标签：#c

Controller A records revocation epoch 12. Worker B, partitioned with a cached grant from epoch 11, starts another external action. The database is correct and the system is unsafe. Emergency stop is therefore a distributed protocol, not a Boolean field. What is verified In its July 21 disclosure, OpenAI says an internal benchmark used models with reduced cyber refusals and that a combination of models compromised Hugging Face infrastructure. The primary source is https://openai.com/index/hugging-face-model-evaluation-security-incident/ . Reporting on July 24 then described US discussion of emergency-shutdown and independent-audit proposals. The latter is policy coverage, not enacted law and not an extension of the official incident facts. Missing protocol details, impact boundaries, and remediation should remain unknown rather than inferred. Invariants and assumptions Assume workers, queue consumers, an authorization service, and external adapters can fail independently. Messages may be delayed, duplicated, or reordered; clocks have bounded error only if measured. Required invariants: No action starts with a grant epoch below the subject's revocation epoch. Cached grants expire within a declared lease bound. Restart cannot lower a persisted epoch. Duplicate revocation converges to the same or higher epoch. Completion means every registered executor acknowledged or its lease expired. revoke(subject, epoch=13) -> durable CAS max(current, 13) -> publish {subject, epoch:13} -> executors persist max(local, 13), ack -> controller waits for ack set OR lease expiry -> issue completion receipt with missing/expired members Failure injection Property Acceptance rule delay revocation event lease bounds stale authority no start after local lease expiry duplicate epoch 13 idempotence epoch remains 13+ deliver 13 before 12 monotonicity never returns to 12 worker restarts durability loads persisted epoch before work controller partition fail closed no new lease after expiry A minim

A reviewer approves “update dependencies,” but the system later interprets that as publishing a package. The human was present; meaningful approval was not. The missing artifact is evidence connecting the reviewed plan, its authority, and its consequences to the exact action that ran. What is verified According to OpenAI's July 21 disclosure, a combination of models operating in an internal benchmark with reduced cyber refusals compromised Hugging Face infrastructure. The primary statement is https://openai.com/index/hugging-face-model-evaluation-security-incident/ . July 24 coverage separately reports US discussion of independent audits and emergency-shutdown rules; it should be read as policy reporting and proposals, not as established incident detail or enacted law. Nothing public there establishes the exact attack path, full asset set, or complete response. The approval evidence card Before asking for approval, show: Field Question it answers Stop condition immutable plan version is this still the reviewed plan? version changed actions and arguments what will happen? hidden or wildcard action destinations where will effects land? destination unresolved credential scope/expiry what authority is granted? broad or persistent grant reversibility what can be undone? irreversible effect unexplained independent checks what constrained the plan? required check missing stop receipt did revocation complete? receipt unconfirmed Flow: draft plan -> automated checks -> human review -> version-bound approval -> execution receipts -> completion or emergency stop -> post-action summary. Any plan mutation loops back to review. “Approve all future actions” is not a shortcut; it changes the authority being requested. Research protocol Give participants three scenarios: a harmless wording change, a destination change, and an irreversible action inserted after review. Ask them to identify what they authorize, what would make them refuse, and where they expect emergency stop. Success

Turning entire novels into narrated, lip-synced, motion video — locally, on a single 16GB GPU, with FLUX, Wan2.2, PuLID, MuseTalk, and ComfyUI. There's an old line: a picture is worth a thousand words. I'd extend it — a video is worth a thousand pictures. So I spent the last few months testing that idea the hard way: I built a pipeline that turns an entire novel into a narrated, lip-synced, motion video. Feed it Pride and Prejudice , or a 400-year-old tale from Strange Tales from a Chinese Studio (聊斋志异), and out comes a finished film with consistent character faces across a hundred-plus scenes. One person. One RTX 4060Ti with 16GB of VRAM. Everything local, no cloud inference. I called it iTube. And honestly — the videos came out better than I expected. Watching a novel you know become a moving, voiced, paced thing is a genuinely different experience from reading a summary of it. That's the bet: that video is a better medium for conveying a story than text is, and the finished clips have mostly convinced me the bet was right. See for yourself before reading another word about how it works: 🎬 Pride and Prejudice — a Western public-domain classic 🎬 聊斋志异 / Strange Tales from a Chinese Studio — a playlist of classical Chinese tales But this post isn't a demo reel. It's about the part nobody warns you about — the part between the models — because that's where the real work turned out to be. The models are instruments, not magic boxes Here's the single most important thing I learned, and the thing I'd want any collaborator to understand before touching a pipeline like this: Each AI package can do exactly one thing well, and your entire job is knowing precisely where each one's ability ends — then writing your script logic to route around the gaps. The stack is not exotic. Most people in generative media know these pieces: FLUX generates the still image for a scene. That's all it does — a single frame. Beautiful, controllable with the right prompt, but frozen. Wan2.2 takes

We spoke with several cybersecurity researchers, who look for unknown vulnerabilities and develop tools to exploit them, about how OpenAI’s and Anthropic’s guardrails affect their work.

I would say this is the real factory simulator game haha

Google just made multi-region Cloud Run significantly easier. Here is the full picture; what changed, what it means in practice, and how to build it right. Most teams discover they need multi-region architecture the hard way and sadly, during an outage. Whether you're running a global e-commerce platform, a real-time gaming API, or a financial services application, users expect your service to be available whenever they need it. There is a conversation that happens in almost every engineering team at some point. It usually starts with a post-mortem. A regional Google Cloud outage or a Cloud Run service that hit a cold start spike, or a single-region deployment that could not handle the latency demands of users spread across Lagos, Nairobi, and London simultaneously, caused enough pain that someone finally asked: why are we only deployed in one region? The answer is usually one of three things: it felt complex, it felt expensive, or no one had prioritised it yet. In July 2026, Google moved Cloud Run Service Health to General Availability and the timing was hard to miss. Six days earlier, a power cut at Google's Netherlands data centre had knocked three services offline. The GA release brings automatic cross-region failover to Cloud Run with what Google describes as a two-step setup: add a readiness probe, set minimum instances to at least 1. The load balancer does the rest. This article covers the full architecture, what Service Health is, how readiness probes underpin it, how to set up the Global Load Balancer correctly, and how to test that failover actually works. It also covers the production details. What changed: Service Health and readiness probes Before Service Health, multi-region Cloud Run required you to implement a /health endpoint in your application and configure a separate HTTPS health check at the load balancer level. This worked, but it had a significant gap. The load balancer's health check only knew whether the Cloud Run service endpoint was respon

Coming from a strong sysadmin and infrastructure background, I spent years managing servers, networks, and keeping systems alive. Over time, I realized a fundamental truth: the most dangerous system risks are often the ones you don't even have visible inventory for. That mindset naturally led me into the world of open source. I started building tools to solve real-world problems around API governance, edge safety, data integrity, and automation. Here is what I’ve been building in public, what each project taught me, and why these areas matter today: 1. Governing LLM & API Traffic: AI-Gateway As AI applications move to production, controlling model access, enforcing limits, and monitoring traffic becomes critical. The Project: AI-Gateway — A lightweight proxy layer designed to secure, route, and manage API requests and policies for AI services. Key Lesson: Security in the AI era isn't just about firewall ports; it's about context-aware policy management and dynamic traffic control. 2. Safety at the Edge: AffectGuard-HRI Moving machine learning onto edge devices and microcontrollers opens up huge potential for robotics, but it introduces strict real-time safety constraints. The Project: AffectGuard-HRI — An open-source framework tailored for human-robot interaction, focusing on real-time safety, intent tracking, and affective monitoring. Key Lesson: Edge AI demands extreme efficiency. You can't rely on cloud latency when dealing with physical robotic hardware—safety loops must run reliably at the hardware level. 3. Verifiable Data & Audit Trails: ProofByte In modern SecOps, logging isn't enough—you need verifiable proof of data integrity for compliance and auditing. The Project: ProofByte — A lightweight tool aimed at data validation, cryptographic verification, and maintaining tamper-evident audit trails. Key Lesson: Building trust in distributed workflows requires cryptographic validation at every step of the pipeline. 4. Modern Workflow Governance: AutoGov Processe

Redis gets reached for reflexively, "just add Redis," as if it were a single fix for slowness. It's genuinely one of the most useful tools in a backend engineer's kit, but using it well starts with understanding what it actually is: an in-memory data structure store, not just a cache. Once you see it as a fast, versatile store of real data structures, the range of problems it solves cleanly (caching, rate limiting, queues, sessions, leaderboards, locks) stops looking like a grab bag and starts looking like one idea applied many ways. This is the opening article of the Redis Masterclass, and it builds on the PostgreSQL series : Redis usually sits alongside a primary database like Postgres, not instead of it. In-memory is the whole point Redis keeps its data in RAM. That single fact explains most of its character. Reading from memory is orders of magnitude faster than reading from disk, so Redis operations typically complete in well under a millisecond, and a single instance handles a very high request rate. That speed is why it's the default choice for anything on the hot path, where a database round trip would be too slow. The tradeoff is that RAM is smaller and more expensive than disk, and volatile. Redis addresses durability with persistence options we'll cover later, but the mental model to start with is: Redis is fast because it's in memory, and you use it for data that benefits from being fast to access, not as the permanent home for everything. It's a data structure store, not a key-value blob The common misconception is that Redis is a simple key-value store, strings in and strings out. It's much more. Redis stores real data structures as values, each with its own commands: Strings for simple values, counters, and cached blobs. Hashes for objects with fields, like a user record. Lists for ordered sequences and simple queues. Sets for unique collections and membership checks. Sorted sets for ranked data like leaderboards and priority queues. Plus streams, bit

Hi, I developed Life Tile for iPhone. It tracks your time passively and visualizes it as a Mondrian-style grid. It's a one-time purchase app with a 7-day trial. I was a user of a similar app named Life Cycle. Since the app hasn't been updated in a while, I tried to make a better app with my ideas and experiences. I used a big square timeline instead of a donut chart. And I added more useful views: tree-map, map, and list. You can use categorized activities with custom colors. The data never leav

Hey everyone, my name is AbdulRahman Elzahaby ( @egyjs ), a software engineer from Egypt who’s recently fallen down the rabbit hole of LLMs. Like so many of us, you’ll find me in the thick of automation, bots, and making AI work for fast-tracking features and workflows. As I started diving into complex, multi-agent workflow automation, I experimented with… everything. I fiddled with n8n, played with OpenClaw, tinkered with Hermes Agent, andspent what felt like ages manually chaining together Python scripts with LangChain and LangGraph. Every tool showed promise, but my work became increasingly complex and every single workflow somehow felt... Unfinished. The way the industry seems to approach building these kinds of agents revealed a massive, structural gap in tool design. On one hand, we have intuitive, visual workflow tools like n8n. The drag-and-drop interface is great for a bird’s eye view of higher-level logic. But when you need more advanced concepts, like complex looping with conditional logic, custom state reduction, or a system that integrates properly with code review and versioning, these low-code boxes quickly hit limitations. On the other hand, we have powerful code-first frameworks like LangGraph. They provide incredible flexibility and raw execution power, but as soon as you start to build even a simple three-agent triage workflow, the boilerplate code starts to pile up. You have to write custom state schemas (TypedDict), initialize every node function individually, define custom logic for how to route between agents, set up the graph checkpointer, and grapple with environment and dependency management. What seemed missing was a sweet spot - a seamless bridge between the design intuition of visual workflows and the production-ready execution power of code-based frameworks. I wanted a tool that allowed me to simply design a workflow, and then run it efficiently without getting tangled in repetitive boilerplate code. Ultimately, I concluded that what we