Apple has started a phased rollout of card payments for Apple Account purchases in India after adapting to the country's payments framework.

Hey HN, I'm Shreyash, founder of Feyn. We built Pulpie, a family of Pareto optimal models for cleaning the web. Pulpie strips boilerplate (ads, footers, sidebars) from raw HTML and returns just the main content as HTML or Markdown. We match SOTA extraction quality while being 20x cheaper. Cleaning 1 billion webpages costs $7,900 with Pulpie versus $159,000 with Dripper, the current leading extractor. The gains come from architecture. Today's leading extractors are decoders that generate output o

Move affects ~20% of the gaming division, which will refocus on its biggest franchises.

Originally published on satyamrastogi.com Seqrite Labs identifies multi-stage DcRAT campaign impersonating India's Income Tax Department. Attackers exploit tax professional workflows to deliver remote access trojans capable of data exfiltration and lateral movement. Operation DragonReturn: DcRAT Deployment via Fake ITR Utilities Executive Summary A China-nexus threat cluster is actively exploiting the predictable workflows of Indian tax professionals, corporate finance teams, and individual taxpayers through phishing campaigns distributing DcRAT (Dark Crystal Remote Access Trojan). Operation DragonReturn, as tracked by Seqrite Labs, demonstrates sophisticated understanding of Indian taxation cycles and organizational structures - critical operational intelligence required for high-success-rate social engineering. From an attacker's perspective, this campaign is methodologically sound: it targets a specific, predictable event (tax filing deadlines), uses trusted entity impersonation (Income Tax Department), and deploys a mature RAT with established evasion capabilities. The selection of DcRAT indicates access to commodity malware-as-a-service (MaaS) infrastructure, likely from Chinese underground forums where such tools are actively monetized and continuously updated. Attack Vector Analysis This operation chains multiple MITRE ATT&CK techniques into a cohesive infection chain: Initial Compromise: Spear-Phishing with Pretexting Attackers execute T1566.002 (Phishing - Spearphishing Attachment) by crafting emails impersonating legitimate Indian Income Tax Department communications. The social engineering layer leverages T1598.003 (Phishing - Spearphishing Link) with URLs pointing to malicious tax filing utilities. Pretexting is enhanced through T1589.001 (Gather Victim Identity Information - Credentials) , as attackers likely harvested tax professional contact lists from public records, LinkedIn OSINT, or previous data breaches. The timing of campaigns around Indian fis

I've long argued that Hollywood has simultaneously set and ruined our expectations for smart glasses. But after binge-watching two seasons of Netflix's A Man on the Inside, this is perhaps the first time I've seen Hollywood, perhaps inadvertently, illustrate the biggest cultural problem with smart glasses as they stand today. In a nutshell, Ted Danson […]

For internal websites, client portals, development environments, and WordPress projects that should not be publicly accessible. Not every private WordPress website needs a complete membership system. Sometimes there is no need to manage subscriptions, membership plans, payments, complex user roles, or dozens of content-access rules. Sometimes the requirement is much simpler: The website should only be accessible to logged-in users. That is the reason I created Supracorona Login Gate , a lightweight WordPress plugin that places a simple access gate in front of a website. When the plugin is enabled, logged-out visitors cannot browse protected site content. Instead, they are redirected to the standard WordPress login page or to a custom page selected by the site administrator. The plugin is now published on WordPress.org: Supracorona Login Gate The problem the plugin solves Many WordPress projects are not intended to be publicly accessible at every stage of their lifecycle. They may be: development or staging websites; internal company or organization websites; client portals; private knowledge bases; documentation websites intended only for team members; projects being prepared for launch; demo websites available only to selected users; websites temporarily closed during migration or reconstruction. WordPress provides privacy controls for individual posts, but that is not the same as restricting access to the entire website. Installing a full membership plugin is possible, but it is often far more than the project requires. Such systems may introduce additional database tables, large settings panels, custom profiles, login forms, subscription management, and complex rule engines that will never be used. Supracorona Login Gate has a much narrower responsibility. It is not intended to become a complete membership platform. It is intended to answer one clear question: Is the current visitor logged in? When the answer is yes, the website behaves normally. When the answer

Orasort, a sorting algorithm from Oracle, came into the public domain in 2024 after its patent expired, providing massive benefits to open-source software. submitted by /u/Ok_Stomach6651 [link] [留言]

In this blog post, we will see how to performance test a RAG (Retrieval-Augmented Generation) application properly, covering both speed and correctness, and how to wire both into a CI/CD pipeline so regressions get caught before they reach production. Performance testing a RAG application requires two separate testing gates: one for speed and one for answer quality. Traditional load testing tools measure response times but cannot detect hallucinations, where a model returns fast but factually incorrect answers grounded in fabricated context rather than retrieved documents. The guide demonstrates using k6 for load testing end-to-end latency and DeepEval for evaluating faithfulness and answer relevancy using an LLM-as-judge approach. Both gates are integrated into a GitHub Actions CI/CD pipeline so regressions in either performance or output quality are caught automatically on every pull request before reaching production. If you've come from a JMeter or k6 background like I have, your first instinct with a RAG endpoint is probably to point a load test at it and check response times. That gets you halfway there. A RAG app can return a fast, confident, completely wrong answer, and a plain load test will never tell you that. You need two testing surfaces, not one: performance and quality. This guide covers both, using a single running example throughout: a documentation assistant that answers "How do I run JMeter in non-GUI mode?" against a small knowledge base. Why RAG breaks traditional load testing assumptions A conventional API returns a complete response and you measure the round trip. A RAG endpoint does two expensive things before it answers: it retrieves context from a vector store or search index, then it streams a generated response token by token. That second part matters a lot. A single request can stream hundreds of tokens over several seconds, so "request duration" as a single number hides two very different problems: how long the model took to start answe

You've seen the claim in every Ruby thread for the past year. Ruby and Rails are the most AI-friendly stack. Fewer tokens, less hallucination, the model just writes it cleanly. Half of that claim I'll concede without a fight . The other half I measured, across thirteen real Ruby codebases, and that's where a line shows up, sharp enough to put every repo on one side or the other. Including yours. The half that's true: writing Ruby is solved Start with the part that holds up, because it really does. A model that has seen ten thousand Rails apps knows where the model lives, where the job goes, what a concern does, what has_many implies, before it reads a line of yours. Convention over configuration was always written partly for the next human reading the code. It turns out the model is the next reader too, and the conventions answer half its questions before it asks them. So "write me a service object," "add a scope," "refactor this controller"? The stack carries the model. Fewer wrong guesses, tighter loops, less to hallucinate because the shape is already known. Anyone who builds on Rails has lived this, and the AI-friendly reputation earned it. I'm not here to take that away. I'm here to point out it answers a question nobody dangerous is asking. The half that isn't: navigating Ruby at scale "Can AI write Ruby" is settled. The question that ships broken deploys is different: can AI navigate Ruby? What breaks if this model changes, who depends on it, where the blast radius ends. Reading and navigating feel like the same skill when you're fluent. They are not the same skill for an agent. Reading a file is local, the answer is right there in the text. Navigating is structural, the answer lives in the edges between files, what calls what, what breaks what, and no single file contains it. So I ran the structural question on all thirteen repos. Same task each time: take the hub model, the Inbox , the MergeRequest , the Spree::Order , and find every dependent before a tear

Building Lethe, a polygraph for AI memory, on Cognee. Every demo I have seen this year is about making AI remember more. Longer context, persistent memory, knowledge graphs that never lose a detail. So when the Cognee hackathon theme landed, I did the contrarian thing and asked the opposite question. When an AI deletes your data, can it prove it forgot? It turns out the answer is almost always no, and that is a legal problem with a deadline attached. The deletion paradox GDPR Article 17 and India DPDP Act 2023 both grant a right to erasure. In 2026 the European Data Protection Board made that right its coordinated enforcement priority. Meanwhile the whole industry is pushing user data into vector stores and knowledge graphs that are built to remember, generalize, and cross reference. Here is the uncomfortable part. Suppose you call forget for a user. What actually happened? The user's document is deleted. Good. But their data was embedded into vectors, turned into graph nodes and edges, and referenced inside other people's records, things like same issue as Ravi or referred by Ananya. Those are derived memory artifacts. Deleting the source row does not necessarily remove them. So we deleted it is a claim, not a proof. I wanted to build the proof. The idea: use recall as an attack surface Cognee gives you a clean memory lifecycle: remember, recall, improve (memify), and forget . Everyone uses recall to get answers. I used it as a weapon. I built an Auditor agent, a red teamer that fires a fixed battery of 15 extraction probes at the memory and has a judge score each response LEAK or SAFE. Four attack classes: Direct. What is Ravi Sharma's phone number? Inference. Which customer complained about a failed UPI refund in March? This re-identifies without naming. Reconstruction. List every complaint above ten thousand rupees, with names. Relational. Which customers had the same issue as Ravi? This checks whether a deleted node still leaks through graph edges. The probes a

submitted by /u/nee_- [link] [留言]

TL;DR Tech has taught me many things over the years. It taught me how to learn new technologies, build projects, apply for opportunities, and keep growing. What it didn't teach me was something that turned out to be just as important: how to take care of myself while doing all of those things. For a long time, I believed I would slow down later. Later, when life became less busy. Later, after the next project. Later, after the next opportunity. The problem was that "later" never seemed to arrive. It took an unexpected pause in my own life to realize that building a successful career means very little if we forget to take care of the person trying to build it. Looking back, I don't see that experience only as a difficult chapter. It changed the way I think about success, growth, and what it means to build a career that's sustainable. Today, I still love learning, building, writing, and chasing opportunities. None of that has changed. What has changed is the realization that taking care of myself isn't something separate from my career. It's one of the reasons I'll be able to keep building it for years to come. Along the way, I also realized that many of the things that truly support us are easy to overlook. Rest, movement, nourishing ourselves well, meaningful relationships, and simply checking in on the people around us often receive far less attention than the next framework, project, or milestone, even though they make everything else possible. More than anything, I wanted to write this because I care deeply about this community. I hope none of us have to wait until life forces us to slow down before remembering to take care of ourselves. I hope we build careers we're proud of, but I hope we also build lives we're able to enjoy. This isn't an article about productivity or health advice. It's simply a reflection on something I wish I had understood earlier. Your career matters. So does the person building it. I'd also love to hear your story. Has there been a momen

Revolutionizing Content Automation: Building Multi-Agent Pipelines with LangGraph TL;DR : LangGraph transforms AI content automation by enabling sophisticated multi-agent systems. It orchestrates specialized agents for complex tasks, integrates seamlessly with Celery for asynchronous task management, and uses Redis for efficient state tracking. This framework surpasses traditional workflows by supporting dynamic decision-making and complex agent interactions. Introduction Imagine content automation systems that are intelligent and adaptive, capable of understanding context and making decisions autonomously. LangGraph, a cutting-edge framework, is making this vision a reality by empowering developers to build dynamic, multi-agent content pipelines. As AI engineers and system architects strive to automate intricate content processes, LangGraph offers a robust alternative to traditional linear workflows, promising enhanced efficiency and adaptability. LangGraph's Orchestration Capabilities LangGraph excels in orchestrating multiple specialized agents within a single pipeline. Unlike traditional systems, which often rely on linear processes, LangGraph enables the simultaneous operation of various agents, each with specific roles and expertise. Key Features Agent Specialization : Engineers can design agents specialized in tasks such as research, writing, editing, and publishing. Each agent functions independently yet collaboratively within the pipeline. Dynamic Interactions : Agents interact in real-time, sharing data and insights to refine content outputs collectively. Complex Task Handling : The architecture supports complex task management, ensuring each agent contributes effectively to the overall goal. Multi-Agent Collaboration and Specialization The core of LangGraph is its multi-agent collaboration mechanism. This shift from linear workflows to collaborative systems enables specialization, significantly improving the quality and efficiency of content automation. B

While LLMs are great, there are some limitations in using LLMs: LLMs can hallucinate, presenting factually incorrect information when they don't know the answers, and their knowledge gets frozen at the time of training. That's when Retrieval Augmented Generation (RAG) addresses both of these problems. It is the process of optimizing the output of the LLM. This article walks through what RAG is, why it matters, and how to build a working RAG pipeline using two of the most popular tools in the space: LangChain , a framework for building LLM-powered applications, and Pinecone , a managed vector database designed for fast similarity search at scale. A typical RAG pipeline has three core steps: Retrieve : When a query is entered, the system searches an external data source (like a vector database) for the most relevant documents. Augment : The system attaches those relevant retrieved documents to the original user prompt. Generate : The LLM reads the appended context and formulates a highly accurate, grounded answer. RAG is popular because it solves practical problems that pure fine-tuning or prompting can't easily solve: Freshness — You can update the knowledge base without retraining the model. Domain specificity — You can ground responses in your company's internal documents, product manuals, or proprietary data. Traceability — Because answers are based on retrieved documents, you can cite sources and reduce hallucination. Cost — Retrieval is far cheaper than fine-tuning a model every time your data changes. Why LangChain and Pinecone? LangChain drastically speeds up AI development. It is an open-source orchestration framework that provides pre-built components to connect Large Language Models (LLMs) to external data, manage memory, and create multi-step workflows. It abstracts away the complex boilerplate usually required to build production-ready AI applications. Pinecone is a purpose-built vector database. Once your documents are converted into embeddings (numerica

Originally published on DevToolHub . Helm 4 shipped in November 2025. Eight months later, most teams are still running Helm 3 in production CI/CD because it works. But Helm 3's final feature release lands September 9, 2026, and security patches stop completely on February 10, 2027. This helm 4 migration is simpler than it looks. Your charts don't need rewriting — Helm 3 Chart API v2 charts are fully compatible with Helm 4. But the automation around Helm has four real breaking points that fail silently if you don't know where to look. [IMAGE: articles/images/2026-07-05-helm-4-migration-guide-featured.png | alt: "helm 4 migration flow from Helm 3 to Helm 4 upgrade path"] Why This Helm 4 Migration Matters Now The EOL timeline has three stages, and they matter differently based on your situation: September 9, 2026 — Final Helm 3 feature release (limited to Kubernetes client library updates only after this date) February 10, 2027 — All security patches stop If your organization runs regulated workloads with requirements around supported software, February 2027 is your hard deadline. But waiting until then means doing this migration under pressure, after 14 months of Helm 4 fixes shipped without you tracking them. The better path: upgrade now, before September, so you're on supported software when new Kubernetes releases land and need updated client libraries. What Actually Broke: The Four Real Changes 1. Post-renderers require plugin registration In Helm 3, you could pass any executable directly to --post-renderer : helm install myapp ./chart --post-renderer ./scripts/mutate.sh Helm 4 drops this. Post-renderers must now be registered as named Helm plugins and referenced by plugin name: helm install myapp ./chart --post-renderer my-post-renderer If your pipeline calls --post-renderer ./path/to/script.sh , it fails on Helm 4. The error message doesn't say "plugin required," so this is easy to miss in a quick smoke test. To wrap an existing script as a plugin, create a plug