标签：#crypto

Dockerize Your LLM Proxy: One Container for Free Multi-Provider Access Want free LLM access in a repeatable, portable way? Run it as a container. Why Docker Single command to deploy anywhere Isolated environment with consistent deps Easy to put behind a reverse proxy DAVIL Cod in Docker DAVIL Cod ships a Dockerfile. Build and run with provider keys as env vars: docker build -t davil-cod . docker run -p 4000:4000 \ -e PROVIDER_GROQ_APIKEY = ... \ -e PROVIDER_MISTRAL_APIKEY = ... \ davil-cod Features you get Provider rotation with circuit breaker Disk cache for repeated prompts Dashboard on port 4000 FAQ Does it persist the cache? Yes — mount a volume for the cache directory. Can I expose it to my team? Yes — it's a normal HTTP service with token auth.

Cryptographic Context Injection is only the latest way to break an LLM safety guardrail.

Binance's Agent OS works with tools including ChatGPT, Claude Code, and Cursor.

The hacks at shipping companies used to mail out hardware wallets puts crypto owners at greater risk of real-world attacks.

Modern encryption is almost always AEAD: authenticated encryption with associated data. AES-GCM and ChaCha20-Poly1305 are the two you meet everywhere, in TLS, in disk encryption, in message formats, in cloud key management. They give you confidentiality plus an authentication tag, and decryption either returns the plaintext or returns an error. The security definition behind that tag is about forgery. An attacker who does not know the key cannot produce a ciphertext that verifies. That definition holds. What it says nothing about is the situation where the attacker does know one or more keys and gets to choose the ciphertext. What a key multi-collision looks like Take AES-GCM. Its authentication tag is computed with GHASH, a polynomial evaluation over a binary field, and the relationship between the ciphertext blocks and the tag is linear in that field. Linearity is convenient for speed, and it is also solvable. Given two keys the attacker controls, K1 and K2, that linearity lets them set up a system of equations and solve for a ciphertext whose tag verifies under both. Decrypting it with K1 yields one plaintext. Decrypting the same bytes with K2 yields a completely different plaintext. Neither decryption throws an error, because from each key's point of view the tag is correct. Both plaintexts can be attacker-chosen and meaningful. The 2019 paper that named this attack demonstrated a file that was a valid image either way, which is where the memorable label came from: the two decryptions showed different pictures, and the second one had a salamander in it that the reporting system never saw. The property that was missing. An AEAD is key committing if a ciphertext can verify under at most one key. AES-GCM, AES-GCM-SIV, and ChaCha20-Poly1305 are not key committing, and were never claimed to be. The property simply was not part of the design goal, and for a long time no widely deployed system depended on it. The system it broke: message franking Here is the problem th

TRON processed $2.1 trillion in USDT transfers during Q2 2026, according to Messari. During the same quarter, circulating USDT on TRON reached $87.9 billion, putting it ahead of Ethereum. Those numbers point to something developers working with stablecoins have to consider more carefully: the blockchain underneath a token can shape the entire payment experience. USDT on TRON uses the TRC-20 token standard. That means a USDT transfer is a smart contract transaction rather than a native TRX transfer. The wallet signs the transaction, the network executes the token contract and the resulting balance change is recorded on-chain. For an application accepting USDT, this creates several technical requirements. The system needs to identify the correct token contract, monitor the relevant transfer events and wait for sufficient confirmation before crediting the user's balance. Checking the address balance alone is not enough. TRON's developer documentation provides APIs for retrieving TRC-20 transaction history and filtering transfers by contract address. A payment system can use this data to monitor incoming USDT deposits and associate them with the correct customer account. The transaction also has a resource cost. TRON uses Bandwidth and Energy to process transactions. Regular transactions consume Bandwidth, while smart contract execution requires Energy. When an account does not have enough available resources, TRX is burned to cover the remaining cost. This creates an operational detail that users may never see. Someone can hold USDT in a wallet and still need TRX to send it. A payment provider can handle this in several ways. It can maintain TRX balances, stake TRX for resources or use delegated Energy. Another design can leave the requirement with the user. The choice affects the product. The amount of Energy required can also change depending on the destination account. TRON's documentation notes that a USDT transfer to an address that already holds USDT generally re

This is good : Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency , we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

USDT Payments for AI Workers: Architecture Deep Dive If you've ever built an AI agent marketplace or a platform that pays automated workers, you've likely hit the same wall I did: how do you pay a bot? Stripe and PayPal are off the table. Bank transfers require legal entities. Even most crypto payment processors demand KYC that bots can't complete. When I started building the payment layer for roborent.cc — a marketplace where AI agents and humans both earn USDT for completing tasks — I had to design this from scratch. Here's the architecture that survived production. The Core Problem AI workers need programmatic, instant, low-fee payments . Traditional rails fail on every axis: Speed : ACH takes days. Your agent's motivation dies in days. Fees : Credit cards eat 2.9% + 30¢. When your agent earns $0.50 per task, that's brutal. Automation : Bots can't fill out W-9s. They can't even check a "I'm not a robot" box. The answer is stablecoins on fast chains. But "just send USDT" hides a dozen design decisions. Chain Selection: The TRC-20 Default We default to Tron (TRC-20) for payouts. Why Tron over Ethereum or Solana? Fees : ~$0.80 per transaction regardless of amount. On Ethereum, you'd pay $5-30 in gas. Speed : 3-second finality. Good enough for "instant" payouts. Adoption : USDT's largest supply actually lives on Tron. Exchanges and OTC desks all support it natively. But we also support BEP-20 (BNB Chain), Arbitrum, and TON because different regions and different exchanges have different preferences. The architecture handles all of them through a unified abstraction layer. The Payment Pipeline Here's the high-level flow when an AI agent completes a task and earns a payout: Task Completion Event ↓ [Ledger Service] — records pending balance, idempotency key ↓ [Settlement Service] — batches payouts, applies fee logic ↓ [Signing Service] — air-gapped key management, builds tx ↓ [Broadcast Service] — sends to chain, monitors confirmation ↓ [Webhook + WebSocket] — notifies

The Problem There are millions of people holding crypto who want to spend it on real things — hire a developer, buy a script, sell design work. But where do they go? Telegram OTC chats → chaotic, no protection, scam-heavy Forum classifieds → threads get buried in hours P2P exchange sections → designed for fiat conversion, not commerce I decided to build a dedicated marketplace for this. What I Built CryptoBoard — a classifieds platform with Web3 wallet authentication. 🔗 https://crypto.my-board.org/ Tech decisions: Auth : Wallet-only (MetaMask, Trust Wallet, WalletConnect). No backend user database with emails and passwords to get hacked. Listings : Icon-based instead of user-uploaded images. Keeps the UI clean and avoids the "flea market" look. Messaging : Built-in chat between buyers and sellers. Escrow : This is the interesting part (see below). The Escrow Problem with Digital Goods Traditional escrow works like this: Buyer sends money to escrow Seller delivers product Buyer confirms → escrow releases money But with digital goods (source code, design files), step 3 is broken: The buyer can receive the files, say "this isn't what I wanted," request a refund, and keep a copy The seller has no recourse The escrow service has no way to verify the claim My Solution: Human-Powered Escrow Instead of just holding funds, the platform admin becomes an active verifier: Seller sends product + testing instructions to admin Admin installs/runs the product on their own machine Admin performs agreed-upon tests and records a screencast Buyer watches the screencast — verified by a neutral party, not the seller If satisfied, buyer sends crypto directly to seller Admin verifies the on-chain transaction Admin delivers files to buyer Admin deletes all copies (per agreement) Is it scalable? Probably not infinitely. But for high-value digital transactions ($100–$10,000+), having a human in the loop is actually a feature, not a bug. Design Philosophy I deliberately chose not to allow user

A tutorial where you prove things without revealing things, and yes, the math actually maths. Here's something the internet doesn't want you to know: you overshare every single time you prove something. Prove you're over 21 at a bar? You hand over a card with your name, your address, your height, and your terrible 2019 haircut. Prove your income to a landlord? Here's every transaction I've made since college, please don't judge the 3am food delivery. We built the entire digital world on a verification model that boils down to "here's everything, trust me bro." Not anymore. There's a branch of cryptography that lets you prove a statement is true while revealing nothing else . It sounds fake. It's called a zero knowledge proof , and by the end of this article you'll understand one well enough to check it with Python. Then we'll look at Midnight , a blockchain that turned this party trick into a developer platform. Let's go. 🚀 🪪 The Trust Me Bro Problem Every verification system you use today works by disclosure . You prove things by showing the underlying data: Prove your age ➡️ show your whole ID Prove you can pay ➡️ show your bank statements Prove you're a real user ➡️ solve a CAPTCHA and sacrifice your data to the algorithm gods The data doesn't just get seen . It gets stored , and eventually it gets breached , and then a guy named xX_darkweb_Xx is selling your identity for the price of a burrito. The verifier never needed the data. They needed one bit of information : true or false. Everything else was collateral damage. In short: we've been answering yes or no questions with our entire life story. 🕵️ The Party Trick That Started It All Zero knowledge proofs let a prover convince a verifier that a statement is true without revealing why it's true. The classic example is Where's Waldo. Say I claim I found Waldo on the page and you don't believe me (fair, you've seen my code reviews). I could point at him, but then I've revealed the answer and ruined the puzzle. Ins

Passwords are broken. They get leaked in database breaches, reused across platforms, and phished through clever domain spoofs. While Multi-Factor Authentication (MFA) helps, standard SMS or OTP codes still leave major security gaps. Enter Passkeys : a modern authentication standard built on top of WebAuthn and FIDO2 specifications designed to eliminate shared secrets entirely. Here is a dive into the underlying cryptography, architectural flow, and why passkeys are inherently phishing-proof. The Core Concept: Asymmetric Cryptography Traditional authentication relies on shared secrets . Both you and the server know your password (or a hashed version of it). To verify who you are, you send that secret over the network. Passkeys replace shared secrets with asymmetric (public/private key) cryptography : Private Key: Generated locally on your device and stored inside a Hardware Security Module (like Apple's Secure Enclave, Android's Titan chip, or a YubiKey) or an end-to-end encrypted sync service (iCloud Keychain, 1Password, Google Password Manager). It never leaves your device unencrypted. Public Key: Registered with and stored by the website (the Relying Party). It is completely public and mathematically useless to an attacker on its own. Architectural Breakdown: How It Works Passkey operations consist of two cryptographic phases: Registration and Authentication . Phase 1: Registration (Generating the Keypair) When you create a passkey for a service (e.g., app.example.com ): Challenge Request: Your client initiates registration. The server generates a cryptographic challenge (a high-entropy random string) and sends it back alongside origin metadata ( RP ID ). Local Verification: Your browser hands this request to the OS/authenticator, which prompts for user verification—biometrics (Face ID/Touch ID/Windows Hello) or a hardware PIN. KeyPair Generation: Once unlocked, the hardware generates a unique keypair bound exclusively to app.example.com . Public Key Registration:

Every signal in the previous articles is statistical. They weigh evidence, they have thresholds, they can be argued with. Honeytokens are different in kind. A honeytoken is a record that does not exist and was never given to anyone . Nothing legitimate can ask for it, because nothing legitimate has ever held a reference to it. A request for one isn't suspicious — it's proof that someone is guessing or working from a stolen list. That makes it the highest-confidence signal available, and worth building carefully. Derivation: make the decoy recognise itself The obvious implementation is a table. Generate decoy IDs, store them, and check every miss against the table. That has two problems. It puts a database lookup in the request path on every miss — and misses are exactly what a flood produces. And it doesn't tell you whose decoy was tripped without another join. Instead, derive them: export function honeytokenFor ( clientId : string , n : number , generation = 0 ): string { const mac = createHmac ( ' sha256 ' , config . honeytokenSecret ) . update ( ` ${ clientId } : ${ generation } : ${ n } ` ) . digest (); return uuidFromBytes ( mac . subarray ( 0 , 16 )); } Three properties fall out of this, and they're the whole design: Recognition is stateless. Given any ID and any client, recompute the client's decoy set and check membership. No lookup, no cache, no round trip. The gateway precomputes each known client's set at startup into a Set and membership is O(1). Attribution is automatic. The client ID is inside the derivation. There is no "which client did this decoy belong to?" question — a decoy for integration-acme is not a decoy for anyone else, and cannot be. If a decoy seeded into acme's scope is requested by a different credential, that's information too. They're format-identical to real IDs. The output is shaped as a v4 UUID — correct version and variant nibbles — so it is indistinguishable from a real documents identifier: export function uuidFromBytes ( bytes

What started as a vision for mapping urban gardens has evolved into something much bigger. Over the past weeks, we've built a complete decentralized ecosystem that connects IoT sensors, robots, and communities using Monero (XMR) and MYZ tokens. The Journey: From Gardens to Streets It all began with a simple idea: create a map for urban gardens. But we quickly realized that a map alone wasn't enough. We needed a full system that could: Monitor soil health in real-time Automate irrigation and analysis Enable private, decentralized payments Connect communities and institutions Here's what we built. 🗺️ The Urban Garden Map Using Leaflet.js and a REST API, we created an interactive map where anyone can register their urban garden. The map supports: Geolocation with /nearby endpoint Full CRUD operations for gardens Search by name and city Check it out: Live Demo 📡 Arduino Sensors for Smart Agriculture We integrated Arduino sensors to monitor soil conditions in real-time: pH (0-14 scale) EC (Electrical Conductivity) Temperature and Humidity The data flows through Node.js APIs and is stored in MongoDB, making it accessible for analysis and reporting. 🦾 The Robot Ecosystem We built a family of software robots that can receive payments automatically in MYZ and XMR: 1. AgricoloBot - The Garden Assistant Monitors soil health Generates automatic reports Provides recommendations for farmers 2. Robot Arm - The Physical Gardener 4 DOF (Degrees of Freedom) Controlled via WebSocket Can water, plant, analyze, and harvest 3. CleanStreetBot - Street Cleaning Robot Reports waste with geolocation Automates zone cleaning Generates reports for municipalities 4. RecicloBot, PuliziaBot, CompostBot - Recycling and Waste Management Monitor containers and optimize collection routes Track composting and organic waste management 💰 Decentralized Payments with Monero and MYZ All robots receive automatic payments through an escrow system: 85% → Robot owner 2% → MyZubster platform 8% → Bosco Community

When a Go application needs on-chain and protocol-level data, the HTTP request itself is usually the easy part. The difficult work starts afterward: defining request models, decoding inconsistent payloads, respecting rate limits, recovering from transient failures, and deciding what to do when one part of a multi-metric query succeeds while another part does not. Those concerns can quietly turn a small integration into a maintenance burden. tokenterminal-go is an open-source, production-oriented Go SDK for Token Terminal API v2 that aims to remove that plumbing. The project supports all 24 documented API routes across Assets, Projects, Market Sectors, Metrics, and Datasets; it requires Go 1.21 or newer and uses only the Go standard library. 1 It is a focused choice for engineers building internal analytics services, data jobs, dashboards, research tooling, or any application that needs Token Terminal data without hand-rolling an HTTP client. The practical promise: keep the integration idiomatic and type-aware, while the client handles the failure modes that normally appear only after an application reaches real traffic. Why an SDK matters here Token Terminal’s API gives programmatic access to its data, but it requires an API key and an API-enabled plan. 2 That makes the client layer part of the application’s operational surface: it needs to handle credentials, request timeouts, rate limits, pagination or filtering parameters where relevant, and failures that should not crash a larger data pipeline. The library addresses these needs with a small, deliberate design. Its client methods take a context.Context , its response envelopes use generic Result[T] types, and its errors can be inspected with standard Go mechanisms such as errors.Is and errors.As . 1 In other words, callers can keep control of cancellation and business policy instead of receiving opaque, string-only errors. Capability What it means in practice Why it is useful Zero external dependencies The packag

A security vulnerability in the cryptocurrency hardware wallet Coldcard is allowing hackers to drain the crypto from victims’ wallets. The total losses amount to more than $130 million, according to blockchain-monitoring firms.

And it’s personal information (alternate link ): The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data. Exposed chats reportedly include private cryptocurrency wallet keys and personal information like peoples’ addresses. What seems to be the issue is a user setting about data sharing. Anthropic’s position is that it’s not their problem : “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google,” the company said in a statement. “These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”...

Una discusión sobre un archivo digital casi nunca se pierde por lo que el archivo dice. Se pierde una pregunta antes: ¿Cómo sabemos que ese es el archivo que usted recibió, y no el que editó anoche? Si la respuesta es "confíe en mí", ya perdiste. Y da igual cuánta razón tengas en el fondo. Este problema no es exclusivo de un juzgado. Lo tiene el auditor que recibe un volcado de logs, el equipo que documenta un incidente, quien conserva la copia de un contrato firmado por correo. En todos los casos hace falta lo mismo: poder demostrar que un conjunto de bytes no cambió desde un momento determinado, y que lo demuestre alguien que no seas tú . Para eso escribí Tunjo : una herramienta en Rust que recorre un material en solo lectura, calcula su huella y firma un acta verificable por cualquiera. Por qué un árbol y no un hash Lo obvio sería concatenar todo y sacar un SHA-256. Funciona, y es inútil en la práctica. Cuando alguien discute un archivo —un correo concreto entre cuatro mil— con un hash único solo puedes ofrecer dos cosas: o entregas el conjunto completo para que se recalcule, o pides que te crean. La primera opción expone material que no tiene por qué exponerse; la segunda no es una prueba. Un árbol de Merkle resuelve exactamente eso. Cada archivo es una hoja, cada par de nodos se combina hacia arriba y queda una raíz. Para demostrar que una hoja pertenece a esa raíz basta con exhibir esa hoja y el camino de hashes hasta arriba: unos pocos kilobytes. El resto del conjunto no se toca. Dos detalles del árbol que no son opcionales: // Separación de dominio: una hoja nunca puede hacerse pasar por nodo interno. h . update ([ 0x00 ]); // hoja h . update ([ 0x01 ]); // nodo interno // Y la raíz ata el número de hojas. h . update ([ 0x02 ]); h . update ( n . to_be_bytes ()); Sin lo primero, un hash de hoja podría presentarse como si fuera un nodo del árbol. Sin lo segundo aparece la ambigüedad clásica de los árboles con número impar de hojas: dos conjuntos distintos pued

I sell Solana token facts for two cents a call, and refuse to give an opinion While building this I ranked a token's trading pairs by pool depth, which seemed obviously correct. It picked JUP's biggest pool — quoted in an obscure token — and reported a price of $943 against a real price of about $0.19. A 5000x error that would have silently poisoned everything downstream. Depth doesn't make a derived price trustworthy; what it's quoted against does. That bug is why the service now always prefers SOL/stablecoin-quoted pairs, and says so explicitly when the best available pair is still exotic. That's the whole design philosophy. solsafe returns measured values — mint and freeze authority, holder concentration, pool depth and age, pump.fun origin — and never a score, signal, or recommendation. You can reproduce every field against your own RPC. An opinion can be wrong in ways a null mint authority cannot. The other unusual part is billing. It's paid per request over x402: call it, get a 402 with machine-readable payment instructions, pay in USDC on Base, retry, get JSON. No API key, no signup, no dashboard — which is the point, because the intended caller is an autonomous agent that can't complete a signup flow. $0.02 for the raw facts, $0.15 for a written brief explaining them. Things I'd rather say up front than have you discover: holder concentration is permanently unavailable for the most widely held tokens, because Solana's RPC refuses that query outright. A failed or partial call isn't charged. And demand for this is entirely unproven — agent-native payments are early, and I might be wrong that anyone wants it. Code: github.com/newbieBuilderr/solsafe

I am not by any means an expert at finance but I think I do now have some advice for people who are: Do not name your hedge fund anything that will be hilarious if it blows up. Don't use a name like "Long-Term Capital Management," or "Amaranth Advisors" (named for the floral symbol for […]

Encrypted data stored in cloud archives today will outlive the mathematical algorithms guarding it. In enterprise architectures that handle long-term records, like construction risk logs or employee compliance platforms, data retention schedules often span twenty to thirty years. When building cloud pipelines that move this information across services, we depend heavily on asymmetric encryption, which is a security method using one public key to lock data and a separate private key to unlock it. Standard public-key algorithms rely on mathematical problems that are nearly impossible for classical computers to solve within a reasonable human timeframe. Quantum computing changes this equation entirely. Quantum computers leverage quantum mechanics, the physical rules governing subatomic particles, to perform calculations at speeds fundamentally unimaginable with traditional silicon processors. While powerful quantum systems are still in development, the security threat to distributed systems exists today. Hostile actors do not need to crack modern security algorithms in real time. Through a pattern known as Harvest Now, Decrypt Later, adversaries can capture and store encrypted network traffic right now. They simply wait until future quantum hardware becomes capable of running the formulas required to decrypt that stolen history. For software architects, preparing for post-quantum cryptography, which refers to new mathematical encryption algorithms designed to withstand quantum attacks, is far more than a simple library swap. It is a deep distributed systems migration challenge. The primary operational hurdle is payload size and computational overhead. Quantum-resistant algorithms require significantly larger digital keys and payload headers than the standards we rely on today. When cryptographic payloads expand, every component of a distributed platform feels the ripple effect. Message queues experience higher bandwidth demands. Database indexes inflate. Memory consump