标签：#c

I spent last month reviewing JWT implementations across 12 open-source Node.js projects on GitHub — ranging from starter templates with 2k stars to production boilerplates used by teams at real companies. I found the same 6 mistakes in almost every one. None of these projects are bad. The developers are skilled. The mistakes are subtle, copy-paste errors from tutorials that nobody questioned. Here they are. Mistake 1 — The Secret Is Literally "secret" I found this in three separate projects: const token = jwt . sign ({ userId : user . id }, " secret " , { expiresIn : " 1h " }); This secret is in every JWT tutorial on the internet. It is in the jwt.io documentation. It is in the jsonwebtoken README. Developers copy it and forget to replace it. A 6-character ASCII secret has approximately 42 bits of entropy. A GPU cluster cracks it from a dictionary in milliseconds. Generate a real secret here — it takes 3 seconds and produces a 256-bit cryptographically random key. Mistake 2 — jwt.decode() Used in Auth Middleware // DANGEROUS — this is in a production auth middleware const decoded = jwt . decode ( req . headers . authorization . split ( " " )[ 1 ]); if ( ! decoded . userId ) return res . status ( 401 ). send ( " Unauthorized " ); jwt.decode() does not verify the signature. It reads the payload regardless of whether the token is valid, expired, or forged. An attacker can craft any payload they want and it will pass this check. The fix is two characters: jwt.verify() . const decoded = jwt . verify ( token , process . env . JWT_SECRET , { algorithms : [ " HS256 " ] }); Mistake 3 — Algorithm Not Specified in verify() // Missing algorithms option jwt . verify ( token , secret ); Without { algorithms: ['HS256'] } , the library trusts whatever algorithm is in the token's header. An attacker can create a token with alg: none and an empty signature — and jwt.verify() will accept it. Always specify the expected algorithm explicitly. Mistake 4 — Secret Committed to Version Cont

When I started programming, Git was hard for me — like anything new is at first. Over time I noticed something: most of the best resources for learning it are in English. And for a lot of people just starting out, that's one more obstacle they shouldn't have to deal with. So in my spare time I built the thing I wish I'd had back then: Commitea . What is it? Two pieces, designed to complement each other: An open source repo with the full documentation in Spanish — from what a commit actually is, to how to get yourself out of trouble with rebase , a cherry-pick , or a push you regret. Every entry follows the same format: the concept in one sentence, a real example with commands, and "how this breaks" (the typical mistake people make). A web app with an interactive visualizer ( commitea-web.vercel.app ) where you type real Git commands and watch, live, what happens to the branch/commit graph. It doesn't touch any real repo — it's an in-memory simulator, but the engine actually replicates real Git behavior: fast-forward vs. merge commit detection, history rewriting on rebase, blocking a branch switch when you have uncommitted changes (just like real Git does), etc. What's in it right now 7 built-in scenarios you can run with one click and watch play out step by step: branch + merge, fast-forward, rebase, cherry-pick + reset --hard, fixing a commit made on the wrong branch, several branches merging in sequence, and stashing changes. Full command support : branch , checkout , commit , merge , rebase , cherry-pick , reset --hard , stash (with an edit helper command to simulate uncommitted changes, since the simulator has no real filesystem), status , and log . Site-wide search (⌘K), powered by Pagefind, indexing only the actual article content — not nav or boilerplate. A feedback widget on every article ("was this helpful?") that stores vote counts in Redis, so I know which content needs work without guessing. Light/dark mode , respecting system preference by default. A ch

The contract between the two companies ends in May 2028, Uber told TechCrunch.

Big Tobacco studied nicotine analogs like 6-methyl-nicotine for decades but never marketed them. Now, Chinese vape makers are using them to sidestep US regulations.

This was not supposed to become a product. When PaddleOCR-VL-1.6 dropped, independent benchmarks put it at the top of document parsing models. I had to try it. I needed a provider, but there simply isn't one ready for production that I would trust. So i set one up myself. I assumed that even after getting it running, serving a vision-language model would be expensive. It turns out the opposite is true. Once I had it running properly, the cost was absurdly low. At proper GPU utilization, the cost

Roku blames RAM shortage after CEO called it "great" for business in May.

Meta's smart glasses have been a PR headache for the company. Public backlash has been swift, and fierce; people are concerned about the erosion of privacy and expansion of surveillance. Some especially bad actors are using the glasses to film themselves "pranking" random strangers. Women have become unsuspecting social media content for men filming themselves […]

Midjourney, which has gone from generating AI cat images to full-body ultrasound scans, is getting into a new field: astrology. The AI startup announced on Thursday that it has acquired the personalized astrology app Co-Star, as reported earlier by Bloomberg. Co-Star is a free app that offers daily horoscopes and allows you to check your […]

Tool comparison posts obsess over feature matrices and monthly pricing. Both are the easy numbers. The expensive number is what it costs to leave , and almost nobody publishes it. Three kinds of lock-in, in ascending order of pain Data lock-in is the one people check. Can you export? In what format? A CSV dump that loses your relationship structure is not really an export. Workflow lock-in is worse and less visible. Your team learned the tool's mental model. Your runbooks reference its UI. Your onboarding docs have screenshots. Switching means rewriting all of that, and none of it shows up in a pricing comparison. Integration lock-in is the killer. Every webhook, every CI step, every Zap pointing at this tool is a thing that breaks on migration day. The count grows silently — nobody tracks how many integrations a tool accumulates until they try to remove it. A rough way to score it before you commit Before adopting anything, ask four questions and write the answers down: Export fidelity — can I get my data out in a form a competitor can actually ingest? Not "is there an export button." Integration surface — how many other systems will end up pointing at this? Each one is future migration work. Config as code? — if the configuration lives in a database behind a UI, migration means clicking. If it lives in YAML in my repo, migration means editing files. Who owns the identity? — if the tool is also your auth provider, leaving is a much bigger project than swapping a dependency. Score each 1-5. A tool scoring badly on 3 and 4 needs to be substantially better to justify adoption, not marginally better. Why the cheap option often is not The pattern I keep seeing: a team picks the cheaper tool, accumulates 20 integrations over 18 months, then discovers the migration cost exceeds three years of the price difference they were optimising for. Pricing is a recurring cost you can forecast. Migration friction is a one-time cost you cannot, and it lands at the worst possible mome

Every "run this model locally" guide tells you to grab a Q4 GGUF and move on. That advice is fine right up until you try a long-context run and your machine starts swapping. The weights are the part everyone budgets for Quantization maths is straightforward. A model's weight footprint is roughly params x bits / 8 : Quant Bits/param 12B model Quality note Q8_0 ~8.5 ~12.8 GB Near-lossless, rarely worth it Q6_K ~6.6 ~9.9 GB Very close to Q8 Q4_K_M ~4.8 ~7.2 GB The usual sweet spot Q3_K_M ~3.9 ~5.9 GB Noticeable degradation Below Q4 the loss stops being subtle. Instruction-following degrades before raw perplexity does, which is why benchmark numbers can look fine while the model quietly stops respecting your system prompt. The KV cache is the part that bites Here is what the guides skip. The KV cache scales with context length , and it is not quantized by default: kv_bytes ~= 2 (K and V) x layers x kv_heads x head_dim x seq_len x dtype_bytes The practical consequence: a model that loads in 7 GB can need well over twice that at long context. Grouped-query attention helps a lot — kv_heads is much smaller than attention heads — but the term still grows linearly with sequence length while your weights stay fixed. Two knobs matter more than picking a fancier quant: --ctx-size : do not allocate 128K if your prompts are 8K. You are reserving memory you will never touch. KV cache quantization ( q8_0 for K/V): roughly halves cache memory for a quality hit most workloads never notice. Underused. A decision order that works Start at Q4_K_M Set context to what you actually use, not the model maximum If you are still tight, quantize the KV cache before dropping to Q3 Only move up to Q6/Q8 if you have headroom left over That ordering matters: dropping to Q3 to buy context is the most common mistake, and it trades a permanent quality loss for memory you could have gotten from the cache instead. Per-quantization benchmarks and deployment notes for the Gemma 4 family are collected at ge

Why Sick Patients Hate Your Cheerful Conversational Voice AI Picture an oncology patient sitting in the dark at three in the morning, nursing a severe bout of breakthrough pain. Desperate for assistance, she calls her clinic's scheduling and triage line. Instead of a calm, grounded response, she is greeted by an artificially bright synthetic voice: "Hi there! What a bright day to take care of your health!" The patient hangs up immediately. This reaction is far from an isolated incident. When individuals reach out to a medical office, they are rarely seeking entertainment or cheerful banter. They are frequently managing acute pain, administrative frustration, or intense health anxiety. When a high-stress emotional state collides with a forced, chipper baseline tone, the resulting healthcare voice AI tone mismatch creates severe cognitive friction. Patients perceive forced cheerfulness as cold apathy disguised as friendliness. In clinical communications, this phenomenon manifests as conversational AI toxic positivity. An upbeat virtual receptionist telling a patient with severe chest tightness that it would be "happy to help you today" projects a disturbing lack of situational awareness. Instead of humanizing the interaction, artificial warmth highlights the machine's non-human nature. It pushes the caller deep into the uncanny valley of simulated care, leaving patients feeling managed by a cost-cutting algorithm rather than supported by a dedicated care team. The Data Behind Patient Frustration Industry benchmarks reveal a profound disconnect between healthcare automation strategies and patient expectations. While health systems rapidly deploy patient experience virtual assistant models to offload administrative burden from front-desk staff, few organizations audit the emotional resonance of their automated telephony systems. Metric Patient / Consumer Reaction Source 68% Report heightened frustration when automated healthcare voice systems use overly enthusiastic or