标签：#c

The first time I audited seriously, I opened the biggest contract in the repo and started reading line one. Two hours later I had a headache and zero findings. I had memorized how the code worked without ever asking what it was supposed to guarantee. That is backwards, and it took me a while to unlearn it. Now I do not read Solidity first. I read the scope, and before I look at a single function body I write down what must always be true. Bugs are violations of those truths. If you do not know the truths, you are just admiring the code. Step one: write the invariants before you read An invariant is a property the protocol claims will always hold, no matter who calls what in what order. For a contest, I start with money and control, because that is where severity lives. Two questions cover most of it: Who can move funds, and under what conditions? What must always hold about the accounting? For a lending-pool-shaped protocol my starting invariant list looks like this, written in plain language before I care how any of it is implemented: The sum of all user deposits minus all borrows equals the pool's available liquidity plus outstanding debt. Accounting must reconcile. A user can only withdraw up to their own balance, never more, never someone else's. A position can only be liquidated when it is actually under the health threshold. Interest accrues monotonically, it never goes backwards in a way that lets someone repay less than they owe. Only the borrower, or a liquidator on an unhealthy position, can reduce a debt. Nobody except governance can change interest rate parameters or the oracle. Notice none of that mentions a function name. These are the promises. Now my job for the rest of the contest is simple to state: find an ordering of calls that breaks one of these. Step two: map the external entry points Funds do not teleport. Something has to be called from outside for state to change. So I list every externally reachable function, because the attack surface is

Originally published on nejckorasa.github.io . When a team moves from a monolith into microservices and event-driven, asynchronous systems, it inherits a class of problems that used to be someone else's: work that fails halfway through, steps that must not run twice, calls that return before the work is done. Temporal is a durable execution engine that handles a lot of this - you define a multi-step process, and it guarantees the process runs to completion even when workers crash in the middle. I've spent the better part of a decade building distributed systems in the money-movement core of banks - ledgers, payments, credit cards - a lot of it on Temporal, from short request-triggered workflows to ones that stayed open for weeks. This is the high-level guide I'd give a team making that jump: the principles worth internalising before you ship, not a full tutorial. Most of them aren't really about Temporal. They're the habits the async shift demands - Temporal just punishes you quickly when you skip one. Durable Execution: The Problem It Solves Distributed work fails in the middle. You call service A, it succeeds. You call B, it times out. The pod dies before C. Now you have half-finished work and no memory of how far you got. The usual fix is a pile of status columns, a cron job to find stuck rows, and retry logic hand-rolled for every step. Temporal's promise is that any process you start runs to the end. The runtime picture: there's a Temporal service (its own cluster), and your app runs worker processes that poll it and execute your code. As a workflow runs, Temporal records every step to an event history . If a worker dies, another picks the workflow up and replays that history to rebuild state, then carries on from where it left off, retrying anything that failed. The history is the source of truth, and it survives the crash. Most of the rules below fall out of that one fact. The Golden Rule: Workflows Decide, Activities Do There are two kinds of code in Tempora

Clean out that cable junk drawer every so often and keep only the things you actually need.

This is Part 18 of my series on the Microsoft Agent Framework. You can read the original post over on lukaswalter.dev . In the previous article , we looked at observability for agents. The main idea was to make a run visible as a chain of model calls, tool calls, approvals, and workflow events. Testing starts from the same idea. An agent run is not one answer string. It is a small application flow with several boundaries: user input -> prompt and context -> model request -> model response -> tool selection -> tool arguments -> tool execution -> structured result or final answer -> routing or workflow state If the only test is an end-to-end prompt against a live model, all of those boundaries are mixed together. When the test fails, you do not know whether the problem is the prompt, the model, the tool schema, the router, the workflow, or the real dependency behind the tool. The solution is not to pretend that an LLM is deterministic. The solution is to test each boundary at the level where it is deterministic, then add a smaller number of evaluation-style tests for behavior that genuinely depends on the model. This post covers: fake model clients tool contract tests structured output tests routing tests workflow tests eval-style regression checks The examples use xUnit-style assertions, but the testing approach does not depend on xUnit. The snippets focus on the relevant testing boundary and omit some application-specific factory and workflow setup. Do not start with the live model A live model test is useful. It is also expensive, slow, sometimes flaky, and difficult to diagnose. That makes it a poor replacement for normal unit and integration tests. I use a testing pyramid for agent applications: evals realistic model and user examples application integration tests agent + tools + storage + workflow boundaries deterministic component tests fake model client, tools, schemas, routing The bottom layer should be the largest. It should catch ordinary programming mistak

A few weeks ago, I set out to build a small portfolio project: a Streamlit app that could take any tabular dataset, understand something about its structure, and give honest guidance on how to model it. I called it ContextLens . I expected it to be a practical exercise in Python, machine learning, and deployment. What I didn't expect was how closely it would connect with the same questions I work with every day in my PhD research on context-aware intelligent systems. The problem I started with Most introductory machine-learning tutorials follow a familiar sequence: Load a CSV. Choose a model. Train it. Check the accuracy. What often gets skipped is the layer of judgment that should come before any of that: Is this actually a classification problem or a regression problem? Is the target so imbalanced that accuracy becomes misleading? Is that "ID" column secretly leaking the answer into your model? Are there duplicate rows, missing values, high-cardinality categories, or too many features for the number of available observations? Experienced practitioners make these judgments almost automatically. But that reasoning usually remains invisible—it sits in someone's head rather than inside the system, where another person can inspect it. ContextLens is my attempt to make that layer visible. Upload a dataset, and it profiles the data, flags structural risks—missingness, duplicate rows, likely identifier columns, class imbalance, and high-dimensional settings—and adapts its evaluation guidance to what it finds before training a single model. The point is not simply to train a model. The point is to ask whether the modelling process makes sense in the first place. Why I call it "context-aware" rather than "AI-powered" I was deliberate about this distinction, just as I have been throughout my PhD work, and it turned out to be the most important design decision in the whole project. ContextLens does not claim to be intelligent in the way a human expert is. It does not hide its

"These are things that tend to be really hard."

The carmaker has said it's owed a refund in the "tens of millions of dollars."

Tesla's electronic door handles that have been linked to several deaths could lead to tougher safety rules for the entire auto industry. In a notice published today, the National Highway Traffic Safety Administration said that complaints about Tesla's mechanical door release don't warrant a defect investigation. Instead, the issue is better addressed through a broader […]

Users can now ask Attie questions about news, trends, and conversations on Bluesky and other apps on the AT Protocol.

Most Chromebooks ship with only 8GB of RAM, which is enough for some people, but certainly not enough for me. Multitaskers who want more memory in their next Chromebook should check out Best Buy, which is discounting Acer’s Chromebook Plus Spin 514 for the remainder of the day. Originally $749 for the configuration with 12GB […]

Boox's new Tile lineup will take on Xteink's popular e-readers that are small enough to stick on the back of an iPhone with MagSafe. As spotted by Good E-Reader, the first one is the Picco, which will feature a 3.97-inch front-lit, black-and-white e-paper display and expandable storage with an SD card slot. Boox confirmed to […]

The AI “startups” worth billions of dollars are raising alarm bells about Chinese AI. The smaller players have a totally different take.

The Trump administration unveiled the first "Genesis Mission" grants on Thursday, directing $5 billion toward hundreds of AI-driven science projects in an effort the White House has described as "comparable in urgency and ambition to the Manhattan Project." At roughly the same time, Trump's science adviser Michael Kratsios was on Capitol Hill selling lawmakers on […]

Relativity Space announced plans to build a second rocket factory near Cape Canaveral, Florida.