标签：#ha

Memory Chips Supply chain strategy from electronics production engineering, 500–50k units/year Introduction "Order from Digi-Key" is a prototyping strategy, not a production strategy. The 2020–2023 IC shortage demonstrated that supply chain resilience must be designed in — not improvised when lead times hit 52 weeks. The Sourcing Tier Structure Tier Examples MOQ Price Premium Lead Time Risk Authorized dist. Digi-Key, Mouser, Newark 1 pc +25–40% 1–3 days (stock) Lowest Franchise dist. Arrow, Avnet, TTI 100–1k Baseline 2–8 weeks Low Manufacturer direct TI, Infineon, ST portals 1k–10k+ −10 to −30% 8–20 weeks Low Regional aggregators IC-Online, local dist. Mixed Variable Variable Medium Spot market Brokers, eBay 1 pc +50 to +500% Days High Never use spot market for ICs without incoming inspection. Counterfeit STM32, ESP32, and common analog ICs are well-documented. Volume Pricing Reality Illustrative for a $2.50 MCU: Volume Digi-Key Arrow/Avnet Manufacturer Direct 100 $3.10 $2.65 N/A 1,000 $2.75 $2.15 $1.85 10,000 $2.40 $1.70 $1.25 50,000 $2.10 $1.40 $0.90 The franchise/direct savings are material at 1k+ units. Establishing Arrow or Avnet relationships pays for the admin overhead within 2 production cycles. BOM Resilience Framework For each critical component, document: Primary source : authorized distribution or direct Secondary distributor : alternative channel for same part Alternate part : functionally equivalent, different manufacturer, validated Buffer stock : target weeks at production rate Lead time worst-case : historical peak, not current During normal periods: 4-week buffer, one secondary source, one qualified alternate. For 5+ year product lifecycles: qualify the alternate before you need it. Practical Sourcing Mix: 500–5k Units/Year Component Type Primary Secondary Notes Commodity passives Digi-Key/Mouser + Yageo/Walsin Arrow Annual pricing agreements MCUs < $3 Arrow direct IC-Online for gap fills 90-day POs, buffer stock MCUs $3–$10 Manufacturer direct + A

Written from months of grinding on shielded liquidity DeFi protocols on Midnight. If you've been trying to build anything serious with shielded fungible tokens on Midnight lending protocols, liquidity pools, DEXes you've probably hit some walls that the documentation doesn't fully prepare you for. The Midnight programming model around shielded tokens is genuinely different from anything in the EVM world, and a lot of the intuitions you carry from Solidity or even other ZK environments will get you into trouble fast. This post is a breakdown of the most impactful errors and misconceptions I ran into while building shielded liquidity DeFi contracts using Midnight's Compact language. These are not theoretical every single one of these either broke a circuit or caused a proof server failure at some point. I'll walk through what the issue is, why it happens, and what the correct pattern looks like. Background: How Shielded Tokens Actually Work Under the Hood Before we get into the errors, let's get clear on the underlying mechanics because this context is what makes the errors make sense. Midnight uses a protocol called Zswap for shielded token operations. When a user sends tokens to your contract by calling receiveShielded , what actually happens is more involved than it looks on the surface. When your circuit calls receiveShielded(coin) , the Compact runtime records a shielded receive obligation in the transaction being constructed. At this point, the proof server kicks in to generate the ZK proof for your circuit. But here's the thing your circuit only describes what the contract side is doing. The transaction still needs to be balanced : the tokens being received by the contract have to come from somewhere. This is where the wallet gets involved through an internal mechanism that runs beneath your circuit. The wallet looks at the ShieldedCoinInfo you're receiving the coin's color (token type) and value and finds a matching UTXO in the user's private coin set. It then

https://www.faa.gov/newsroom/trumps-transportation-secretary...

My hackathon journey didn't start with winning. It started with losing. My first hackathon was BlueHacks 2025 . We spent almost all of our time building and very little time understanding the business side of our project. When it came time to pitch, we struggled to explain why our solution mattered. That experience taught me an important lesson: A great product means nothing if people don't understand its value. Next came GCash's invite-only hackathon . We didn't win, but I walked away with something more valuable than a trophy. I learned more about product thinking, working with data, and met someone named Neo, who would later become a key part of my hackathon journey. Then came the YSES Hackathon . Once again, we fell short. We believed we had built a strong solution, but we made the same mistake. We focused too much on the technology and too little on market validation, business models, and the value our product created. Everything changed during Based Space Batch 002 . It was my first international blockchain hackathon, and it completely changed how I approached building products. During the program, Sir Eli Becislao, then Country Lead of Base Philippines, emphasized the importance of storytelling, pitching, and business strategy. That was when I realized hackathons aren't just coding competitions. They're startup simulations. Our team eventually pivoted our idea and built NameThat , a Web3 platform on Base where users could earn rewards for creative names and ideas. Although we didn't win, we received the Most Pivoting Project Award , recognizing how much we improved our solution throughout the competition. That experience became a turning point. Next was the Philippine Blockchain Week ICP Hackathon . Simply being selected as one of the Top 50 teams in the Philippines already felt like an achievement. Then we were invited to present FarmChain on the Philippine Blockchain Week stage. When the results came out, we finished Top 6 out of 50 teams . To some, sixth p

Every open-source CVE backlog has that one line item you keep sliding into next quarter. The library is a couple of majors behind, the upgrade breaks four services, and the fix upstream ships against a version you cannot ride to. So you file the ticket again. (Everyone's doing great, thanks for asking.) On June 30, Aikido Security said it had acquired Root, whose whole pitch is to make that ticket go away by another route: patch the vulnerability directly into the version already resolved by your build, and skip the upgrade entirely. Per The New Stack, the deal is worth $70 million, and Root's patching technology gets folded into a new Aikido product. Let me phrase what has just moved as plainly as I can. A vendor now edits open-source packages on your behalf and hands you back a version string upstream never shipped. If that sentence made you flinch, hold the flinch. It is doing useful work. The problem this is actually solving The dirty secret of dependency remediation is that a lot of "known" CVEs sit unfixed because remediating them means a version bump that carries breaking changes. You do not get a security patch for the 2.x line, you get a "fixed in 4.0" release note and a laugh track. Backporting the fix is the right operational move: keep the API surface, change only the vulnerable bytes. Linux distributions have done exactly this for decades. The reason your app team is not doing it too is that nobody has the muscle to maintain a patched fork of every transitive dependency in a lockfile. If Aikido now makes that muscle available to the average CI/CD owner, teams get a lever they simply did not have. That is the honest upside. Own it. Who is signing what, exactly Here is the part I care about, which is trust. When your build resolves a package by name and version, you rely on a chain: the registry answers, the digest matches what upstream published, the SBOM you generate downstream still refers back to that same identity. A backported build breaks that chai