标签：#an

Expectations for Tim Cook were almost impossibly high when he stepped in to replace Apple's visionary cofounder in 2011. He inherited a company on a blockbuster run, after Steve Jobs returned and revitalized the Mac, launched the iPod, and oversaw the launch of the iPhone. Now, after 15 years in the CEO role, Tim Cook […]

The company known for stick vacuums and hair dryers is coming for your teeth. The $499 Dyson CameraJet uses a tiny camera to aim streams of rinsing fluid into the gaps between your teeth.

Fertilizer is crucial for the global food supply, but making it uses a lot of energy and produces a lot of emissions. Some companies hope microbes can help. A growing body of research shows that seeding the soil around a crop’s roots with beneficial microbes can help feed the plant, providing crucial nitrogen to help…

Originally published on xroot.dev . In high-frequency Web3 infrastructure, relying on a TypeScript SDK or a third-party pricing API means you are already too late. If you are building an arbitrage bot, a sniper, or a real-time indexer on Solana, reading data through abstracted REST endpoints introduces hundreds of milliseconds of latency. To build institutional-grade infrastructure, you have to bypass the middleman. You need to pull the raw binary state of the Automated Market Maker (AMM) directly from the RPC node and deserialize it natively in memory. Here is how to reverse-engineer Solana DeFi pools and parse raw account data in Rust at microsecond speed. The Anatomy of a Solana Account & The Anchor Discriminator Beneath the abstractions of the Solana ecosystem, an account's data is fundamentally just a continuous array of bytes ( &[u8] ). When a smart contract writes to an account, it serializes its state into this raw byte buffer. If the AMM was built using the Anchor framework — which the vast majority of modern Solana DeFi protocols are — the account data doesn't just start with the struct variables. Anchor prepends an 8-byte discriminator to the beginning of the data payload. This discriminator is calculated using the first 8 bytes of the SHA256 hash of the string "account:StructName" . It acts as a safety check: if you try to deserialize an AMM pool account but the first 8 bytes don't match the expected hash, the program knows you passed the wrong account type and immediately aborts. Bytes 0–7 (Anchor Discriminator) → Bytes 8–N (Raw struct data (Borsh-serialized)) To parse the account data yourself, your first step is always identifying and slicing off those first 8 bytes. Reverse-Engineering the AMM Struct You cannot parse binary data without knowing its exact memory layout. We need to map the byte layout of the DeFi pool — such as a Raydium CPMM or a pump.fun bonding curve — into a tightly packed Rust struct . Instead of paying the "Borsh tax" (the CPU ov

Disclosure: I work on Tessera, which is one of the tools in the gap I am describing. Ask a fifty-person engineering organisation how they control production access and you will hear the same answer with small variations: a bastion host, SSH keys distributed by configuration management, a shared kubeconfig somewhere, and a spreadsheet or a Notion page that is out of date. Nobody chose that. It is what remains after the alternatives were priced. How the category got shaped Privileged access management grew up serving banks, telcos and governments in the 2000s. Those buyers had specific characteristics: thousands of administrators, regulators with written opinions, dedicated security teams, and procurement processes measured in quarters. Products shaped themselves accordingly. Six-figure entry prices. Deployments measured in months with professional services attached. Feature sets covering every mainframe and network appliance in a bank's estate. Sales motions that start with a discovery call and a mutual NDA. That was a reasonable fit for those buyers. It is a terrible fit for a company with sixty engineers, no dedicated security team, one person who is security-adjacent, and a procurement process that consists of a founder approving a card payment. So the mid-market did what people do when a category prices them out: they built the minimum themselves. A bastion is a bastion because it was free and it was Tuesday. The problem this leaves The bastion answer works, up to a point, and it is worth being specific about where the point is. A bastion controls the door. It does not control the room. Once someone is through, there is no per-command record, no way to reduce their privileges while they are working, and no session replay. And keys still have to be distributed and revoked behind it, which means the original problem is intact — it just has a nicer front entrance. Three things then converge, usually in the same year: The first enterprise customer. Their security que

Disclosure: I work on an access tool (Tessera), mentioned once at the end. Everything before that is about evidence, and applies whatever you use. The most common surprise in a first SOC 2 or ISO 27001 audit is not that a control is missing. It is that a control exists, works, and cannot be evidenced — so it counts as absent. The distinction is worth stating precisely, because it is not obvious until it has cost you something. A control is a thing that is true about your system. Only authorised engineers can reach production. Evidence is an artefact, produced by a system rather than by a person, that demonstrates the control was operating throughout the audit period — not on the day someone checked. Most organisations have decent controls. Most cannot produce evidence, because their controls live in places that do not emit artefacts: a bastion's authorized_keys file, a spreadsheet, a Slack thread where someone approved something, and the collective memory of three engineers. What gets asked for Reconstructed from what people have told me, this is the shape of the questions: "Show me everyone who could access production on 14 March." Not today. A specific date in the past, usually chosen by the auditor. This is the one that catches people, because most systems can tell you the current state and cannot tell you a historical one. authorized_keys has no history. A spreadsheet has whatever history git gives it, if it is in git, which it usually is not. "Show me that this person's access ended when their employment ended." Both timestamps, from two systems, matched. HR has the first. The second is the problem. "Show me the approval for this elevated access." Not that a policy requires approval — the specific approval, for this specific grant, with who approved it and when. "Show me what was done in this session." Increasingly common where production access to customer data is involved. Not "we log commands", but the actual record for a named session. "Show me that these c

Disclosure: the numbers below are from Tessera, which I work on. The reasoning applies to any proxy that sits in a session path. Every vendor page in this category says something like "scales to thousands of users". It is a useless number, because a user who is not connected costs nothing. What costs something is a session that is open right now. So here is the arithmetic instead, with the method, so you can check it against whatever you are evaluating. The unit The controller does not know how many engineers you employ and does not care how many targets are registered. It knows how many sessions are open. The planning rule that has held up for us: on a normal working day, 10–20% of a team is connected at once. A 200-person engineering organisation is 20–40 concurrent sessions, not Size for your own observed peak, but if you are estimating from scratch, start there. This matters because the difference between the two numbers is the difference between a 512 MB VM and an argument about whether you need a cluster. Memory A proxied session is mostly buffers. In our case: about 256 KB of copy buffers, plus 6 to 10 goroutines at roughly 8 KB of stack each. Call it 320 KB per session. The base Go process is about 30 MB. So 200 concurrent sessions is 200 × 320 KB ≈ 64 MB of live data, plus 30 MB base, ≈ 94 MB. Except that is not what RSS will show you, and this is the part people get wrong when they size Go services. Go does not hand memory back to the operating system promptly, and at the default GOGC=100 the collector lets the heap grow to roughly twice the live set before collecting. So resident memory settles at about double the arithmetic. Concurrent sessions vCPU Expected resident Provision up to 50 1 ~90 MB 512 MB 50–200 2 ~190 MB 1 GB 200+ 4 ~380 MB 2 GB The gap between the last two columns is headroom for spikes, not a hidden cost. A controller serving 200 sessions really does use a couple of hundred megabytes. Our Helm chart ships requests: 256Mi and limits: 1Gi ,

Every infrastructure post-mortem contains the same paragraph, and it is never the one anyone expected to write. The initial access was not sophisticated. It was a credential that existed, that worked, and that nobody had a reason to look at — because it had been legitimately issued months earlier, for a reason that had since ended. That is standing access. It is not a vulnerability, so no scan finds it. It is not a misconfiguration, so no posture report flags it. It is the residue of a hundred reasonable decisions: a key added for a migration, a database password shared during an outage, a kubeconfig sent to a contractor who did good work and left on good terms. It stays invisible to the risk register because a risk register asks what could go wrong, and standing access is the record of things that already went right. The distribution problem The mechanism is worth being precise about, because it explains why the usual fixes only partly work. Infrastructure access is almost always handed out rather than granted . A key is copied to a host. A kubeconfig is copied to a laptop. A password is copied into a password manager and then, at two in the morning, into a chat window. Once a credential has been copied, the organisation has permanently lost the ability to list its copies. There is no query that returns the answer. Revocation stops being an operation and becomes an investigation — carried out by people, at the exact moment the person who knew where everything was has left. This is why the honest test of an offboarding process is not "did we remove their access". It is: can we show a third party, at any point in the future, that access ended when we say it ended? Most organisations that pass the first test fail the second, and usually find out during an audit or a due-diligence review, which are the two worst moments to find out. Why the obvious fixes fall short Configuration management as the source of truth is a real improvement. It makes access declarative and pu

Magna's investment in Yuma Energy has reached $87 million as the Canadian auto supplier increases its majority stake in the Indian battery-swapping firm.

AI agents do not need to hallucinate to make the wrong decision. They can read accurate information, reason correctly, and still take the wrong action because the information changed before execution. That is the problem FreshCtx is built to address. The same failure keeps appearing in different systems Developer feedback around FreshCtx surfaced several versions of the same underlying problem: A subscription status changed in Stripe, but an application acted on its old snapshot. A deployment worker continued after another worker had already claimed the job. An agent relied on remembered database action items instead of checking their current status. A research source changed after a claim had been prepared. A voice workflow reached an outdated business record after correctly understanding the request. Different industries and different tools, but the same gap: The reasoning was valid when produced, but stale when executed. What changed in FreshCtx 0.6.0 FreshCtx now provides the same pre-action freshness boundary across several practical environments: Stripe Subscription validation An Agno pre-tool integration Synchronous LangGraph action-node wrappers Asynchronous LangGraph action-node wrappers Selective revalidation of only the evidence an action declared Audit evidence explaining why an action was allowed or blocked The LangGraph integration checks the evidence an action depends on immediately before the node runs. If a required dependency changed or cannot be verified, FreshCtx blocks before the node body starts. FreshCtx does not replace LangGraph routing, retries, checkpointing, transactions, or idempotency. It adds the missing freshness check at the point where reasoning becomes action. Why framework neutrality matters Agno and LangGraph have different execution models. Stripe is not an agent framework at all. The integration changes, but the control remains consistent: An action declares the evidence it depends on. FreshCtx checks that evidence again at the

Founded by a 20-year-old, Alteon is developing autonomous aircraft that hopes to harvest wind energy to stay aloft for several months.

Andreessen Horowitz held out its hand and returned with billions more in new funds to invest in startups.

Build American AI plans to lobby voters in select states about the virtues of data centers by spending millions of dollars on ads.

The Slate Truck is affordable because you have to 'bring your own tech'.

Implementing A* and RRT Motion Planning for Robotics Two classic planning approaches are A * and RRT (Rapidly-exploring Random Tree) . A* is particularly useful when the environment can be represented as a graph or grid. RRT is useful when planning in continuous or high-dimensional configuration spaces. A* Planning A* combines the cost already traveled with an estimate of the remaining cost. Conceptually: f(n) = g(n) + h(n) Where: g(n) is the cost from the start. h(n) estimates the cost to the goal. f(n) ranks candidate nodes. Grid Example S . . # . . . . . . # . . . . . . . . # . . # # # . # . . . . . . . G The planner explores promising cells while avoiding blocked cells. Python Implementation Skeleton import heapq def astar ( graph , start , goal , heuristic ): queue = [( 0 , start )] cost = { start : 0 } parent = { start : None } while queue : _ , current = heapq . heappop ( queue ) if current == goal : break for neighbor in graph [ current ]: new_cost = cost [ current ] + 1 if neighbor not in cost or new_cost < cost [ neighbor ]: cost [ neighbor ] = new_cost priority = new_cost + heuristic ( neighbor , goal ) heapq . heappush ( queue , ( priority , neighbor )) parent [ neighbor ] = current return parent RRT Planning RRT works differently. Instead of systematically exploring grid cells, it samples points and gradually grows a tree. x / x------x / S-----x x----x------G A typical loop is: Sample a random configuration. Find the nearest existing node. Steer toward the sample. Check collision. Add the new node if valid. Repeat until the goal is reached. RRT Skeleton for _ in range ( max_iterations ): sample = random_configuration () nearest = nearest_node ( tree , sample ) new_node = steer ( nearest , sample ) if collision_free ( nearest , new_node ): tree . add ( new_node ) tree . connect ( nearest , new_node ) if reached_goal ( new_node ): return extract_path ( tree , new_node ) A* vs RRT Property A* RRT Representation Grid/graph Continuous space Search Determinis

Lawsuit: Anthropic’s torrenting totally screwed songwriters as AI songs top charts.

The controversial founder of the checkout startup once valued at $11 billion is putting in $5 million of his own money.

“One more warning sign here of what we're facing in a warmer world.”

Adding an index stops working eventually. Here's what we did when a nationwide logistics platform's core table crossed a billion rows — and the parts nobody warns you about. There's a specific moment in a backend engineer's life when the usual advice stops working. A query gets slow. You check the execution plan, you add an index, it gets fast again. This works for years. It works so reliably that it starts to feel like a law of nature. Then one day you add the index and nothing happens. Or worse — the index takes six hours to build, locks the table while it does, and the query is still slow at the end of it. That's roughly where we were on a nationwide logistics platform processing tens of thousands of orders a day. The tracking events table — one row per scan, per parcel, per status change — had crossed a billion rows. Every parcel generated a dozen or more events on its journey. The table only ever grew. This is what we did about it, and more usefully, what nobody told us beforehand. First: are you sure you need this? Partitioning is not a performance trick you reach for when a query feels sluggish. It carries real operational cost, and most tables that people want to partition should just be indexed properly. Some honest signals that you're actually at the boundary: Your indexes no longer fit comfortably in memory, so index reads hit disk Index maintenance — REINDEX, VACUUM, ANALYZE — takes so long you can't schedule it Deleting old data is impossible in practice, because a DELETE of a hundred million rows will destroy your write throughput for hours Your queries almost always filter on a single obvious dimension, usually time That last one matters more than the rest. Partitioning only helps if your access pattern lines up with how you split the data. If your queries hit every partition anyway, you have added complexity and gained nothing. For us the alignment was clean: nearly every query on the events table was scoped to a date range. Operations dashboards loo

The journey to create a polyfill for the upcoming CSS random() function that works in all browsers. Let’s Use the Emergent CSS random() Function in all the Browsers originally handwritten and published with love on CSS-Tricks . You should really get the newsletter as well.