标签：#ast

Por que usar o Cloudflare em vez do DNS padrão do seu registrador Escrevi esse texto depois de um perrengue aqui na empresa onde trabalho. Precisei registrar uns subdomínios, entrei no painel da Cloudflare esperando achar os registros lá e não tinha nada, fui atrás do time para entender onde aquilo estava apontando e a resposta foi que tudo passava direto pelo provedor de domínio. Quando você registra um domínio na GoDaddy, Namecheap, Registro.br ou qualquer outro provedor de domínio, ele já vem com um par de nameservers configurados por padrão. Funciona, mas "funcionar" e "ser a melhor opção para produção" são coisas diferentes, e trocar esses nameservers pelos da Cloudflare é uma das mudanças de maior custo-benefício que dá para fazer em um projeto. O que muda ao trocar os nameservers Um provedor de domínio só precisa resolver DNS: publicar seus registros A, CNAME, MX e afins, e responder consultas. A infraestrutura por trás disso varia muito de provedor para provedor e raramente é otimizada para latência global ou resiliência a ataques, porque não é o produto principal deles. A Cloudflare constrói a rede em torno de DNS, CDN e mitigação de DDoS como núcleo do negócio, e isso aparece em números concretos: a rede anycast cobre mais de 330 cidades, então uma consulta DNS ou uma requisição HTTP é respondida pelo ponto de presença fisicamente mais próximo do usuário, não por um servidor central do outro lado do mundo. Hoje a Cloudflare responde por algo em torno de 23% de todos os sites da internet. Vantagens técnicas O anycast é a base de tudo. Não existe "o servidor DNS" que pode cair: se um ponto de presença fica indisponível, o tráfego é roteado automaticamente para o mais próximo, o que reduz latência de resolução e risco de indisponibilidade. A mesma arquitetura, combinada a TTLs baixos, também acelera a propagação de mudanças: um registro DNS alterado costuma valer em minutos, enquanto em boa parte dos provedores de domínio tradicionais não é incomum esperar ho

HashiCorp has introduced tfpolicy, a new HCL-based policy-as-code framework for Terraform, now available in public beta within HCP Terraform. It is designed to simplify and modernize infrastructure governance by integrating policy creation and enforcement directly into Terraform workflows, eliminating the need for separate tools and languages. By Sergio De Simone

When the phrase "OpenAI hacked Hugging Face" has more or less entered mainstream culture, you know we have an AI problem. This week, we learned more about exactly how OpenAI's agent broke out of a sandbox and autonomously traversed the web, including a bunch of other supposedly secure web services, all in the name of […]

Kubernetes makes it easy to define CPU and memory requests for our applications. But there is a problem: How do we know whether those resource requests are actually correct? If an application requests: yaml resources: requests: cpu: "1000m" memory: "1Gi" but normally consumes only a few millicores of CPU and a few megabytes of memory, we may be reserving significantly more cluster capacity than the workload actually needs. I wanted to understand how Kubernetes cost optimization platforms detect this situation, so I built a small hands-on lab using: Google Kubernetes Engine (GKE) CAST AI Kubernetes Docker FastAPI Google Artifact Registry The goal wasn't simply to install CAST AI. I wanted to observe the complete process: Deploy workload ↓ Observe resource usage ↓ Compare requests vs usage ↓ Identify over-provisioning ↓ Generate recommendation ↓ Apply rightsizing ↓ Verify from Kubernetes Architecture The lab architecture was intentionally simple. FastAPI Coffee API | v Docker Image | v Google Artifact Registry | v GKE Cluster | v Kubernetes Deployment | +----------------+ | | v v Pod #1 Pod #2 | | +-------+--------+ | v ClusterIP Service + | v CAST AI | +-------+-------+ | | v v Cost Monitoring Workload Optimization 1. Building a Small Test Application I created a very small FastAPI application for the experiment. from fastapi import FastAPI import socket import os import time app = FastAPI() @app.get("/") def home(): return { "message": "Coffee Shop API", "hostname": socket.gethostname(), "pod": os.getenv("HOSTNAME"), "time": time.time() } @app.get("/coffee") def coffee(): return { "coffee": "Cappuccino", "price": 120 } The hostname in the response was useful later because I could see which Kubernetes Pod handled each request. 2. Containerizing the API The application was packaged using Docker. FROM python:3.12-slim WORKDIR /app COPY requirements.txt . RUN pip install --no-cache-dir -r requirements.txt COPY app.py . EXPOSE 8000 CMD ["uvicorn", "app:app", "--host", "0

This week on Uncanny Valley, we discuss the open- vs. closed-source debate in AI, key players in White House AI policy, and how to stop your chatbot logs from showing up in search-engine results.

British AI neocloud Nscale is buying software startup Anyscale, which helps companies scale their AI workloads across data centers and servers.

The Series A was led by Khosla Ventures, with participation from Allianz, Rebel Fund, Brick and Mortar Ventures’ Darren Bechtel, and Y Combinator’s Garry Tan.

I run a fact-check site for an unreleased game. That genre is a swamp: half the pages you find are somebody's guess reprinted six times until it reads like news. I wanted the opposite, so I made provenance a schema requirement instead of an editorial habit. If a claim has no source, the build fails. Here is how that works in Astro, and what it cost me. Sources live in the content schema, not in the prose Every entity on the site is a YAML file validated by a Zod schema. The interesting part is that sources is not optional: const sourceSchema = z . object ({ url : z . string (). url (), date : z . string (), // when the source said it, not when I read it }); const base = { status : z . enum ([ ' confirmed ' , ' trailer-spotted ' , ' rumor ' , ' debunked ' ]), updated : z . string (), sources : z . array ( sourceSchema ). min ( 1 ), }; export const entitySchema = z . object ({ name : z . string (), description : z . string (), sections : z . array ( z . object ({ heading : z . string (), text : z . string (), status : z . enum ([ ' confirmed ' , ' trailer-spotted ' , ' rumor ' , ' debunked ' ]), sources : z . array ( sourceSchema ). min ( 1 ), // per section, not per page })). optional (), ... base , }); Two decisions in there matter more than they look. Sources are per section, not per page. A page usually mixes a confirmed fact with a plausible reading of a trailer. One source list at the bottom lets those blur together. Per-section sources force me to say which sentence rests on what. Status is a required enum, not a boolean. rumor and debunked are first-class. The page renders a badge from the same field, so the reader sees the confidence level next to the claim instead of a disclaimer nobody scrolls to. The cost is real: adding a paragraph means finding a citable source for it. Several times I have deleted a nice sentence because I could not back it. That is the feature working. Seven locales, and the empty ones stay invisible The site ships in seven languages, a

Let's Encrypt issues TLS certificates with a 90-day validity period by default. However, as the industry is gradually shortening TLS certificate lifetimes—with the maximum eventually expected to fall to 47 days—Let's Encrypt already offers certificates using the tlsserver profile with a validity period of 45 days. Compared with the current default classic profile, the tlsserver profile removes deprecated attributes such as the Common Name. Because it follows the latest recommended configuration, it also produces slightly smaller certificates. The differences between the profiles are documented on the following page. If you have already automated certificate issuance and renewal, it is worth considering an early move to the tlsserver profile. Certificate Profiles - Let's Encrypt Certificates issued with the classic profile are currently valid for 90 days. However, the validity period is scheduled to be shortened to 64 days in February 2027 and then to 45 days in February 2028. Certificate renewal automation is easy to leave untouched once it is working, and many monitoring systems also use fixed day-based thresholds. Both renewal automation and monitoring therefore require careful review. Decreasing Certificate Lifetimes to 45 Days - Let's Encrypt With only about six months remaining before the validity period is reduced to 64 days, now is a good time to begin validating your systems. Let's Encrypt also provides the shortlived profile for certificates that support IP addresses. These certificates are valid for only six days. With such a short lifetime, using them without automation is no longer practical. 6-Day and IP Address Certificates - Let's Encrypt To issue certificates using any of these profiles, you need an ACME client that supports ACME profile selection. Widely used clients such as Certbot should be able to issue them without difficulty. Issuing a certificate with the new tlsserver or shortlived profile is straightforward. The harder part is keeping it ren

Comcast, accused of negligence, says lawsuit mischaracterized alleged events.

When you open a website, send a message, or watch a YouTube video, many technologies work together in the background. As a beginner in DevOps, understanding these basic networking concepts will help you understand how applications communicate over the internet. **What Is a Protocol? A protocol is a set of rules that devices follow when communicating with each other. Think about two people having a conversation. For communication to be successful, both people must speak the same language and follow simple rules, like taking turns to talk and listening before responding. Computers work the same way. They use protocols to know how to send, receive, and understand information. Without protocols, computers would not be able to communicate with one another. **2. What Is Packet Switching? **Imagine you want to send a large book to a friend. Instead of sending the entire book in one huge package, you divide it into many smaller packages. Each package travels separately and, when they all arrive, your friend puts them back together in the correct order. This is exactly how the internet works. When you visit a website, your data is broken into small pieces called packets. Each packet travels across the internet and is reassembled when it reaches its destination. This process is called packet switching, and it makes internet communication faster and more reliable. **3. What Is an IP Address? **Every house has a unique address that helps delivery drivers know where to deliver packages. Similarly, every device connected to the internet has a unique Internet Protocol (IP) address. An IP address helps the internet know exactly where information should be sent. Without an IP address, websites, computers, and phones would not know where to send or receive data. **4. What Is TCP/IP? **Breaking data into packets is not enough. The packets must also arrive correctly. This is where TCP/IP (Transmission Control Protocol/Internet Protocol) comes in. IP finds the correct destination for ea

A portfolio for thoughtful, reliable learning technology I am a senior full-stack software engineer with 20 years of experience building scalable web applications, primarily for learning and education. I recently published a focused portfolio to share the products, technologies, and engineering work behind that experience. Diogo Bastos | Senior Full-Stack Software Engineer Professional portfolio of Diogo Bastos, a senior full-stack software engineer. diogobastos.pages.dev The site is intentionally straightforward: a clear overview of my background, selected professional work, personal projects, certifications, and a public résumé. What you will find Learning technology work : projects across Pearson eDynamic Learning, HMH, and Neovation Learning Solutions. Full-stack engineering : React and TypeScript on the frontend; Node.js, Java, APIs, SQL, and cloud delivery practices on the backend. Recent personal projects : experiments in Python, FastAPI, React, AWS, and Java/Spring Boot. A concise, accessible build : the portfolio is a static site built with Astro, with attention to responsive design and usability. I care about turning complex product needs into dependable experiences for the people who use them. If you work in software engineering, learning technology, or product development, I would be glad to connect. Explore the portfolio: diogobastos.pages.dev Thanks for stopping by.

I've been having the same conversation with my colleagues for months. What does it mean to create...

Rate limiting is one of those features every production API eventually needs. Whether you're building a public REST API, a WebSocket service, or an authentication endpoint, you'll eventually face problems like: Credential stuffing Brute-force attacks API abuse Bots scraping your endpoints Unexpected traffic spikes Most applications solve this with a simple request counter. But after building several APIs with Django, FastAPI, and Flask, I realized that production traffic requires much more than "X requests per minute." That observation led me to build drogue , an open-source Python library for rate limiting and traffic protection. The Problem Traditional rate limiting is straightforward: Allow 100 requests per minute. This works well for many cases, but real-world applications quickly expose its limitations. For example: A distributed attack can remain below the per-IP limit. A bot can rotate through proxies. WebSocket connections often require different handling than HTTP requests. Different endpoints need different protection strategies. I wanted a system that could go beyond simple request counting. Design Goals From the beginning, I focused on a few principles. 1. Clean framework integration I didn't want endpoint functions filled with framework-specific plumbing. Instead, the library should feel like a natural extension of the framework. from fastapi import FastAPI from drogue.adapters.fastapi import DrogueLimiter app = FastAPI () limiter = DrogueLimiter ( app , default_limits = [ " 100/minute " ]) @app.get ( " /users " ) @limiter.limit ( " 10/minute " ) async def users (): return { " status " : " ok " } No additional request objects. No complicated middleware configuration. Minimal boilerplate. Multiple Rate Limiting Algorithms Different applications require different algorithms. Instead of supporting only one approach, drogue includes multiple options: Token Bucket Sliding Window Fixed Window Each has different trade-offs between accuracy, burst handling, and

Docker published the second entry in its Coding Agent Horror Stories series on July 20, and the operational read is short: on a stock developer laptop, an AI coding agent runs with the engineer's filesystem permissions and the engineer's credentials, with nothing sitting between it and the host. The post frames a scenario in which the agent deletes production and works backward through why that outcome is not exceptional. Docker names the piece as part two of a series that will cover six categories of coding-agent failure. What the post actually claims Two claims carry the argument. First, the agent inherits the developer's shell posture: whatever the developer can touch on disk, the agent can touch; whatever token is exported into the environment, the agent can spend. Second, that default is not a sandbox. Docker's phrasing is that nothing sits between the agent and the host unless the operator puts it there. The piece does not attribute the scenario to a named incident; it is a category, not a case study. Anyone extrapolating specific companies, victims or numbers is filling in blanks the source did not. The runner problem, one hop to the left For CI operators this shape is familiar. A self-hosted Actions runner or a Jenkins agent that mounts the workspace, holds a checkout token and can call the host shell is a service you already isolate on purpose. You isolate it because the workflow you invited in is not always the workflow that runs. You isolate it because the token in the environment can do more than the job description. You isolate it because rollback of a bounded container is cheaper than reasoning about everything a process touched on a shared box. A coding agent living on the developer laptop occupies the same trust position, one machine earlier in the pipeline. It reads and writes the working tree. It holds session credentials to cloud APIs, the cluster and the registry. It executes instructions the developer did not always write, sometimes routed from

“We're in the realm where we might be essentially killing off everything within that first hour or two."

Github URL: https://github.com/SID-Technologies/Pilum In December 2025, I open-sourced Pilum , a multi-cloud deployment CLI that deploys to Cloud Run, Lambda, Azure, Cloudflare Pages, npm, Homebrew, and Docker Hub from a single pilum.yaml . The announcement post covered the architecture: recipes, ingredients, handlers, wave-based execution. That was the "it compiles and the tests pass" version. Three months and 40+ pull requests later, Pilum deploys all of SID Technologies , platform-core, Torch, Statio, every website, every npm package, and itself. This post is about everything that broke between "it works" and "it ships production software." ( Update: * there's now a seven-months-in addendum at the bottom. It's mostly about what stopped breaking.)* The Timeline Dec 2, 2025 : First commit. Baseline CLI with recipe system. (#1) Dec 4 : Homebrew release workflow. Pilum dogfoods its own deployment. (#2-#4) Dec 31 : Service graph, --only-changed , file embedding support. The "I need this for real" features. (#22-#24) Jan 3-12 : Documentation and bug fixes. The quiet "oh, this doesn't actually work" phase. (#25-#29) Feb 6-7 : The big feature sprint — 8 features in 48 hours. Wave deployments, npm recipe, Cloudflare Pages, Azure Container Apps, Cloud Run Jobs, environment variables, JSON output, history command. (#30-#38) Feb 8-12 : The big fix sprint — YAML parsing, package manager issues, build failures, error swallowing, GCP secrets, Cloudflare execution. Everything from the feature sprint broke something. (#42-#49) Feb 24 : Security hardening and npm publishing fixes. (#51-#53) Mar-Apr : Memory-based worker allocation, wave ordering bug, orchestrator rewrite. The "I thought this was done" phase. (#58-#62) The pattern is clear: features ship fast, fixes ship faster, and the real bugs show up a month later. Wave-Based Deployments Were Broken Wave-based deployment was the headline feature in #31. Services declare dependencies, Pilum builds a dependency graph, topological

Hands-On tests with 'UserHarbor' and IBM Bob: A Modular Approach to Python User Authentication and Permissions Introduction When evaluating open-source libraries for core application infrastructure - such as authentication, session management, and fine-grained Role-Based Access Control (RBAC) - getting hands-on with a complete reference application is invaluable. This is especially true for libraries aiming to be framework-agnostic, promising flexibility but requiring more explicit wiring. Recently, I wanted to explore UserHarbor ( github.com/userharbor/userharbor ), a lightweight Python user-management library designed without direct coupling to any web framework or database toolkit. Rather than manually bootstrapping a new project, setting up the SQLite database, and writing boilerplate code to explore every edge of the library, I used IBM Bob , to scaffold and implement an end-to-end reference demonstration integrated with FastAPI , SQLAlchemy for persistence, and SMTP (or a local console fallback) for transactional emails. The goal was to rapidly test UserHarbor's entire feature lifecycle - registration, email verification, session tokens, optional authentication, RBAC guards, password resets, and account deletion, which I personally find really useful. These capacities could be implemented in many applications and ease the phase of user registration, email validation etc… This post details the architecture built, highlights the key implementation logic, and illustrates how easily a decoupled core can be integrated into a modern web stack. UserHabor (from official GitHub repostory) Image from official project's repository Project status: UserHarbor is currently in an early stage of development. The API may change frequently. The library is not ready for production use yet . UserHarbor is a framework-agnostic Python library for user account management. Its goal is to provide a simple, stable, and framework-independent interface for common user-related operations:

Veo is launching accessibility-focused electric tricycles in Denver, with plans to put its e-trikes on the streets nationwide.

In 2023, the Times sued OpenAI and Microsoft for copyright infringement. They’ve since spent more than $20 million on the case, and publisher A.G. Sulzberger has no plans to stop fighting it.