标签：#ia

Authors say publishers seem to be claiming more than their fair share of settlement payments.

An AI agent that has no job description will invent one. That is the whole reason agents drift, and it is the reason most of the agents I have seen deployed inside Indian businesses are quietly switched off within a few months of going live. Nobody would hire a person, point them at the office, and say "handle things". Yet that is exactly how most owners deploy an agent. They connect it to WhatsApp or email or the accounts folder, give it a paragraph of instructions, and let it run. Then they are surprised when it starts answering questions it was never meant to answer, promising delivery dates it cannot know, or filing something that a human should have looked at first. The fix is not a better model. It is the same discipline you already use for people: defined duties, an escalation path, a probation period with a review date, and one named person who is accountable for it. What drift actually looks like Drift is not a dramatic failure. It is a slow widening of scope that nobody approved. A distributor in the FMCG trade sets up an agent to acknowledge incoming orders on WhatsApp and log them into a sheet. Week one, it does that. Week three, a retailer asks "when will my stock reach?" and the agent, being helpful, answers with a guess. Week five, a retailer asks for a discount, and the agent, having seen discounts mentioned in earlier messages, offers one. None of this was in the brief. All of it followed naturally from "be helpful to customers", which is what the owner wrote because they did not know what else to write. By the time the owner notices, the agent has made commitments in writing to twenty retailers, and the sales team is cleaning up after it. The agent did not malfunction. It did what an unsupervised new employee does: it filled the vacuum with its own judgement. The mistake was upstream, at the moment of deployment. The job description A job description for an agent is not a prompt. It is a one-page document the owner can read and sign off, written in

Modern price monitoring systems need to do more than tell you that a price changed. A single abnormal listing, a scraped error, or a temporary outlier can make a traditional threshold-based detector fire an alert when nothing meaningful happened. In this project, I built a lightweight real-time price anomaly detector in Python that combines: A rolling median baseline Median Absolute Deviation (MAD) Robust Z-scores Short-term percentage returns Trend confirmation Alert cooldowns The goal is simple: detect meaningful price movements without overreacting to noisy observations. Note: This project monitors retail prices from Google Shopping results through SerpApi. It is a retail-price monitoring example, not a financial exchange-data feed. What we're building The pipeline looks like this: ┌──────────────────────┐ │ SerpApi / Shopping │ └──────────┬───────────┘ │ ▼ ┌──────────────────┐ │ Price Extraction │ │ + Validation │ └────────┬─────────┘ │ ▼ ┌────────────────────┐ │ Rolling Price │ │ History │ └────────┬───────────┘ │ ┌───────────┼───────────┐ ▼ ▼ ▼ Median MAD Return % │ │ │ └───────────┼───────────┘ ▼ Robust Z-score │ ▼ Trend Confirmation │ ▼ Signal Engine │ ▼ Alert Cooldown The implementation is intentionally small and interpretable. The complete engine is built around a single PriceAlertEngine class and a compact AnomalyResult data structure. Why not just use standard deviation? A common first implementation is: price > mean + 3 * standard_deviation The problem is that standard deviation is sensitive to extreme observations. Suppose your historical prices are: 990, 995, 999, 1001, 1005 Then one bad observation such as: 1500 can distort the mean and standard deviation. That can move your detection boundary away from the actual market behavior you are trying to model. For a noisy retail environment, a more robust baseline is useful. That's where median and Median Absolute Deviation come in. 1. Building a rolling median baseline Instead of storing an unlimited stre

"We achieved within a few years what had taken the European space industry decades before."

Published 2026-09-06 This describes NIST IR 8547 ipd — the initial public draft of November 2024 — as it stood on the date above. Its dates are proposed. If a final IR 8547 has published since you are reading this, check it: the numbers below may have moved, and the article's central caveat may no longer apply. If you have read anything about post-quantum migration in the last year, you have read that RSA is deprecated in 2030. It is one of those facts that has been repeated into the shape of a rule. It is half true, and the half that is false is the half people plan around. Here is the actual table, from NIST IR 8547, Transition to Post-Quantum Cryptography Standards : algorithm parameters transition RSA, ECDSA 112 bits of security strength Deprecated after 2030 Disallowed after 2035 RSA, ECDSA, EdDSA ≥ 128 bits of security strength Disallowed after 2035 Read the second row again. At 128 bits and above there is no 2030 row at all . RSA-3072 is not deprecated in 2030. Neither is P-256. The 2030 date applies to 112-bit strength — RSA-2048, P-224, 2048-bit finite-field Diffie-Hellman — and to nothing else. The key-establishment table (Table 4, covering finite-field DH/MQV, elliptic curve DH/MQV and RSA) has exactly the same shape. Same split, same dates. So an inventory that reports "47 uses of RSA, all deprecated in 2030" is reporting something the document does not say. Some of those uses are on a 2030 clock and some are on a 2035 clock, and which is which depends on a field most tooling does not look at. Deprecated is not disallowed The second thing worth getting right is what the two words mean, because they are not synonyms and NIST defines both: deprecated — "The algorithm and key length may be used, but the user must accept some security risk." disallowed — "The algorithm or key length is no longer allowed for applying cryptographic protection." Deprecated is a risk acceptance. You may continue, with your eyes open and presumably a note in a register somewhere.

If you have ever tried to programmatically get the current RBA cash rate, you know the drill. You open the RBA F1 statistical table, download f01hist.xls, write a pandas.read_excel call, fight with the multi-row header (Series ID on row 11, units on row 6), filter, sort, take the last row. That is 30 lines of code to get a single number that changes 11 times a year. One line (MIT, no key) from rba_mcp import client print ( client . latest ( " F1_1 " , series = " cash_rate_target " ). records [ - 1 ]. value ) # live AU.CASHRATE as of 2026-09-03: 4.35 pip install rba-mcp No key. MIT-licensed. Attribution and source URL come back with the number. Hosted gateway Use GET /v1/series/AU.CASHRATE/latest on api.ausdata.io with a free key from ausdata.io (500 calls/mo). Live 2026-09-06: cash 4.35 percent, trimmed-mean CPI 3.6 percent (2026-Q2), real rate 0.75 percent. Why the hosted path exists The RBA publishes the nominal cash rate. The ABS publishes inflation. Neither publishes the real cash rate (nominal minus trimmed-mean CPI). Use /v1/real-rate-regime for that join. Same envelope across nine AU sources: source, source_url, attribution, retrieved_at. MCP Wire ausdata-mcp via npx in Claude Desktop or Cursor. Sisters on PyPI run fully local with no key. What this is not Suburb-level property prices Live KYC / company-officer lookup 5-minute wholesale electricity bid stacks AU macro public data, one envelope, citations done for you. R users readrba by Matt Cowgill is the R equivalent. This is the Python / JS / agent path. Links Canonical: https://ausdata.io/blog/rba-cash-rate-python-api/ Free key: https://ausdata.io Series: https://ausdata.io/series/AU.CASHRATE PyPI: rba-mcp

The choice is usually made by whoever draws the first diagram, and then everybody lives with it for years. It is worth five minutes of thought, and the deciding question is not which tool is best but who will edit this thing next. Short answer. A visual editor such as draw.io for diagrams that non-engineers maintain. Mermaid or PlantUML when the diagram belongs with the code and should be reviewed like code. An attached SVG when the picture comes from a design tool and you need it to look exactly right. A screenshot when the diagram will genuinely never change again. The four options A diagramming app inside Confluence draw.io is the common choice, and it is free for small teams. The diagram is created and edited inside the page, links on shapes work, and anyone who can use a mouse can maintain it. This is the default answer for architecture maps, process flows and floor plans that live in the documentation and get corrected by whoever notices the mistake. The cost is lock-in of a mild kind: the diagram lives in the app's format, and moving to something else later means exporting and redrawing. Mermaid or PlantUML: diagrams as text Here the diagram is source code — a few lines describing nodes and arrows, rendered into a picture. The appeal is real: text goes into version control, diffs are readable, and a diagram can be generated by a script from the system it describes. Two things to know before choosing this. Confluence Cloud does not render Mermaid natively, so you need an app for it, and several of them exist including free ones. And the editing audience narrows sharply: a technical writer will not touch a diagram that has to be edited as syntax, so the diagram becomes the property of the engineers, whether you intended that or not. An SVG made somewhere else The diagram comes from Figma, Illustrator, Inkscape, Visio or an architecture tool, and lands on the page as an attachment. It looks exactly as designed, which is why people do it. The catch is documented

Two more news organizations are suing OpenAI and Microsoft over the supposed use of their journalism to train AI.

So now that you have a basic understanding of how Terraform works , before you start running any terraform command against a real AWS account, two things need to happen: you need an identity Terraform can authenticate as, and you need a mental picture of what you're about to create, so the plan output in Part 4 isn't just a list of unfamiliar resource names. Never Use Your AWS Root User! The root user (the email/password you signed up to AWS with) can do anything , including closing the account. It should basically never be used day-to-day. Instead, create a dedicated IAM user just for this project. In real life you would create a dedicated IAM user for your CI/CD pipeline to automate deployments: AWS Console → IAM → Users → Create user (e.g. terraform-voting-app ). Do not enable AWS Console access, this user only needs programmatic access, i.e. an API key pair. The AWS managed policy AdministratorAccess is the path of least friction, and is what you should use for the IAM user to test things out. but in real life you would go with least privilege approach, learn more about it in AWS EKS IAM policy examples . On the user's Security credentials tab → Create access key → choose "Command Line Interface (CLI)". You'll get an Access Key ID and a Secret Access Key , store them somewhere safe, we will be needing them later. Give Terraform those Credentials The rule: credentials never go inside a .tf file, and never inside terraform.tfvars . So in your local machine or CI/CD pipeline you need to export AWS_ACCESS_KEY_ID , AWS_SECRET_ACCESS_KEY , and AWS_REGION as environment variables in the shell. Then you won't be needing aws configure or aws login step anywhere, the aws provider has no access_key / secret_key arguments of its own, so it falls back to the AWS SDK's standard credential chain, which checks these exact environment variables first. The AWS CLI and, later kubectl read the same variables. In my local machine I do export an env variable files using a shell scrip

Hello, fellow version-bumping enthusiasts, sleep-deprived Rustaceans, and accidental software...

A federal court decided that "Twitter" was off-limits, but tweet and the bird logo were fair game.

Now that we have a mental model of how Solana works, it’s time to actually use it. We’ve talked about accounts holding state, programs containing the logic, instructions telling those programs what to do, and transactions bringing those instructions together. Creating an SPL Token Mint is a good place to see all of those concepts working together. In this part, we’ll create and initialize an SPL Token Mint on Solana Devnet, but more importantly, we’ll break down what is actually happening underneath the code. So, what exactly is a Mint? If I tell Solana to give someone 100 of a particular token, Solana first needs to know what that token is. What defines it? How divisible is it? How many units currently exist? Who has the authority to create more? That is where the Mint Account comes in. A Mint Account represents a particular type of token on Solana. It stores information about that token such as its current supply, decimals, mint authority and optional freeze authority. It does not store how many tokens I personally own. That belongs somewhere else, which we’ll get to when we talk about Token Accounts and ATAs. A simple way to separate the two is this: the Mint tells us what token exists, while a Token Account tells us how much of that token a particular owner holds. Before looking at any code, the complete process for creating our Mint looks like this: Connect to Solana Devnet Load our wallet Generate a new keypair for the Mint Calculate how much space a Mint Account needs Calculate the lamports required for the account Ask the System Program to create the account Ask the Token Program to initialize it as a Mint Put both instructions inside a transaction Sign the transaction Send and confirm it on Solana There are quite a few SDK functions involved when implementing this, but underneath all that syntax, this is really what the entire spl_init.ts file is doing. Starting with the wallet and Mint address We first load our wallet and turn it into a signer. The wallet

A familiar production failure looks like this: an AI support agent reads a ticket, decides the customer deserves compensation, calls the refund tool, and refunds the full annual subscription instead of the $12 add-on. The model did not crash. The API did not throw an exception. The tool worked exactly as designed. The postmortem usually starts with the wrong question: “How do we stop the model from making bad decisions?” The better question is: which layer should have stopped the mistake before it became damage? AI agents fail in many different ways. They misunderstand intent. They create dangerous plans. They pass malformed arguments. They exceed permissions. They loop. They leak data. They take irreversible actions. Each failure mode belongs to a different layer, and each layer has a different job. If your only defense is a prompt that says, “Be careful,” you do not have a safety architecture. You have a hope. TL;DR: AI agent mistakes should not be stopped by the model alone. Use layered defense: intent classification stops wrong missions, plan validation stops forbidden sequences, tool schemas stop invalid arguments, authorization stops unauthorized actions, execution controls limit blast radius, output validation catches harmful results, runtime monitors stop loops, and human approval guards asymmetric risk. The best stopping layer is the earliest deterministic layer that can prevent harm, with the final brake closest to irreversible side effects. 📋 Table of Contents The Mistake Is Not One Failure Mode 1. The Prompt Layer Should Persuade, Not Enforce 2. The Intent Layer Should Catch the Wrong Mission 3. The Planning Layer Should Reject Forbidden Paths 4. The Tool Contract Layer Should Make Invalid Actions Unrepresentable 5. The Authorization Layer Should Veto Even Correct-Looking Actions 6. The Execution Layer Should Make Side Effects Boring 7. The Output Layer Should Catch Harmful Results Before They Ship 8. The Runtime Monitor Should Stop Slow-Motion Failures

By Michael Nocito , data analyst · Published August 9, 2026 By the end of this page you can add an extension to a dashboard, tell the two hosting kinds apart, and read the permission box well enough to know what you're agreeing to. You'll also know the one behavior that surprises people after publishing, which is what an extension looks like in a PDF. It's about twelve minutes. Here's what to do before you add your first one. Find out where it runs. An extension you drop onto a dashboard is a web application, and some of them are hosted on Tableau-managed servers while others are hosted by whoever built them. That single fact decides how much thought the rest of the decision needs. The short version: an extension is a third-party web application running inside a dashboard object, and one of the two permission levels gives it your full underlying data along with table and field names. Where the code actually runs is the thing the panel doesn't show you, so it gets the picture. The original carries a diagram here. In words: A large rectangle labeled your dashboard contains four panels that all look alike. Three of them are shaded the same and marked as ordinary views. The fourth, in the lower right and outlined in a warning color, is labeled extension. A line runs from that fourth panel, crosses the boundary of the dashboard rectangle, and continues out to a separate box drawn outside and to the right labeled third-party host. The three ordinary views have no lines leaving the rectangle. The drawing shows that the extension panel sits inside the dashboard visually while its code and its data traffic reach outside it, which the other three panels never do. 1. What an extension actually is Before the explanation: you drop an extension onto a dashboard and it draws a chart type Tableau doesn't have. Where did that chart come from? From a web application, written by somebody else, running inside a panel on your dashboard. Tableau's own description is that extensions "let

When a checkout form receives a card number, the first useful question is often not whether the payment will be approved. It is whether the input is structurally plausible and which network rules should be shown to the user. The open-source credit-card-brand-detector package provides that small client-side or server-side building block. It detects 11 brands, removes spaces and hyphens, and applies a Luhn checksum. It has zero runtime dependencies and exposes CommonJS functions for validation and brand detection. This tutorial builds a minimal Node.js check, verifies the result with known test numbers, and explains what this kind of validation cannot tell you. TL;DR Install version 1.0.1 , call validateCreditCard when you need both a boolean result and a brand, and call detectBrand when you only need the network name. The package does not contact a payment processor, authorize a transaction, tokenize data, or prove that a card exists. Prerequisites You need: Node.js 12 or newer. The package declares >=12.0.0 in its metadata. npm. A terminal and a small JavaScript file. The package is released under the MIT license . The examples below target the published npm package version 1.0.1 , which is also the version I installed for this walkthrough. Install the package Create a directory for the example and install the pinned version: mkdir card-check-example cd card-check-example npm init -y npm install credit-card-brand-detector@1.0.1 Pinning the version makes the example reproducible. If you use a different version later, check its README and package metadata before copying the behavior into a production application. Build the smallest useful check Create check-card.js : const { validateCreditCard , detectBrand , getBrand , } = require ( ' credit-card-brand-detector ' ); const formattedVisa = ' 4532 0151-1283-0366 ' ; const mastercard = ' 5555555555554444 ' ; console . log ( validateCreditCard ( formattedVisa )); console . log ( detectBrand ( mastercard )); console . log

When adb devices does not show the result you expect, reinstalling random drivers is rarely the best first move. The output already tells you which layer is failing. This checklist separates the most common states: device unauthorized offline An empty device list ADB not recognized by the terminal The goal is to diagnose the connection in a logical order: tool, cable, USB mode, authorization, and finally drivers. Before troubleshooting Make sure the basic setup is correct: Install the latest Android SDK Platform-Tools from Google. Use a USB cable that supports data, not only charging. Unlock the Android phone. Enable Developer options and USB debugging. Connect directly to the computer when possible instead of using an unpowered hub. The location of Developer options differs between Samsung, Xiaomi, Pixel, Huawei, OnePlus, and other interfaces. If you need the device-specific menu paths, this guide to enabling USB debugging on Android phones covers the common manufacturers and the RSA authorization step. Start with one command Open Terminal, PowerShell, or Command Prompt inside the Platform-Tools folder and run: adb devices For extra information, use: adb devices -l A normal result looks similar to this: List of devices attached R58M123ABCD device product:example model:Example device:example The word after the serial number is the important part. What each ADB state means Result Meaning Where to look first device ADB can communicate with the phone The connection is ready unauthorized The phone has not authorized this computer Phone screen and RSA prompt offline ADB sees the device but cannot communicate reliably ADB server, cable, port, or device Empty list The computer is not exposing the phone to ADB Cable, USB mode, driver, or debugging setting adb not recognized The shell cannot find the ADB executable Platform-Tools folder or PATH Case 1: The result is device This is the success state. ADB can send commands to the phone. You can test the connection with a harml

Abstract When evaluating robot control policies, many practitioners draw direct conclusions from simple success‑rate percentages. For instance, given Policy A with 90 % success and Policy B with 92 % success, people frequently claim Policy B performs better. Nevertheless, purely comparing percentage figures without sample size, confidence intervals, paired experimental design and statistical power analysis often produces unreliable judgments. Drawing on Clopper‑Pearson exact confidence intervals, Wilson score intervals, McNemar’s paired testing and hierarchical episode‑within‑task structure, this article lays out a complete practical workflow for robot policy evaluation, covering pre‑experiment planning and post‑hoc result checking. For engineering teams running robot‑simulation benchmarks mixed with LLM‑based agent workloads, an API gateway such as 4sapi can help standardize telemetry collection and multi‑backend request orchestration. 1. The Pitfall: Percentages Without Sample Sizes Lack Evidentiary Weight Statements such as “Policy A achieves 90 % success; Policy B achieves 92 % success” are ubiquitous in robotics papers and technical reports. However, these two numbers alone cannot support the conclusion that Policy B is stronger. Valid interpretation must account for roll‑out count, task composition, random seeds, paired‑group configuration and statistical power. The RoboLab v4 benchmark illustrates this concrete risk. Each policy runs only 10 episodes per task. Under this setup, when a policy reaches a 90 % success rate, its 95 % confidence interval spans approximately 19 percentage points . Even expanding to 100 roll‑outs, the interval width still sits near six percentage points. Authors explicitly classify 10‑episode runs as coarse‑grained indicators and warn that fine‑grained policy comparison remains untrustworthy. This warning generalizes across most high‑cost robot benchmarks: reported numbers may print with high numerical precision, yet real statistical

Our app ships long video lessons. Twenty to forty minutes each, watched mostly on hostel wifi and mobile data with two bars. Streaming video looks like a solved problem when you build the happy path. You wire up ExoPlayer, point it at a stream, it plays. Then real students open it on devices you have never held, and your bug tracker starts filling up with one line: "video not playing." That line turned out to be four unrelated problems. Here's what I actually learned. ## Buffering is the bug you feel before you see an error Nobody waits out a bad connection during a 35-minute lecture. On a 15-second reel a stall is annoying. In a lecture, a stall every two minutes means the student closes the app and studies from a PDF instead. So the real question was never "does it play." It was "what happens when the network stops cooperating for four seconds." Three situations broke us repeatedly: Wifi to mobile data handover mid-lesson Bandwidth that is technically connected but useless Short total drops, three to ten seconds, that should not end playback ExoPlayer gives you everything you need here. Adaptive bitrate, a configurable LoadControl , player listeners. The catch is that the defaults are tuned for general media, not for a 40-minute lecture on a bad link. What moved the numbers for us: Bigger buffers, deliberately. DefaultLoadControl.Builder().setBufferDurationsMs(...) takes a min buffer, a max buffer, the buffer needed to start playback, and the buffer needed to resume after a rebuffer. That last parameter is the interesting one. Raising it costs you a little extra time on resume and buys you far fewer repeat stalls, because the player stops trying to restart on a nearly empty buffer. Telling the user the truth. Our first version showed a spinner and nothing else. A spinner with no context reads as "the app is frozen," so students force-closed and reopened, which threw away the buffer and made everything worse. Saying "reconnecting" instead of spinning silently cut t

Six coding agents were running. I could not tell you what any of them had done. Not roughly. Not approximately. The output was there, the files had changed, and the honest answer to "which one did that" was a shrug. Three questions in particular had no answer: which run burned the tokens, whether they genuinely ran at the same time or merely started together, and whether two of them had quietly edited the same file. That last one is the expensive question. An agent working on the wrong file looks exactly like an agent working on the right one, right up until you read the diff. The thing that was already true Every one of those runners writes a transcript to disk while it works. Claude Code does. So do Cursor, Codex, Gemini CLI, Copilot CLI and Kiro. The record of what happened was sitting in my home directory the entire time, in six different formats, none of which I had ever looked at. So runlanes does not wrap anything. There is no SDK, no instrumentation step, no account, and nothing to start before the run starts. It reads what the runner already wrote. The consequence is the part I did not expect to matter as much as it does: it works on runs that already finished. Most tools in this space need you to have decided, in advance, that this particular run was worth watching. This one can answer a question you only thought to ask afterwards. npx runlanes That opens a console on 127.0.0.1:4180 for whatever project you are standing in. There is no configuration file to write first. What it actually shows Now is every live session, across every runner it found, with what the main conversation spent against what it handed to subagents. On the session that motivated the whole thing, that split was 8.3 million tokens of conversation against 2.1 million delegated, which was not the ratio I would have guessed. The parallelism figure is the one I keep coming back to. Peak concurrency was four agents. The share of elapsed time where anything genuinely overlapped was 9% . Four

Ever since I got involved with local LLMs I wanted to share the magic with my friends. The process before involved either Ollama or llama.cpp, which are great, but the setup was difficult and a barrier to entry for most people. WHAT ARE THE BENEFITS OF LOCAL AI? Local AI isn't as powerful as cloud-based solutions, but the gap is narrowing. With local AI there are no subscription costs, token limits, or outages, since it all runs on your own hardware. It doesn't require an internet connection, so it can be used fully offline. For businesses that are worried about leaking IP or sensitive data it's especially attractive. It stays on your machine and your data doesn't get captured by some company that may or may not use it to train their next model. WHAT YOU NEED FIRST Before we get started you need to understand what your hardware is capable of. For this to work well I suggest an Apple Silicon Mac with at least 24 GB of unified memory, or a gaming desktop with at least 16 GB of VRAM. The more VRAM you have, the more capable models you will be able to run. For reference, I run it on three machines: a MacBook Pro with 96 GB of unified memory, a Mac Mini with 24 GB, and a gaming desktop with a Radeon 7900 XTX. ONE INSTALLER, NO SETUP Unsloth Desktop is what people have been waiting for. It's just been released as a beta. It's pretty much a single-click install. You download the installer and run it, and from there Unsloth Desktop handles everything else for you. Behind the scenes it scans your machine and determines what needs to be installed. It puts a wrapper around llama.cpp and MLX, which gives you all the power of the top open source models without having to manage the underlying tools. Unsloth Desktop will automatically detect if any of the tools have gotten any updates and will prompt you to install the updates. MODELS COME STRAIGHT FROM HUGGING FACE Not only does Unsloth Desktop make the initial install easy, it integrates directly with Hugging Face. For those who