manufacturing, the industry faces a dilemma: How can the semiconductor workforce scale to meet the coming demand?
Efforts to develop a strong workforce have grown, for example with government-funded initiatives from the Microelectronics Commons, a U.S. Department of Defense program that established eight hubs across the country to bridge research and manufacturing. (The National Semiconductor Technology Center was also established by the CHIPS Act in part for workforce development. However, in late August, the Commerce Department revoked funding from the nonprofit that was set up to administer the program.) Through a combination of federal programs, state funding, and private-sector partnerships, U.S. colleges and universities are working to increase talent.
To fill the gap, some universities—including UC Santa Barbara—are also offering microcredential programs separate from traditional degree programs. In these bite-size courses, which can be as short as a week or two, future engineers and technicians can gain critical hands-on experience in clean-room fundamentals or an introduction to topics like lithography or etching. Deploying short, standardized, and skill-based courses across the country could be an essential part of building a sustainable U.S. semiconductor workforce.

Developing Microcredentials

UC Santa Barbara launched its clean-room training in 2021, opening the university’s clean room to enrolled students as well as those from outside the university, including community college students and people looking to make a career change. Many universities already have clean rooms where they teach undergraduates about semiconductor fabrication, but students outside of a four-year degree program typically can’t access these facilities to gain the necessary training.
“There’s a big mismatch in culture between companies and city colleges and universities. They all want to solve the same problem, but they don’t actually understand each other’s needs that well,” John says. To him, the importance of these courses is in aligning the needs of the industry, students, and educational institutions.
While developing the UC Santa Barbara course, however, John was surprised to find there was no established educational standard for those wishing to enter the semiconductor workforce outside of a bachelor’s degree.

Scientist in cleanroom suit handling silicon wafers in a semiconductor manufacturing facility.A student at UC Santa Barbara loads wafers into a machine used for plasma etching. Ben Werner
Since then, he has collaborated with several other institutions and organizations working to implement a microcredential program developed by IEEE in partnership with the University of Southern California (USC) as part of California DREAMS (Defense Ready Electronics and Microdevices Superhub), funded by the DOD. Other programs also offer short training courses, but the standardization IEEE aims to provide is important for ensuring participants’ skills are widely recognized by employers across the country.
Initially, John aimed to address the shortage of technicians to help companies scale up production. But as the courses have expanded elsewhere, it has become clear that the same hands-on experience can be used for engineering students as well.
Students who take these introductory courses may go on to join the workforce or continue in their education to a bachelor’s or advanced degree. “The entire ladder of different workforce exits into the semiconductor industry is really important,” says John. The industry needs operators and technicians, who may seek employment right after high school, as well as Ph.D.-level engineers. “These microcredentials get somebody into the start of that workforce ladder.”

What the Semiconductor Industry Needs

Microcredentials assure employers that applicants have the skills needed to work in their fabs. A common misconception is that companies need students who have already been taught how to build their particular technology. But “it doesn’t matter exactly which specific device you made. What matters is that this person has had the experience of making some real chip,” John says. He compares it to carpentry: Someone who has spent time in a woodshop making furniture may not know how to frame a house, but “all the tools are basically the same. I know they can figure it out.”
So, in addition to specific skills, the course demonstrates a student’s ability to learn the processes—and tolerate the environment. With its loud machines, safety procedures, and protective bunny suits, the clean room isn’t a typical workplace. Having students experience that environment lowers the risk of employers hiring someone who dislikes it.

“It doesn’t matter exactly which specific device you made. What matters is that this person has had the experience of making some real chip.” —Demis John
The course has students spend several days in a clean room, which is more likely than a single clean-room day to filter out participants who wouldn’t last. That’s important for companies that invest a lot of resources in hiring and training new people, notes the University of Washington’s Darick Baker, who serves as acting director of the Washington Nanofabrication Facility, in Seattle.

Can Hands-On Courses Scale Up?

The hands-on experience is a critical part of semiconductor microcredential programs, because companies want employees who are excited about building things. But it also inherently limits how many students can enroll at once. “If I can handle 12 students at a time, maybe there’s the pathway to 100 students a year. But that’s not the numbers we need,” says Baker.
Instead, scalability will likely come from offering courses more frequently, and at more universities. Many universities already have a clean room and courses for university students, John says, so the goal was to make it easy for universities to adapt programs already in place to fit with the microcredential program. This also requires training of the instructors. USC, for example, offers a microcredential for instructors themselves in a “train the trainer” model.
For 10 years, Baker has run clean-room training courses during which students make a diode. He became excited about the possibility of awarding students IEEE’s professional microcredentials as a way to give students an advantage in the job market.
Baker visited USC and UC Santa Barbara to observe their programs and realized they were already quite similar to his. With a few small changes, he could make his program meet the requirements for IEEE microcredentials. His hope is that “somebody can look at that credential and say, maybe this person doesn’t know everything about working at a fab, but they spent one week gowned-up in a bunny suit. They’re not going to quit in that first month because they can’t handle being in the lab.”
Currently, these programs may have significance mostly to local employers. But “nationally, it starts to take meaning when you have a critical mass of universities that are offering these credentials,” says Baker. “The more universities we can get on board with this, the more meaning that credential has.”
"Evan Ackerman" / 2025-09-25 a month ago / 未收藏/ spectrum发送到 kindle


A critical vulnerability in the Bluetooth Low Energy (BLE) Wi-Fi configuration interface used by several different Unitree robots can result in a root level takeover by an attacker, security researchers disclosed on 20 September. The exploit impacts Unitree’s Go2 and B2 quadrupeds and G1 and H1 humanoids. Because the vulnerability is wireless, and the resulting access to the affected platform is complete, the vulnerability becomes wormable, say the researchers, meaning “an infected robot can simply scan for other Unitree robots in BLE range and automatically compromise them, creating a robot botnet that spreads without user intervention.”
Initially discovered by security researchers Andreas Makris and Kevin Finisterre, UniPwn takes advantage of several security lapses that are still present in the firmware of Unitree robots as of 20 September, 2025. As far as IEEE Spectrum is aware, this is the first major public exploit of a commercial humanoid platform.

Unitree Robots’ BLE Security Flaw Exposed

Like many robots, Unitree’s robots use an initial BLE connection to make it easier for a user to set up a Wi-Fi network connection. The BLE packets that the robot accepts are encrypted, but those encryption keys are hardcoded and were published on X (formerly Twitter) by Makris in July. Although the robot does validate the contents of the BLE packets to make sure that the user is authenticated, the researchers say that all it takes to become an authenticated user is to encrypt the string ‘unitree’ with the hardcoded keys and the robot will let someone in. From there, an attacker can inject arbitrary code masquerading as the Wi-Fi SSID and password, and when the robot attempts to connect to Wi-Fi, it will execute that code without any validation and with root privileges.
“A simple attack might be just to reboot the robot, which we published as a proof-of-concept,” explains Makris. “But an attacker could do much more sophisticated things: It would be possible to have a trojan implanted into your robot’s startup routine to exfiltrate data while disabling the ability to install new firmware without the user knowing. And as the vulnerability uses BLE, the robots can easily infect each other, and from there the attacker might have access to an army of robots.”
Makris and Finisterre first contacted Unitree in May in an attempt to responsibly disclose this vulnerability. After some back and forth with little progress, Unitree stopped responding to the researchers in July, and the decision was made to make the vulnerability public. “We have had some bad experiences communicating with them,” Makris tells us, citing an earlier backdoor vulnerability he discovered with the Unitree Go1. “So we need to ask ourselves—are they introducing vulnerabilities like this on purpose, or is it sloppy development? Both answers are equally bad.” Unitree has not responded to a request for comment from IEEE Spectrum as of press time.
“Unitree, as other manufacturers do, has simply ignored prior security disclosures and repeated outreach attempts,” says Víctor Mayoral-Vilches, the founder of robotics cybersecurity company Alias Robotics. “This is not the right way to cooperate with security researchers.” Mayoral-Vilches was not involved in publishing the UniPwn exploit, but he has found other security issues with Unitree robots, including undisclosed streaming of telemetry data to servers in China which could potentially include audio, visual, and spatial data.
Mayoral-Vilches explains that security researchers are focusing on Unitree primarily because the robots are available and affordable. This makes them not just more accessible for the researchers, but also more relevant, since Unitree’s robots are already being deployed by users around the world who are likely not aware of the security risks. For example, Makris is concerned that the Nottinghamshire Police in the UK have begun testing a Unitree Go2, which can be exploited by UniPwn. “We tried contacting them and would have disclosed the vulnerability upfront to them before going public, but they ignored us. What would happen if an attacker implanted themselves into one of these police dogs?”

How to Secure Unitree Robots

In the short term, Mayoral-Vilches suggests that people using Unitree robots can protect themselves by only connecting the robots to isolated Wi-Fi networks and disabling their Bluetooth connectivity. “You need to hack the robot to secure it for real,” he says. “This is not uncommon and why security research in robotics is so important.”
Both Mayoral-Vilches and Makris believe that fundamentally it’s up to Unitree to make their robots secure in the long term, and that the company needs to be much more responsive to users and security researchers. But Makris says: “There will never be a 100 percent secure system.”
Mayoral-Vilches agrees. “Robots are very complex systems, with wide attack surfaces to protect, and a state-of-the-art humanoid exemplifies that complexity.”
Unitree, of course, is not the only company offering complex state-of-the-art quadrupeds and humanoids, and it seems likely (if not inevitable) that similar exploits will be discovered in other platforms. The potential consequences here can’t be overstated—the idea that robots can be taken over and used for nefarious purposes is already a science fiction trope, but the impact of a high-profile robot hack on the reputation of the commercial robotics industry is unclear. Robots companies are barely talking about security in public, despite how damaging even the perception of an unsecured robot might be. A robot that is not under control has the potential to be a real physical danger.
At the IEEE Humanoids Conference in Seoul from 30 September to 2 October, Mayoral-Vilches has organized a workshop on Cybersecurity for Humanoids, where he will present a brief (co-authored with Makris and Finisterre) titled Humanoid Robots as Attack Vectors. Despite the title, their intent is not to overhype the problem but instead to encourage roboticists (and robotics companies) to take security seriously, and not treat it as an afterthought. As Mayoral-Vilches points out, “robots are only safe if secure.”
"Liquid Instruments" / 2025-09-25 a month ago / 未收藏/ spectrum发送到 kindle


In this webinar, we will explore efficient, accurate, and scalable techniques for analog and mixed-signal device testing using reconfigurable test setups. As semiconductor devices grow more complex, engineers face the challenge of validating performance and catching edge cases under tight schedules. Test setups often include oscilloscopes, waveform generators, network analyzers, and more, potentially from different vendors with unique automation and configuration considerations. In order to keep pace with semiconductor validation requirements, multi-channel test setups designed for flexibility and performance can help engineers scale effectively.
Register now for this free webinar!
"Evan Ackerman" / 2025-09-26 a month ago / 未收藏/ spectrum发送到 kindle


Video Friday is your weekly selection of awesome robotics videos, collected by your friends at IEEE Spectrum robotics. We also post a weekly calendar of upcoming robotics events for the next few months. Please send us your events for inclusion.
CoRL 2025: 27–30 September 2025, SEOUL
IEEE Humanoids: 30 September–2 October 2025, SEOUL
World Robot Summit: 10–12 October 2025, OSAKA, JAPAN
IROS 2025: 19–25 October 2025, HANGZHOU, CHINA
Enjoy today’s videos!
Gemini Robotics 1.5 is our most capable vision-language-action (VLA) model that turns visual information and instructions into motor commands for a robot to perform a task. This model thinks before taking action and shows its process, helping robots assess and complete complex tasks more transparently. It also learns across embodiments, accelerating skill learning.


[ Google DeepMind ]

A simple “force pull” gesture brings Carter straight into her hand. This is a fantastic example of how an intuitive interaction can transform complex technology into an extension of our intent.


[ Robust.ai ]

I can’t help it, I feel bad for this poor little robot.


[ Urban Robotics Laboratory, KAIST ]

Hey look, no legs!


[ Kinisi Robotics ]

Researchers at the University of Michigan and Shanghai Jiao Tong University have developed a soft robot that can crawl along a flat path and climb up vertical surfaces using its unique origami structure. The robot can move with an accuracy typically seen only in rigid robots.


[ University of Michigan Robotics ]

Unitree G1 has learned the “Anti-Gravity” mode: stability is greatly improved under any action sequence, and even if it falls, it can quickly get back up.


[ Unitree ]

Kepler Robotics has commenced mass production of the K2 Bumblebee, the world’s first commercially available humanoid robot powered by Tesla’s hybrid architecture.


[ Kepler Robotics ]

Reinforcement learning (RL)-based legged locomotion controllers often require meticulous reward tuning to track velocities or goal positions while preserving smooth motion on various terrains. Motion imitation methods via RL using demonstration data reduce reward engineering but fail to generalize to novel environments. We address this by proposing a hierarchical RL framework in which a low-level policy is first pre-trained to imitate animal motions on flat ground, thereby establishing motion priors. Real-world experiments with an ANYmal-D quadruped robot confirm our policy’s capability to generalize animal-like locomotion skills to complex terrains, demonstrating smooth and efficient locomotion and local navigation performance amidst challenging terrains with obstacles.


[ ETHZ RSL ]

I think we have entered the ‘differentiation-through-novelty’ phase of robot vacuums.


[ Roborock ]

In this work, we present Kinethreads: a new full-body haptic exosuit design built around string-based motor-pulley mechanisms, which keeps our suit lightweight (<5kg), soft and flexible, quick-to-wear (<30 seconds), comparatively low-cost (~$400), and yet capable of rendering expressive, distributed, and forceful (up to 120N) effects.


[ ACM Symposium on User Interface and Software Technology ]

In this episode of the IBM AI in Action podcast, Aaron Saunders, CTO of Boston Dynamics, delves into the transformative potential of AI-powered robotics, highlighting how robots are becoming safer, more cost-effective and widely accessible through Robotics as a Service (RaaS).


[ IBM ]

This CMU RI Seminar is by Michael T. Tolley from UCSD, on ‘Biologically Inspired Soft Robotics.’


Robotics has the potential to address many of today’s pressing problems in fields ranging from healthcare to manufacturing to disaster relief. However, the traditional approaches used on the factory floor do not perform well in unstructured environments. The key to solving many of these challenges is to explore new, non-traditional designs. Fortunately, nature surrounds us with examples of novel ways to navigate and interact with the real world. Dr. Tolley’s Bioinspired Robotics and Design Lab seeks to borrow the key principles of operation from biological systems and apply them to robotic design.
[ Carnegie Mellon University Robotics Institute ]

"Julianne Pepitone" / 2025-09-27 a month ago / 未收藏/ spectrum发送到 kindle


“How did we get here?”
That existential question about the universe has captivated humankind for centuries. Many scientists have attempted to answer it, including the Rev. Georges Lemaître, a Belgian cosmologist and Catholic priest. In 1927 he theorized that the universe was created from a single particle he called the “primeval atom.”
That atom later disintegrated in an explosion, LeMaître figured, creating space, time, and an ever-expanding universe, according to the American Museum of Natural History.
LeMaître’s idea likely sounds familiar, as it is now known as the big bang theory. Direct evidence for the theory wasn’t found until almost four decades later, entirely by accident.
Bell Labs researchers Arno Penzias and Robert Woodrow Wilson were conducting radio astronomy experiments in 1964 using a horn antenna located on the company’s campus in Holmdel, N.J. The reflector antenna was the most sensitive in the world at the time. It was constructed to pick up weak radio signals from space for Project Echo, NASA’s experimental 1960 satellite communications program. The project successfully did so twice, first in 1961 through the passive Echo communication satellite, and a second time in 1963 through the active Telstar communications satellite.
While Penzias and Wilson were using the Holmdel antenna to map radio signals from the Milky Way, it picked up a mysterious buzzing noise that wouldn’t go away despite their attempts to eliminate it.


The signals, which persisted day and night, turned out to be cosmic microwave background radiation that permeates the universe—a remnant from the creation of the cosmos—that helped confirm the big bang theory. The accidental breakthrough earned Penzias and Wilson the 1978 Nobel Prize in Physics.
Project Echo, Telstar, and the discovery of the cosmic microwave background radiation were recognized as an IEEE Milestone at a ceremony held on 25 May in Holmdel at Wilson Park, where the horn antenna is located.
Penzias and Wilson’s evidence for the big bang theory shaped “our understanding of this universe and our place in it,” Thomas Coughlin, 2024 IEEE president, said in a news release about the dedication.
“Cosmic background radiation, one of the most transformative discoveries in the second half of the 20th century, has also led to non-terrestrial communication innovations that address some of the world’s greatest needs, including disaster relief aid,” Coughlin said.

Building the world’s most sensitive antenna

After the Soviet Union in 1957 launched Sputnik, the world’s first artificial satellite put into low Earth orbit, the U.S. government increased its efforts to fund the development of non-terrestrial communication innovations, as detailed in an Engineering and Technology History Wiki entry.
Government and industry worked together on initiatives at laboratories around the country. One of the first programs was Project Echo, which aimed to achieve two-way voice communication between NASA’s Jet Propulsion Laboratory in Goldstone, Calif., and Crawford Hill in Holmdel, 5 kilometers from the Bell Labs complex.

Three men looking into a satellite balloon during inflation tests.Langley engineers (from right): Norman Crabill, Edwin Kilgore, and an unidentified man take a peek inside the vast balloon during inflation tests of the Echo 1 Satellite in Weeksville, N.C.NASA
To make the communication possible, project leads developed and built the horn antenna on the Bell Labs site. The antenna was 15.24 meters long by 6.1 meters wide, weighing in at 16,329 kilograms. It funneled radio waves in or out of the horn shape, and the reflector bounced the waves into a single focused beam—similar to a huge metal megaphone pointing into a curved mirror. Despite its large size, the machine could be precisely aimed.
Unlike other antennas that are tuned to only one frequency, the Holmdel antenna worked across a wide band of frequencies, so it could pick up several types of radio signals. It also could handle radio waves moving in linear or circular paths.
The design accounted for the potential need to eliminate unwanted noise from the environment.
The receiver was placed at the horn’s apex, eliminating the need for a connecting line, which could result in external noise and signal loss.
The antenna allowed Project Echo to complete the first high-quality long-distance voice circuit in 1961 through its namesake’s passive communication satellite, Echo. A similar experiment was successfully completed two years later through the Telstar satellite, according to the proposal for the IEEE Milestone.
In 1964 Penzias and Wilson began using the Holmdel antenna to perform their own radio astronomy experiments.

What’s that buzzing sound?

The duo was trying to map weak radio signals from the Milky Way. They took pains to eliminate external noise from the ground, the environment, and the antenna itself so that their readings would not be affected. They even suppressed interference from the receiver on the antenna by cooling it with liquid helium to -269 °C—only 4 degrees above absolute zero, the theoretical temperature at which all motion stops.
Yet they kept hearing a persistent buzz. It was low, steady, and 100 times more intense than the researchers would expect for interference noise—and it was coming from all directions in space.
Penzias and Wilson redoubled their efforts to eliminate the interference, painstakingly retesting their equipment.

Penzias and Wilson’s evidence for the big bang theory shaped “our understanding of this universe and our place in it.” —Thomas Coughlin, 2024 IEEE president
“They went so far as to take rags and detergents to carefully wash the antenna from the droppings of a pair of pigeons that had nested there,” Leonardo Colletti told IEEE Spectrum in a 2023 article about the discovery. Colletti is a physics professor at the Free University of Bozen-Bolzano, in Italy.
But even after all the duo’s work, the mysterious buzz continued.
After Penzias and Wilson had accounted for everything, including the pigeon poop, they concluded that the radiation they detected could not have come from the Earth, the sun, or anything else in the galaxy.
They later learned that researchers and astrophysicists Robert H. Dicke, P. James Peebles, and David Todd Wilkinson at Princeton University predicted the existence of cosmic microwave background noise, which “they believed would have resulted from the big bang,” according to an entry on the Nokia Bell Labs website.
“As it turned out,” the article says, “the radiation detected by Penzias and Wilson was a perfect match for what the Princeton researchers had predicted.”

Saving the horn antenna

In 1989 the Holmdel antenna was named a national historic landmark. But in 2021 Nokia, which had acquired Bell Labs, sold the 43-acre area to technology entrepreneur Rakesh Antala.
The following year, the Holmdel planning board voted to undertake a study to consider reclassifying the site as an area in need of redevelopment.

Three people, one woman on the left and two men, standing in front of a horn-shaped antenna.[From left] Holmdel Deputy Mayor Kim LaMountain, former Bell Labs researcher Giovanni Vannucci, and 2024 IEEE President Tom Coughlin celebrating the Milestone dedication in front of the Horn Antenna in Holmdel, N.J.Bala Prasanna
That put the landmark at risk of being demolished, IEEE Spectrum reported.
The local community banded together, launching a publicity campaign and an online petition to save the antenna. The township ultimately secured ownership of the horn antenna site following an extensive legal process. Last year it dedicated the site as Dr. Robert Wilson Park, honoring it as the place where “we gained a critical understanding of the birth of our universe.”
A plaque recognizing the IEEE Milestone designation is displayed in the lobby of the AT&T Labs Science and Technology Center in Middletown, N.J., which is about 7 kilometers from Crawford Hill. The plaque reads:
In 1959–1960, NASA and AT&T developed a satellite Earth station in Holmdel, N.J., including a novel tracking horn-reflector antenna, maser preamplifier, and FM demodulator. The Earth station demonstrated the first high-quality long-distance voice circuit via the Echo passive communication satellite in 1960–1961, and via the active Telstar communications satellite in 1962–1963. Experiments conducted in 1964–1965 provided the first indication of the cosmic background radiation associated with the Big Bang.
The IEEE New Jersey Coast Section and the IEEE Photonics Society sponsored the nomination.
Administered by the IEEE History Center and supported by donors, the Milestone program recognizes outstanding technical developments around the world.

作者:Dirk-jan Mollema 原文链接:https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ 在为今年7月的Black Hat和DEF CON演讲做准备时,我发现了一个可能是我职业生涯中最为严重的Entra ID漏洞。该漏洞足以让我攻陷全球所有的Entra ID租...
2025-09-22 a month ago / 未收藏/ seebug发送到 kindle
作者:Abhishek Goswami 译者:知道创宇404实验室翻译组 原文链接:https://arxiv.org/html/2509.13597v1 摘要 自主大型语言模型(LLM)智能体每小时可发起数千次API调用,且无需人工监督。OAuth 2.0协议假设客户端具有确定性,但在智能体场景中,随机性推理、提示注入或多智能体协同可能会悄无声息地扩大权限范围。本文提出智能体JWT(A...
2025-09-24 a month ago / 未收藏/ seebug发送到 kindle
作者:Landon Bragg, Nathan Dorsey, Josh Prior 译者:知道创宇404实验室翻译组 原文链接:https://arxiv.org/html/2509.10543v1 摘要 分布式拒绝服务(DDoS)攻击仍是在线基础设施面临的严重威胁,攻击者常通过细微改变流量模式绕过检测系统。本文提出一种结合网络数据蜂巢图序列与3D卷积神经网络(3D CNN)的方法,实现对...
2025-09-25 a month ago / 未收藏/ seebug发送到 kindle
作者:Pavan Reddy1, Aditya Sanjay Gujral1 译者:知道创宇404实验室翻译组 原文链接:https://arxiv.org/html/2509.10540v1 摘要 大型语言模型(LLM)助手正日益融入企业工作流,由于其连接内部与外部数据源,新的安全问题也随之浮现。本文深入分析了EchoLeak(CVE-2025-32711)这一案例,它是微软365 Cop...
2025-09-26 a month ago / 未收藏/ seebug发送到 kindle
作者:Moran Feldman, Amin Karbasi 译者:知道创宇404实验室翻译组 原文链接:https://arxiv.org/html/2509.18383v1 摘要 前沿人工智能模型实验室近期发布的公告显示,其模型在高中和本科数学竞赛中取得了优异成绩。然而,大型语言模型能否在更高级的数学领域解决新的简单猜想,目前仍不明确。为此,我们提出“哥德尔测试”:评估模型能否为极简单且...
2025-09-27 a month ago / 未收藏/ crossoverjie发送到 kindle
前段时间碰到一个 StarRocks 物化视图的 bug: https://github.com/StarRocks/starrocks/issues/55301
但是这个问题只能在存算分离的场景下才能复现,为了找到问题原因我便尝试在本地搭建一个可以 Debug 的存算分离版本。
之前也分享过在本地 Debug StarRocks,不过那是存算一体的版本,而存算分离稍微要复杂一些。
这里提到的本地 Debug 主要是指可以调试 FE,而 CN/BE 则是运行在容器环境,避免本地打包和构建运行环境。


当前 StarRocks 以下的存算分离部署方式,在本地推荐直接使用 MinIO 部署。

启动 MinIO

首先第一步启动 MinIO:
1
2
3
4
5
6
7
8
docker run -d --rm --name minio \
-e MINIO_ROOT_USER=miniouser \
-e MINIO_ROOT_PASSWORD=miniopassword \
-p 9001:9001 \
-p 9000:9000 \
--entrypoint sh \
minio/minio:latest \
-c 'mkdir -p /minio_data/starrocks && minio server /minio_data --console-address ":9001"'
进入 MinIO 容器设置 access token:
1
2
docker exec -it minio sh
mc alias set myminio http://10.0.9.20:9000 miniouser miniopassword; mc admin user svcacct add --access-key AAAAAAAAAAAAAAAAAAAA --secret-key BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB myminio miniouser

启动 cn:

1
docker run -p 9060:9060 -p 8040:8040 -p 9050:9050 -p 8060:8060 -p 9070:9070 -itd --rm --name cn -e "TZ=Asia/Shanghai" starrocks/cn-ubuntu:3.4-latest
修改 cn.conf :
1
2
cd cn/config/
echo "priority_networks = 10.0.9.20/24" >> cn.properties
使用脚本手动启动 cn:
1
bin/start_cn.sh --daemon
使用以下配置在本地 IDEA 中启动 FE:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
LOG_DIR = ${STARROCKS_HOME}/log  

DATE = "$(date +%Y%m%d-%H%M%S)"

sys_log_level = INFO

http_port = 8030
rpc_port = 9020
query_port = 9030
edit_log_port = 9010
mysql_service_nio_enabled = true

run_mode = shared_data
cloud_native_storage_type = S3
aws_s3_endpoint = 10.0.9.20:9000
# set the path in MinIO
aws_s3_path = starrocks
# credentials for MinIO object read/write
# 这里的 key 为刚才设置的 access token
aws_s3_access_key = AAAAAAAAAAAAAAAAAAAA
aws_s3_secret_key = BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
aws_s3_use_instance_profile = false
aws_s3_use_aws_sdk_default_behavior = false
# Set this to false if you do not want default
# storage created in the object storage using
# the details provided above
enable_load_volume_from_conf = true

# 本机 IP,需要与 cn 中的配置对齐
priority_networks = 10.0.9.20/24
启动 FE 之前最好先删除 meta/. 下的所有元数据文件然后再启动。

添加 CN 节点

FE 启动成功之后连接上 FE,然后手动添加 CN 节点。
1
2
ALTER SYSTEM ADD COMPUTE NODE "127.0.0.1:9050";
show compute nodes;

然后就可以创建存算分离的表了。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
CREATE TABLE IF NOT EXISTS par_tbl1
(
datekey DATETIME,
k1 INT,
item_id STRING,
v2 INT
)PRIMARY KEY (`datekey`,`k1`)
PARTITION BY date_trunc('day', `datekey`)
PROPERTIES (
"compression" = "LZ4",
"datacache.enable" = "true",
"enable_async_write_back" = "false",
"enable_persistent_index" = "true",
"persistent_index_type" = "LOCAL",
"replication_num" = "1",
"storage_volume" = "builtin_storage_volume"
);
最终其实是参考官方提供的 docker-compose 的编排文件进行部署的:
https://raw.githubusercontent.com/StarRocks/demo/master/documentation-samples/quickstart/docker-compose.yml

如果只是想在本地搭建一个存算分离的版本,可以直接使用这个 docker compose.

其中有两个坑需要注意:

创建表超时

建表出现超时,提示需要配置时间:
1
admin set frontend config("tablet_create_timeout_second"="50")
配置也不能解决问题,依然会超时,可以看看本地是否有开启代理,尝试关闭代理试试看。

unknown compression type(0) backend [id=10002]

不支持的压缩类型:这个问题我在使用 main 分支的 FE 与最新的 starrocks/cn-ubuntu:3.4-latest 的镜像会触发,当我把 FE 降低到具体到 tag 分支,比如 3.3.9 的时候就可以了。
具体原因就没有细究了,如果要本地 debug 使用最新的 tag 也能满足调试的需求。
参考链接:
2025-09-27 a month ago / 未收藏/ crossoverjie发送到 kindle
之前写过一篇 StarRocks 开发环境搭建踩坑指北之存算分离篇讲解如何在本地搭建一个可以 debug 的存算分离版本。
但最近在本地调试一个场景,需要 CN 节点是以集群的方式启动,我还是按照老方法通过 docker 启动 CN,然后 export 端口的方式让 FE 进行绑定。
比如用以下两个命令可以启动两个 CN 节点。
1
docker run -p 9060:9060 -p 8040:8040 -p 9050:9050 -p 8060:8060 -p 9070:9070 -itd --rm --name cn -e "TZ=Asia/Shanghai" starrocks/cn-ubuntu:3.5.2
1
docker run -p 9061:9060 -p 8041:8040 -p 9051:9050 -p 8061:8060 -p 9071:9070 -itd --rm --name cn2 -e "TZ=Asia/Shanghai" starrocks/cn-ubuntu:3.5.2
然后按照之前的方式在 FE 中手动绑定这两个节点:
1
2
3
ALTER SYSTEM ADD COMPUTE NODE "127.0.0.1:9050";  
ALTER SYSTEM ADD COMPUTE NODE "127.0.0.1:9051";
show compute nodes;

此时会出现新增的第二个节点的状态有问题,比如 metrics 取不到,workerId 是-1(-1 代表节点创建失败了,默认值是 -1)


经过 debug 发现是在添加节点的时候,由于生成的 workerIpPort 与上一个节点相同(127.0.0.1:9060) 从而导致这个节点被跳过了。

也就是说我这两个 CN 节点不能是相同的 IP(用不同的端口来区分)。
解决这个问题有以下几个办法:
  • 再找一个台机器来跑 CN2 节点
  • 启动一个虚拟机来跑 CN2 节点
  • 使用 docker compose 来启动 CN 集群,会在集群内自动分配不同的 IP
  • 利用 Docker Bridge 创建一个虚拟网络,由他来分配 IP
第一种方案直接 Pass 了,我手上没有多余的设备。
第二种方案倒是可以直接用 OrbStack 启动一个 VM,但是还不如后面的 docker 来的轻量,此外还需要我安装运行环境,也 pass 了。
第三种方案看似可行,但也比较繁琐,由于 CN 给 docker compose 管理了,FE 要和 CN 网络打通也得在 docker compose 里运行,这样我 Debug 就不方便了,更别提如果需要频繁修改源码的情况。
甚至每次修改代码后都得重新打包上传镜像,以及开启 remote debug,非常麻烦。

这么看来就第四种方案最为合适了。

使用 Docker Bridge 网络

我们可以使用 Docker Bridge 创建一个虚拟网络,使用这个虚拟网络启动的镜像会自动分配自定义范围的 IP;同时本地启动的 FE 也能直接访问。
1
docker network create --subnet=172.18.0.0/16 --gateway=172.18.0.1 my_custom_net
首先用 docker 创建一个 network。
  • --subnet=172.18.0.0/16: 定义网络的 IP 地址范围。这里我们使用了 172.18.x.x 这个私有网段。
  • --gateway=172.18.0.1: 指定这个网络的网关地址。
之后我们就可以使用这个虚拟网络来启动容器了。
1
2
3
docker run --ip 172.18.0.20 --net my_custom_net -p 9060:9060 -p 8040:8040 -p 9050:9050 -p 8060:8060 -p 9070:9070 -itd --rm --name cn -e "TZ=Asia/Shanghai" starrocks/cn-ubuntu:3.5.2

docker run --ip 172.18.0.30 --net my_custom_net -p 9061:9060 -p 8041:8040 -p 9051:9050 -p 8061:8060 -p 9071:9070 -itd --rm --name cn2 -e "TZ=Asia/Shanghai" starrocks/cn-ubuntu:3.5.2
这样这两个容器就会被分配不同的 IP,并且网络和宿主机也是互通的。
需要注意的是这里的子网尽量选择 172.16.0.0 到 172.31.255.255 这个 IP 段,192.168.0.0 到 192.168.255.255 这个范围段很有可能家里或公司的路由器占用了。
而这里的网关 --gateway=172.18.0.1地址也需要在我们自定义的 IP 范围里。
同时我们也不需要在这两个容器内为 CN 指定 priority_networks 参数了。
同理 minio 也得使用这个虚拟网络启动:
1
2
3
4
5
6
7
8
9
10
docker run -d --rm --name minio \
--ip 172.18.0.10 \
--net my_custom_net \
-e MINIO_ROOT_USER=miniouser \
-e MINIO_ROOT_PASSWORD=miniopassword \
-p 9001:9001 \
-p 9000:9000 \
--entrypoint sh \
minio/minio:latest \
-c 'mkdir -p /minio_data/starrocks && minio server /minio_data --console-address ":9001"'
设置 token 的时候也要指定对应的 IP:
1
mc alias set myminio http://172.18.0.10:9000 miniouser miniopassword; mc admin user svcacct add --access-key AAAAAAAAAAAAAAAAAAAA --secret-key BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB myminio miniouser
当 CN 和 minio 都启动之后,我们在 FE 里手动绑定这两个 CN 节点:
1
2
ALTER SYSTEM ADD COMPUTE NODE "172.18.0.20:9050";
ALTER SYSTEM ADD COMPUTE NODE "172.18.0.30:9050"
这样这两个节点就可以绑定成功了。
#Blog
"The Conversation" / 2025-09-23 a month ago / 未收藏/ studyfinds发送到 kindle
Conceptual image showing engineers inspect small micro modular nuclear reactor loaded on transport truck for installation at industrial energy facility.Nuclear microreactors, by contrast, could sit on land the size of a football field and power a whole town.
The post Nuclear In Your Backyard? Tiny Reactors Could One Day Power Towns And Campuses appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-24 a month ago / 未收藏/ studyfinds发送到 kindle
silhouette of a human head with a tree as the brainFor decades, many scientists assumed that human consciousness depends mainly on the brain’s newest and most complex regions. A wide-ranging review by Peter Coppola, a researcher at the University of Cambridge, suggests otherwise: awareness may rest on the brain’s oldest structures.
The post Your ‘Lizard Brain’ May Actually Oversee Your Consciousness appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-24 a month ago / 未收藏/ studyfinds发送到 kindle
An older woman having a mammogram to check for breast cancerNew research suggests that mammograms may continue to benefit women in their eighties, a group often excluded from cancer screening guidelines.
The post Mammograms After 80 Linked To Longer Breast Cancer Survival appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-24 a month ago / 未收藏/ studyfinds发送到 kindle
VenusAstronomers warn that Venus’s orbital neighborhood may hide large space rocks that slip past Earth’s telescopes. In A Nutshell SÃO PAULO — Scientists have spotted a major blind spot in how we watch for dangerous asteroids. New research shows that space rocks orbiting near Venus stay hidden from Earth’s telescopes,…
The post Undiscovered Venus Asteroids Could Pose City-Destroying Threat To Earth appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-24 a month ago / 未收藏/ studyfinds发送到 kindle
Taylor Swift attends the Red Carpet at the 2018 Billboards Music Awards at the MGM Grand Arena in Las Vegas on May 20, 2018.A study by researchers at the University of Minnesota shows that Taylor Swift's accent shifted noticeably during different phases of her career, picking up features of a Southern drawl in Nashville before those traits disappeared when she moved north. Later, in New York, her voice pitch became lower.
The post Fake Muse? How Taylor Swift’s Accent Significantly Shifted With Her Career (And Location) appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-24 a month ago / 未收藏/ studyfinds发送到 kindle
Man going to the bathroom at nightA quick glance at the color of your urine after you wake up could reveal more about your day than you realize.
The post Your Morning Urine Color May Signal How Your Body Handles Stress appeared first on Study Finds.
"The Conversation" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Jewish students, supporters and University of Toronto faculty attend Rally Against Hate, in support of Jewish and pro-Israel students and staff.It’s been nearly two years since Hamas’ Oct. 7, 2023, attack on Israel and the subsequent start of the Israel-Hamas war – and still, antisemitism shows no sign of abating as one of the thorniest issues at American colleges and universities.
The post Campus Antisemitism: Hostility Towards Jews Persists Despite Students And Faculty Rejecting Extremist Views appeared first on Study Finds.
"The Conversation" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Michelangelo, The Last Judgment (Fresco, Sistine Chapel Altar Wall), between 1536 and 1541If you believe that the end of the world is at hand, then you really need to know what the rapture is.
The post What Is The Rapture, And Why Does TikTok Believe The End Is Coming Soon? appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
A glass of white wineA sweeping new study of over half a million people across two continents has delivered a stark message about alcohol and brain health: even light drinking may raise dementia risk.
The post Why That Evening Glass Of Wine May Harm Your Brain More Than You Realize appeared first on Study Finds.
"The Conversation" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Acupuncture for neck and back painLower back pain is the leading cause of disability worldwide, yet most treatments offer limited relief.
The post Acupuncture vs. Holistic Therapies: Which Works Better For Lower Back Pain? appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Image of the MoonFor centuries, women have whispered about the mysterious link between their monthly cycles and the moon's phases. New research shows that the connection was real, and, believe it or not, smartphones may have disrupted it.
The post Women’s Periods Synced Up With The Moon Until 2010. Why Smartphones May Have Zapped The Connection appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Older couple riding bicycles togetherA Canadian study of more than 8,000 older adults is overturning the common assumption that aging is a one-way slide toward decline.
The post Think Aging Means Decline? 1 In 4 Ailing Older Adults Bounce Back To Ideal Health appeared first on Study Finds.
"The Conversation" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Woman Counter Protester with a Sign of Trump in Jail Outside the Courthouse during the Trump Indictment in New York CityProtests are becoming a routine part of public life in the United States. Since 2017, the number of nonviolent demonstrations has almost tripled, according to researchers with the nonprofit Crowd Counting Consortium.
The post Why Are There So Many Protests In The United States? appeared first on Study Finds.
"The Conversation" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Hacker using laptop and credit cardPeople’s lives are more enmeshed with digital systems than ever before, increasing users’ vulnerability and insecurity.
The post The Warning Signs Are Clear: We’re Heading Toward A Digital Crisis appeared first on Study Finds.
"The Conversation" / 2025-09-25 a month ago / 未收藏/ studyfinds发送到 kindle
Woman getting yelled at by boss at workMost people picture defiance as dramatic outbursts. In reality, it’s often these small, tense moments where conscience collides with compliance.
The post The Science Of Defiance: Why People Comply — And How To Resist appeared first on Study Finds.
"The Conversation" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
Tylenol pills (acetaminophen)Our study of nearly 2.5 million births in Sweden published in 2024 shows no evidence that acetaminophen use during pregnancy increases a child’s risk of autism.
The post Tylenol Use During Pregnancy Not Linked To Autism, Our Study Of 2.5 Million Children Shows appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
People dancing together, dance classCommunity dance programs often deliver unexpected benefits beyond learning new moves. Participants frequently experience improved physical fitness, better mental health, stronger cultural connections, and increased community engagement.
The post The Surprising Cure in Your Community: How Arts Programs Improve Health, Prevent Disease appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
Aspirin tabletsAn important new study published in JAMA Oncology analyzed 9,350 healthy adults aged 70 and older and found that blanket aspirin recommendations miss the mark for nearly half of all seniors.
The post Daily Aspirin After 70? Study Shows Who May Benefit, And Who Should Avoid Entirely appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
Paranthropus (left) and Homo Habilis skullsTwo million years ago, while our earliest tool-making ancestors crafted stone implements and processed animal carcasses, they faced a harsh reality that modern humans have long forgotten: they were still very much on the menu.
The post Before We Were Predators, Early Humans Were Actually Big Cat Prey appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
The Sun hovering over the EarthNew modeling shows that global warming events can, under certain conditions, trigger long-term cooling strong enough to resemble ice age conditions, according to researchers at the University of California, Riverside.
The post How Earth’s ‘Thermostat’ Can Malfunction, Flipping Global Warming Into Ice-Age Level Cooling appeared first on Study Finds.
"Press Releases" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
Alzheimer's Research Study at Northern Arizona UniversityNorthern Arizona University researchers are experimenting with new technology that could help medical providers easily detect Alzheimer’s disease early and prevent its advance. 
The post This Breakthrough Tool Could Detect Early Signs Of Alzheimer’s appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-26 a month ago / 未收藏/ studyfinds发送到 kindle
Family screen time: Mom, dad, child looking at phone, computer, tabletParents across America are scheduling something once considered natural: quality time with their own children.
The post Parents Now Book ‘Appointments’ With Kids For Quality Time As Digital Life Takes Priority appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-27 a month ago / 未收藏/ studyfinds发送到 kindle
Woman kissing her catA massive analysis of nearly 800 million donation records reveals cat owners donate more frequently and to a wider variety of causes than dog owners.
The post Cat Owners Vs. Dog Owners: Who Gives More To Charity? 800 Million Donation Records Analyzed appeared first on Study Finds.
"The Conversation" / 2025-09-27 a month ago / 未收藏/ studyfinds发送到 kindle
Man with broken leg recoveringWould you willingly have your legs broken, the bone stretched apart millimeter by millimeter and then spend months in recovery – all to be a few centimeters taller?
The post Why More People Are Purposely Having Their Legs Broken By Cosmetic Surgeons appeared first on Study Finds.
"The Conversation" / 2025-09-27 a month ago / 未收藏/ studyfinds发送到 kindle
Economy definition in dictionaryFor years, I’ve puzzled over a question that seems to defy common sense: If stock markets are hitting records and tech innovation seems endless, why aren’t companies pouring money back into new projects?
The post Why Aren’t Companies Speeding Up Investment? New Theory Offers Answer To Economic Paradox appeared first on Study Finds.
"StudyFinds Analysis" / 2025-09-27 a month ago / 未收藏/ studyfinds发送到 kindle
Woman eating a mangoA daily mango habit produced unexpected results for people with prediabetes: even though the tropical fruit contained more natural sugar than a granola bar, it actually lowered blood sugar levels while increasing lean body mass over six months.
The post Mangos Can Help Lower Blood Sugar, Build Lean Muscle — Even With Triple The Sugar Of Granola Bars appeared first on Study Finds.
"Michael" / 2025-09-26 a month ago / 未收藏/ michael-simons.发送到 kindle
Introduction Sir Antony Hoare[1] introduced the concept of Null-references or a Null pointer[2] back in 1965 with the release of ALGOL W. In 2009 he spoke about it as his “Billion Dollar Mistake”[3]. Dereferencing a Null pointer will address an invalid memory region, usually leading to runtime errors or complete crashes. Despite many efforts, this is still […]
"Claudio Bernasconi " / 2025-09-27 a month ago / 未收藏/ Telerik Blogs发送到 kindle
Learn why integrating Blazor components into desktop applications is a valuable approach.
Blazor was once a promising new web technology that quickly established itself, and today it is a viable choice for .NET developers to build modern, robust and blazingly fast web applications.
Today, Blazor is primarily associated with web development. While at its core Blazor is a web technology, you can do so much more with it than only build web applications.
In this article, I will highlight scenarios where using Blazor components in a desktop environment (WPF, WinForms or .NET MAUI) can be a strategic move that you need to be familiar with and what benefits this approach provides.

The Blazor Component Model

When discussing why you might consider using Blazor components in a desktop application, we cannot get around the Blazor Component model.
Its simplistic syntax, the option to use HTML and CSS to define the user interface, and the component-oriented architecture, which is inherently modular and provides a robust and efficient lifecycle, are advantages you cannot overlook.
Desktop technologies often have their own distinctive way of defining a user interface. We have fewer choices of predefined components, and reusing components for different application types is usually impossible.
A user profile component developed as a Blazor component for an internal application can be reused in an existing customer-facing desktop application. Adding new features to existing applications (with different technologies) becomes simpler.
Practical use case: You can reuse existing C# services within Blazor components directly (Blazor Server) or through an API (Blazor WebAssembly). You can share Blazor components between different applications and application types.

The Integration Between Blazor and Desktop

Integrating Blazor components in desktop applications requires using a browser-based host component.
For example, the WebView2 component can be installed from a NuGet package to add Blazor component support to an existing WinForms desktop application.
Learn more about integrating Blazor components with WinForms from a step-by-step guide.
Practical use case: Add a NuGet Package to integrate Blazor components into existing WinForms applications.

Why Desktop Still Matters—and Why Blazor Helps

There are valid reasons why developers will continue maintaining desktop applications or even start new projects targeting a native desktop application.
A few industries continue to heavily use desktop applications, including finance, engineering and healthcare.
The main advantages of desktop applications are:
  • Local performance and fewer server resources to manage
  • Access to native features
  • Offline support
  • Offline updates
With Blazor, we have solutions for the first three points above. We can use Blazor WebAssembly, which mainly uses the local resources. We can use modern web features to access local resources such as a camera. And with progressive web applications, we can implement offline support.
Desktop technologies like WinForms or WPF are around 20 years old. Their user interface definition isn’t as flexible and modern as HTML and CSS.
If you want to make your newly implemented components available to as many application types as possible, implementing them as Blazor components is a great option.
While some desktop technologies might be limited in some way or another, Blazor offers you the world of the standard web technologies, HTML and CSS, including all available low-level CSS frameworks and complete Blazor UI control libraries, such as Progress Telerik UI for Blazor.
Practical use case: Blazor component can be (re)used for web, desktop and mobile applications. Future-proof your investments. You can even create new desktop applications using .NET MAUI and mainly use Blazor components to build them.

Reusing Existing Blazor Investments

We can look at it from a different angle. Let’s say you have a few older desktop applications and a few more recent Blazor-based web applications. You can modernize the desktop applications by adding Blazor components created for the web applications.
For example, you might implement a form-handling system using Telerik UI for Blazor or other controls with vast support for input validation and modern user feedback.
You can introduce those new components to the existing desktop applications step-by-step and modernize them without having to rewrite the whole application in one massive migration. With this process, you continuously deliver value and take less risk.
Practical use case: Reduce risk with a step-by-step modernization of an existing desktop application compared to a costly and long-lasting complete rewrite.

Common Pitfalls or Gotchas

Desktop applications traditionally have longer startup times compared to modern web applications. We potentially add more delay by integrating additional components and leveraging the WebView2 component.
When introducing Blazor components to an existing desktop application, we must critically investigate and potentially improve the user experience. Blazor components look and feel different from WinForms components.
We should mitigate it by adapting Blazor components to existing UI patterns and using the same spacing and colors for the components. Luckily, we can do that with CSS comparatively easily.
By cleverly leveraging dependency injection, we can inject different implementations for a web and desktop application if we need different behavior.
Practical use case: In web components, we often use links (HTML anchor tag) to navigate to a different page, while in desktop applications, we usually use buttons. We can account for those situations with a good component tree architecture and adapt Blazor components to desktop applications using CSS.

When to Choose This Path

Nothing is perfect, and neither are Blazor components. Let’s talk about use cases that perfectly fit a modernization strategy with Blazor components:
Internal tools or admin panels often don’t have the same requirements for the application’s consistent look and feel. Development speed and cost are more important than getting the last 20% of usability or user experience.
If you have difficulty finding new developers to maintain your WinForms or WPF applications, integrating Blazor components helps you attract new talent with experience with HTML and CSS.
However, applications requiring ultra-low-level native APIs or platform-specific libraries, you might want to stick with a tested and trusted desktop application technology.
Use web technologies such as regular Blazor web applications over .NET MAUI or similarly complex desktop technologies for straightforward and small applications.

Conclusion

As a developer who has worked across desktop and web development, I like the versatility of Blazor components and its modern, robust and flexible component model.
It allows you to upgrade an existing .NET desktop application with new components, and you’ll be able to share components between newly written web applications and older .NET desktop applications.
You can use Blazor to create brand-new applications or enhance existing .NET applications.
Blazor is a stable bridge between the different worlds in .NET development, including web, mobile and desktop application development.
You can save hours, days or weeks by sharing components between different applications and utilizing modern web standards to implement user interfaces compared to technology-specific user interface languages, such as WPF or other XAML-flavored tools.
If you want to learn more about Blazor development, you can watch my free Blazor Crash Course on YouTube. And stay tuned to the Telerik blog for more Blazor Basics.
"Christian Nwamba " / 2025-09-27 a month ago / 未收藏/ Telerik Blogs发送到 kindle
Learn to add real-time observability to a NestJS application using OpenTelemetry and then visualize what's happening in your app with real data. Identify bottlenecks, fix them and scale your application effectively.
In this post, we’ll add real-time observability to a NestJS application using OpenTelemetry. You’ll learn how to visualize what’s happening in your app with real data. This approach will help you to identify bottlenecks, fix them and scale your application effectively.
We’ll build a simple NestJS app that generates telemetry data and sends it to Jaeger, allowing us to visually monitor and gain valuable insights in the way our application behaves.

Prerequisites

To follow along with this post, you’ll need to have basic knowledge of HTTP and RESTful APIs, familiarity with Docker and a basic understanding of NestJS and TypeScript.

What Is Observability?

Observability is the ability to understand a system from the outside based on the data it generates. It lets us look into the inner workings of our system and understand what is happening and why it is happening.
For example, if you notice that your api/orders endpoint is slow, observability shows us the chain of services called by that endpoint. It can tell that the performance issue is caused by the database query taking 1.5 seconds to execute, allowing us to quickly identify and address the bottleneck.
The data generated is called “telemetry,” and it comes in the form of traces, metrics and logs:
  • Traces: Document the entire flow of a request through the chain of services
  • Metrics: Give insights into system performance and resource usage
  • Logs: Provide context-rich information that complements traces and metrics
NestJS uses a modular architecture, which is great for scalability and organization, but it also means:
  • A single request can interact with multiple layers.
  • If X depends on Y, errors or slowness in Y can lead to X failing.
  • Logs alone aren’t enough to fully understand what’s happening most of the time.

Understanding OpenTelemetry

OpenTelemetry, or OTel, is an open-source observability framework that lets us collect, process and export telemetry data. It gives us a common standard for collecting telemetry data and processing it, along with tools, APIs and SDKs for instrumenting, generating and exporting telemetry data.
OTel serves as the bridge between our running code and external observability tools like Jaeger, which is used to visualize telemetry data. Apart from Jaeger, OTel integrates well with other popular tools like Grafana, Prometheus and Zipkin.

Project Setup

Start by creating a NestJS project:
nest new Otel-project
cd Otel-project
Next, create a docker-compose.yml file and add the following configuration to it:
services:
  jaeger:
    image: jaegertracing/all-in-one:latest
    ports:
      - "16686:16686"
      - "4317:4317"
In the configuration above, we set up our Jaeger backend to receive, store and view our traces. We expose two ports: “16686” to access the Jaeger UI, and “4317” which OpenTelemetry uses to send traces to Jaeger. After adding the code to the docker-compose.yaml file, run the command below:
docker compose up
Now, run the following command in your terminal to install the dependencies for our NestJS project:
npm install @nestjs/common @nestjs/core @nestjs/platform-express rxjs \
@opentelemetry/api @opentelemetry/sdk-node @opentelemetry/auto-instrumentations-node \
@opentelemetry/exporter-trace-otlp-grpc @opentelemetry/sdk-metrics
Next, create a tracing.ts file in your src folder and add the following to it:
import { NodeSDK } from "@opentelemetry/sdk-node";
import { getNodeAutoInstrumentations } from "@opentelemetry/auto-instrumentations-node";
import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-grpc";
import {
  PeriodicExportingMetricReader,
  ConsoleMetricExporter,
} from "@opentelemetry/sdk-metrics";

const traceExporter = new OTLPTraceExporter({
  url: "http://localhost:4317",
});

const metricReader = new PeriodicExportingMetricReader({
  exporter: new ConsoleMetricExporter(),
  exportIntervalMillis: 15000,
});

const sdk = new NodeSDK({
  serviceName: "nestjs-opentelemetry-demo",
  traceExporter,
  metricReader,
  instrumentations: [getNodeAutoInstrumentations()],
});

(async () => {
  await sdk.start();
  console.log("✅ OpenTelemetry tracing & metrics initialized");
})();

process.on("SIGTERM", async () => {
  await sdk.shutdown();
  console.log(" OpenTelemetry shutdown complete");
  process.exit(0);
});
In the code above, traceExporter is an instance of OTLPTraceExporter. It tells OpenTelemetry where to send our trace data using the OpenTelemetry Protocol over Google Remote Procedure Call. The metricReader is an instance of PeriodicExportingMetricReader, which gathers and exports metrics every 15 seconds.
Next, we configure the OpenTelemetry Node SDK. We set the serviceName we’ll use in Jaeger to identify our app. We pass the traceExporter and metricReader, and the instrumentation property, which expects a list of instrumentation instances that define how OpenTelemetry automatically tracks our app’s operations.
Instead of passing them manually, getNodeAutoInstrumentations() detects commonly used libraries like Express, HTTP and some database drivers you might have installed and configures them with default options to enable automatic tracing.
Finally, we listen to the SIGTERM signal that’s sent by Node when our server shuts down. When this happens, we call sdk.shutdown(), which clears any pending telemetry data, closes open connections and frees up resources.
Update the code in your main.ts file with the following:
import "./tracing";
import { NestFactory } from "@nestjs/core";
import { AppModule } from "./app.module";

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  await app.listen(3000);
  console.log(" App running on http://localhost:3000");
}

bootstrap();
The import './tracing'; declaration must be at the top to so that OpenTelemetry tracing is initialized before any other application code runs. We’re essentially telling Node.js to load and run everything in that file, thereby setting up tracing and metrics. Since this happens before creating the NestJS app and starting the server, all incoming requests are tracked and reported.
OpenTelemetry doesn’t need to know the port ahead of time. When we import the file, it automatically patches low-level Node.js and Express libraries before NestJS starts. That’s why it hooks into the request lifecycle regardless of the port the app eventually binds to.

Adding Tracing

Right out of the box, OpenTelemetry gives us auto-tracing, which can automatically trace every HTTP request. This way, we don’t need to write any tracing code.
Create a file called orders.controller.ts and add the following to it:
import { Controller, Get } from "@nestjs/common";

@Controller("orders")
export class OrderController {
  @Get()
  getOrders() {
    return [
      { id: 1, item: "Product A", qty: 2 },
      { id: 2, item: "Product B", qty: 1 },
    ];
  }
}
Now, even though we don’t have any tracing code, when we hit this endpoint, OpenTelemetry will detect it.
That said, the OpenTelemetry Node SDK auto-tracing is limited. It gives us limited information, like how long an endpoint takes to respond, but in some cases we might want more information, and that’s where manual spans come in.
A span is a single unit of work in our app, and traces are made up of spans. Spans have a start and end time, a name, attributes and can have a parent, thereby allowing nesting.

Manual spans allow us to track and label specific parts of our app, such as database operations, server computations and external API calls.
Create a file called product.controller.ts and add the following to it:
import { Controller, Get } from "@nestjs/common";
import { trace, context } from "@opentelemetry/api";

@Controller("products")
export class ProductController {
  @Get()
  async getProducts() {
    const tracer = trace.getTracer("nestjs-opentelemetry-demo");
    const span = tracer.startSpan(
      "fetch_products",
      undefined,
      context.active()
    );

    // Simulate a delay to mimic a real database or API call
    await new Promise((resolve) =>
      setTimeout(resolve, 100 + Math.random() * 400)
    );

    span.end();

    return [
      { id: 1, name: "Product A" },
      { id: 2, name: "Product B" },
    ];
  }
}
In the code above, we first get a tracer instance from OpenTelemetry and then use that to start a new span. We name it fetch_products, and we don’t set any attributes, but use context.active() to set its parent so that it becomes part of the trace that OpenTelemetry started for the request.
Now, let’s update the app.module.ts file to use our ProductController:
import { Module } from "@nestjs/common";
import { AppController } from "./app.controller";
import { AppService } from "./app.service";
import { ProductController } from "./product.controller";
import { OrderController } from "./orders.controler";

@Module({
  imports: [],
  controllers: [AppController, ProductController, OrderController],
  providers: [AppService],
})
export class AppModule {}

Adding Metrics

As mentioned earlier, metrics give us insights into system performance and resource usage. They track values over time, and here we’ll use them to track how many HTTP requests our app handles across all routes. To do this, we’ll use a simple interceptor that runs for every request and counts it using OpenTelemetry.
Create an observability.interceptor.ts file, and add the following to it:
import {
  CallHandler,
  ExecutionContext,
  Injectable,
  NestInterceptor,
  Logger,
} from "@nestjs/common";
import { Observable, tap } from "rxjs";
import { metrics } from "@opentelemetry/api";

const meter = metrics.getMeter("nestjs-meter");
const requestCount = meter.createCounter("http_requests_total", {
  description: "Count of all HTTP requests",
});

@Injectable()
export class ObservabilityInterceptor implements NestInterceptor {
  private readonly logger = new Logger("HTTP");

  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
    const req = context.switchToHttp().getRequest();
    const method = req.method;
    const route = req.url;
    const now = Date.now();

    return next.handle().pipe(
      tap(() => {
        const duration = Date.now() - now;
        this.logger.log(`${method} ${route} - ${duration}ms`);

        requestCount.add(1, {
          method,
          route,
        });
      })
    );
  }
}
First, we retrieved the active meter we defined in our tracing.ts file from the OpenTelemetry SDK using metrics.getMeter('nestjs-meter'). The string nestjs-meter serves as a unique name to label this particular meter instance.
Next, we define a counter metric http_request_total that will be incremented for every request that comes in. requestCount.add(1, { method, route }) increments the counter by 1 and attaches two labels (method and route).
With this setup, we can visualize the number of requests each endpoint in our app receives. Since we are using a NestJS interceptor to automatically run this logic on every request, there is no need to add metrics to every controller.
Next, we need to update the main.ts file to use the interceptor globally:
import "./tracing";
import { NestFactory } from "@nestjs/core";
import { AppModule } from "./app.module";
import { ObservabilityInterceptor } from "./observability.interceptor";

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.useGlobalInterceptors(new ObservabilityInterceptor()); // Register the interceptor globally

  await app.listen(3000);
  console.log(" App running on http://localhost:3000");
}

bootstrap();
In the code above, we set up our interceptor to be globally-scoped, which means it will be automatically bound to all routes in our app.
In our tracing.ts file, we configured our metrics to use ConsoleMetricExporter, so every few seconds, we’ll see them printed to our terminal, but this can be replaced with monitoring systems like Prometheus.

Now, start the server:
npm run start:dev

Viewing Traces in Jaeger

With Jaeger now running, open http://localhost:16686 in your browser and you should see the Jaeger UI.
Jaeger UI
In the Jaeger dashboard, select nestjs-opentelemetry-demo as the Service and click the Find Traces button. You’ll see a list of recent traces, each representing a single HTTP request. As explained earlier, each trace is made up of one or more spans, and our manual spans will appear nested in the main HTTP span.
First, let’s test OpenTelemetry’s auto-tracing. Use the curl command below to hit the GET /orders endpoint, then go to the Jaeger UI once again:
curl http://localhost:3000/orders
Jaeger UI orders test
After triggering the /orders endpoint, you’ll see a trace for that GET /orders request. After clicking it, the top section should show key metadata like name, duration and total spans. Spans show the total number of individual operations (8), while depth shows how nested those spans are (4).
You can see different middleware being applied, like expressInit and jsonParser, as well as NestJS’s request handler and controller method. This trace was automatically generated by OpenTelemetry without any tracing code. It’s done by hooking into common libraries using the configurations we set in the tracing.ts file.
Similarly, to test how manual spans work, use the curl command below to hit the GET /products endpoint, then go to the Jaeger UI once again:
curl http://localhost:3000/products
Jaeger UI products test
After triggering the /products endpoint, you’ll see a trace for that GET /products request.
Notice we can also see how long each span takes, and we can see our custom span fetch_products that simulates a database call, which spends the most time at ~472ms.

What’s Next?

To improve our app, consider adding a collector that sits between your app and observability tools. It will receive telemetry data, batch it and send it to tools like Jaeger. You could also use Prometheus to capture metrics and monitor your app better, especially in production environments.
Based on your needs, you could integrate a number of cloud APM (Application Performance Monitoring) tools, since most of them support OpenTelemetry.

Conclusion

In this article, we added observability to a NestJS app with OpenTelemetry, which gives us visibility into what happens under the hood with request traces, custom spans and basic metrics. You’ve learned about OpenTelemetry and its core concepts, how to use its Node SDK with NestJS, and how to export telemetry data to platforms like Jaeger and Prometheus.
"Teon Beijl " / 2025-09-27 a month ago / 未收藏/ Telerik Blogs发送到 kindle
Designers don’t need to be architects, but in complex systems, the biggest design win might come from a shared C4 diagram.
Designers don’t need to be architects. But the smart ones collaborate with them.
In complex systems, Figma alone won’t get you to clarity. C4 diagrams will.
Your biggest design win might not come from a single screen. It might come from sitting down with a platform architect, drawing boxes and arrows.

Context Is Complex

When you’re building large-scale enterprise platforms, most of the key decisions aren’t made at the interface level. They’re made deep in the infrastructure, long before anyone talks about flows or functionality.
In complex domains, the architecture shapes everything: data pipelines, security, system integrations and protocols. These systems are built for reliability and performance first. That means UX often comes in late, after major decisions are already made.
In construction, architects are both designers and engineers. In software, the architect is usually a software engineer with system ownership and the authority to make technical decisions.
Unless designers understand that system-level thinking, they’re stuck designing around constraints they never had a chance to influence.

What Are C4 Diagrams?

A C4 diagram is like Google Maps for your codebase. It shows your system at different zoom levels—from the big picture down to developer-level details.
Here’s how it works:
Level 1: Context
This is the world your system lives in. Who uses it? What other systems does it interact with? This level helps everyone understand why the system exists and what job it supports.

Level 2: Containers
These are the major parts inside the system—web apps, APIs, databases, services. It shows how responsibilities are distributed across the architecture.

Level 3: Components
Zoom into a container to see what it’s made of. You’ll find the internal building blocks: modules, services or UI parts that work together.

Level 4: Code
This is the implementation layer—classes, methods, attributes. Often generated directly from your code editor.

As a designer, your work often lives in Level 1 and 2. If you’ve done UX research, ask yourself:
  • Is that user insight visible in the C4 diagrams?
  • Are there diagrams available?
  • If not, can you help create or update them?
C4 isn’t just for engineers. It’s a shared map. Make sure your design insights are on it.
Want to explore more? Visit c4model.com.

The Time When Draw.io Beat Figma

I did exactly that.
I was working as the Global Design Lead on a new remote operations and IoT platform in the oil and gas industry. Our challenge? Build software that would let operators work from the office instead of the rig. That meant handling real-time data streams, edge connectivity and integrating with a mix of new and legacy applications.
I had a great relationship with the platform architect, and that’s when I first came across C4 diagrams. The moment he walked me through one, I thought: Wait, this is my job!
He was mapping the same systems and workflows, but from a technical perspective. And I had additional insights—what users were trying to do, what tools they used today, how we should name things.
We realized that, by collaborating early, we could cover the problem from both ends. Design could inform the architecture, and architecture could guide the design. It made everyone’s job easier. Fewer surprises. Better alignment.
I spent more time in Draw.io than I did in Figma. That’s where the magic happened.

Influencing Impact

Going on a roadshow with an architect was new for me. I had to step up my game.
A technical deep dive isn’t the same as building a conceptual user journey. And in a lot of those workshops, I didn’t know what half the acronyms meant.
But the benefit of collaborating early was that I could ask questions at the right moments. These were big technical decisions with long-term consequences.
And even if I didn’t have the answers, I could bring evidence, raise user concerns or challenge assumptions that hadn’t been questioned yet.
I wasn’t there to redesign the system. I helped shape it.
And because I was working side by side with the architect, I had one of the most trusted voices in the org on my side. He had decades of credibility. He knew the domain. He’d seen what failed before and could help us avoid repeating it.
In earlier projects, I didn’t have that kind of collaboration. There was tension and misunderstanding. This time, the partnership changed everything.
And what I realized is this: When designers help shape the technical foundation, UI work becomes easier later. Because the foundation is stronger. And it’s built with the user in mind.

How to Get Started

If you’re a designer, start by finding out who’s in charge of architecture. It might be an architect. It might be a senior developer.
Go talk to them. Ask how they visualize the architecture. Ask if they use C4 diagramming. If they do, ask to see it. Tell them you want to collaborate and build a shared map of the system.
When you explain designs, use their diagrams. Put them up in design reviews or sprint planning sessions. Refer to them in refinement.
You can also sketch it yourself—especially Levels 1 and 2. If you’ve done user research, you probably already know who uses the system, what they need, and how they interact with it. That’s context and container-level insight.
Schedule a session with the owner of the system design and walk through it together. You’re not trying to do their job. You’re trying to build a shared understanding.
Even if you’re not leading strategy or deeply involved in architecture, helping visualize the system earns trust. It helps everyone stay on the same page—even if all you do is make their diagram look nice.
If you’re an architect or developer reading this: invite the designer in.
Walk them through your C4 diagram. Ask what they see. Ask what’s missing. Designers bring research, language and mental models that will make your diagrams better.

Whether you’re designing code or designing flows, you’re still designing a system. You don’t need a new process. Just collaborate. Share. Care about getting it right at all the levels.

Closing: Think in Layers

Great architecture happens when design and engineering work together.
In complex systems, you need clarity. You need to see what you’re building. You need a map.
C4 diagrams are a powerful way to get there. They help teams collaborate across roles, zoom into code when needed and still tie it all back to context.
Clarity is the foundation of great software. And when architects and designers co-create, you help connect every layer—from infrastructure to interface.
That’s what it means to think in layers. That’s how you design better systems.
Layer like a dev.
"Dhananjay Kumar " / 2025-09-27 a month ago / 未收藏/ Telerik Blogs发送到 kindle
Learn how to get started in AI development with LangChain and OpenAI by making a Python chat app.
Everyone is excited about GenAI, chatbots and agents—and for good reason. This article offers a very beginner-friendly introduction to building with OpenAI and LangChain using Python, helping you take your first steps into the world of AI development. This article covers the following topics:
  1. Installation of dependencies
  2. Connecting to the OpenAI GPT model
  3. Creating your first chat app
  4. Streaming the output
  5. Working with UserMessage, SystemMessage of LangChain
  6. Working with JSON data and a model

Installation

Let us start by installing the dependencies. First, create an empty folder and add a file named requirements.txt. Inside this file, list the following dependencies:
openai>=1.0.0
langchain>=0.1.0
langchain-openai>=0.1.0
python-dotenv>=1.0.0 
langgraph>=0.1.0
Once you’ve created the requirements.txt file, run the following command in the terminal to install all the dependencies:
pip3 install -r requirements.txt
You can verify whether dependencies are successfully installed by using the command below, which should display a list of installed dependencies.
pip3 list

Setting Up the Environment

After installing the dependencies, set up the environment variables. Create a file named .env in your project directory and add the following keys:
OPENAI_API_KEY= "openaikey"
LANGSMITH_TRACING="true"
LANGSMITH_API_KEY="langsmith key"
Verify that you have already obtained your OpenAI API key and LangSmith key. You can get them from their respective portals.

Working with GPT Model

Once the environment variables are set, create a file named main.py in your project and import the following packages.
import os
from dotenv import load_dotenv
from openai import OpenAI
from langchain_openai import ChatOpenAI
from langchain.schema import HumanMessage
from langchain_core.messages import AIMessage

load_dotenv()
After importing the packages, create an instance of the model. Use ChatOpenAI to initialize the GPT-3.5-Turbo model as shown below:
model = ChatOpenAI(
            model="gpt-3.5-turbo",
            api_key=os.getenv("OPENAI_API_KEY")
        )
Next, we construct the message to send to the model and get the model’s response.
   messages = [
        HumanMessage(content="Hi! I'm DJ"),
        AIMessage(content="Hello DJ! How can I assist you today?"),
        HumanMessage(content="What is capital of India?"),
    ]

Above, we are using HumanMessage and AIMessage to send to the model.
HumanMessage
  • Messages sent by the user
  • Contains the user’s input, questions or statements
  • This message is sent to the AI model
AIMessage
  • Messages sent by the AI model
  • Contains the model’s responses, answers or generated content
  • This message is included to represent the model’s response in the conversation history
Pass this message to invoke the model as shown below.
        response = model.invoke(messages)
        return response
Here’s how you create a model, build a message and send it to the model to receive a response. Putting it all together, a basic chat app might look like this:
import os
from dotenv import load_dotenv
from openai import OpenAI
from langchain_openai import ChatOpenAI
from langchain.schema import HumanMessage
from langchain_core.messages import AIMessage

load_dotenv()

model = ChatOpenAI(
            model="gpt-3.5-turbo",
            api_key=os.getenv("OPENAI_API_KEY")
        )

def chat():
    try:
        messages = [
        HumanMessage(content="Hi! I'm DJ"),
        AIMessage(content="Hello DJ! How can I assist you today?"),
        HumanMessage(content="What is capital of India?"),
    ]
        response = model.invoke(messages)
        return response
    except Exception as e:
        print(f"Error: {e}")
        return None

if __name__ == "__main__":
    dochat = chat()
    print(dochat.content)
Run the above code by executing the following command in your terminal:
python3 main.py
You should get the expected output as shown below.
first-app-chat-bot - The capital of India is New Delhi

Streaming Response

LangChain also offers a simple way to stream responses from the model. To enable streaming, use the stream method on the model as shown below:
response = model.stream(messages)
        print("Streaming response:")
        for chunk in response:
            print(chunk.content, end="", flush=True)
            print()  
When running the application, you should obtain the expected output, as shown below.
streaming response says the capital of India is New Delhi
Until now, user input has been hardcoded. We can update the code to accept input from the user and use it to create a HumanMessage.
while True:
            # Ask user for input
            user_input = input("You: ").strip()
            
            # Check if user wants to exit
            if user_input.lower() in ['exit']:
                print("Goodbye!")
                break
            
            if not user_input:
                continue
            
            messages.append(HumanMessage(content=user_input))
            response = model.invoke(messages)
            messages.append(response)
            print(f"AI: {response.content}")
            print()
We can continuously receive user input in a loop, and stop only when the user types Exit. We simply append the user input as a HumanMessage to the messages array and invoke the chat model.
Putting it all together, a basic chat app with user input might look like this:
import os
from dotenv import load_dotenv
from openai import OpenAI
from langchain_openai import ChatOpenAI
from langchain.schema import HumanMessage
from langchain_core.messages import AIMessage

load_dotenv()

model = ChatOpenAI(
    model="gpt-3.5-turbo",
    api_key=os.getenv("OPENAI_API_KEY")
)

def chat():
    try:
        messages = [
            HumanMessage(content="Hi! I'm DJ"),
            AIMessage(content="Hello DJ! How can I assist you today?"),
        ]
        
        print("Chat started! Type 'quit' to exit.")
        print("-" * 30)
        
        while True:
            # Ask user for input
            user_input = input("You: ").strip()
            
            # Check if user wants to exit
            if user_input.lower() in ['exit']:
                print("Goodbye!")
                break
            
            if not user_input:
                continue
            
            messages.append(HumanMessage(content=user_input))
            response = model.invoke(messages)
            messages.append(response)
            print(f"AI: {response.content}")
            print()
            
    except Exception as e:
        print(f"Error: {e}")
        return None

if __name__ == "__main__":
    chat()
You should get the expected output as shown below.
chat app shows questions being asked and answered by AI

Working with JSON Data

Now, suppose you have a JSON dataset and want the model to generate responses exclusively based on this data, without referencing any external sources.
data = {
    "company": {
        "name": "NomadCoder AI",
        "founded": 2024,
        "employees": 5,
        "location": "San Francisco",
        "industry": "Technology"
    },
    "training": [
        {"name": "Angular ", "price": 100},
        {"name": "React", "price": 200},
         {"name": "Lanchain ", "price": 500}
    ]
}
After that, you construct the system prompt to be passed to the model as follows:
data_string = json.dumps(data, indent=2)

system_prompt = f"""Answer questions based only on the data provided below.
If the answer is not found in the data, reply: 'Not available in provided data.'
Data:{data_string}"""
After that, you construct the message array to include the system prompt as the SystemMessage.
  messages = [
            SystemMessage(content=system_prompt),
            HumanMessage(content="Hi! I'm DJ"),
            AIMessage(content="Hello DJ! How can I assist you today?"),
        ]
Now, when you ask a question, the model will not use any external data; it will respond only based on the JSON data provided in the SystemMessage.
Putting everything together, you can generate a response from a given set of JSON data as shown below.
import json
import os
from dotenv import load_dotenv
from openai import OpenAI
from langchain_openai import ChatOpenAI
from langchain.schema import HumanMessage, SystemMessage
from langchain_core.messages import AIMessage

load_dotenv()

data = {
    "company": {
        "name": "NomadCoder AI",
        "founded": 2024,
        "employees": 5,
        "location": "San Francisco",
        "industry": "Technology"
    },
    "training": [
        {"name": "Angular ", "price": 100},
        {"name": "React", "price": 200},
         {"name": "Lanchain ", "price": 500}
    ]
}

data_string = json.dumps(data, indent=2)

system_prompt = f"""Answer questions based only on the data provided below.
If the answer is not found in the data, reply: 'Not available in provided data.'
Data:{data_string}"""

model = ChatOpenAI(
    model="gpt-3.5-turbo",
    api_key=os.getenv("OPENAI_API_KEY")
)

def chat():
    try:
        messages = [
            SystemMessage(content=system_prompt),
            HumanMessage(content="Hi! I'm DJ"),
            AIMessage(content="Hello DJ! How can I assist you today?"),
        ]
        
        print("Chat started! Type 'quit' to exit.")
        print("-" * 30)
        
        while True:
            # Ask user for input
            user_input = input("You: ").strip()
            
            # Check if user wants to exit
            if user_input.lower() in ['exit']:
                print("Goodbye!")
                break
            
            if not user_input:
                continue
            
            messages.append(HumanMessage(content=user_input))
            response = model.invoke(messages)
            messages.append(response)
            print(f"AI: {response.content}")
            print()
            
    except Exception as e:
        print(f"Error: {e}")
        return None

if __name__ == "__main__":
    chat()
You should get the expected output as shown below.
Chat result with answers from AI
As you can see, the model is generating responses only based on the JSON provided in the system prompt.

Summary

This article provided you with basic steps to get started with AI development with LangChain and OpenAI.
To learn about LangChain and OpenAI with TypeScript, read this post: How to Build Your First LLM Application Using LangChain and TypeScript.
"Suzanne Scacca " / 2025-09-27 a month ago / 未收藏/ Telerik Blogs发送到 kindle
In PageSpeed Insights, Google gives your website a score based on Performance. To calculate this score, it uses five metrics. But what do each mean and how do you go about improving them? In this post, we’ll explore.
When using PageSpeed Insights, Google gives you four scores related to your website Performance, SEO, Best Practices and Accessibility. In this post, we’re going to hone in on what you’ll see under Performance.
While your overall Performance score tells you how good or poor the page loading experience is on mobile and desktop, there are other metrics Google shows you on this page. These include:
  • First Contentful Paint
  • Largest Contentful Paint
  • Total Blocking Time
  • Cumulative Layout Shift
  • Speed Index
Google has numerous guides that explain what each of these metrics means in the grand scheme of things. To save you time in chasing down this information and trying to figure out what you need to do to achieve a good page speed score, I’ve summarized it below.

Understanding Google’s Page Speed Metrics

Before we jump in, I want to show you a neat trick in PageSpeed Insights you can use to figure out which metrics to prioritize.
We’ll be using the Disney website as our example. Here’s what your overall Performance scorecard will look like:
In this screenshot from Google PageSpeed Insights, we see four scores for the disney.com website: 55 for Performance, 98 for Accessibility, 100 for Best Practices, and 77 for SEO.
Hover over or click the bigger circle to the left of the homepage screenshot. It will reveal more data about why you received the score that you did.
The circle will show you how each of the performance metrics adds up to the total score. It will also show you which metrics positively contributed to your Performance score (in green) and which negatively contributed (in red).
Under the Performance tab of PageSpeed Insights, users can hover over or click on the Performance score circle. It transforms into a circle chart. Each of the 5 metrics — SI, FCP, LCP, TBT, and CLS — is represented as a segment of the circle. If they had a positive effect on Performance, they’re green. In this case, CLS and TBT are green.
If you move your mouse over any segment of the circle, it will tell you how many points were added or subtracted based on the different metrics. For instance, TBT added 28 and CLS added 25. FCP and LCP added 0, while SI added only 2.
For reference, here are the actual times/scores given for each metric.
An analysis of the disney.com website in PageSpeed Insights. We see 5 metrics for the mobile experience: 8.4 s for First Contentful Paint, 19.3 s for Largest Contentful Paint, 160 ms for Total Blocking Time, 0.022 for Cumulative Layout Shift, and 8.4 s for Speed Index.
We’ll look at what makes them good or bad (in Google’s interpretation) as we explore each of the speed metrics next.

First Contentful Paint

First Contentful Paint (FCP) refers to the length of time that it takes for the browser to display the first bit of content on the screen from the DOM. DOM content includes things like:
  • Imagery
  • Fonts
  • SVGs
  • Tables
  • Forms
  • Embedded content (not in iframes)
  • <canvas> elements (non-white)
This metric is measured in seconds. In the Disney example, the FCP was 8.4 seconds.
According to Google, this is far too slow regardless of device. Here’s the rubric Google uses to determine if the FCP on mobile and desktop is fast (green), moderate (orange), or slow (red):
FCP ScoringMobileDesktop
Fast0-1.8 s0-0.9 s
Moderate1.8-3 s0.9-1.6 s
Slow3 s or more1.6 s or more

To speed up the FCP, you’ll need to remove the barriers keeping your content from loading right away.
For instance, eliminating render-blocking resources is a big help. So is verifying your text appears on the screen even while your fonts load behind the scenes. If you can, cut down on the size of your DOM so there isn’t as much to load with each browser visit.

Largest Contentful Paint

Largest Contentful Paint (LCP) refers to the length of time before the biggest piece of content gets rendered on the screen. In other words, it’s the amount of time it takes before the main content appears to your visitors instead of just a blank screen.
This metric is measured in seconds. In the Disney example, the LCP was 19.3 seconds.
This is another severely underperforming metric, according to Google. Here’s the rubric Google uses to determine if the LCP on mobile and desktop is fast (green), moderate (orange) or slow (red):
LCP ScoringMobileDesktop
Fast0-2.5 s0-1.2 s
Moderate2.5-4 s1.2-2.4 s
Slow4 s or more2.4 s or more

This LCP metric can be a complex one to improve because there are four parts to account for:
  • Time to first byte (TTFB)
  • Resource load delay
  • Resource load duration
  • Element render delay
Here’s a graphic from Google that demonstrates visually what’s going on:
In this graphic from Google’s https://web.dev/, we see a chart visually demonstrate how the Largest Contentful Paint loading process works. The first part is Time to first byte. The second is Resource load delay. The third is Resource load duration. And the fourth is Element render delay.
Let’s say that you have a beautiful image in the background of your hero section. That would be your largest piece of content. To load it, the browser would first unpack the HTML document, begin to load the image and then deal with anything that might prevent it from fully loading.
If you’re only looking at this as an issue of an image not loading fast enough, you might be inclined to think it’s the size of the file alone that’s problematic. This can definitely contribute to the problem. However, compressing or resizing your image would only help shorten the resource load duration portion of the process.
So, again, you’d need to look at other factors delaying the loading of elements on the page. Many of the tactics you use to improve the FCP will apply here, like removing render-blocking resources.

Total Blocking Time

Total Blocking Time (TBT) refers to the length of time it takes before a visitor can engage with the page. This might mean they can’t scroll to see content, click or tap on the interactive components, or fill in form fields, among other things.
This metric is measured in milliseconds. In the Disney example, the TBT was 160 milliseconds.
According to Google, this TBT is good, though it is on the higher end of the range of what’s considered fast. Here’s the rubric Google uses to determine if the TBT on mobile and desktop is fast (green), moderate (orange) or slow (red):
TBT ScoringMobileDesktop
Fast0-200 ms0-150 ms
Moderate200-600 ms150-350 ms
Slow600 ms or more350 ms or more

The calculation of TBT is different from the two metrics we discussed above. What Google does is first determine what sorts of long tasks appear on the page. A long task is one that takes more than 50 ms to execute. It then identifies which of your long tasks take longer. Any extra time after the 50 ms is considered blocking time and gets added together to come up with the TBT.
Here’s another helpful Google graphic that shows how total blocking time works. The darker portions of the tasks occur after the “necessary” 50 ms needed to complete them:
From Google’s https://web.dev/, we see how Total Blocking Time is calculated based on task time length. The first block has 200 ms extra after the first 50 ms. The second block has an extra 40 ms. The third and fourth block don’t have any extra time. And the fifth one has 105 ms.
In the case of the Disney homepage, this means there were 160 milliseconds of delays on top of the allowable 50 milliseconds per task.
To speed up the TBT, you’d need to find out what your long tasks are and why they’re taking so long. You can use a tool like Lighthouse to look through your code to find out what’s going on.
The Performance panel will show you which tasks take too long. It may also reveal that certain tasks are holding things up unnecessarily. For example, you may have time-consuming JavaScript loading that’s not even necessary for the page to function. In that case, the fix would be easy—delete the unused code.
Another helpful trick is to find more efficient ways of loading third-party scripts. Or, if possible, do away with third-party content, so you have more control over your site and how quickly it loads.

Cumulative Layout Shift

Cumulative Layout Shift (CLS) refers to visual stability. In other words, when content has loaded, will all the visible elements remain fixed? Or will they shift position after the user believes the page has finished loading?
This metric is a unitless value. In the Disney example, the CLS was 0.022.
According to Google, this CLS is good. Here’s the rubric Google uses to determine if the CLS is good (green), needs improvement (orange) or poor (red):
CLS ScoringAll Devices
Fast0-0.1
Moderate0.1-0.25
Slow0.25 or higher

This is a unique metric among the other Performance metrics as it has less to do with loading time as it does perceived stability and usability of the page.
CLS is a vital metric to pay attention to as an unexpected layout shift can cause a number of problems for visitors. For instance, they may:
  • Lose track of what they’re looking at
  • Click on the wrong button
  • Stop reading or engaging with the page altogether, waiting to see if it’s done loading
It can be frustrating when a webpage suddenly moves beneath one’s cursor or finger. And if it happens more than once, it can break a visitor’s trust altogether.
As for why this happens, there are a number of reasons:
  • Asynchronous loading of resources
  • Images or videos aren’t programmed with set dimensions
  • Embedded content and iframes lack set dimensions
  • Third-party ads dynamically resize
  • Fonts render incorrectly upon initial load
To stop your content from making these unexpected and jarring shifts, you’ll need to identify which components are to blame.
Note: Not all layout shifts are considered bad in Google’s eyes (or your visitors’). For instance, user interactions that lead to animations or page transitions are technically considered layout shifts. So long as the process feels smooth and natural, and doesn’t take longer than expected, they won’t count against you.

Speed Index

Speed Index (SI) refers to the pace at which content visually appears while a page loads. You can see what this looks like in PageSpeed Insights in the section below your speed metrics.
In PageSpeed Insights, visitors can see a breakdown of how the visuals appear as the page loads. In this screenshot, we see 8 frames of the homepage. The first two are completely blank. The second two show the mobile website header and a tan-colored page. The next four show how the content of the page slowly loads into focus.
This metric is measured in seconds. In the Disney example, the SI was 8.4 seconds.
According to Google, this SI is slow. Here’s the rubric Google uses to determine if the SI is fast (green), moderate (orange) or slow (red):
SI ScoringMobileDesktop
Fast0-3.4 s0-1.3 s
Moderate3.4-5.8 s1.3-2.3 s
Slow5.8 s or more2.3 s or more

This is where that often-quoted Google benchmark comes from:
If a webpage takes longer than 3 seconds to load (on mobile), it’s too slow.
As you can see, the Speed Index doesn’t account for how long it takes to fully load all the content on the page.
The Speed Index time (8.4 seconds) is the same length as the First Contentful Paint (8.4 seconds). However, the Largest Contentful Paint is 19.3 seconds.
This doesn’t mean you shouldn’t be concerned with how quickly all the visual elements load, especially the biggest ones. This is just to give you an idea of how Google determines this particular metric.
As for improving the Speed Index, all the changes recommended above apply. And if you want to see a noticeable difference in your PageSpeed Insights metrics, start by working your way through Google’s suggested changes first.
You’ll find this info below the Speed Index visualization.
The Performance Insights tab in Google PageSpeed Insights recommends actions like Render blocking requests, Use efficient cache liftetimes, Improve image delivery, Legacy JavaScript, and Forced reflow.
For this page, Google has marked these optimizations as most critical:
  • Render blocking requests
  • Use efficient cache lifetimes
  • Improve image delivery
  • Legacy JavaScript
  • Forced reflow
  • LCP request discovery
  • Network dependency tree
You can click on each insight/optimization to expand the suggestion. Google usually provides instructions on how to implement the change.
Once you’ve tackled these optimizations, return to your performance metrics and see how you’re doing. If the scores still don’t fit within the good ranges that Google looks for on mobile website experiences, work on refining the experience further.

Wrapping Up

Google’s PageSpeed Insights is an invaluable tool. In addition to giving us insight about technical aspects of our website experience like accessibility and usability, it gives us a ton of details on what the loading experience looks and feels like to users when they visit a page for the first time.
As Google says, this tool gives designers and developers a way to “Discover what your real users are experiencing.”
This experience isn’t always easy to witness on our own, though, as caching can sometimes prevent us from seeing the true loading experience. What’s more, some of the changes aren’t as easy to notice, especially the ones measured in milliseconds.
So, this is why it’s great we have this tool where Google breaks down the user’s experience step by step. This gives us a clear view of their experience during the initial page load and can also help us better understand their first impressions.
By improving page loading speeds, we can reduce that early friction and instill trust from the get-go.
"David Adeneye Abiodun " / 2025-09-27 a month ago / 未收藏/ Telerik Blogs发送到 kindle
These tips might help you get your development space set up on a Mac.
Setting up a new Mac for web development can feel like standing in front of a blank canvas: exciting but slightly overwhelming, with checklists of tools and configuration settings to consider. But with a streamlined guide, it doesn’t have to be.
Whether you’re a beginner developer or seeking a concise web development setup for Mac, this guide will walk you through configuring your macOS from scratch for web development: installing essential applications and tools, setting up your shell environment, setting up Git and SSH, configuring VS Code, and even spinning up your first web project using Vite (a modern build tool for the web). By the end of this walkthrough, you will have a development environment ready for web development.
Let’s get your Mac ready to ship code.

Getting Started

If you’re setting up a new MacBook for the first time, macOS will guide you through the Setup Assistant, helping you set up your language and time zone, and sign in with your Apple ID. Once you land on the desktop, your first move should be to update macOS to verify you have the latest security patches and system updates installed.
This guide is structured to support both beginner and experienced developers. You can jump straight to the sections you need or follow it step by step. Here’s what we’ll cover:
  • Installing Homebrew (The Developer Toolkit)
  • Setting Up Your Shell with Oh My Zsh
  • Installing and Setting Up Git
  • Setting Up SSH Keys
  • Setting Up Node.js via NVM
  • Setting Up Your First Web Project with Vite
  • Setting Up Visual Studio Code
  • Optional macOS Tweaks & Customizations

Installing Homebrew (The Developer Toolkit)

Homebrew is a package manager for macOS and Linux that simplifies the installation and management of software from the terminal—eliminating the need to drag apps into folders or guess which version to download.
To install Homebrew, paste this into your terminal:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Once installed, you’ll be able to install pretty much anything you need with a single command.

Installing Essential GUI Apps with Homebrew

Here are some of the core apps I use daily—all installable using Homebrew’s --cask flag:
GUI ApplicationsPurpose
Google Chromeweb browser
iTerm2terminal
Visual Studio CodeText Editor
Rectanglewindow resizing
Postgresdatabase
SlackCommunication
DiscordCommunication
DockerDevelopment
ObsidianNotes
FigmaDesign
OBSStreaming
BitwardenPassword Manager
SpotifyMusic
MaccyClipboard Manager

To install them, run:
# Install GUI programs
brew install --cask \
google-chrome \
iterm2 \
visual-studio-code \
rectangle
I didn’t add all the apps, you can add more as needed—just use --cask for GUI apps.

Install Terminal Tools

These are my go-to command-line tools for productivity and development:
Terminal ApplicationPurpose
wgetcurl replacement
gitversion control
nvmnode version manager
pnpmnode package manager
cmatrixterminal screensaver

Run the following command to install your them:
brew install \
wget \
git \
nvm \
pnpm \
cmatrix

Setting Up Your Shell with Oh My Zsh

macOS ships with Zsh as the default shell. Zsh (short for Z Shell) is a powerful Unix shell that serves both as an interactive command-line interface and a scripting language. To enhance its functionality, we use Oh My Zsh—an open-source framework for managing your Zsh configuration. It comes packed with useful functions, plugins, themes and helpers to boost your terminal productivity.
To install Oh My Zsh, run:
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
After installation, update Oh My Zsh and its plugins to the latest version:
omz update

Custom Shortcuts

You can add command aliases (shortcuts) by editing your ~/.zshrc file. Just use the alias keyword.
For example, if you’re on an Apple Silicon (M1/M2) Mac and need to switch between ARM64 and Intel (x86_64) architectures—say, for compatibility testing—you can create aliases like this:
alias x86="env /usr/bin/arch -x86_64 /bin/zsh --login"
alias arm="env /usr/bin/arch -arm64 /bin/zsh --login"
To check your current architecture, run:
uname -m
You’ll see either arm64 (Apple Silicon) or x86_64 (Intel).
Here are a few useful plugins you might want to enable:
To enable them, add them to the plugins=(...) array in your .zshrc file and restart your terminal.

Installing and Setting Up Git

The first thing you’ll want to do after installing Git is configure your global username and email. These details will be attached to all your commits.
git config --global user.name "Your Name"
git config --global user.email "you@your-domain.com"

Add a Better Git Log View

You can create a helpful alias to visualize your Git commit history more clearly:
git config --global alias.lg "log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit"
Now, you can view a clean, colorized Git log using:
git lg

Set main as Default Branch

By default, Git creates a branch named master. If you want your default branch name to be main when initializing new repos, set it like this:
git config --global init.defaultBranch main

View Your Git Configuration

To check all your global Git settings:
git config --list
Or create an alias for quick access:
alias gitconfig="git config --list"

Setting Up SSH Keys

There are two common approaches to managing SSH keys:
  1. Using a single key for all services
  2. Generating a separate key for each service (recommended for better security and separation)
I prefer the second approach, and in this section, I’ll walk you through it by connecting to GitHub via SSH.

Step 1: Create a New SSH Key

First, navigate to your ~/.ssh directory (create it if it doesn’t exist):
# create a new directory in case the folder doesn’t already exist
mkdir -p ~/.ssh
cd ~/.ssh
# Optional: create an alias for quick access
# alias sshhome="cd ~/.ssh"
Now generate a new SSH key:
ssh-keygen -t ed25519 -C "github"
# Recommended file name: github
# Set a secure passphrase and store it somewhere safe

Step 2: Verify the Key

Check that the key was generated with the passphrase:
ssh-keygen -y -f github
# You'll be prompted for your passphrase

Step 3: Configure SSH to Use the Key

If the SSH config file doesn’t already exist, create it:
# in case the file doesn't exist yet
touch ~/.ssh/config
Then add the following configuration to use your new key automatically:
Host github.com
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/github
This tells SSH to use your custom key whenever you connect to GitHub.

Step 4: Add Key to macOS Keychain

ssh-add --apple-use-keychain ~/.ssh/github

Step 5: Add the Public Key to GitHub

You can either copy the key manually or use the GitHub CLI (gh) to add it:
# Copy the public key to your clipboard
pbcopy < ~/.ssh/github.pub
# Then paste it on https://github.com/settings/keys
Or, using the GitHub CLI:
brew install gh # if not already installed
gh auth login  # follow the interactive prompts
# Add your SSH key
gh ssh-key add ~/.ssh/github.pub -t "GitHub Key"
That’s it! You’ve:
  • Generated a dedicated SSH key for GitHub
  • Protected it with a passphrase
  • Configured automatic usage in terminal sessions
  • And linked it to your GitHub account
You can now securely push, pull and clone over SSH.

Setting Up Node.js via NVM

Node Version Manager (NVM) is a command-line tool that lets you install, manage and switch between multiple versions of Node.js. It is particularly beneficial when handling projects that require various versions of Node.js.
Assuming you’ve already installed nvm using Homebrew (as described earlier), complete the setup with:
echo "source $(brew --prefix nvm)/nvm.sh" >> ~/.zshrc
source ~/.zshrc
# Or use an alias like:
# zshsource

Install the Latest LTS Version

nvm install --lts
After installation, check that both Node.js and npm (Node Package Manager) are installed successfully.
node -v  # Displays the installed Node.js version
npm -v  # Displays the installed npm version

Update npm to the Latest Version

npm install -g npm@latest

Set npm Author Default (Optional)

To save time when initializing new projects, you can configure npm’s default author metadata:
npm set init-author-name="your name"
npm set init-author-email="you@example.com"
npm set init-author-url="example.com"

Log in to npm (For Library Authors)

If you plan to publish packages to npm:
npm adduser

Managing Node.js Versions

To list all installed Node versions:
nvm list
To install a newer version and carry over global packages from your current version:
nvm install <version> --reinstall-packages-from=$(nvm current)
nvm use <version>
nvm alias default <version>
This installs the specified version, switches to it, and sets it as the default for future terminal sessions—while preserving global packages.

View Global npm Packages

npm list -g --depth=0
You’re all set! You now have a fully working version of Node.js and npm—ready for development.

Setting Up Your First Web Project with Vite

At this point, you can start your web development project either for frontend or backend. Since JavaScript is the fundamental language for the web, this section will guide you on how to quickly scaffold a frontend-focused web project using Vite, a lightning-fast modern build tool.

Setting Up Vite

Vite is a modern frontend build tool created by Evan You (the creator of Vue.js). It’s designed to be extremely fast and efficient, helping developers build the next generation of web applications.
Vite offers features like instant server startup, lightning-fast hot module replacement (HMR), optimized production builds and built-in support for TypeScript, JSX, CSS and more. It also works seamlessly with popular frameworks like React, Vue and others right out of the box.
With Vite, you can skip the complex, tedious JavaScript development environment setup and dive straight into building your app.
To scaffold a new Vite project, run the following command :
npm create vite@latest  my-first-project
This command will run to configure every necessary tool to scaffold a local development environment.
> npx
> "create-vite" my-first-project
│
◆  Select a framework:
│  ● Vanilla
│  ○ Vue
│  ○ React
│  ○ Preact
│  ○ Lit
│  ○ Svelte
│  ○ Solid
│  ○ Qwik
│  ○ Angular
│  ○ Marko
│  ○ Others
└
Vite can bootstrap various frontend frameworks and libraries. Select Vanilla to scaffold a plain web project.
Vite will ask you to choose a language, either JavaScript or TypeSscript. You can choose whichever one you prefer for your project. Use your arrow keys to get to your selection (here I have selected JavaScript):
◆  Select a variant:
│  ○ TypeScript
│  ○ TypeScript + SWC
│  ● JavaScript
│  ○ JavaScript + SWC
│  ○ React Router v7 ↗
│  ○ TanStack Router ↗
│  ○ RedwoodSDK ↗
You can see other options with SWC. SWC (Speedy Web Compiler) is a JavaScript/TypeScript compiler used in Vite for transforming JavaScript and TypeScript code. It’s a fast, low-level JavaScript and TypeScript compiler built with Rust, designed to deliver faster build times and better performance. For this guide, we’re sticking with the basic JavaScript option.
After setting up the framework, you will see an output that the project has been scaffolded in your project folder. Vite will then instruct you to install dependencies using npm(or any package manager you’re using):
◇  Scaffolding project **in** /Users/mac/my-first-project...
│
└  Done. Now run:
cd my-first-project
npm install
npm run dev
Navigate to your project folder as directed:
cd my-first-project
Then install the dependencies for this project:
npm install
Next, start the development server to verify everything is working. Use the following command to run the development server:
npm run dev
This command will then run your project in development mode. It will prompt the following outputs:
VITE v6.3.5  ready in 1227 ms

➜  Local:  http://localhost:5173/

➜  Network: use --host to expose

➜  press h + enter to show help
Next, click on the link (http://localhost:5173/) to open the project in your browser:
Setting up Vanilla JavaScript Project with Vite

Setting Up Visual Studio Code

While you’re free to use any code editor, VS Code is my go-to code editor for web development. It’s fast, lightweight, and has a vast library of extensions that enhance productivity and are suitable for web development.

Install and Configure VS Code

You can download VS Code from https://code.visualstudio.com.
Once installed, I recommend enabling the code command from the terminal:
  1. Press Cmd + Shift + P
  2. Search for and run Shell Command: Install 'code' command in PATH
Now you can use code to open any file or folder in VSCode directly from the terminal.
code .

Optional: My Personal VS Code Setup

This is my personal preference—you don’t have to follow it, but if you’re curious about my workspace:

Move Search to Bottom Panel

I prefer moving the search view from the sidebar to the panel (bottom area). You can configure this via the Command Palette or JSON settings.

My VS Code Settings JSON

The JSON setting is long, so I’ve saved my settings file here for you: VS Code Settings JSON.
Feel free to explore or use it as a starting point.

My Keybindings

Here are some of my custom keyboard shortcuts (stored in keybindings.json):
[
{
"key": "shift+cmd+e",
"command": "editor.action.copyLinesDownAction",
"when": "editorTextFocus && !editorReadonly"
},
{
"key": "shift+alt+down",
"command": "-editor.action.copyLinesDownAction",
"when": "editorTextFocus && !editorReadonly"
},
{
"key": "shift+cmd+d",
"command": "editor.action.deleteLines",
"when": "textInputFocus && !editorReadonly"
},
{
"key": "shift+cmd+k",
"command": "-editor.action.deleteLines",
"when": "textInputFocus && !editorReadonly"
}
]
These are totally optional. You can customize VS Code however suits your style best.

Must-Have VS Code Extensions for Web Dev

There are numerous extensions in VS Code for web development. Here are my top seven:
You can explore more on the Visual Studio Marketplace.
With Vite and VS Code set up, you’re now ready to start building fast, modern frontend apps with zero configuration hassle.

Optional macOS Tweaks & Customizations

System Preferences

Appearance

  • Enable Dark Mode.
  • Set Scroll Bars to: Always show

Dock

  • Remove unused apps from the Dock
  • Enable Auto-hide Dock.
  • Enable Show indicators for open apps.
  • Enable Show recent applications in Dock.
  • Go to Battery settings and enable: Show Percentage

Security & Privacy

  • Turn on FileVault to encrypt your SSD.
  • Under App Permissions: Allow apps from App Store and identified developers
  • In Screen Recording: Add your browser

Sharing

  • “Change computer name from the terminal”
Update your system name (optional but helpful for networks or Airdrop):
sudo scutil --set ComputerName "Your-Mac"

sudo scutil --set LocalHostName "Your-Mac"

sudo scutil --set HostName "Your-Mac"
Also, disable file sharing unless needed.

Keyboard Settings

  • In Mission Control: Disable all shortcuts
  • Set Fn key to: “Do Nothing”
  • Key Repeat: Fast
  • Delay Until Repeat: Short
  • Under Text settings:
    • Disable “Capitalize words automatically”
    • Disable “Smart quotes and dashes”
    • Disable “Add period with double‑space”
    • Use straight quotes: " and '

Trackpad Settings

  • Tracking Speed: Max
  • Enable Tap to Click
  • Under Point & Click: Disable “Look up & data detectors”
  • Under More Gestures: Disable “Notification Center” gesture

Terminal Defaults (macOS)

Some of my favorite defaults tweaks via terminal:
# Show Library folder

chflags nohidden ~/Library

# Show hidden files in Finder

defaults write com.apple.finder AppleShowAllFiles YES

# Show path bar and status bar

defaults write com.apple.finder ShowPathbar -bool true

defaults write com.apple.finder ShowStatusBar -bool true

# Disable swipe-to-navigate in Chrome

defaults write com.google.Chrome AppleEnableSwipeNavigateWithScrolls -bool false

# Prevent Preview from reopening previously opened files

defaults write com.apple.Preview ApplePersistenceIgnoreState YES

iTerm2 Setup (Optional)

If you use iTerm2 instead of the default Terminal app, here are some customizations I personally recommend:
  • Set Iterm2 as the default terminal
  • Preferences -> Appearances:
  • Under Windows, check: “Hide Scrollbar”
  • Under Tabs, uncheck: “Show tab bar in fullscreen”
  • Profiles -> Window:
  • Transparency: 10%
  • Style: Full Screen
  • Screen: Main Screen
  • Profiles -> Advanced:
  • Set Semantic History -> Open with editor to Visual Studio Code

Wrapping Up

By now, your Mac is no longer just a fresh machine—it’s a fully loaded development powerhouse tailored for modern web development. You’ve installed the essential tools, customized your terminal, set up Node.js, secured your GitHub workflow with SSH, and even scaffolded your first frontend project using Vite.
If you’re working with JavaScript, this guide provides the essential setup you’ll need for any frontend or backend web project with frameworks such as React, Vue, Angular, Next.js, Express.js or Nest.js. Even if you’re using other web development stacks, such as ASP.NET with Blazor, Python with Django, or Ruby on Rails, this guide still offers a solid foundation for web development on macOS, you’ll just need to refer to their specific documentation for your chosen stack to complete your setup or you can check the further resources section for reference.
Everything we’ve covered, from macOS settings and shell tweaks to VS Code enhancements, is about one thing: removing friction so you can focus on building. Of course, your setup will evolve over time, but with this foundation in place, you’re already way ahead of the curve.
Happy coding! Welcome to a smoother, faster and more enjoyable coding experience on macOS.

Further Resources

"Eleftheria Drosopoulou" / 2025-09-26 a month ago / 未收藏/ Java Code Geeks发送到 kindle
DevOps practices have revolutionized software delivery, but the ever-growing complexity of systems introduces new challenges. Build failures, flaky tests, inefficient pipelines, and resource bottlenecks can slow down delivery cycles. This is where AI and Machine Learning (ML) step in, bringing intelligence to continuous integration and continuous deployment (CI/CD). By learning from historical data and real-time …
"Omozegie Aziegbe" / 2025-09-26 a month ago / 未收藏/ Java Code Geeks发送到 kindle
Efficient handling of large file uploads and downloads is a common requirement in modern web applications. Traditional approaches often buffer entire files in memory or on disk, which can lead to excessive resource usage and performance bottlenecks when working with large payloads. To overcome these limitations, Spring provides mechanisms for streaming multipart data sequentially. In …
"Omozegie Aziegbe" / 2025-09-26 a month ago / 未收藏/ Java Code Geeks发送到 kindle
When building applications in Java that deal with two-dimensional data, one of the most common needs is to represent and store X and Y coordinates. These coordinates may represent points on a graph, pixel positions in a user interface, or nodes in a simulation. There are multiple ways to model this data in Java, each …
"Eleftheria Drosopoulou" / 2025-09-27 a month ago / 未收藏/ Java Code Geeks发送到 kindle
In Java development, bugs often arise not from logic errors but from unintended side effects—mutable state being the most notorious culprit. A single unnoticed modification to a shared object can cascade through your application, creating subtle, hard-to-reproduce issues. The solution? Embracing immutability through value objects. By designing immutable types, you can make your code safer, …
{"_":"\n\t\t\t\tby \t\t\t\t\t","a":[{"_":"Michel Ferreira","$":{"itemprop":"url","class":"author","rel":"author","href":"https://alistapart.com/author/michel-ferreira/"}}]} / 2025-09-27 a month ago / 未收藏/ A List Apart: The Full Feed发送到 kindle
"Language is not merely a set of unrelated sounds, clauses, rules, and meanings; it is a totally coherent system bound to context and behavior." — Kenneth L. Pike
The web has accents. So should our design systems.

Design Systems as Living Languages

Design systems aren't component libraries—they’re living languages. Tokens are phonemes, components are words, patterns are phrases, layouts are sentences. The conversations we build with users become the stories our products tell.
But here’s what we've forgotten: the more fluently a language is spoken, the more accents it can support without losing meaning. English in Scotland differs from English in Sydney, yet both are unmistakably English. The language adapts to context while preserving core meaning. This couldn’t be more obvious to me, a Brazilian Portuguese speaker, who learned English with an American accent, and lives in Sydney.
Our design systems must work the same way. Rigid adherence to visual rules creates brittle systems that break under contextual pressure. Fluent systems bend without breaking.
Consistency becomes a prison
The promise of design systems was simple: consistent components would accelerate development and unify experiences. But as systems matured and products grew more complex, that promise has become a prison. Teams file “exception” requests by the hundreds. Products launch with workarounds instead of system components. Designers spend more time defending consistency than solving user problems.
Our design systems must learn to speak dialects.
A design dialect is a systematic adaptation of a design system that maintains core principles while developing new patterns for specific contexts. Unlike one-off customizations or brand themes, dialects preserve the system’s essential grammar while expanding its vocabulary to serve different users, environments, or constraints.

When Perfect Consistency Fails

At Booking.com, I learned this lesson the hard way. We A/B-tested everything—color, copy, button shapes, even logo colors. As a professional with a graphic design education and experience building brand style guides, I found this shocking. While everyone fell in love with Airbnb’s pristine design system, Booking grew into a giant without ever considering visual consistency.  
The chaos taught me something profound: consistency isn’t ROI; solved problems are.
At Shopify. Polaris (https://polaris-react.shopify.com/) was our crown jewel—a mature design language perfect for merchants on laptops. As a product team, we were expected to adopt Polaris as-is. Then my fulfillment team hit an “Oh, Ship!” moment, as we faced the challenge of building an app for warehouse pickers using our interface on shared, battered Android scanners in dim aisles, wearing thick gloves, scanning dozens of items per minute, many with limited levels of English understanding.
Task completion with standard Polaris: 0%.
Every component that worked beautifully for merchants failed completely for pickers. White backgrounds created glare. 44px tap targets were invisible to gloved fingers. Sentence-case labels took too long to parse. Multi-step flows confused non-native speakers.
We faced a choice: abandon Polaris entirely, or teach it to speak warehouse.

The Birth of a Dialect

We chose evolution over revolution. Working within Polaris’s core principles—clarity, efficiency, consistency—we developed what we now call a design dialect:
ConstraintFluent MoveRationale
Glare & low lightDark surfaces + light textReduce glare on low-DPI screens
Gloves & haste90px tap targets (~2cm)Accommodate thick gloves
MultilingualSingle-task screens, plain languageReduce cognitive load
Result: Task completion jumped from 0% to 100%. Onboarding time dropped from three weeks to one shift.
This wasn’t customization or theming—this was a dialect: a systematic adaptation that maintained Polaris’s core grammar while developing new vocabulary for a specific context. Polaris hadn’t failed; it had learned to speak warehouse.

The Flexibility Framework

At Atlassian, working on the Jira platform—itself a system within the larger Atlassian system—I pushed for formalizing this insight. With dozens of products sharing a design language across different codebases, we needed systematic flexibility so we built directly into our ways of working. The old model—exception requests and special approvals—was failing at scale.
We developed the Flexibility Framework to help designers define how flexible they wanted their components to be:
TierActionOwnership
ConsistentAdopt unchangedPlatform locks design + code
OpinionatedAdapt within boundsPlatform provides smart defaults, products customize
FlexibleExtend freelyPlatform defines behavior, products own presentation
During a navigation redesign, we tiered every element. Logo and global search stayed Consistent. Breadcrumbs and contextual actions became Flexible. Product teams could immediately see where innovation was welcome and where consistency mattered.

The Decision Ladder

Flexibility needs boundaries. We created a simple ladder for evaluating when rules should bend:
Good: Ship with existing system components. Fast, consistent, proven.
Better: Stretch a component slightly. Document the change. Contribute improvements back to the system for all to use.
Best: Prototype the ideal experience first. If user testing validates the benefit, update the system to support it.
The key question: “Which option lets users succeed fastest?”
Rules are tools, not relics.

Unity Beats Uniformity

Gmail, Drive, and Maps are unmistakably Google—yet each speaks with its own accent. They achieve unity through shared principles, not cloned components. One extra week of debate over button color costs roughly $30K in engineer time.
Unity is a brand outcome; fluency is a user outcome. When the two clash, side with the user.

Governance Without Gates

How do you maintain coherence while enabling dialects? Treat your system like a living vocabulary:
Document every deviation – e.g., dialects/warehouse.md with before/after screenshots and rationale.
Promote shared patterns – when three teams adopt a dialect independently, review it for core inclusion.
Deprecate with context – retire old idioms via flags and migration notes, never a big-bang purge.
A living dictionary scales better than a frozen rulebook.

Start Small: Your First Dialect

Ready to introduce dialects? Start with one broken experience:
This week: Find one user flow where perfect consistency blocks task completion. Could be mobile users struggling with desktop-sized components, or accessibility needs your standard patterns don’t address.
Document the context: What makes standard patterns fail here? Environmental constraints? User capabilities? Task urgency?
Design one systematic change: Focus on behavior over aesthetics. If gloves are the problem, bigger targets aren’t “"breaking the system”"—they’re serving the user. Earn the variations and make them intentional.
Test and measure: Does the change improve task completion? Time to productivity? User satisfaction?
Show the savings: If that dialect frees even half a sprint, fluency has paid for itself.

Beyond the Component Library

We’re not managing design systems anymore—we’re cultivating design languages. Languages that grow with their speakers. Languages that develop accents without losing meaning. Languages that serve human needs over aesthetic ideals.
The warehouse workers who went from 0% to 100% task completion didn’t care that our buttons broke the style guide. They cared that the buttons finally worked.
Your users feel the same way. Give your system permission to speak their language.
"hello@smashingmagazine.com (Lyndon Cerejo)" / 2025-09-26 a month ago / 未收藏/ smashingmagazine发送到 kindle
What if your best AI prompts didn’t disappear into your unorganized chat history, but came back tomorrow as a reliable assistant? In this article, you’ll learn how to turn one-off “aha” prompts into reusable assistants that are tailored to your audience, grounded in your knowledge, and consistent every time, saving you (and your team) from typing the same 448-word prompt ever again.
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
OpenAI与Databricks携手1亿美元:企业AI代理时代来临 在人工智能浪潮席卷全球的当下,OpenAI与Databricks的合作无疑是今年最引人注目的技术联盟之一。 2025年9月25日,两家公司正式宣布签署一项多年度、价值1亿美元的战略伙伴关系:这一协议将OpenAI的最新模型,包括备受期待的GPT-5,直接集成到Databricks的Agent Bricks和Data Intelligence Platforms中,从而让全球超过2万家Databricks客户瞬间获得这些前沿AI能力的访问权
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
特斯拉新专利通过三曲线泵壳与自动转子定位机制,实现纯机械式双向驱动下的单向流体输送,无需阀门或电子控制,显著提升电驱系统润滑可靠性并降低成本。 为什么电动车倒车的时候,变速箱里的润滑油不会“倒流”?这听起来好像不是什么大事,但其实背后藏着一个让工程师头疼几十年的难题——传统油泵一旦反转,就会把已经过滤掉的脏东西重新冲回油底壳,甚至产生真空负压,把密封圈直接吸坏! 但现在,特斯拉用一个纯机械的绝妙设计,彻底解决了这个问题,而且连一个电子元件都没用! 今天我们
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
澳大利亚的维多利亚成为第一个达到千兆瓦大电池充电的电网:吸收了屋顶太阳能的一半。电池充电达到1,049兆瓦的峰值,打破了本月早些时候创下的789兆瓦的充电率纪录。 引言:一个划时代的充电高峰 2025年9月24日下午1点45分,澳大利亚维多利亚州(Victoria)的电力市场迎来一个里程碑时刻:该州的大规模电池储能系统(Big Battery Storage)总充电功率首次突破1吉瓦(GW),达到1049.3兆瓦(MW)的峰值。这一成就标志
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
雷军坦言小米拆解三台Model Y研究,但真正壁垒在于特斯拉的软件集成与制造系统,工厂才是核心产品,未来竞争在于“制造机器”的创新能力。 雷军今天在年度演讲中亲口承认:今年年初,小米内部一口气买了三台特斯拉Model Y,全部拆开做研究。他由衷感叹:“这真是一辆了不起的车。”更耐人寻味的是,他还半开玩笑地说:“如果你不喜欢小米YU7,那就选Model Y吧。”这话听起来轻松,背后却藏着中国新势力造车企业普遍面临的深层困境——拆得开一辆车,却未必能复制出一辆真正有竞争力的电动车。 作为工程师,我必须指出:拆解
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
尼克·莱恩提出生命起源于碱性热液喷口,地球天然质子梯度驱动了首个细胞的诞生,解释了LUCA的统一性与细菌/古菌的分化。 我们身体里每一个细胞的能量来源,其实和地球深处的岩石、海水、火山喷口有着千丝万缕的联系?不是玄学,不是科幻,而是当代顶尖生物化学家尼克·莱恩(Nick Lane)用几十年研究提出的惊人理论:生命并非凭空诞生,而是地球地质化学过程的自然延续。 换句话说,你体内的ATP、你的细胞膜、你呼吸时依赖的质子梯度,这些看似“生命专属”的机制,其实早在第一个细胞出现之前,就在地球的碱性热液喷口里默默运行
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
HighPoint发布支持GPUDirect的PCIe 5.0智能交换卡Rocket 7638D,实现GPU与NVMe直连,带宽达64GB/s,大幅提升AI训练效率。 在本周四,全球领先的存储与扩展解决方案厂商HighPoint正式发布了其划时代新品——Rocket 7638D PCIe 5.0智能交换卡。这款产品可不是普通的扩展卡,它专为打通AI训练与推理中的“最后一公里”瓶颈而生,真正实现了GPU与NVMe固态硬盘之间的“直连通信”,彻底绕过CPU和系统内存,让数据传输快到飞起! 你可能会问,这
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
DeepSeek V3.1 Terminus在推理模式下登顶开源模型榜首,与gpt-oss-120b并列第一,小幅领先Qwen3 235B,在指令遵循、长上下文和终端编码能力上实现显著跃升。第一章:风云再起——中国AI的“王座之争” 阿里巴巴旗下的通义千问(Qwen)与独立AI公司DeepSeek,如同两位武林高手,在“最强大脑”的擂台上反复交锋。 而就在近日,DeepSeek祭出一记重拳——DeepSeek V3.1 Ter
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
阿里押注530亿美元打造中国AI全栈生态,以开源模型圈开发者、自研芯片建算力底座,剑指“AI时代安卓+AWS”,豪赌科技自主未来。 2025年9月25日那个烟雨朦胧的杭州清晨,阿里巴巴一年一度的“云栖大会”(Apsara Conference)本该是老套路——讲讲云计算升级、晒晒客户合作、放点PPT就散场。 可谁能想到,新任CEO吴泽泓(Eddie Wu)一上台,直接扔出三颗“核弹”:第一,把原本已经吓人的530亿美元AI基础设施投资计划再加码;第二,发布号称参数破万亿的“通义千问3-Max
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
量化交易中盯PnL曲线容易被假象误导,真正的方法是用统计假设检验区分运气与实力,避免陷入盈亏幻觉,实现更快更稳的策略迭代。 PnL就是 Profit and Loss 的缩写,中文意思就是 盈亏。在交易和投资里,它就是那条最直观的“成绩单”: Profit(利润):赚的钱。 Loss(亏损):赔的钱。 合在一起,PnL就是“最终到底赚了多少、亏了多少”。举个例子: 今天你用某个交易策略买卖股票,最后赚了 500 美元,那今天的PnL就是 +500。 如果亏了 200 美元,那P
"banq" / 2025-09-26 a month ago / 未收藏/ jdon发送到 kindle
2025年12大网络数据采集服务深度测评,从企业级高端到高性价比入门款全覆盖,助你高效获取商业情报,告别爬虫维护烦恼。 2025年最值得入手的12大网络数据采集神器!别再自己写爬虫了,省下90%开发时间! 2025年最佳Web数据抓取工具Oxylabs——<
"Lena Morozova" / 2025-09-26 a month ago / 未收藏/ Company Blog发送到 kindle
In Part 1 of this series, we introduced some of the Java community’s most recognized open-source projects. Now, we’re back with more standouts: projects that speed up builds, strengthen testing, and simplify working with modern web stacks. And as always, IntelliJ IDEA helps maintainers move faster, confidently, and with a focus on quality. 🌿 jsoup […]
"Ned Batchelder" / 2025-09-26 a month ago / 未收藏/ Ned Batchelder's blog发送到 kindle
I saw a generative art piece I liked and wanted to learn how it was made. Starting with the artist’s Kotlin code, I dug into three new algorithms, hacked together some Python code, experimented with alternatives, and learned a lot. Now I can explain it to you.
It all started with this post by aBe on Mastodon:
I love how these lines separate and reunite. And the fact that I can express this idea in 3 or 4 lines of code.
For me they’re lives represented by closed paths that end where they started, spending part of the journey together, separating while we go in different directions and maybe reconnecting again in the future.
#CreativeCoding #algorithmicart #proceduralArt #OPENRNDR #Kotlin
80 wobbly black hobby curves with low opacity. In some places the curves travel together, but sometimes they split in 2 or 3 groups and later reunite. Due to the low opacity, depending on how many curves overlap the result is brighter or darker.

The drawing is made by choosing 10 random points, drawing a curve through those points, then slightly scooching the points and drawing another curve. There are 40 curves, each slightly different than the last. Occasionally the next curve makes a jump, which is why they separate and reunite.
Eventually I made something similar:
Along the way I had to learn about three techniques I got from the Kotlin code: Hobby curves, Hilbert sorting, and simplex noise.
Each of these algorithms tries to do something “natural” automatically, so that we can generate art that looks nice without any manual steps.

Hobby curves

To draw swoopy curves through our random points, we use an algorithm developed by John Hobby as part of Donald Knuth’s Metafont type design system. Jake Low has a great interactive page for playing with Hobby curves, you should try it.
Here are three examples of Hobby curves through ten random points:
The curves are nice, but kind of a scribble, because we’re joining points together in the order we generated them (shown by the green lines). If you asked a person to connect random points, they wouldn’t jump back and forth across the canvas like this. They would find a nearby point to use next, producing a more natural tour of the set.
We’re generating everything automatically, so we can’t manually intervene to choose a natural order for the points. Instead we use Hilbert sorting.

Hilbert sorting

The Hilbert space-filling fractal visits every square in a 2D grid. Hilbert sorting uses a Hilbert fractal traversing the canvas, and sorts the points by when their square is visited by the fractal. This gives a tour of the points that corresponds more closely to what people expect. Points that are close together in space are likely (but not guaranteed) to be close in the ordering.
If we sort the points using Hilbert sorting, we get much nicer curves. Here are the same points as last time:
Here are pairs of the same points, unsorted and sorted side-by-side:
If you compare closely, the points in each pair are the same, but the sorted points are connected in a better order, producing nicer curves.

Simplex noise

Choosing random points would be easy to do with a random number generator, but we want the points to move in interesting graceful ways. To do that, we use simplex noise. This is a 2D function (let’s call the inputs u and v) that produces a value from -1 to 1. The important thing is the function is continuous: if you sample it at two (u,v) coordinates that are close together, the results will be close together. But it’s also random: the continuous curves you get are wavy in unpredictable ways. Think of the simplex noise function as a smooth hilly landscape.
To get an (x,y) point for our drawing, we choose a (u,v) coordinate to produce an x value and a completely different (u,v) coordinate for the y. To get the next (x,y) point, we keep the u values the same and change the v values by just a tiny bit. That makes the (x,y) points move smoothly but interestingly.
Here are the trails of four points taking 50 steps using this scheme:
If we use seven points taking five steps, and draw curves through the seven points at each step, we get examples like this:
I’ve left the points visible, and given them large steps so the lines are very widely spaced to show the motion. Taking out the points and drawing more lines with smaller steps gives us this:
With 40 lines drawn wider with some transparency, we start to see the smoky fluidity:

Jumps

In his Mastodon post, aBe commented on the separating of the lines as one of the things he liked about this. But why do they do that? If we are moving the points in small increments, why do the curves sometimes make large jumps?
The first reason is because of Hobby curves. They do a great job drawing a curve through a set of points as a person might. But a downside of the algorithm is sometimes changing a point a small amount makes the entire curve take a different route. If you play around with the interactive examples on Jake Low’s page you will see the curve can unexpectedly take a different shape.
As we inch our points along, sometimes the Hobby curve jumps.
The second reason is due to Hilbert sorting. Each of our lines is sorted independently of how the previous line was sorted. If a point’s small motion moves it into a different grid square, it can change the sorting order, which changes the Hobby curve even more.
If we sort the first line, and then keep that order of points for all the lines, the result has fewer jumps, but the Hobby curves still act unpredictably:

Colophon

This was all done with Python, using other people’s implementations of the hard parts: hobby.py, hilbertcurve, and super-simplex. My code is on GitHub (nedbat/fluidity), but it’s a mess. Think of it as a woodworking studio with half-finished pieces and wood chips strewn everywhere.
A lot of the learning and experimentation was in my Jupyter notebook. Part of the process for work like this is playing around with different values of tweakable parameters and seeds for the random numbers to get the effect you want, either artistic or pedagogical. The notebook shows some of the thumbnail galleries I used to pick the examples to show.
I went on to play with animations, which led to other learnings, but those will have to wait for another blog post.
"Bruce Schneier" / 2025-09-24 a month ago / 未收藏/ Schneier on Security发送到 kindle
Today’s world requires us to make complex and nuanced decisions about our digital security. Evaluating when to use a secure messaging app like Signal or WhatsApp, which passwords to store on your smartphone, or what to share on social media requires us to assess risks and make judgments accordingly. Arriving at any conclusion is an exercise in threat modeling.
In security, threat modeling is the process of determining what security measures make sense in your particular situation. It’s a way to think about potential risks, possible defenses, and the costs of both. It’s how experts avoid being distracted by irrelevant risks or overburdened by undue costs.
We threat model all the time. We might decide to walk down one street instead of another, or use an internet VPN when browsing dubious sites. Perhaps we understand the risks in detail, but more likely we are relying on intuition or some trusted authority. But in the U.S. and elsewhere, the average person’s threat model is changing—specifically involving how we protect our personal information. Previously, most concern centered on corporate surveillance; companies like Google and Facebook engaging in digital surveillance to maximize their profit. Increasingly, however, many people are worried about government surveillance and how the government could weaponize personal data.
Since the beginning of this year, the Trump administration’s actions in this area have raised alarm bells: The Department of Government Efficiency (DOGE) took data from federal agencies, Palantir combined disparate streams of government data into a single system, and Immigration and Customs Enforcement (ICE) used social media posts as a reason to deny someone entry into the U.S.
These threats, and others posed by a techno-authoritarian regime, are vastly different from those presented by a corporate monopolistic regime—and different yet again in a society where both are working together. Contending with these new threats requires a different approach to personal digital devices, cloud services, social media, and data in general.

What Data Does the Government Already Have?

For years, most public attention has centered on the risks of tech companies gathering behavioral data. This is an enormous amount of data, generally used to predict and influence consumers’ future behavior—rather than as a means of uncovering our past. Although commercial data is highly intimate—such as knowledge of your precise location over the course of a year, or the contents of every Facebook post you have ever created—it’s not the same thing as tax returns, police records, unemployment insurance applications, or medical history.
The U.S. government holds extensive data about everyone living inside its borders, some of it very sensitive—and there’s not much that can be done about it. This information consists largely of facts that people are legally obligated to tell the government. The IRS has a lot of very sensitive data about personal finances. The Treasury Department has data about any money received from the government. The Office of Personnel Management has an enormous amount of detailed information about government employees—including the very personal form required to get a security clearance. The Census Bureau possesses vast data about everyone living in the U.S., including, for example, a database of real estate ownership in the country. The Department of Defense and the Bureau of Veterans Affairs have data about present and former members of the military, the Department of Homeland Security has travel information, and various agencies possess health records. And so on.
It is safe to assume that the government has—or will soon have—access to all of this government data. This sounds like a tautology, but in the past, the U.S. government largely followed the many laws limiting how those databases were used, especially regarding how they were shared, combined, and correlated. Under the second Trump administration, this no longer seems to be the case.

Augmenting Government Data with Corporate Data

The mechanisms of corporate surveillance haven’t gone away. Compute technology is constantly spying on its users—and that data is being used to influence us. Companies like Google and Meta are vast surveillance machines, and they use that data to fuel advertising. A smartphone is a portable surveillance device, constantly recording things like location and communication. Cars, and many other Internet of Things devices, do the same. Credit card companies, health insurers, internet retailers, and social media sites all have detailed data about you—and there is a vast industry that buys and sells this intimate data.
This isn’t news. What’s different in a techno-authoritarian regime is that this data is also shared with the government, either as a paid service or as demanded by local law. Amazon shares Ring doorbell data with the police. Flock, a company that collects license plate data from cars around the country, shares data with the police as well. And just as Chinese corporations share user data with the government and companies like Verizon shared calling records with the National Security Agency (NSA) after the Sept. 11 terrorist attacks, an authoritarian government will use this data as well.

Personal Targeting Using Data

The government has vast capabilities for targeted surveillance, both technically and legally. If a high-level figure is targeted by name, it is almost certain that the government can access their data. The government will use its investigatory powers to the fullest: It will go through government data, remotely hack phones and computers, spy on communications, and raid a home. It will compel third parties, like banks, cell providers, email providers, cloud storage services, and social media companies, to turn over data. To the extent those companies keep backups, the government will even be able to obtain deleted data.
This data can be used for prosecution—possibly selectively. This has been made evident in recent weeks, as the Trump administration personally targeted perceived enemies for “mortgage fraud.” This was a clear example of weaponization of data. Given all the data the government requires people to divulge, there will be something there to prosecute.
Although alarming, this sort of targeted attack doesn’t scale. As vast as the government’s information is and as powerful as its capabilities are, they are not infinite. They can be deployed against only a limited number of people. And most people will never be that high on the priorities list.

The Risks of Mass Surveillance

Mass surveillance is surveillance without specific targets. For most people, this is where the primary risks lie. Even if we’re not targeted by name, personal data could raise red flags, drawing unwanted scrutiny.
The risks here are twofold. First, mass surveillance could be used to single out people to harass or arrest: when they cross the border, show up at immigration hearings, attend a protest, are stopped by the police for speeding, or just as they’re living their normal lives. Second, mass surveillance could be used to threaten or blackmail. In the first case, the government is using that database to find a plausible excuse for its actions. In the second, it is looking for an actual infraction that it could selectively prosecute—or not.
Mitigating these risks is difficult, because it would require not interacting with either the government or corporations in everyday life—and living in the woods without any electronics isn’t realistic for most of us. Additionally, this strategy protects only future information; it does nothing to protect the information generated in the past. That said, going back and scrubbing social media accounts and cloud storage does have some value. Whether it’s right for you depends on your personal situation.

Opportunistic Use of Data

Beyond data given to third parties—either corporations or the government—there is also data users keep in their possession.This data may be stored on personal devices such as computers and phones or, more likely today, in some cloud service and accessible from those devices. Here, the risks are different: Some authority could confiscate your device and look through it.
This is not just speculative. There are many stories of ICE agents examining people’s phones and computers when they attempt to enter the U.S.: their emails, contact lists, documents, photos, browser history, and social media posts.
There are several different defenses you can deploy, presented from least to most extreme. First, you can scrub devices of potentially incriminating information, either as a matter of course or before entering a higher-risk situation. Second, you could consider deleting—even temporarily—social media and other apps so that someone with access to a device doesn’t get access to those accounts—this includes your contacts list. If a phone is swept up in a government raid, your contacts become their next targets.
Third, you could choose not to carry your device with you at all, opting instead for a burner phone without contacts, email access, and accounts, or go electronics-free entirely. This may sound extreme—and getting it right is hard—but I know many people today who have stripped-down computers and sanitized phones for international travel. At the same time, there are also stories of people being denied entry to the U.S. because they are carrying what is obviously a burner phone—or no phone at all.

Encryption Isn’t a Magic Bullet—But Use It Anyway

Encryption protects your data while it’s not being used, and your devices when they’re turned off. This doesn’t help if a border agent forces you to turn on your phone and computer. And it doesn’t protect metadata, which needs to be unencrypted for the system to function. This metadata can be extremely valuable. For example, Signal, WhatsApp, and iMessage all encrypt the contents of your text messages—the data—but information about who you are texting and when must remain unencrypted.
Also, if the NSA wants access to someone’s phone, it can get it. Encryption is no help against that sort of sophisticated targeted attack. But, again, most of us aren’t that important and even the NSA can target only so many people. What encryption safeguards against is mass surveillance.
I recommend Signal for text messages above all other apps. But if you are in a country where having Signal on a device is in itself incriminating, then use WhatsApp. Signal is better, but everyone has WhatsApp installed on their phones, so it doesn’t raise the same suspicion. Also, it’s a no-brainer to turn on your computer’s built-in encryption: BitLocker for Windows and FileVault for Macs.
On the subject of data and metadata, it’s worth noting that data poisoning doesn’t help nearly as much as you might think. That is, it doesn’t do much good to add hundreds of random strangers to an address book or bogus internet searches to a browser history to hide the real ones. Modern analysis tools can see through all of that.

Shifting Risks of Decentralization

This notion of individual targeting, and the inability of the government to do that at scale, starts to fail as the authoritarian system becomes more decentralized. After all, if repression comes from the top, it affects only senior government officials and people who people in power personally dislike. If it comes from the bottom, it affects everybody. But decentralization looks much like the events playing out with ICE harassing, detaining, and disappearing people—everyone has to fear it.
This can go much further. Imagine there is a government official assigned to your neighborhood, or your block, or your apartment building. It’s worth that person’s time to scrutinize everybody’s social media posts, email, and chat logs. For anyone in that situation, limiting what you do online is the only defense.

Being Innocent Won’t Protect You

This is vital to understand. Surveillance systems and sorting algorithms make mistakes. This is apparent in the fact that we are routinely served advertisements for products that don’t interest us at all. Those mistakes are relatively harmless—who cares about a poorly targeted ad?—but a similar mistake at an immigration hearing can get someone deported.
An authoritarian government doesn’t care. Mistakes are a feature and not a bug of authoritarian surveillance. If ICE targets only people it can go after legally, then everyone knows whether or not they need to fear ICE. If ICE occasionally makes mistakes by arresting Americans and deporting innocents, then everyone has to fear it. This is by design.

Effective Opposition Requires Being Online

For most people, phones are an essential part of daily life. If you leave yours at home when you attend a protest, you won’t be able to film police violence. Or coordinate with your friends and figure out where to meet. Or use a navigation app to get to the protest in the first place.
Threat modeling is all about trade-offs. Understanding yours depends not only on the technology and its capabilities but also on your personal goals. Are you trying to keep your head down and survive—or get out? Are you wanting to protest legally? Are you doing more, maybe throwing sand into the gears of an authoritarian government, or even engaging in active resistance? The more you are doing, the more technology you need—and the more technology will be used against you. There are no simple answers, only choices.
2025-09-27 a month ago / 未收藏/ ongoing by Tim Bray发送到 kindle
This is the blog version of my talk at the IPTC’s online conference. Its title is the one the conference organizers slapped on my session without asking; I was initially going to object but then I thought of the big guitar riff in Dire Straits’ and snickered. If you want, instead of reading, to watch me present, . Here we go.Photo Metadata Conferencethat’s on YouTubePrivate Investigations
Hi all, thanks for having me. Today I represent… nobody, . I’m not on any of the committees nor am I an employee of any of the providers. But I’m a photographer and software developer and social-media activist and have written a lot about C2PA. So under all those hats this is a subject I care about.officially
Also, I posted this on Twitter back in 2017.
I’m not claiming that I was the first with this idea, but I’ve been thinking about the issues for quite a while.
Enough self-introduction. Today I’m going to look at C2PA in practice right now in 2025. Then I’m going to talk about what I think it’s is for. Let’s start with a picture.
I should start by saying that a few of the things that I’m going to show you are, umm, broken. But I’m still a C2PA fan. Bear in mind that at this point everything is beta or preview or whatever, at best v1.0. I think we’re in glass-half-full mode.
This photo is entirely created and processed by off-the-shelf commercial products and has content credentials, and let me say that I had a freaking hard time finding such a photo. There are very few Content Credentials out there on the Internet. That’s because nearly every online photo is delivered either via social media or by professional publishing software. In both cases, the metadata is routinely stripped, bye-bye C2PA. So one of the big jobs facing us in putting Content Credentials to work is to stop publishers from deleting them.
Of course, that’s complicated. Professional publishers probably want the Content Credentials in place, but on social media privacy is a key issue and stripping the metadata is arguably a good default choice. So there are a lot of policy discussions to be had up front of the software work.
Anyhow, let’s look at the C2PA.
I open up that picture in Chrome and there are little “Cr” glyphs at both the top left and top right corners; that’s because I’ve installed multiple C2PA Chrome plug-ins. Turns out these seem to only be available for Chrome, which is irritating. Anyhow, I’ve clicked on the one in the top left.
That’s a little disappointing. It says the credentials were recorded by Lightroom, and gives my name, but I think it’s hiding way more than it’s revealing. Maybe the one on the top right will be more informative?
More or less the same info. A slightly richer presentation But both displays have an “inspect” button and both do the same thing. Let’s click it!
This is the Adobe Content Credentials inspector and it’s broken. That’s disappointing. Having said that, I was in a Discord chat with a senior Adobe person this morning and they’re aware of the problem.
But anyhow, I can drag and drop the picture like they say.
Much much better. It turns out that this picture was originally taken with a Leica M11-P. The photographer is a famous software guy named Rob Pike, who follows me on Mastodon and wanted to help out.
So, thanks Rob, and thanks also to the Leica store in Sydney, Australia, who loaned him the M11. He hasn’t told me how he arranged that, but I’m curious.
I edited it in Lightroom, and if you look close, you can see that I cropped it down and brightened it up. Let’s zoom in on the content credentials for the Leica image.
There’s the camera model, the capture date (which is wrong because Rob didn’t get around to setting the camera’s date before he took the picture.) The additional hardware (R Adapter-M), the dimensions, ISO, focal length, and shutter speed.
Speaking as a photographer, this is kind of cool. There’s a problem in that it’s partly wrong. The focal length isn’t zero, and Rob is pretty sure he didn’t have an adapter on. But Leica is trying to do the right thing and they’ll get there.
Now let’s look at the assertions that were added by Lightroom.
There’s a lot of interesting stuff in here, particularly the provenance. Lightroom lets you manage your identities, using what we call “OAuth flows”, so it can ask Instagram (with my permission) what my Instagram ID is. It goes even further with LinkedIn; it turns out that LinkedIn has an integration with the Clear ID people, the ones who fast-track you at the airport. So I set up a Clear ID, which required photos of my passport, and went through the dance with LinkedIn to link it up, and then with Lightroom so it knew my LinkedIn Id. So to expand, what it’s really saying is: “Adobe says that LinkedIn says that Clear says that the government ID of the person who posted this says that he’s named Timothy Bray”.
I don’t know about you, but this feels like pretty strong provenance medicine to me. I understand that the C2PA committee and the people are re-working the provenance assertions. To them: Please don’t screw this particular style of provenance up.CAWG
Now let’s look at what Lightroom says it did. It may be helpful to know what I in fact did.
Lightroom knows what I did, and you might wonder how it got from those facts to that relatively content-free description that reads like it was written by lawyers. Anyhow, I’d like to know. Since I’m a computer geek, I used the open-source “c2patool” to dump what the assertions actually are. I apologize if this hurts your eyes.
It turns out that there is way more data in those files than the inspector shows. For example, the Leica claims included 29 EXIF values, here are three I selected more or less at random:
Some of these are interesting: In the Leica claims, the serial number. I could see that as a useful provenance claim. Or as a potentially lethal privacy risk. Hmmm.
And in the Lightroom, it actually shows exactly what I did, see the sharpness and exposure values.
My feeling is that the inspector is doing either too much or too little. At the minimal end you could just say “hand processed? Yes/No” and “genAI? Yes/No”. For a photo professional, they might like to drill down and see what I actually did. I don’t see who would find the existing presentation useful. There’s clearly work to do in this space.
Oh wait, did I just say “AI”? Yes, yes I did. Let’s look at another picture, in this case a lousy picture.
I was out for a walk and thought the building behind the tree was interesting. I was disappointed when I pulled it up on the screen, but I still liked the shape and decided to try and save it.
So I used Lightroom’s “Select Sky” recover its color, and “Select Subject” to pull the building details out of the shadows. Both of these Lightroom features, which are pretty magic and I use all the time, are billed as being AI-based. I believe it.
Let’s look at what the C2PA discloses.
Having said all that, if you look at the C2PA (or at the data behind it) Lightroom discloses only “Color or Exposure”, “Cropping”, and “Drawing” edits. Nothing about AI.
Hmm. Is that OK? I personally think it is, and highlights the distinction between what I’d call “automation” AI and Generative AI. I mean, selecting the sky and subject is something that a skilled Photoshop user could accomplish with a lot of tinkering, the software is just speeding things up. But I don’t know, others might disagree.
Well, how about that generative AI?
The turtle is 100% synthetic, from ChatGPT, and on the right is a Pixel 10 shot on which I did a few edits including “Magic Eraser”. Both of these came with Content Credentials; chatGPT’s is actually invalid, but on the glass-half-full front, the Pixel 10’s were also invalid up until a few days ago, then they fixed it. So this stuff does get fixed.
I’m happy about the consistent use of C2PA terminology, they are clearly marking the images as genAI-involved.
I’m about done talking about the state of the Content Credentials art generally but I should probably talk about this device.
Because it marks the arrival of Content Credentials on the mass consumer market. Nobody knows how many Pixels Google actually sells but I guarantee it’s a lot more than Leica sells M11’s. And since Samsung tends to follow Google pretty closely, we’re heading for tens then hundreds of millions of C2PA-generating mobile devices. I wonder when Apple will climb on board?
Let’s have a look at that C2PA.
This view of the C2PA is from the Google Photos app. It’s very limited. In particular, there is nothing in there to support provenance. In fact, it’s the opposite, Google is bending over backward to do anything that could be interpreted as breaking the privacy contract by sharing information about the user.
Let’s pull back the covers and dig a little deeper. Here are a few notes
The C2PA not being optional removes a lot of UI issues but still, well, I’m not smart enough to have fully thought through the implications. That Digital Source Type looks good and appropriate, and the untrusted-ness of the timestamp is interesting.
You notice that my full-workflow examples featured a Leica rather than the Pixel, and that’s because the toolchain is currently broken for me, neither Lightroom nor Photoshop can handle the P10 C2PA. I’ll skip the details, except to say that Adobe is aware of the bug, a version mismatch, and they say they’re working on it.
Before we leave the Pixel 10, I should say that there are plenty of alternate camera apps in Android and iOS, some quite good, and it’d be perfectly possible for them to ship much richer C2PA, notably including provenance, location, and so on.
I guess that concludes my look at the current state of the Content Credentials art. Now I’d like to talk about what Content Credentials are for. To start with, I think it’d be helpful to sort the assertions into three baskets.
Capture, that’s like that Leica EXIF stuff we showed earlier. What kind of camera and lens, what the shooting parameters were. Processing, that’s like the Lightroom report: How was the image manipulated, and by what software. Provenance: Which person or organization produced this?
But I think this picture has an important oversimplification, let me fix that.
Processing is logically where you’d disclose the presence of GenAI. And in terms of what people practically care about, that’s super important and deserves special consideration.
Now I’m going to leave the realm of facts and give you opinions. As for the Capture data there on the left… who cares? Really, I’m trying to imagine a scenario in which anyone cares about the camera or lens or F stop. I guess there’s an exception if you want to prove that the photo was taken by one of Annie Liebowitz’s cameras, but that’s really provenance.
Let’s think about a professional publication scenario. They get photos from photographers, employees or agencies or whatever. They might want to be really sure that the photo was from the photographer and not an imposter. So having C2PA provenance would be nice. Then when the publisher gets photos, they do a routine check of the provenance and if it doesn’t check out, they don’t run the picture without a close look first.
They also probably want to check for the “is there genAI?” indicator in the C2PA, and, well, I don’t know what they might do, but I’m pretty sure they’d want to know.
That same publisher might want to equip the photos they publish with C2PA, to demonstrate that they are really the ones who chose and provided the media. That assertion should be applied routinely by their content management system. Which should be easy, on the technology side anyhow.
So from the point of view of a professional publisher, provenance matters, and being careful about GenAI matters, and in the C2PA domain, I think that’s all that really matters.
Now let’s turn to Social Media, which is the source of most of the images that most people see most days. Today, all the networks strip all the photo metadata, and that decision involves a lot of complicated privacy and intellectual-property thinking. But there is one important FACT that they know: For any new piece of media, they know which account uploaded the damn thing, because that account owner had to log in to do it. So I think it’s a no-brainer that IF THE USER WISHES, they can have a Content Credentials assertion in the photo saying “Initially uploaded by Tim Bray at LinkedIn” or whoever at wherever.
What we’d like to achieve is that if you see some shocking or controversial media, you’d really want to know who originally posted it before you decided whether you believed it, and if Content Credentials are absent, that’s a big red flag. And if the picture is of the current situation in Gaza, your reaction might be different depending on whether it was originally from an Israeli military social-media account, or the Popular Front for the Liberation of Palestine, or by the BBC, or by igor282356057@popular.online.
Anyhow, here’s how I see it:
So for me, it’s the P and A in C2PA that matter – provenance and authenticity. I think the technology has the potential to change the global Internet conversation for the better, by making it harder for liars to lie and easier for truth-tellers to be believed. I think the first steps that have been taken so far are broadly correct and the path forward is reasonably clear. All the little things that are broken, we can fix ‘em.
And there aren’t that many things that matter more than promoting truth and discouraging lies.
And that’s all, folks.
Twitter post from 2017 presaging C2pAPicture of a shopping mall storefrontPicture with two Content Credentials glyphs and one drop-downPicture with two Content Credentials glyphs and one drop-downContent Credentials inspector page, failing to retrieve a page for reviewContent credentials as displayed by the InspectorLeica-generated C2PA displayLightroom-generated C2PA displayPicture of an under-construction high-rise behind leavesPicture of an under-construction high-rise behind leaves, improvedLightroom C2PA assertions with automation AITurtle in shallow water, generated by ChatGPTDesktop with decorations, Magic Erase has been appliedBlue Pixel 10C2PA associated with Magic Eraser imageC2PA assertions in Capture, Processing, and Provenance basketsC2PA assertion baskets with the addition of GenAIC2PA assertion baskets inflated according to their relative importance
This smaller version doesn’t have C2PA,but if you click on it, the larger version you get does. Photo credit: Rob Pike


"exif:ApertureValue":"2.79917","exif:BitsPerSample":"16","exif:BodySerialNumber":"6006238",
{"action":"c2pa.color_adjustments","parameters":{"action":"c2pa.color_adjustments","parameters":{"com.adobe.acr.value":"60","com.adobe.acr":"Exposure2012"}},{"action":"c2pa.color_adjustments","parameters":{"com.adobe.acr":"Sharpness","com.adobe.acr.value":"52"}},{"action":"c2pa.cropped","parameters":{"com.adobe.acr.value":"Rotated Crop","com.adobe.acr":"Crop"}}
Fails validation, “DigitalSourceType” is c2patooltrainedAlgorithmicMedia
“DigitalSourceType” is compositeWithTrainedAlgorithmicMedia
  1. Cropped the picture down.
  2. Used Lightroom’s “Dehaze” tool because it looked a little cloudy.
  3. Adjusted the exposure and contrast, and boosted the blacks a bit.
  4. Sharpened it up.
  • The device is identified just as “Pixel camera”. There are lots of different kinds of those!
  • The C2PA inclusion is Not optional!
  • DigitalSourceType: 
(if no genAI)computationalCapture
  • Timestamp is “untrusted”