标签：#c

Vulcan oven mitts, spaceship baking dishes, and an out-of-this-world communicator grater—you'll need warp speed to Klingon to this limited edition kitchen kit, ideal for perfecting the broth of Khan.

Stuxnet! Here reproduced by me. Only researchs educations purposes.

Faker Doesn't Know Your Entities Are Related, So I Built Something That Does You've added a second entity to the schema, wired up a @ManyToOne , and gone back to your seed script to generate fifty more rows. Ninety seconds later, the app refuses to start: unique constraint violation, somewhere inside a loop you wrote three weeks ago at 11pm. You fix it. You restart. A different field breaks a different constraint. This is the exact moment every Spring Boot developer eventually meets the real limit of tools like Faker. They're brilliant at generating a name, an email, an address. They have no idea the Payment sitting in front of them needs a Counterparty to already exist. So you do what everyone does: hand-write the wiring. Create parents first. Hold onto their generated IDs. Wire them into children. Hope you didn't just violate a @NotNull somewhere in the process. It works, for a while. Then the schema changes, and the script quietly stops matching reality until the next 3am debugging session finds out the hard way. I hit this enough times that I stopped patching the script and looked at the actual problem: the information needed to seed this correctly already exists. It's sitting right there in the entity, in the annotations you already wrote. @ManyToOne , @NotNull , @Column(unique = true) , JPA already knows the shape of your data. Nothing should need to be told that twice. That became SynthForge . The core idea Instead of writing a script that generates data, you annotate the entity: @Entity @Seed ( count = 50 ) public class Counterparty { /* fields only */ } @Entity @Seed ( count = 200 ) public class Payment { @ManyToOne ( optional = false ) private Counterparty counterparty ; } Start the app in a dev profile. Both tables populate, correctly ordered, on every restart. No seed method. No calling code, anywhere. The entity is the seed script. What's actually happening underneath Entity scanning. SynthForge reads JPA-managed attributes through the jakarta.persisten

Originally published on WordPress on September 27, 2025. When AI systems fail in production, the failure is often blamed on data quality, model drift, or algorithmic limitations. In practice, many of the most damaging failures originate much earlier and much lower in the stack. They come from weak security foundations that allow systems to behave in unintended ways. Reliable AI is not just about accuracy or performance. It is about whether the surrounding infrastructure enforces discipline around access, data handling, and execution paths. Infrastructure as the First Line of AI Security Every AI system depends on infrastructure that controls how compute, storage, and networking are consumed. If that infrastructure is loosely governed, the AI system inherits that weakness. A common example is a shared compute environment where multiple teams run experiments. If isolation is poorly enforced, one workload can access artifacts, logs, or intermediate data from another. The model may be mathematically sound, but the environment allows behavior that violates assumptions about separation and control. From a reliability standpoint, this creates hidden coupling. An AI job might fail or behave inconsistently because another process consumed shared resources or modified shared state. From a security standpoint, the same weakness allows unauthorized access to sensitive datasets or trained models. Strong infrastructure boundaries do not just protect against attackers. They protect teams from each other and from accidental misuse. Access Control Across the AI Lifecycle AI systems have long lifecycles that include data ingestion, preprocessing, training, evaluation, deployment, and monitoring. Each stage introduces different access needs. Problems arise when a single identity or role is allowed to operate across too many of these stages. For example, an engineer might have permission to both modify training data and deploy models. That convenience can quietly undermine trust in the

OAuth can prove that a request may reach a resource. It does not, by itself, tell an operator the full story of the actor holding the token. That distinction matters once software can plan, call tools, retry, and act across several systems. The question is no longer only, "Is this request authenticated?" It is also: Which agent is acting? Under whose authority? For what purpose? Against which target? What evidence will remain after the action? If your system cannot answer those questions without reading the agent's prompt, it does not yet have an operational identity model. It has a credential. A token is permission, not the whole identity OAuth remains essential infrastructure for agents. The current Model Context Protocol authorization specification builds on OAuth 2.1, Protected Resource Metadata, Client ID Metadata Documents, audience binding, and least-privilege scopes. It also hardens issuer validation, defines step-up authorization, and forbids token passthrough. Those controls answer important questions: Is this token intended for this resource? Which permissions did the user approve? Has the credential expired? Does the resource server accept its audience? But a token is still one artifact inside a larger system. It can carry identity claims, but it does not automatically give that identity a lifecycle, an owner, a purpose, or a useful audit trail. An operational identity is the continuity around the token. It says this is the same agent before, during, and after a credential is issued, and that its authority can be understood and withdrawn. Borrowing a human identity breaks the record The fastest way to get an agent moving is often to lend it a human credential. Copy an API key into the environment. Reuse a browser session. Give it an access token created for an employee. Now the log says a person acted when an agent did. The credential may carry every permission the person has, even though the task needed two. Revoking the agent means revoking the human.

From Prompt to Paycheck: Wiring an LLM Chain Into Real Gig Platforms Building autonomous AI agents that can accept work, perform tasks, and get paid is no longer a sci‑fi thought experiment. The pieces exist—large language models, tool‑calling frameworks, and micropayment protocols—but stitching them together requires careful engineering. Below is a pragmatic walk‑through of how to turn a prompt‑driven LLM chain into a billable service that can be offered on gig‑style marketplaces (Upwork, Fiverr, or a custom job board). 1. High‑level Architecture +----------------+ +-------------------+ +-------------------+ | Gig Platform | <--->| Agent Frontend | <--->| LLM Orchestrator| | (job post, | | (webhook / API) | | (LangChain + | | payout) | | | | x402 payment) | +----------------+ +-------------------+ +-------------------+ Gig Platform – posts a job, sends a JSON payload to a webhook you expose, and later releases payment when you signal completion. Agent Frontend – a thin HTTP service (e.g., a Cloudflare Worker or FastAPI app) that validates the incoming request, adds authentication, and forwards the job description to the orchestrator. LLM Orchestrator – the core where the prompt chain runs, tools are invoked, and the x402 micropayment protocol is used to charge the client per call or per completed unit of work. The flow is synchronous for simplicity: the client waits for the agent to finish and returns the result in the same HTTP response. If you need longer‑running work, replace the synchronous response with a job ID and a polling endpoint. 2. Choosing the LLM Stack For reproducibility, I’ll use LangChain (v0.2) with OpenAI’s GPT‑4‑turbo as the base model. The same pattern works with any model that supports function calling (Anthropic Claude, Mistral, local Llama‑3 via TGI, etc.). # orchestrator.py import os from langchain.chat_models import ChatOpenAI from langchain.prompts import ChatPromptTemplate , MessagesPlaceholder from langchain.agents import AgentExecutor

Even though networking fundamentals are often taught at the early stages of a tech career, their relevance becomes far more important when you begin working with distributed IoT and edge-driven architectures. Concepts like subnetting, routing, NAT, DNS, firewalls, and VPNs evolve from simple textbook ideas into core architectural tools that determine how devices communicate, how secure the system remains, and how reliably data moves between the edge and the cloud. This refresher looks at these fundamentals from the perspective of someone building and supporting real IoT and edge environments. The goal is not to re-teach the basics, but to reconnect them with the realities of large-scale, low-power, and cloud-connected systems. 1. Subnetting as the Backbone of IoT Network Segmentation Subnetting plays a much bigger role in IoT and edge-driven environments than most people realize. In traditional networking, subnets help organize traffic and reduce broadcast noise. In IoT, they become a core part of the system architecture. When you’re dealing with sensors, gateways, and edge compute nodes running side by side, the network must be segmented in a way that keeps each function secure and predictable. A typical LoRaWAN setup shows this clearly. The gateway LAN, the packet-forwarder network, and the edge analytics node usually sit in different subnets. This separation allows you to apply strict ACLs around what each component can communicate with, especially because IoT devices often have limited security controls of their own. Subnetting also helps manage traffic flow, ensuring that noisy sensor broadcasts don’t interfere with time-sensitive edge workloads. Beyond security, good subnet design improves fault isolation. If a node misbehaves, the impact is contained within its segment. This structure also supports multi-tenant IoT deployments, where different applications or departments share the same physical infrastructure without touching each other’s data paths. In short

Hi DEV! 👋 I’m the developer behind Flame IDE , a free desktop IDE for macOS, Windows, and Linux. I built Flame to bring my everyday development workflow into one place: multiple repositories, Git worktrees, AI agents, browser previews, terminals, debugging, databases, and API testing. I wanted to spend less time moving between tools and more time building. That also meant making everyday tasks easier, from browsing folders visually and editing images to fixing a failing test or resolving a merge conflict with AI. Multiple projects should feel like one workspace A frontend, an API, and a shared package often belong to the same piece of work. In Flame, I can group them, switch between them, and keep their branches and changes visible without opening a separate IDE window for every repository. The Broadcast terminal runs a command across selected projects with separate output for each. Saved run configurations handle the scripts, servers, and browser previews I regularly start together. Less repeated setup, especially when working across the whole stack. Parallel work should be easy to start and review Git worktrees are incredibly useful, but preparing each checkout can become a chore: missing .env files, local configuration, dependencies, and another window to manage. Flame automates worktree creation and local configuration copying, with initialization steps to prepare the checkout. Features, experiments, and agent tasks can live side by side in one window. The Agents Manager lets me create, monitor, schedule, stop, retry, and review AI tasks across projects, each with its own permissions and landing strategy. Point at the problem. Let AI see what you see. I got tired of screenshotting bugs, drawing red circles, and describing my UI to an AI chat. In Flame’s built-in browser, I select an element and tell the agent what to fix. It can inspect the DOM, screenshots, console errors, and page state, then interact with the page to check its changes. I can follow the fix in

Windows function VS Group by Both window functions and GROUP BY help you summarize data. But they do it in different ways, and mixing them up leads to confusing results. GROUP BY squishes many rows into one row per group. -A window function keeps every row , and just adds an extra column next to it. Once you see that difference, it's easy to know which one to reach for. We'll use one simple table the whole way through, so the examples stay easy to follow: students --------------------------- name | class | score --------------------------- Amina | A | 90 Brian | A | 70 Carla | A | 85 Dennis | B | 60 Efrem | B | 95 Difference between Windows Functions and Group by GROUP BY answers a question like: "What's the average score in each class?" It gives you back fewer rows than you started with — one row per class. A window function answers a question like: "How does this student's score compare to their class average?" It gives you back the same number of rows you started with — one per student — just with something extra calculated for each one. So: Want one summary row per group? Use GROUP BY . Want to keep every row, but add a calculation? Use a window function. Example 1: GROUP BY — one row per class -- One row per class. We lose the individual students. SELECT class , AVG ( score ) AS average_score FROM students GROUP BY class ; Result: class | average_score ------------------------ A | 81.6 B | 77.5 Notice we no longer see Amina, Brian, or any individual name. GROUP BY traded the detail for a summary. That's fine when the summary is all you need. Example 2: A window function — keep every row Now say you want to see each student's score next to their class average, without losing any rows: -- Every student stays, plus a new column showing their class average. SELECT name , class , score , AVG ( score ) OVER ( PARTITION BY class ) AS class_average FROM students ; Result: name | class | score | class_average ------------------------------------------ Amina | A | 90 | 8

ZECpad is an early-stage market and launch infrastructure project being built around the Zcash ecosystem. The product is not publicly available yet. The website currently displays a “TOO SOON” page while development, security planning, and market design continue in the background. There is no token sale, investment solicitation, or return promise associated with this post. Why build on Zcash? Most token launch and trading platforms expose far more information than users expect. Wallet addresses, balances, trading activity, and asset ownership can often be connected and analyzed publicly. Zcash offers a different foundation: programmable market infrastructure can be designed around stronger privacy boundaries rather than adding privacy as an afterthought. Our goal is not to hide the market itself. Prices, liquidity, reserves, oracle health, and aggregate activity should remain observable. What should not automatically become public is the identity and complete financial history of every participant. What ZECpad is exploring The current design work covers three connected areas: Zcash-native token launch and discovery Shielded settlement and privacy-aware browser wallet flows Reference markets linked to external assets without representing direct ownership of shares The reference-market concept is especially important to explain clearly. Exposure linked to assets such as NVDA or gold would not represent legal ownership of the underlying stock or commodity. It would be a ZEC-settled market instrument whose risk, collateral, oracle source, limits, and settlement conditions must be visible to users. Privacy is only one part of the problem A private transaction is not automatically a safe transaction. A launchpad also needs defenses against liquidity removal, concentrated insider supply, manipulated pricing, stale oracle data, insufficient collateral, and misleading asset claims. The areas currently being evaluated include: reserve and collateral accounting; oracle freshne

An approval rule becomes useful when you can test what happens on both sides of it: the forbidden action is refused, and the permitted decision leaves evidence. A happy-path demo alone cannot show that distinction. Here is a runnable example using Accordo, the open-source framework coding agents use to build custom CRMs. A synthetic customer wants 30 seats of an Enterprise Plan and requests 25% off. The existing policy permits automatic approval through 10%; above that, through 50%, it requires a user decision. Run it locally You need Git, Node.js 22.16 or newer, npm, and internet access for cloning and dependency installation. Start in an empty working directory: git clone https://github.com/khaoss85/agent-crm.git framework-source cd framework-source git checkout 3b5b5f0c4c3e582e48d54501136024b064756daa node --no-warnings examples/recipes/quote-approval/run.mjs ../my-quote-crm The pinned recipe source creates a project, installs its dependencies and composes the existing commercial package. It then starts a temporary server on localhost and drives the public SDK through HTTP. The catalog is a fixture; the business journey does not call an external provider. It uses source from the checkout, independently of the npm scaffolder release. Check the refusal, then the decision The script contains assertions for each transition: Server pricing produces EUR 3,750 once and EUR 2,400 per month after discount. These are synthetic quote amounts, kept in separate periods. Submission under policy version 1 freezes a commercial snapshot and enters pending_approval . An approval request from the simulated agent receives HTTP 403 with HUMAN_APPROVAL_REQUIRED . The quote and approval remain pending, and no business audit entry is added. A simulated user approves. The quote becomes approved , with one user decision audit and a completed trace. The submitted snapshot remains unchanged. There is one quote version and one approval record. The refusal also has a failed trace. That is a u

We maintain a corpus of 456 role-specific resume examples in TypeScript. Someone asked me what a good bullet point actually looks like, and rather than answer from taste I decided to measure the thing I already had. Fifteen minutes later we had a script, a set of numbers, and a conclusion. The conclusion was wrong, because the script had silently read about twelve percent of the data. This is a post about that failure mode, and then about the numbers I got once the script worked. The corpus Thirty-one TypeScript files, each exporting an array of role objects. One role looks roughly like this: { slug : ' cloud-architect ' , title : ' Cloud Architect Resume ' , category : ' Information Technology ' , sampleData : { summary : ' ... ' , experiences : [ { company : ' Amazon Web Services ' , position : ' Senior Cloud Architect ' , description : ' - Designed multi-region architecture... \n - Led migration of... ' , }, ], skills : [...], }, tips : [...], } The interesting field is description . It holds a newline-delimited list of bullets as a single string, so the whole corpus of bullets is sitting there in source, greppable, without a database or an export step. Version one const descs = [... text . matchAll ( /description: ' ((?:[^ ' \\] | \\ . ) * ) '/g )]. map ( m => m [ 1 ]); Nothing exotic. Match description: , then a single-quoted string, allowing escapes so an apostrophe inside the text does not terminate the match early. It found 199 description strings. I did not question that, because I had no prior for what the number should be. 199 sounded like a lot of text. We computed medians off it, looked at the opener distribution, and started writing. The number that saved me was on a different line of the same output: roles 456 . The slug count was fine. So 456 roles between them had 199 job descriptions, which would mean the overwhelming majority of roles had no work history at all. I knew that was false, because I had rendered these pages. Why it read twelve percent

Checked with a Googlebot user agent one morning: every single URL on our site returned the same 3,780-byte shell. Same <title> , zero <h1> , zero body text. The homepage, a blog post and a product page were byte-identical before JavaScript ran. Search Console agreed with the crawler rather than with us. Of 741 URLs, 116 had earned a single impression in 28 days, and a landing page that had been live for five months was still reported as "URL is unknown to Google". Here is what I actually learned fixing it, including the two things that cost us the most time. Google does render JavaScript. That is not the point. The standard reply to this problem is "Googlebot executes JS now, you are fine." It does. Several of our pages were indexed, so rendering clearly happened. But rendering is a separate, budgeted queue . A domain with little authority does not get much of that budget. So the practical question is not "can Google render our page", it is "will Google spend its budget rendering this page, today, before it decides what the page is about". There is a second problem that has nothing to do with rendering: 741 URLs that are byte-identical before render look like duplicates. You are handing a duplicate-content signal to the crawler and hoping the render queue fixes your first impression. What we built, and what we deliberately did not We wrote a post-build script that injects a real <head> into each generated HTML file: title, description, canonical, robots, Open Graph, Twitter. Head only. The body stayed exactly as the SPA served it. That was deliberate: No hydration flash. No risk of a static copy drifting out of sync with what users see. Nothing that could be read as cloaking, because the static markup is a subset of the rendered markup, not a different page. Every value is read from the same source the React page reads. Where a title is a literal inside a component, the script extracts it from that component's source rather than having anyone retype it. A number ret