📰 English IT Daily · 2026-07-18

A recent security story shows how a normal hiring process can turn into a serious cyberattack. According to a blog post by AI Safe, an experienced software engineer was contacted on LinkedIn about a job opportunity and was given a take-home coding assignment. The task looked believable: a private GitHub repository, a React-based project, and a small feature request related to showing the blockchain network selected in MetaMask. Nothing about it seemed out of place at first glance, and that is exactly why the case is getting attention.

The project appeared to be a realistic demo application for an NFT campaign platform. It included user accounts, dashboards, wallet features, and sample data. The assignment itself was simple and familiar to many developers: add helper functions, call a wallet method, and display a readable network label after connection. In other words, the technical request was not a red flag. In fact, the setup was convincing enough to lower the candidate's guard, because it matched the kind of practical test that many companies now use in recruitment.

Trouble began only after the candidate finished the work and tried to run the project locally. The development environment did not start as expected, and the process seemed to hang for too long. That delay set off alarm bells. The engineer disconnected the machine from the internet and asked a friend for help. This moment matters because it shows how small warning signs can be easy to brush aside when someone is focused on completing an interview task quickly. A rushed workflow can create the perfect opening for an attacker.

What makes this case especially unsettling is the human side of the attack. It did not rely on a fake lottery email or an obvious phishing page. Instead, it played on professional trust. Recruiters regularly contact developers through LinkedIn, and coding assignments are now common across the industry. That makes the scam a double-edged sword for modern hiring: the same process that helps companies evaluate talent can also be used as a cover for malicious code. For engineers, the lesson is not to become paranoid, but to treat unsolicited projects with healthy skepticism.

This kind of attack also highlights a wider security problem. Developers often run unfamiliar code as part of interviews, open-source work, or quick experiments. In many teams, speed is valued, and candidates may feel pressure to move fast and avoid asking too many questions. Attackers can exploit that pressure. If a repository is designed to look polished, includes realistic file names, and contains a plausible business use case, even a careful person may miss what is hidden in plain sight. The risk becomes greater when the code is run on a personal laptop with access to saved credentials, browser sessions, or crypto wallets.

The likely impact of stories like this is that both candidates and employers will rethink how take-home tests are handled. Safer habits may include checking who owns a repository, reviewing scripts before execution, using isolated environments, and confirming the assignment through official company channels. Companies may also need to spell out secure interview practices more clearly so applicants know what is normal. The broader takeaway is simple: in tech, trust can speed up collaboration, but blind trust can open the door to compromise. As hiring becomes more digital, security awareness must keep pace.

Many people now ask a new question: how can a website appear in ChatGPT answers? A recent blog post by Suganthan looked at this issue in a different way. Instead of studying only the final text that users see, he examined the network traffic sent to his browser while ChatGPT was working. In simple terms, he looked at the machine’s “behind-the-scenes” messages in JSON format. His goal was not to prove one perfect strategy for ranking, but to understand what kinds of source labels, search actions, and internal categories the system appears to use.

This matters because much of the current advice about “showing up in ChatGPT” is based on assumptions. People often repeat tips such as writing strong content, publishing list articles, or joining discussions on community sites. Some of that advice may be useful, but it can also become an echo chamber where one expert repeats another without hard evidence. By reading raw traffic rather than polished answers, the blogger tried to cut through that uncertainty. He argued that this method reveals structure: not how often something happens across all users, but what fields and labels clearly exist inside the process.

According to the source context, the study found repeated internal fields such as result_source, turn_use_case, vendor names, search queries generated by the system, and the model that actually handled the task. The writer said he saw labels like serp, bright, labrador, and oxylabs in the traffic. He also reported that some text queries appeared to skip the web entirely, while “Thinking” mode triggered many more web actions, including site-specific and price-checking searches. These are useful findings because they suggest that ChatGPT may not follow one single path every time. The path can vary depending on the type of request.

At the same time, the writer was careful to draw a clear line between structural facts and frequency claims. Structural facts are things he could observe directly on the wire, such as the existence of a field or the exact name of a label. Frequency claims are much weaker. He used one logged-in Pro account over a few days and focused mainly on SaaS and tech-related prompts. That means any percentages, rankings, or statements about which websites appear most often should be taken with a grain of salt. The sample was simply too narrow to stand in for all users, topics, and regions.

This distinction is important for anyone working in search, content, or product strategy. Large visibility studies often send thousands of prompts and measure which brands appear in answers. That gives a broad picture, but it is still a black box because researchers only see the output. Traffic analysis turns the method inside out. It does not tell us the whole market picture, but it can reveal the system’s own terminology and workflow. For engineers, this is a reminder that outputs alone may hide many layers of decision-making. For marketers and publishers, it suggests that success may depend not only on content quality but also on query type, browsing mode, and tool selection behind the scenes.

The bigger lesson is that AI search should be studied with humility. It is tempting to jump to sweeping conclusions from a few striking examples, especially in a fast-moving field. However, careful observation and clear limits matter. This kind of work does not settle the debate about how to optimize for AI assistants, but it adds a more grounded starting point. In the coming months, people will likely pay closer attention to how assistants choose sources, when they search the web, and when they rely on internal knowledge instead. For anyone building products or content, that shift could have real business consequences.

Linus Torvalds, the creator and lead maintainer of the Linux kernel, has shared a cautious view on the use of large language models, or LLMs, in kernel development. His basic point is not that AI tools are useless. Instead, he argues that the kernel is a very special kind of project, where small mistakes can have serious effects. The Linux kernel sits at the core of an operating system. It manages hardware, memory, and many low-level tasks. Because of that, code quality, deep understanding, and careful review matter more than speed alone.

Torvalds has often stressed that kernel work is not just about writing code that looks correct. It is about understanding why the code behaves in a certain way under real conditions. In this area, an LLM can be a double-edged sword. It may produce code quickly, summarize discussions, or suggest possible fixes. However, it can also generate answers that sound confident but are wrong in subtle ways. In kernel development, subtle bugs are especially dangerous because they may only show up under rare workloads, unusual hardware, or heavy system pressure.

One concern is that AI-generated patches could increase the burden on maintainers. A patch is a proposed code change, and maintainers are the people who review and decide whether it should go into the project. If many developers start sending in patches written partly by LLMs, reviewers may have to spend more time checking code that the sender does not fully understand. That can bog down the review process. For a large open-source project, trust is built not only on results but also on a contributor's ability to explain design choices and respond to criticism in detail.

At the same time, the discussion is not completely one-sided. Supporters of AI coding tools argue that LLMs can still be useful around the edges of development. For example, they can help rewrite comments, summarize mailing list threads, or point newcomers to relevant documentation. They may also help experienced developers explore unfamiliar parts of a codebase more quickly. In that sense, AI can act more like a productivity aid than an author. The key issue is where teams draw the line between assistance and responsibility.

This debate also reflects a broader shift in software engineering. Across the industry, AI tools are gaining traction because they promise faster output and lower barriers to entry. But systems programming, security-sensitive work, and infrastructure code often have a higher bar. In these areas, a plausible answer is not enough. Developers need evidence, testing, and a clear mental model of what the machine is doing. Torvalds's comments fit this mindset: convenience should not crowd out engineering discipline, especially in code that millions of systems rely on.

Looking ahead, LLMs will probably remain part of the conversation in open-source development, but their role may stay limited in projects like the Linux kernel. The most likely path is a measured one: use AI for support tasks, but keep human judgment at the center of design, debugging, and acceptance decisions. That approach may seem conservative, but it matches the reality of kernel work. When software operates close to the hardware, there is little room for guesswork. For developers, the message is clear: AI can be useful, but understanding still has to come first.

The team behind the Roc programming language says its long rewrite of the Roc compiler has reached feature parity with the original version. In simple terms, the new compiler can now do the same main jobs as the older one. This is a major step in a project that has been going on for about a year and a half. During that time, the team has been rewriting roughly 300,000 lines of compiler code from Rust into Zig. The update is not a full public release yet, but it shows that the rewrite is no longer only an experiment. It is now working well enough to run real programs.

One visible example is Rocci Bird, a small game built for WASM-4. The game has fewer than a thousand lines of Roc code, but getting it to run on the new compiler still required many pieces to fall into place. According to the project update, the newer build is also more concise in some ways and can produce a much smaller WebAssembly binary when optimized for size. That matters because smaller binaries usually load faster and are easier to ship in browser-based tools. The team also highlighted progress on an "echo" platform that lets people write and run simple Roc programs in the browser through a WebAssembly build on the project homepage.

Why rewrite a compiler at all? For any language project, this is a high-stakes decision. A compiler sits at the heart of the developer experience, so changing its implementation can affect performance, reliability, and the speed of future development. Some teams rewrite because the old system becomes hard to maintain. Others want tighter control over memory use, build output, or tooling behavior. In Roc’s case, the rewrite reflects a belief that Zig is a better fit for the compiler’s goals. Even when the reasons sound technical, the choice usually comes down to a trade-off between safety, simplicity, control, and team productivity.

Still, feature parity should not be confused with finishing the job. Rewrites often look clean on paper, but in practice they can drag on and absorb huge amounts of time. Matching existing behavior is only one milestone; after that, teams must hunt down edge cases, improve error messages, and make sure performance holds up under pressure. Compiler work is especially tricky because tiny differences can break programs in surprising ways. A rewrite can also become a double-edged sword: it may remove old pain points, but it can introduce new bugs and require users to adjust their workflows.

The Roc update also stands out because it is so community-driven. The post thanks contributors for work on the parser, type-checker, lambda set resolution, browser support, package design, bug reports, exercises, and more. That list shows how broad compiler development really is. It is not only about code generation. It also involves teaching materials, testing, documentation, examples, and smooth upgrade paths for users. In open-source projects, these less visible tasks often determine whether a technical milestone actually gains traction with real developers.

Looking ahead, the main thing to watch is whether the new compiler can turn this milestone into a stable release. The team has said it aims to ship version 0.1.0 later this year. If that happens, the rewrite may become a case study in when a bold engineering choice pays off. It also adds to a wider conversation in systems programming, where different projects are making different language choices based on their own constraints. For working engineers, the lesson is clear: a rewrite is never just about language preference. It is about what kind of tooling, maintenance burden, and user experience a project wants to prioritize over the long run.

PrismML has announced Bonsai 27B, a new multimodal AI model that it says is the first model in the 27B capability class to run on a phone. The release is based on Qwen3.6 27B and extends PrismML’s earlier work on very low-bit models. In simple terms, low-bit models store weights with far fewer bits than standard models, so they need much less memory. That matters because large models usually need powerful hardware, which has kept advanced AI out of reach for many local devices. Bonsai 27B tries to shift that balance by bringing a much larger model into a much smaller memory footprint.

The company says the model comes in two variants. The ternary version uses weights limited to three values, while the 1-bit version uses only two. Both use group-wise scaling to preserve quality. According to PrismML, the ternary model has an effective 1.71 bits per weight and takes 5.9 GB, while the 1-bit model has an effective 1.125 bits per weight and takes 3.9 GB. That is a striking drop from a normal 16-bit 27B model, which would need around 54 GB, and even from a 4-bit version at about 18 GB. PrismML says the smaller variant can fit within the memory budget of an iPhone 17 Pro, which puts a 27B-class model on a phone for the first time.

What makes this release stand out is not only its size, but also the range of tasks it aims to handle. PrismML says Bonsai 27B can do multi-step reasoning, structured tool calls, vision tasks, and computer-use agentic loops that stay coherent across many steps. In practice, that means the model is designed for more than simple chat. It may be able to read screenshots, understand documents, respond to camera input, and work through tasks that require several linked actions. The vision component is shipped in a compact 4-bit form, and the model also supports a 262K-token context window and speculative decoding, a method that speeds up generation without changing the final output.

The benchmark results suggest that the company has retained much of the original model’s intelligence despite the heavy compression. Across a 15-benchmark suite, PrismML reports that the ternary version keeps 95% of the full-precision baseline and the 1-bit version keeps 90%. The pattern is especially notable in math and coding, where the gap appears relatively small. Tool calling also remains fairly strong, which is a key point for agentic workloads. The company argues that this is not just a small improvement at the margins, but a meaningful Pareto shift: lower memory use without a severe collapse in capability. If those results hold up in wider testing, they could change assumptions about what local AI can do.

For users and developers, the main appeal is clear. Running a capable model on-device can reduce dependence on remote services, improve privacy, and lower latency. It can also make AI features available in places with weak connectivity. For enterprise teams, this could open the door to new mobile workflows, such as document analysis in the field or assistants that can see and act on a phone screen. At the same time, there are trade-offs. A smaller footprint does not remove limits on battery life, heat, or sustained performance. On-device models can also be a double-edged sword for security: data may stay local, but powerful local automation can create new risks if it is misused.

The broader question is whether releases like Bonsai 27B will gain traction beyond early adopters. The model is available under the Apache 2.0 License, which lowers barriers for experimentation and commercial use. Still, benchmarks are only one part of the story. Real-world performance, developer tools, app integration, and user experience will decide whether this approach catches on. Even so, the announcement is a reminder that AI efficiency is moving fast. Until recently, a 27B model on a phone sounded far-fetched. Now it looks like a sign of where the market may be heading next: not only bigger models in the cloud, but smarter and more capable ones running right in your pocket.

JetBrains has introduced Hexana, a toolkit for WebAssembly and binary analysis. It comes in two forms: a full plugin for JetBrains IDEs and an extension for Visual Studio Code-based editors. At its core, Hexana is designed to inspect, edit, run, and debug WebAssembly files, while also offering experimental support for native binary formats such as ELF, Mach-O, and PE. In simple terms, it gives developers a closer look at what is happening inside compiled code, not just the original source files.

WebAssembly, often called WASM, has been gaining traction because it lets code run across different environments with strong performance and portability. It started mainly in the browser, but it is now also used on the server, at the edge, and in embedded systems. As WASM projects become more complex, developers need better tools to understand module structure, imports, exports, and performance costs. This is where Hexana aims to carve out a place for itself. Instead of treating a WASM file as a black box, it opens it up with views that show both low-level details and higher-level structure.

The JetBrains plugin appears to offer the deepest feature set. According to the documentation, it includes a multi-tab editor for .wasm files, an editable virtualized WAT view, WAT and WIT language support, and tools for running and debugging code on several runtimes, including Wasmtime, WAMR, GraalVM, and wazero. It also adds Java-side completion for GraalWasm and Chicory, and JavaScript or TypeScript type inference for WebAssembly.instantiate. Beyond WASM itself, the plugin can inspect formats such as Parquet, Arrow IPC, Protocol Buffers descriptor sets, and some JVM artifacts. That broad scope suggests JetBrains is trying to meet developers where they are, rather than forcing them to jump between separate tools.

The VS Code version is lighter, but it still covers many practical needs. It includes a custom editor, a virtual-scrolling hex viewer, structural analysis tabs, a Protocol Buffers descriptor set viewer, scriptable custom tabs, and on-demand access to an MCP server. It can also run WebAssembly on several runtimes and in environments such as Node.js and the browser. The documentation says both products share the same Kotlin Multiplatform analysis core. That means the main parsing and analysis logic is not split into two unrelated codebases, which should reduce drift between the two versions over time.

One reason Hexana stands out is that it does more than simple file viewing. The shared analysis core supports many WebAssembly features, including the Component Model, GC, SIMD, Threads, Tail Call, Reference Types, Bulk Memory, Multi-Value, and legacy exception handling. Both versions can detect components, list nested modules, and resolve dependencies. They also provide analysis such as size profiling and dead-code detection. For engineers who work close to the metal, this can be valuable when they need to inspect compiled output, understand why a module is larger than expected, or track down unused parts before release.

Still, there are trade-offs. Hexana offers a rich set of capabilities, but binary analysis can quickly pull users into the weeds, especially if they are not already familiar with low-level formats. Experimental support for native binaries and debugging also means some features may evolve over time. Even so, the launch reflects a broader shift in developer tools: modern teams increasingly want source-level comfort together with compiled-code visibility. If WebAssembly keeps expanding beyond the browser, tools like Hexana could become part of the standard toolkit for debugging, optimization, security review, and cross-platform development.

Many people want to learn machine learning, but they do not know where to begin. The field moves fast, and new tools appear all the time. For beginners, this can feel overwhelming. That is why curated study repositories on GitHub have started to gain traction. One example is a public repository by teddylee777. It was created to support people who are interested in machine learning study, especially beginners or those preparing a study group. Instead of offering one single course, it brings together several areas that learners often need in one place.

From the available folder names, the repository appears to cover a practical learning path. It includes Python, Kaggle, PyTorch, TensorFlow, TensorFlow 2.0, Pandas, visualization, and Scikit-learn. That structure matters because self-study often falls apart when learners jump between too many random tutorials. A path like this can act as a roadmap. Python gives the programming base, Pandas supports table-based analysis, and visualization helps learners inspect patterns rather than staying in the weeds of code only. Then tools such as Scikit-learn, PyTorch, and TensorFlow let learners move from basic models to deeper experiments.

The appeal of a repository-based approach is simple. It is open, easy to revisit, and close to real practice. Learners can read notebooks, run examples, and modify code at their own pace. They can also compare different libraries side by side. This matters because machine learning is not only about theory. It also requires repeated hands-on work: cleaning inputs, trying models, checking errors, and understanding why results change. In that sense, a GitHub repository can lower the barrier to entry. It gives learners a place to start without forcing them to stitch together materials from many disconnected sources.

Still, self-study is a double-edged sword. Freedom is useful, but it can also lead to shallow understanding. A learner may finish notebook after notebook and still fail to explain core ideas such as training, validation, overfitting, or feature selection in plain language. Another risk is focusing too much on tools and not enough on concepts. Popular libraries evolve, but the underlying ideas are what hold up over time. Without feedback from a teacher or peers, learners may also miss mistakes that quietly pile up. In other words, progress can look smooth on the surface while gaps remain underneath.

For that reason, the best self-study plans usually strike a balance between structure and curiosity. A repository can provide the backbone, but learners still need habits that deepen understanding. They can write short summaries after each topic, rebuild examples from scratch, and test the same task with different methods. Joining a small study group can also keep motivation from fading. Even when a person studies alone, posting questions, reading issues, or following updates on GitHub can create a sense of community. That social layer often makes it easier to stick with a long learning journey.

In the bigger picture, resources like this reflect a wider shift in technical education. More people now expect learning materials to be open, practical, and continuously updated. For working engineers, this approach is especially relevant because they often need to upskill without leaving their jobs. A well-organized repository will not replace deep courses, academic textbooks, or mentorship. However, it can serve as a springboard. For someone exploring machine learning alone, the real value is not just the content itself. It is the chance to build steady learning habits, connect tools with concepts, and turn interest into sustained practice.

SQLite is one of the most widely used tools for local storage in computing. It is popular in mobile apps, desktop software, and embedded devices because it runs as a library inside an application, not as a separate service. That design keeps deployment simple and makes programs easier to ship. It also gives developers many features of a relational system without forcing them to build their own file format and parser. For these reasons, SQLite has become a go-to choice in many projects, and some web services also rely on it in production.

A recent blog post argues that SQLite should adopt something like Rust-style “editions.” In Rust, an edition is a way to introduce better defaults and improved language behavior without suddenly breaking older code. The writer says SQLite has a similar problem: its long history has left it with defaults that were sensible years ago but now look risky. The main example is foreign key constraints. In many relational systems, these rules are enforced by default, so a row cannot point to a record that does not exist. In SQLite, however, foreign key checks are not enabled unless the application turns them on.

That choice can lead to subtle bugs. Imagine a table of users and another table of posts. Each post stores the ID of its author. If foreign keys are ignored, an application might delete a user but leave the user’s posts behind. At first, this may seem like a simple mistake. The deeper issue is that SQLite can sometimes reuse internal row IDs under certain conditions. If a new user later receives the same ID as the deleted user, an old post may appear to belong to the wrong person. That is worse than an obvious error because the system still appears to work, but the meaning of the data has quietly drifted.

The immediate fix is straightforward: applications can enable foreign key enforcement with a pragma setting. But the broader complaint is about developer expectations. Many engineers assume that a modern relational system will protect referential integrity out of the box. When SQLite behaves differently, teams may not notice until a bug surfaces in testing or, worse, in production. This is the kind of footgun that often survives code review because the schema looks correct on paper. The rules are written down, but the engine does not enforce them unless someone remembers the extra step.

This is where the idea of editions comes in. Instead of changing SQLite overnight and breaking older applications, a future edition could opt in to safer defaults. New projects might get foreign keys enabled automatically, while older projects could continue using legacy behavior for compatibility. Supporters of this approach see it as a pragmatic middle ground. It would preserve SQLite’s famous stability while giving developers a cleaner starting point. Critics, however, may worry that multiple editions would add complexity, fragment documentation, or create confusion when teams move between projects with different settings.

Even so, the discussion highlights a wider issue in programming: backward compatibility is a double-edged sword. Keeping old behavior can protect existing systems, but it can also preserve traps that no longer fit current expectations. The SQLite debate is therefore not only about one setting. It is about how mature tools evolve when millions of applications depend on them. Whether or not SQLite ever adopts editions, the argument is a useful reminder to scrutinize defaults, read the fine print, and avoid assuming that familiar-looking tools behave like their peers in every detail.

StackRender is an open-source tool for designing and generating database schemas. In simple terms, it lets developers plan tables, columns, relationships, and constraints before writing large amounts of SQL by hand. The project describes itself as a next-generation schema design and generation tool, and it is currently in public beta. Its broader vision is ambitious: to automate backend development from the database layer to the final API endpoint. For now, the main focus is a visual schema diagram generator that aims to turn technical specifications into a production-ready database structure.

One of the main selling points is its interactive diagram interface. Instead of editing everything in text files, users can drag and drop elements on a canvas and manage their schema visually. StackRender also gives in-depth control over tables and columns, including data types and constraints. In addition, it supports importing existing SQL DDL, which means developers can bring in a schema they already have, inspect it, and adjust it. They can also export their design in several SQL dialects, including MySQL, PostgreSQL, MariaDB, and SQLite. Support is also listed for Oracle and SQL Server.

The project tries to tackle a common pain point in software teams: schema design often starts clearly but becomes messy as requirements grow. A visual tool can give everyone a shared view of the system and cut through confusion during planning. StackRender also includes index suggestions, which are recommendations meant to improve query performance. Another feature is foreign key cycle detection. That matters because circular dependencies between tables can create problems when teams build, migrate, or delete records. Catching these issues early can save time later and reduce unpleasant surprises in production.

StackRender also stands out because of its AI-powered assistant in the cloud version. According to the project description, this assistant can generate diagrams from written specifications and carry out extra tasks such as schema enrichment, soft-delete implementation, and automatic documentation generation. That could speed up early-stage design work, especially when a team wants to go from idea to prototype quickly. Still, AI in schema design can be a double-edged sword. It may boost productivity, but teams must review the output carefully to make sure the model does not produce weak relationships, poor naming, or impractical structures.

Another reason the project may gain traction is that it can be used in different ways. Developers can try the cloud version or deploy it locally. The repository suggests Docker as the recommended path for local use, although Node.js is also available for development and build tasks. This flexibility matters for companies with different security rules and workflows. Some teams do not want to send internal specifications to an external service, while others prefer a managed online tool that is ready in minutes. By offering both options, StackRender lowers the barrier to entry for experimentation.

Tools like StackRender reflect a wider shift in engineering. Teams want to move faster, but they also need systems that are maintainable and easy to understand. Visual design, SQL import and export, cycle detection, and AI assistance all fit that trend. At the same time, no tool can replace careful thinking about business rules and long-term operations. The real test will be whether StackRender can keep improving during beta and fit smoothly into real-world development pipelines. If it does, it could become a useful bridge between planning, implementation, and documentation.